random-robbie / docker-ssh-honey

SSH Honey pot for docker

docker-ssh-honey

https://hub.docker.com/r/txt3rob/docker-ssh-honey

Start docker run -p 22:22 -it txt3rob/docker-ssh-honey

SSH Honey pot for docker

Using Alpine as base image now to take container from 1GB to around 118MB

Using https://github.com/droberson/ssh-honeypot

FROM THE README

SSH Honeypot

This program listens for incoming ssh connections and logs the ip address, username, and password used. This was written to gather rudimentary intelligence on brute force attacks.

Syslog facilities

As of version 0.0.5, this supports logging to syslog. This feature is toggled with the -s flag. It is up to you to configure your syslog facilities appropriately. This logs to LOG_AUTHPRIV which is typically /var/log/auth.log. You may want to modify this to use one of the LOG_LOCAL facilities if you are worried about password leakage.

This was implemented to aggregate the data from several hosts into a centralized spot.

Dropping privileges

As of version 0.0.8, you can drop root privileges of this program after binding to a privileged port. You can now run this as nobody on port 22 for example instead of root, but have to initially start it as root:

$ sudo bin/ssh-honeypot -p 22 -u nobody

Beware that this chowns the logfile to the user specified as well.

Changing the Banner

List available banners

$ bin/ssh-honeypot -b

Set banner string

$ bin/ssh-honeypot -b "my banner string"

Set banner by index

$ bin/ssh-honeypot -i <banner index>

Use a VPS from DO

docker-ssh-honey's Issues

src/ssh-honeypot.c:36:18: fatal error: pcap.h: No such file or directory

Docker version 20.10.17, build 100c701
Linux tux-server 5.10.0-14-amd64 #1 SMP Debian 5.10.113-1 (2022-04-29) x86_64 GNU/Linux

jramos@tux-server ~/docker-ssh-honey (master)> docker build -t ssh-honeypot .
Sending build context to Docker daemon  88.06kB
Step 1/12 : FROM alpine:3.6
3.6: Pulling from library/alpine
5a3ea8efae5d: Pull complete 
Digest: sha256:66790a2b79e1ea3e1dabac43990c54aca5d1ddf268d9a5a0285e4167c8b24475
Status: Downloaded newer image for alpine:3.6
 ---> 43773d1dba76
Step 2/12 : RUN apk add --no-cache git libssh-dev screen gcc musl-dev nano openssl build-base bash openssh geoip curl netcat-openbsd clang json-c-dev libssh2-dev
 ---> Running in a1a10a306f79
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.6/community/x86_64/APKINDEX.tar.gz
(1/54) Installing ncurses-terminfo-base (6.0_p20171125-r1)
(2/54) Installing ncurses-terminfo (6.0_p20171125-r1)
(3/54) Installing ncurses-libs (6.0_p20171125-r1)
(4/54) Installing readline (6.3.008-r5)
(5/54) Installing bash (4.3.48-r1)
Executing bash-4.3.48-r1.post-install
(6/54) Installing binutils-libs (2.30-r1)
(7/54) Installing binutils (2.30-r1)
(8/54) Installing gmp (6.1.2-r0)
(9/54) Installing isl (0.17.1-r0)
(10/54) Installing libgomp (6.3.0-r4)
(11/54) Installing libatomic (6.3.0-r4)
(12/54) Installing pkgconf (1.3.7-r0)
(13/54) Installing libgcc (6.3.0-r4)
(14/54) Installing mpfr3 (3.1.5-r0)
(15/54) Installing mpc1 (1.0.3-r0)
(16/54) Installing libstdc++ (6.3.0-r4)
(17/54) Installing gcc (6.3.0-r4)
(18/54) Installing musl-dev (1.1.16-r15)
(19/54) Installing libc-dev (0.7.1-r0)
(20/54) Installing g++ (6.3.0-r4)
(21/54) Installing make (4.2.1-r0)
(22/54) Installing fortify-headers (0.8-r0)
(23/54) Installing build-base (0.5-r0)
(24/54) Installing clang-libs (4.0.0-r0)
(25/54) Installing libxml2 (2.9.8-r1)
(26/54) Installing clang (4.0.0-r0)
(27/54) Installing ca-certificates (20161130-r3)
(28/54) Installing libssh2 (1.8.2-r0)
(29/54) Installing libcurl (7.61.1-r2)
(30/54) Installing curl (7.61.1-r2)
(31/54) Installing geoip (1.6.10-r0)
(32/54) Installing expat (2.2.0-r1)
(33/54) Installing pcre (8.41-r0)
(34/54) Installing git (2.13.7-r2)
(35/54) Installing json-c (0.12.1-r0)
(36/54) Installing json-c-dev (0.12.1-r0)
(37/54) Installing libssh (0.7.6-r0)
(38/54) Installing libssh-dev (0.7.6-r0)
(39/54) Installing libressl-dev (2.5.5-r2)
(40/54) Installing zlib-dev (1.2.11-r0)
(41/54) Installing libssh2-dev (1.8.2-r0)
(42/54) Installing libmagic (5.32-r0)
(43/54) Installing nano (2.8.4-r0)
(44/54) Installing libbsd (0.8.3-r3)
(45/54) Installing netcat-openbsd (1.130-r1)
(46/54) Installing openssh-keygen (7.5_p1-r4)
(47/54) Installing openssh-client (7.5_p1-r4)
(48/54) Installing openssh-sftp-server (7.5_p1-r4)
(49/54) Installing openssh-server (7.5_p1-r4)
(50/54) Installing openssh (7.5_p1-r4)
(51/54) Installing libcrypto1.0 (1.0.2r-r0)
(52/54) Installing libssl1.0 (1.0.2r-r0)
(53/54) Installing openssl (1.0.2r-r0)
(54/54) Installing screen (4.5.1-r1)
Executing busybox-1.26.2-r11.trigger
Executing ca-certificates-20161130-r3.trigger
OK: 429 MiB in 67 packages
Removing intermediate container a1a10a306f79
 ---> f411068b322a
Step 3/12 : RUN git clone https://github.com/droberson/ssh-honeypot.git
 ---> Running in 6f7ac4de75b0
Cloning into 'ssh-honeypot'...
Removing intermediate container 6f7ac4de75b0
 ---> a089d628f7bf
Step 4/12 : WORKDIR /ssh-honeypot/
 ---> Running in 04dc7bab94d0
Removing intermediate container 04dc7bab94d0
 ---> dd454ce79d68
Step 5/12 : RUN make
 ---> Running in 143b1a5baee8
cc -Wall -o bin/ssh-honeypot src/ssh-honeypot.c -lssh -ljson-c -lpcap -lssl -lcrypto
src/ssh-honeypot.c:36:18: fatal error: pcap.h: No such file or directory
 #include <pcap.h>
                  ^
compilation terminated.
make: *** [Makefile:9: ssh-honeypot] Error 1
The command '/bin/sh -c make' returned a non-zero code: 2

Email Alert

Is there a simple way to make the honeypot send email alerts whenever a new log entry occurs (or a summary of it)?