Honeypots

Does any lain runs their honeypots I knew they existed before I read the zine but I never though of using it other than a source of entertainment. Before I buy a VPS and start my honeypot I would like to know what type of setup you use and how do you advertise the IP and the passwords to hackers/kiddies.

You can just leave it either open or with some weak/default password and eventually some skids will hit it with nmap and brute force in if you don't have fail2ban

Related?

You don't need to advertise, there's thousands if not millions of probes scanning the entire IPv4 space for ssh servers 24/7. Use a weak password like Password1 or qaz123 or something. Shouldn't take longer than a few hours for someone to get in.

Any programs I can use to log attempted logins to a fake SSH server? I wanna compile a list of the most frequently attempted logins by the chinese botnets without pooing in my real auth logs.

>>6153 /fakeroot/var/log/auth.log? Or are you wanting to record the actual passwords they're using?

>>6157 Yeah I was hoping to record the actual passwords.

>>6243 I found a guide a while ago online, it had this like 200 line python script that I just copy and pasted. It logged all usernames/passwords it received to a text file. Turns out it was just root with a bunch of dictionary words for the passwords, and it was coming from Tor IPs. I'll see if I can find it

Ok so I didn't find it but I did find like 10 other results, that use a PAM module or patch openssh to log them. Just google it

>>6284 >>6285 Thanks for the info