|
Author: K.Miller12 (13 Sep 13 11:20am)
Hi I've it been racking my brains why kippo honeypot will not log any sort of login attempts against my decoy ssh server,
My real SSH is serving in a high port, Kippo seems to accept new connections but after a few seconds the connection is lost,(see snip from log file below) maybe it's just a ping scan I thought but i'm not convinced because when I put my real SSH server on standard port 22 overnight I awoke the next morning to various login attempts in a matter of a few hours.
I left kippo on for 3 straight days and kippo logged no attempts, nothing but new connections and disconnections!
Everything is correctly set up which I'm now sure is 100% right, I'll break it down very briefly.
Method 1
Added new user kippo.
Used authbind to bind tcp/22 to user kippo.
Kippo.cfg port to listen on 22
Added authbind --deep in front of start.sh script.
Router forwarding port 22 to LAN of 192.168.1.66 (honeypot)
Executed start.sh script under user kippo
Kippo starts fine, but doesn't, log attempts
The alternative method 2
As above but with kippo.cfg on default port 2222 then I used plain old iptables to forward tcp/22 traffic to tcp/2222
Still nada! Dam it
Now the strange thing is I can directly connect to my honey pot outside of my local network and kippo will log everything as it should!!, but I don't understand why it's not being picked up and attacked in the wild, being the most common port of attack I find it very odd.
I have no idea other than my network for being wireless is the issue, I've still to try this through Ethernet and that's why I'm having cables installed in my cavity walls!
Have any question or answers for me?
Many thanks!
2013-09-13 00:09:18+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New
connection: 203.XX.40.XXX:36502 (192.168.1.66:2222) [session: 3]
2013-09-13 00:09:27+0100 [HoneyPotTransport,3,203.XX.40.XXX] connectio
n lost
2013-09-13 07:37:37+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New
connection: 117.XX.127.XX:47580 (192.168.1.66:2222) [session: 4]
2013-09-13 07:37:45+0100 [HoneyPotTransport,4,172.XX.127.XX] connectio
n lost
2013-09-13 11:38:56+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New
connection: 46.XXX.221.XXX:54272 (192.168.1.66:2222) [session: 5]
2013-09-13 11:38:57+0100 [HoneyPotTransport,5,46.XXX.221.XXX] connecti
on lost
2013-09-13 11:47:42+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New
connection: 183.XXX.32.XX:46421 (192.168.1.66:2222) [session: 6]
2013-09-13 11:47:52+0100 [HoneyPotTransport,6,183.XXX.32.XX] connectio
n lost
|
Welcome to Project Honey Pot | Login