I've been writing a high interaction honeypot which has required some interesting design decisions, for instance I want the honeypot to get attacked not the underlying infrastructure/ software. Fun stuff.
However I've got an issue and was looking for best practice advice.
Basically the honeypot is an insecure web application which has the ability to change the password.
Now suppose Attacker A changes the password he could expect to come back as Attacker A and use the password he has just set. However if Attacker A clears his browser (I had been tracking via a session cookie) he'll become Attacker B but would still expect to get in on Attacker A's password. At the same time Attacker C might try and access but the password set by Attacker A might be really hard/ not default and I'd miss the opportunity to get Attacker C.
I can keep all the passwords and let them long in by any of these plus the defaults but risk Attacker A having set a new password typing in a default and it still working - acceptable risk?
or I accept that its unlikely to get two people at the same time and reset everything all the time, but accept Attacker A might come back and wonder by the password he set no longer works but the defaults do?