5

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH.

A friend of mine created a number of accounts with these common usernames (with the exception of "root"), gave them extremely weak passwords, and attached them to a fake shell. The fake shell is not functional in any way: it just displays some canned responses resembling a very broken system, and logs the user-entered commands into a file.

Assuming that this fake shell does not have any security vulnerability by itself, what could be the possible dangers of such a setup?

Improve this question
2
  • What kind of file? Can we see the source of this fake shell?
    – xorist
    Commented Mar 12, 2016 at 15:19
  • 1
    You need to be careful assuming that things do "not have any security vulnerabilities". That's a very dangerous assumption.
    – xorist
    Commented Mar 12, 2016 at 15:20

2 Answers 2

Reset to default
3

The shell is probably the least of your concern. The SSH server is a large piece of software with many features provided to anyone who can log in. Maybe one of the most naive hazards would be that port forwarding is still enabled, allowing the attacker through your firewall.

Additionally, once someone logs in they are presented a larger attack surface on the SSH server, allowing them to exploit less severe security flaws that are normally only available to relatively trusted users.

Running a honey pot can be quite dangerous... it needs to be an isolated machine. Even an isolated machine might be used for illegal activity.

Improve this answer
3

this fake shell does not have any security vulnerability by itself

... is usually the wrong assumption. I played with this idea some time ago, but I didn't find any reason why to do such a thing.

It might be interesting as a research of hackers/bots behaviour, but for that you have already existing solutions, that should be more appropriate and probably more secure and give you more data. Also if you want to play with honeypot and observe hackers, there are few assumptions you miss:

  • root is the most common target. Attacking on different users gives the attackers less possibilities to exploit. Giving up this account (either securing it well or disabling the login) you loose a lot of possible data.
  • Even simple passwords might be hard to guess in combination with common user names. If your use case is above (watching hackers/bots), than you might get really few data from such setup since most of the scans fail.

And few bits to your question:

  • your accounts might be exposed to different services, where they might be misused, for example SMTP to send SPAM through your server
  • the security of the shell as mentioned in the start once more and access from it to any resources (files, network, system calls, ...)
Improve this answer
2
  • 1
    Just adding - if you're interested in setting up a honeypot I would recommend doing it on a test VPS instance (you can find them for $5/month most places).
    – just some user
    Commented Mar 12, 2016 at 15:36
  • 1
    @paulburkeland Yes. That is one solution for the above quoted problem. Certainly it is not a good idea to run honeypots without any isolation on production system. Virtualization is one of the possible isolations.
    – Jakuje
    Commented Mar 12, 2016 at 15:41

You must log in to answer this question.