{"id":19795206,"url":"https://github.com/jsfraz/lucian","last_synced_at":"2025-06-19T12:33:46.389Z","repository":{"id":223168910,"uuid":"758194135","full_name":"jsfraz/lucian","owner":"jsfraz","description":"Monitoring SSH login attempts and geolocating remote hosts.","archived":false,"fork":false,"pushed_at":"2025-02-11T00:40:28.000Z","size":44,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-28T16:07:08.985Z","etag":null,"topics":["geolocation","golang","postgres","redis","ssh","ssh-login","ssh-logs","ssh-monitoring","unauthorized-access","valkey"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jsfraz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-15T20:06:34.000Z","updated_at":"2025-02-11T00:39:03.000Z","dependencies_parsed_at":"2025-01-11T04:48:26.826Z","dependency_job_id":"11538443-4afd-420f-b0f0-ce4985ace010","html_url":"https://github.com/jsfraz/lucian","commit_stats":null,"previous_names":["jsfraz/lucian"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/jsfraz/lucian","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfraz%2Flucian","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfraz%2Flucian/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfraz%2Flucian/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfraz%2Flucian/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jsfraz","download_url":"https://codeload.github.com/jsfraz/lucian/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsfraz%2Flucian/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260751314,"owners_count":23057116,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["geolocation","golang","postgres","redis","ssh","ssh-login","ssh-logs","ssh-monitoring","unauthorized-access","valkey"],"created_at":"2024-11-12T07:15:45.495Z","updated_at":"2025-06-19T12:33:41.360Z","avatar_url":"https://github.com/jsfraz.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# lucian\n\nL.U.C.I.A.N (Location-based Unauthorized Connection Investigation and Analysis Network) as the (very cool) name suggests is intended for monitoring SSH login attempts and geolocating remote hosts who failed to login and gathering used credentials.\n\n## How it works\n\nThe main idea is that you don't use default SSH port to connect to your remote server/VPS. This Docker Compose configuration maps fake server's port 22 to Docker host's public IP and stores unsuccesful login details in Postgres database:\n\n| id    | ip_version | ip_address     | latitude  | longitude  | country_name | country_code | time_zone0 | zip_code | city_name | region_name | is_proxy | continent | continent_code | user | password  | timestamp                     |\n|:-----:|:----------:|:--------------:|:---------:|:----------:|:------------:|:------------:|:----------:|:--------:|:---------:|:-----------:|:--------:|:---------:|:--------------:|:----:|:---------:|:-----------------------------:|\n| 35086 | 4          | 180.101.88.252 | 31.311365 | 120.617691 | China        | CN           | +08:00     | 215003   | Suzhou    | Jiangsu     | false    | Asia      | AS             | root | nathalie  | 2024-02-28 14:31:56.356 +0100 |\n| 35085 | 4          | 180.101.88.252 | 31.311365 | 120.617691 | China        | CN           | +08:00     | 215003   | Suzhou    | Jiangsu     | false    | Asia      | AS             | root | dfvgbh    | 2024-02-28 14:31:56.043 +0100 |\n| 35084 | 4          | 180.101.88.252 | 31.311365 | 120.617691 | China        | CN           | +08:00     | 215003   | Suzhou    | Jiangsu     | false    | Asia      | AS             | root | jlo       | 2024-02-28 14:30:55.356 +0100 |\n| 35083 | 4          | 180.101.88.252 | 31.311365 | 120.617691 | China        | CN           | +08:00     | 215003   | Suzhou    | Jiangsu     | false    | Asia      | AS             | root | egk       | 2024-02-28 14:30:53.744 +0100 |\n| 35082 | 4          | 180.101.88.252 | 31.311365 | 120.617691 | China        | CN           | +08:00     | 215003   | Suzhou    | Jiangsu     | false    | Asia      | AS             | root | 1qaz2wsx@ | 2024-02-28 14:30:53.397 +0100 |\n\n## Deploy\n\nChange database passwords and public IP address in `.env` file and run `sudo ./compose.sh` to build the image and compose the project.\n\n.env example:\n\n```env\nPOSTGRES_PASSWORD=hard_password\nVALKEY_PASSWORD=hard_password\nPUBLIC_IP=127.0.0.1\n```\n\n## Future plans\n\nFrontend coming soon! (soon is relative)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsfraz%2Flucian","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjsfraz%2Flucian","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsfraz%2Flucian/lists"}