{"id":13795799,"url":"https://github.com/victpork/sshsyrup","last_synced_at":"2026-03-12T12:01:22.716Z","repository":{"id":137144186,"uuid":"111875266","full_name":"victpork/sshsyrup","owner":"victpork","description":"A low-to-medium interaction SSH Honeypot with features to capture terminal activity and upload to asciinema.org","archived":false,"fork":false,"pushed_at":"2019-02-25T05:05:59.000Z","size":479,"stargazers_count":99,"open_issues_count":6,"forks_count":10,"subscribers_count":5,"default_branch":"master","last_synced_at":"2026-03-05T14:29:39.278Z","etag":null,"topics":["golang","honeypot","ssh","ssh-honeypot","ssh-server"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/victpork.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2017-11-24T04:17:25.000Z","updated_at":"2025-11-28T07:28:17.000Z","dependencies_parsed_at":"2023-07-13T23:53:35.159Z","dependency_job_id":null,"html_url":"https://github.com/victpork/sshsyrup","commit_stats":null,"previous_names":["mkishere/sshsyrup"],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/victpork/sshsyrup","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victpork%2Fsshsyrup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victpork%2Fsshsyrup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victpork%2Fsshsyrup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victpork%2Fsshsyrup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/victpork","download_url":"https://codeload.github.com/victpork/sshsyrup/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victpork%2Fsshsyrup/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30404066,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-11T21:51:19.558Z","status":"ssl_error","status_checked_at":"2026-03-11T21:50:57.892Z","response_time":84,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","honeypot","ssh","ssh-honeypot","ssh-server"],"created_at":"2024-08-03T23:01:02.407Z","updated_at":"2026-03-12T12:01:22.297Z","avatar_url":"https://github.com/victpork.png","language":"Go","funding_links":[],"categories":["\u003ca id=\"c8f749888134d57b5fb32382c78ef2d1\"\u003e\u003c/a\u003eSSH\u0026\u0026Telnet"],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/mkishere/sshsyrup.svg?branch=master)](http://travis-ci.org/mkishere/sshsyrup) [![Build status](https://ci.appveyor.com/api/projects/status/iy271guyn7ig81yn/branch/master?svg=true)](https://ci.appveyor.com/project/mkishere/sshsyrup/branch/master)\n# Syrup\nA SSH honeypot with rich features written in Go\n\n### Features\n- SSH self-defined accounts and passwords, also allow any logins\n- Fake shell. Records shell sessions and upload to [asciinema.org](https://asciinema.org) (Or, if you wish, can log as [UML-compatible](http://user-mode-linux.sourceforge.net/old/tty_logging.html) format)\n- Virtual Filesystem for browsing and fooling intruder\n- SFTP/SCP support for uploading/downloading files\n- Logs client key fingerprints\n- Logs in JSON format for easy parsing\n- Push activities to [ElasticSearch](https://www.elastic.co) for analysis and storage\n- Record local and remote host when client attempt to create port redirection\n- Structure allows [extending command sets](https://github.com/mkishere/sshsyrup/wiki/Writing-new-commands) with ease\n\n### See Recorded Session in Action!\n[![asciicast](https://asciinema.org/a/yu8fdSXn6v9EV0ozdSjNNN5NJ.png)](https://asciinema.org/a/yu8fdSXn6v9EV0ozdSjNNN5NJ)\n\n### Requirements\n#### Running\n- Linux, Mac or Windows (I've only tested in Windows/WSL/Linux on ARMv7, the other platforms should work as expected)\n#### Building\n- Go 1.9+ and [dep](https://github.com/golang/dep), or\n- Go 1.11+ and Git\n\n### Download\nYou may find the pre-build packages for various platform on the [release](https://github.com/mkishere/sshsyrup/releases) tab. If you find the platform you need is not on the list, you can follow the building procedure in the next section.\n\n### Building\n#### Go pre-1.11/1.11 with `GO111MODULE=auto`:\n```\ngo get -u github.com/mkishere/sshsyrup\ncd ~/go/src/github.com/mkishere/sshsyrup\ndep ensure\ngo build -ldflags \"-s -w\" -o sshsyrup ./cmd/syrup\ngo build -ldflags \"-s -w\" -o createfs ./cmd/createfs\n```\n\n#### Go 1.11 with `GO111MODULE=on`:\nCurrently building executable with `GO111MODULE=on` is [a bit tricky](https://github.com/golang/go/wiki/Modules#why-does-installing-a-tool-via-go-get-fail-with-error-cannot-find-main-module) in Go 1.11 with module, here is how to do it if you want to leave module on:\n```\ngit clone https://github.com/mkishere/sshsyrup/\ngo build -ldflags \"-s -w\" -o sshsyrup ./cmd/syrup\ngo build -ldflags \"-s -w\" -o createfs ./cmd/createfs\n```\n\n### Setting up for the first run\n* Modify _config.yaml_. Here is a sample configuration\n    ```yaml\n    server:\n        addr: 0.0.0.0           # Host IP\n        port: 22                # Port listen to\n        allowRandomUser: false  # Allow random user\n        speed: 0                # Connection max speed in kb/s\n        processDelay: 0         # Artifical delay after server returns responses in ms\n        timeout: 0              # Connection timeout, 0 for none\n    ```\n* Prepare the virtual filesystem image by downloading the filesystem.zip from master branch or create your own by running\n   ```\n   ./createfs -p / -o filesystem.zip\n   ```\n\n   Since we'll need to read every file from the directory, it will take some time to load.\n   _For Windows, since there are no user/group information, the file/directory owner will always be root._\n\n   Alternatively, you can create your own image file by using `zip` in Linux (or any compatible zip utility file that is capable preserving _uid_/_gid_, symbolic links and timestamps in zip file). After all the image created is a standard zip file. Theoretically you can zip your entire filesystem into a zip file and hosted in Syrup, but remember to exclude sensitive files like `/etc/passwd`\n\n* Prepare user and passwd file\nPut _passwd_ and _group_ file in the same directory as config.json. The format of both files are the same as their [real-life counterpart](http://www.linfo.org/etc_passwd.html) in _/etc_, except that passwd also stores the password in the second field of each line, and asterisk(*) in password field can be used to denote matching any password.\n* Generate SSH private key and renamed as _id\\_rsa_ and put it in the same directory\n   ```\n   ssh-keygen -t rsa\n   ```\n* Start the server\n   ```\n   ./sshsyrup\n   ```\n\n### Running from a Docker instance\n\nA Docker image based on the latest build:\n```\n  docker pull mkishere/sshsyrup\n```\n\nBy default the internal sshsyrup listens on 22.\n```\ndocker run -d mkishere/sshsyrup\n```\n\nThe following example shows how you can customize stuff while running Syrup in container:\n```sh\ndocker run -d -p 9999:22 \\\n-v /path/to/vfs/image.zip:/filesystem.zip \\\n-v /path/to/config.yaml:/config.yaml \\\n-v /path/to/logfiles:/logs \\\n-v /path/to/group:/group \\\n-v /path/to/passwd:/passwd \\\n-v /path/to/private_key:/id_rsa \\\n-v /path/to/commands.txt:/commands.txt \\\n-v /path/to/command_output:/cmdOutput \\\nmkishere/sshsyrup\n```\nBut you may want to map to port 22 to make your honeypot easier to find.\n\nIf you want to see what happens (logs) in the Docker instance, get the instance id (`docker ps`) and then\nrun `docker logs -f YOUR_INSTANCE_ID`.\n\n### Configuration parameters\nCheck out [config.yaml](https://github.com/mkishere/sshsyrup/blob/master/config.yaml)\n\n### Logging\nBy default Syrup will create a logging file in _logs/_ directory with file name _activity.log_ in JSON format.\n\nPlease note that Syrup will no longer append dates to log files. Use a proper log rotation tool (e.g. _logrotate_) to do the work.\n\nAlso, each terminal session (the shell) will be logged into a separate file under logs/sessions in [asciinema v2 format](https://github.com/asciinema/asciinema/blob/develop/doc/asciicast-v2.md).\n\n### Extending Syrup\nSyrup comes with a framework that helps to implement command easier. By implementing the [Command](https://github.com/mkishere/sshsyrup/blob/dfd91b14bd64f43e8100e3e0fbd6357f29b1708b/os/sys.go#L37) interface you can create your own command and being executed by intruders connecting to your honeypot. For more details refer to the [wiki](https://github.com/mkishere/sshsyrup/wiki/Writing-new-commands).\n\nIf your command prints static output every time, you can put the output in _cmdOutput/_, and Syrup will print that when client type the command in terminal.\n\n### Contributing\nFeel free to submit feature request/bug report via the GitHub issue tracker.\n\nFor submitting PR, do the following steps:\n1. Fork\n2. Create a branch for the feature/bugfix containing your changes on your fork\n3. Submit PR with your branch\n\nIt is advised that creating an issue to discuss the matter in advance if your change is large :)\n\n### TODO\n- Minimal set of POSIX commands/utilities\n- Shell parser\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictpork%2Fsshsyrup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvictpork%2Fsshsyrup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictpork%2Fsshsyrup/lists"}