https://github.com/utoni/potd

A high scalable low to medium interactive SSH/TCP honeypot using Linux Namespaces, capabilities, seccomp, cgroups designed for OpenWrt and IoT devices.
https://github.com/utoni/potd

c capabilities cgroups honeypot openwrt sandbox seccomp ssh-honeypot

Last synced: 2 months ago
JSON representation

A high scalable low to medium interactive SSH/TCP honeypot using Linux Namespaces, capabilities, seccomp, cgroups designed for OpenWrt and IoT devices.

• Host: GitHub
• URL: https://github.com/utoni/potd
• Owner: utoni
• License: bsd-3-clause
• Archived: true
• Created: 2018-07-11T15:29:37.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2020-07-12T19:41:09.000Z (almost 4 years ago)
• Last Synced: 2024-01-24T09:50:39.011Z (5 months ago)
• Topics: c, capabilities, cgroups, honeypot, openwrt, sandbox, seccomp, ssh-honeypot
• Language: C
• Homepage:
• Size: 280 KB
• Stars: 28
• Watchers: 8
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README
  • Changelog: ChangeLog
  • License: COPYING
  • Authors: AUTHORS

Lists

• awesome-honeypots - potd - Highly scalable low- to medium-interaction SSH/TCP honeypot designed for OpenWrt/IoT devices leveraging several Linux kernel features, such as namespaces, seccomp and thread capabilities. (Honeypots)

README

        
honey[potd]aemon

================

This project is part of a BA thesis. It is currently in a pre-alpha state.

Dependencies

============

Kernel/libc requirements: Cgroups, Namespaces (UTS, IPC, PID, NET, CGROUPS)

Required: libssh, pthread

Optional: libseccomp

A chroot'able directory that contains an executable named '/bin/sh'.

HowTo

=====

Build:

  - ./autogen.sh

  - ./configure

  - make

Run:

  - Example:

    ./src/potd --redirect 0.0.0.0:2222:127.0.0.1:22222 \

               --protocol 127.0.0.1:22222:127.0.0.1:33333 \

               --jail 127.0.0.1:33333

    This will process, filter and redirect all traffic incoming from 0.0.0.0:2222 to the

    protocol handler at 127.0.0.1:22222 and if the protocol accepts it, it will forward

    all traffic to the jail/sandbox at 127.0.0.1:33333.

    (clunky atm, will be simplified in the future)

  - Do not forget to set the --rootfs  which contains an executable /bin/sh.

  - see ./src/potd --help

Features

========

The server supports currently only shell channels but exec and direct-tcp channels are coming soon!

Supported protocols (at the moment):

  - ssh with libssh

Protocols to implement:

  - HTTP

  - ssh with openssh

  - SCADA

  - MySQL

Suits perfect for your favoured Desktop/Server/OpenWrt Linux system.

TODOs

=====

- RESTful listener for output sampled data from different processes

    (send (real-time)statistics about protocols/jails/etc to higher level apps)

- ptrace support for jailed processes (trace syscalls)

- improved event handling (maybe libevent?)

Software Architecture

=====================

see data/potd-arch.{svg,dia}