Comments on Bed Against The Wall: Running A SSH Honeypot With Kippo: Let's Catch Som...

http://www.openbl.org/ has a blacklist of IPs know...

2012-02-18T19:05:00.804+01:00

http://www.openbl.org/ has a blacklist of IPs known for ssh scanning and is also using honeypots to acquire these.

Great work! Thanks for that. Any idea on how I can...

2012-02-14T13:00:45.387+01:00

Great work! Thanks for that. Any idea on how I can slow down the scanning? Like you I feel a bit uneasy to run a honeypot on server containing important data. Thus, I was thinking on how I can just make the life of a script kiddie a bit harder... delaying the ssh responses would be a start I guess.

However, in the future I will probably set up some cloud servers as honey pots.

Hello Seppe. Thanks for the great article. Is ther...

2011-11-24T00:10:07.794+01:00

Hello Seppe. Thanks for the great article. Is there any chance to release some of the scripts you used for log analysis/stats? They would be very useful to the community of people interested in honeypots.

Article is deservedly in the first place in google...

2011-11-22T11:25:54.357+01:00

Article is deservedly in the first place in google. Best manual for kippo and kippo itself is a great software. I only wonder if there is a way to change version of the libs shown in ssh deamon headers?

thanks for this article. i also have kippo on my V...

2011-08-12T15:13:54.138+02:00

thanks for this article. i also have kippo on my VPS, and was looking for somewhere to find out why are those attacking my server so retarded. i am so relieved to see that your attackers basically performed the very same things they're doing on my server, from downloading the windows service pack, to attempting to install IRC bots. mind you, they're downloading exactly the same tarball they downloaded on your server, but from a different domain...
now i wonder if i should keep kippo... or block port 22 for good...

i look forward to more of your modifications/scrip...

2011-07-19T19:57:40.759+02:00

i look forward to more of your modifications/scripts :D

I use Fail2ban because we get a lot of attempts on...

2011-05-21T01:13:33.428+02:00

I use Fail2ban because we get a lot of attempts on our SSH port, too. Here's an idea, when triggered, have Fail2ban add a FW/routing rule to forward the port back at the attacker's IP so they are attacking themselves!

Great article, going to try this out myself! :)

2011-05-05T12:34:00.874+02:00

Great article, going to try this out myself! :)

Totally gunna run a honeypot on my VPC amazon clou...

2011-04-10T11:06:01.528+02:00

Totally gunna run a honeypot on my VPC amazon cloud.

fantastic info.here is so much to learn.nice blog ...

2011-04-07T21:07:28.594+02:00

fantastic info.here is so much to learn.nice blog man.i liked your work.i m gonna bookmarked it to visit again.

Funny thing is that most of the examples you liste...

2011-04-07T19:19:49.226+02:00

Funny thing is that most of the examples you listed came from Romanians (I saw some ro words). Super tare :))