<story><title>Learn from your attackers – SSH HoneyPot</title><url>https://www.robertputt.co.uk/learn-from-your-attackers-ssh-honeypot.html</url></story><parent_chain><item><author>X86BSD</author><text>I&amp;#x27;ve been using something similar for a while now. I use pam_jail on freebsd to drop the ankle biters using common ssh login attempts like test, ubuntu, oracle etc into a FreeBSD jail where I watch what the do and get a copy of all their tools. I rate limit the outgoing traffic from that jail to something painfully slow to prevent them from causing any major issues. But being able to fire up &amp;#x27;watch&amp;#x27; on freebsd and snoop the tty they are on in the jail is awesome for forensics.&lt;p&gt;It&amp;#x27;s secure, they can&amp;#x27;t break out of the jail.&lt;p&gt;It&amp;#x27;s rate limited to prevent them causing much damage to anyone.&lt;p&gt;It&amp;#x27;s easy to observe every thing they type and do in the jail from the host.</text></item></parent_chain><comment><author>snuxoll</author><text>That&amp;#x27;s...pretty awesome. Have any guides&amp;#x2F;blog posts&amp;#x2F;whatever on your setup?</text></comment>
<story><title>Learn from your attackers – SSH HoneyPot</title><url>https://www.robertputt.co.uk/learn-from-your-attackers-ssh-honeypot.html</url></story><parent_chain><item><author>X86BSD</author><text>I&amp;#x27;ve been using something similar for a while now. I use pam_jail on freebsd to drop the ankle biters using common ssh login attempts like test, ubuntu, oracle etc into a FreeBSD jail where I watch what the do and get a copy of all their tools. I rate limit the outgoing traffic from that jail to something painfully slow to prevent them from causing any major issues. But being able to fire up &amp;#x27;watch&amp;#x27; on freebsd and snoop the tty they are on in the jail is awesome for forensics.&lt;p&gt;It&amp;#x27;s secure, they can&amp;#x27;t break out of the jail.&lt;p&gt;It&amp;#x27;s rate limited to prevent them causing much damage to anyone.&lt;p&gt;It&amp;#x27;s easy to observe every thing they type and do in the jail from the host.</text></item></parent_chain><comment><author>corybrown</author><text>What have you seen them do?</text></comment>