SSH Honeypots

Decided to create two honeypots (instructions here):

  • which is running SSH on port 22
  • which is running SSH on port 7843

The primary reason I wanted to do this was to study the volume of attempted logins on a standard versus non-standard port over time. I have both servers reporting their /var/log/auth.log to a server. See the results below:

Failed SSH Logins

Failed SSH Logins over Time, by Host

Written on May 12, 2020