Kippo – A SSH Honeypot (Updated)
Updated: May 23, 2020
Cowrie – a (relatively) new SSH honeypot – has been my obsession for the week. I took a quick first glimpse at Cowrie, and I thought before I proceed any further, I should relook at Kippo. Why? Because:
Cowrie is a fork project of Kippo; and
I wrote Kippo write-up v1 in Apr 2013. I should really understand the updated landscape of these SSH honeypots before I explore one of the latest.
Note: Kippo is no longer under active development. It is also advised by Upi Tamminen (author of Kippo), to check out Cowrie instead.
Kippo – A SSH Honeypot (Updated)
Kippo is a medium interaction SSH honeypot designed to log brute force attacks, and the shell interactions performed by the attackers.
My Network Setup
Setting Up the Kippo Box
Software required to run Kippo:
sudo apt-get install git python-twisted python-crypto python-zope.interface python-mysqldb mysql-server
It is highly recommended to run your honeypot using a dedicated non-root user:
sudo adduser –disabled-password <username>
Setting Up the Logging Database
mysql -h localhost -u root -p
You should have been prompted to set your MySQL root password earlier when you were installing it. If you already have MySQL set up and could not remember your password, check out: http://stackoverflow.com/questions/489119/mysql-error-1045-access-denied.
CREATE DATABASE kippo; GRANT SELECT ON kippo.* TO ‘<username>’@’localhost’ IDENTIFIED BY ‘<password>’; mysql> GRANT INSERT ON kippo.* TO ‘<username>’@’localhost’ IDENTIFIED BY ‘<password>’; GRANT UPDATE ON kippo.* TO ‘<username>’@’localhost’ IDENTIFIED BY ‘<password>’;
You can, of course, GRANT ALL ON kippo.* to your dedicated Kippo user, but I rather give only the necessary authorisation of what’s required to run Kippo. Check out dblog/mysql.py to learn how Kippo does MySQL logging.
To check your MySQL access control list:
SHOW GRANTS FOR ‘<username>’@’localhost’;
Basic Kippo Configuration
Switch to your dedicated user
sudo su - <username>
git clone https://github.com/desaster/kippo
Create the necessary logging table
(mysql.sql is located in doc/sql/)
mysql kippo -u root -p < mysql.sql
Configure Kippo to your liking, and according to your environment
(e.g. your database settings under the [database_mysql] section)
cp kippo.cfg.dist kippo.cfg vi kippo.cfg
Take note of the port number Kippo is listening on. By default, Kippo listens on port 2222. You can either change the default port number or use port forwarding:
sudo iptables -A PREROUTING -t nat -i eth0 -p tcp –dport 22 -j REDIRECT –to-port 2222
If you are configuring Kippo into a production environment, you should take time to modify settings that an attacker could use to identify the system as a honeypot.
Through the configuration file (kippo.cfg), you should also note where all the essential files and logs are located. E.g.:
Directory where log files are saved in: log/
Directory where downloaded (malware) files are saved in: dl/
Directory where virtual file contents are kept in: honeyfs/
The virtual file system (created by createfs.py): fs.pickle
Directory for miscellaneous data files, e.g. the password database: data/
Directory for creating simple commands that only output text: txtcmds/
After you’ve edit kippo.cfg to your liking, you’re all set!
Fake Credentials Management
By default, the only root password is “123456”. Additional root passwords can be added to data/userdb.txt. It’s a good idea to have only one password set for each username – multiple successful logins of the same username, but with different passwords, might look suspicious.
Note: When an attacker uses the passwd command in the Kippo shell, the new password will be appended to data/userdb.txt.
Annoying “Sticky” Feature
When an attacker is in your Kippo shell, he/she will not be able to exit the shell by simply launching the command “exit”. The attacker will still be stuck in some annoying shell that doesn’t make much sense. Commands launched in that shell can yield very confusing results. It is quite a fun feature at first glimpse – watching how attackers can get really confused. It is also a big red flag telling the attacker it’s a honeypot. If you do not want to risk attackers blacklisting your honeypot, you should consider turning this feature off.
Check Out Your Logs
Raw logs are available in log/kippo.log.
They are also available in the MySQL database, structured beautifully in the tables created earlier.
In my Kippo write-up v1, I introduced Kippo-Graph – written by my dear friend Ioannis “Ion” Koniaris – a web statistics visualisation tool you can use for the monitoring of your Kippo honeypot. There have been 16 versions of Kippo-Graph since I last explored it. I’ve got many queries on why my Kippo write-up v1 doesn’t work for them. Because we’re using a different version!
I can't update my Kippo write-up without relooking into Ion's contributions to the Kippo ecosystem. Instead of embedding them into this updated Kippo write-up (v2), I've done a write-up on them in a separate, dedicated entry.
Emil Tan, Chapter Lead, The Honeynet Project, Singapore Chapter