Is OP here? Curious as to what they used for geolocation
ipgeolocation.io API - should be in the article as well - cheers
Harvesting SSH Credentials: Insights from My Honeypot Network
31–34 of 34 posts
Re: Harvesting SSH Credentials: Insights from My Honeypot Network
#32Earlier quoted context omitted.
That's a hack. It's a login shell that, once you have already logged in and run the shell, prints a message saying you can't log in or run a shell, and then exits. It does not stop you from, say, logging in to SSH and then starting a port forward. Or running a command in a way that bypasses the login shell. ssh will always pass it to your login shell but other ways can be vulnerable.
Do you have a script to show us how it works? Here, use Claude's login [1]. There's no password. I am not very technical so let me know if I should set a password on that account. I trust everyone here. [1] - sftp ai@nochan.net
Doesn't seem to allow port forwarding so I think you're probably good.
Re: Harvesting SSH Credentials: Insights from My Honeypot Network
#33I'd be more curious to know what these SSH scanner bots actually do if they manage to log in. Automated recon, install spambot/cryptominer/phishing site, something else?
This was submitted 2 weeks ago https://news.ycombinator.com/item?id=48947548
Seems more entertaining than suitable for real analysis. At least I did not see any collected data. You can just watch what happens at this moment.
From watching it a while I came to the conclusion that adding a new authorized ssh key is a common first step.
Re: Harvesting SSH Credentials: Insights from My Honeypot Network
#34Earlier quoted context omitted.
There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git. This…
I suppose /usr/sbin/nologin is not a thing? https://www.man7.org/linux/man-pages/man8/nologin.8.html
git-shell is actually made for this exact situation. it does allow uploading git repos I think so you can't open it to the public, maybe there's a way to configure it though to not allow that.