4 ms·
I've been using something similar for a while now. I use pam_jail on freebsd to drop the ankle biters using common ssh login attempts like test, ubuntu, oracle
by X86BSD 9y ago
I've been using something similar for a while now. I use pam_jail on freebsd to drop the ankle biters using common ssh login attempts like test, ubuntu, oracle etc into a FreeBSD jail where I watch what the do and get a copy of all their tools. I rate limit the outgoing traffic from that jail to something painfully slow to prevent them from causing any major issues. But being able to fire up 'watch' on freebsd and snoop the tty they are on in the jail is awesome for forensics.
It's secure, they can't break out of the jail.
It's rate limited to prevent them causing much damage to anyone.
It's easy to observe every thing they type and do in the jail from the host.
- corybrown 9y agoWhat have you seen them do?
- samstave 9y agoAttempt to log in it would seem...
- ConfucianNardin 9y agoMight have changed by now, but what they used to do was usually: * Download a large file (e.g. XP SP3) from Microsofts servers to test bandwidth * Download IP scanners and trying to run them (in order to find new hosts to attack) * Download botnet code that connects to some C2 server Tools they download were often downloaded as source, which they then tried to compile in order to run it. Searching for e.g. 'youtube kippo' will get you videos of honeypot sessions.
- snuxoll 9y agoThat's...pretty awesome. Have any guides/blog posts/whatever on your setup?
- X86BSD 9y agoI don't. When I was setting this up I didn't find any guides or blogs about doing this so I thought it was not of interest to anyone. So I just went about implementing it a piece at a time. Installing pam_jail, then getting /etc/pam.d/sshd configured to use it (which is a one-line addition, very easy). Now by default pam_jail simply puts the user into a jail of their home directory. This is where you can go a few routes with this. If simply jailing the user on the host OS to their home directory is all you are interested in doing you can stop there. Configure FreeBSD to not allow users to see other processes, user processes and group processes not owned by them, and they won't know anyone else is on the system. security.bsd.see_other_gids security.bsd.see_other_uids The above are the two sysctl's you want to enable. A simple ps will show you all the shells that are in a jail. Tue 19 7:19PM priyanka.setecastronomy ~> ps -x PID TT STAT TIME COMMAND 30308 - S 0:00.05 sshd: oracle@pts/0 (sshd) Now you have the tty he/she is on (pts/0). There are many ways to get that including ps so use whatever method you prefer to get the tty. Fire up watch to snoop on the tty. Tue 19 7:48PM priyanka.setecastronomy ~> doas watch pts/0 And boom, you can watch the ankle biter do his/her thing. You can do this on the host as described, because that is how pam_jail works. But if you prefer for some reason to make an actual jail with VNET etc and do this simply forward ssh on the host to the jail's IP. If you do rate limiting you will already be configuring pf or ipfw anyway so an extra line to forward 22 to the jail host is not big deal. Yeah this is a crappy write-up but it's spur of the moment and in a HN reply post so it's worth the price paid. I'm happy to answer questions or help you if you get stuck anyway I can just message me. It's pretty simple to do. If this is in a corporate setting I would consult with legal before doing this. The world is a whacky place these days, and if the ankle biter does something evil from your honeypot jail you may be liable.
- artursapek 9y agoYou know what would be cool? Piping these sessions to a web frontend and letting people watch these attempts in real time (or recorded) using a JS terminal emulator to display it all. I would sit there and watch that.
- X86BSD 9y agoThat would be pretty cool!
- aeontech 9y agoWould love to read more about this setup, if you have it documented anywhere
- thomasvendetta 9y agoI too would love to hear more about this, unfortunately this article on FreeBSD Jail Management Tools [1] seemed to be the most relevant thing I could come up with. [1] https://blather.michaelwlucas.com/archives/2291 https://blather.michaelwlucas.com/archives/2291
- bochoh 9y agoWould also love to see a write-up on this.
- rrttt 9y agoYou should still be rather careful with this, as they have access to the same kernel as the host, and could potentially jailbreak through kernel vulnerabilities.
- X86BSD 9y agoI have enough confidence in FreeBSD jails to not worry about that. If I found someone who could actually break out of a jail I would at the least buy them dinner anywhere, their choice. You can't modify a running kernel by direct access. And you can't load modules. So it would be a very interesting hack to see.
- rrttt 9y agoIt's been done before, for example the "BadIRET" vulnerability (CVE-2015-5675) was used to jailbreak FreeBSD on the PS4 a couple of years ago.
- X86BSD 9y agoActually it hasn't been done before. That CVE required elevated privelages on the host already. They didn't break out of a jail.
- rrttt 9y agoThey did break out of a jail, the vulnerability was used to gain arbitrary code execution in kernel mode, which was used to modify the cr_prison structure, thus performing a jailbreak.