3 ms·

I wonder why the author set up a dedicated SSH python server which mimics some unix userspace as a honeypot. Why not a VM with a real standard widespread linux

• iforgotpassword 9y ago
  Because it's much easier to set up? It's not breaking after any session no matter what the attacker does. Every session is isolated if several run concurrently. Getting this with a VM involves quite some effort. Then you need to make sure the attacker cannot use any commands to cause external damage but still make them seem to work. But the latter is also a problem with the simulated environment. It's quite easy to detect if you're not just blindly sending automated keystrokes without checking the feedback.
  • ktpsns 9y ago
    Objectively there should be no difference between a honeypot VM and an actual "productive" VM. I acknowledge that it is much harder to setup, maintain and supervise a network of honeypots VMs instead of a dedicated isolated honeypot server process which just simulates a system. However, as mentioned in other comments here, there is no gain of knowledge if you don't simulate a whole system but only parts of it.
• f311a 9y ago
  They stop because they know that it's a honeypot. I guess it's a simple check for popular honeypots which emulate linux commands.