SSH Honeypot
A low-interaction SSH honeypot that logs connection attempts, usernames, and passwords without allowing actual login access.
A low-interaction SSH honeypot that logs connection attempts, usernames, and passwords without allowing actual login access.
Checked October 2026.
SSH Honeypot is a low-interaction honeypot designed to monitor and log SSH connection attempts. The tool listens for incoming SSH connections and captures the IP address, username, and password credentials used by connecting clients.
The honeypot operates as a deceptive service that mimics an SSH server but does not allow actual login access, preventing attackers or malware from gaining system access. It functions purely as a logging mechanism to gather intelligence on brute force attacks and unauthorized access attempts.
The tool requires several development libraries including libssh, openssl, libjson-c, and libpcap for compilation. It generates RSA keys for SSH simulation and can be configured to run on specified ports. The honeypot outputs collected data in a structured format for analysis.
Originally developed for gathering basic intelligence on SSH-based attacks, the tool is commonly deployed in capture-the-flag (CTF) competitions and educational environments. It can be paired with complementary tools like sshunt for enhanced functionality.
The software supports Linux environments with full functionality and provides experimental support for macOS systems. Installation involves installing required dependencies, compiling the source code, generating SSH keys, and running the honeypot service.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about SSH Honeypot: features, pricing and alternatives.
SSH Honeypot is a product in the Honeypots & Deception category. It covers CTF, SSH and Attack Detection.
SSH Honeypot is free. Download and setup instructions are at https://github.com/droberson/ssh-honeypot/.
Alternatives to SSH Honeypot listed on CybersecTools:
Compare all SSH Honeypot alternatives at https://cybersectools.com/alternatives/ssh-honeypot
SSH Honeypot is available as on-premises software. It is listed for startups, small businesses and mid-market companies. It is free.
Side by side: features, pricing model and the company behind each one.
A web application honeypot sensor attracting malicious traffic from the Internet
A honeypot tool that simulates an open relay to capture and analyze spam
Email collection point designed to trap spammers and blacklist IPs.
A low-interaction SSH authentication logging honeypot that logs all authentication attempts in JSON format.
A low-interaction SSH honeypot written in C that simulates SSH services to capture and log unauthorized access attempts.
A modified version of OpenSSH deamon forwarding commands to Cowrie for logging brute force attacks and shell interactions.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
