sshd-honeypot
A modified version of OpenSSH deamon forwarding commands to Cowrie for logging brute force attacks and shell interactions.
A modified version of OpenSSH deamon forwarding commands to Cowrie for logging brute force attacks and shell interactions.
Checked October 2026.
The sshd-honeypot is a modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned. The sshd-honeypot is designed to let Cowrie log brute force attacks and the shell interaction performed by the attacker. As the sshd-honeypot uses OpenSSH, it can not be fingerprinted based on protocol deviations or differences in error messages. [1] Bitter Harvest: Systematically Fingerprinting Low- and Medium-interaction Honeypots at Internet Scale, Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT ’18) [PDF] Installing the sshd-honeypot Step 1: Install cowrie-sshd Step 2: Install dependencies Step 3: Checkout the code Step 4: Run the installer Step 5: Start the honeypot Step 1: Install cowrie-sshd First we need to install cowrie-sshd.
Cowrie-sshd is a modified version of Cowrie which functions as backend for the sshd-honeypot to interpret commands and log interactions performed by the attacker. Step 2: Install dependencies On Debian based
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about sshd-honeypot: features, pricing and alternatives.
sshd-honeypot is a product in the Honeypots & Deception category. It covers SSH, Attack Detection and Brute Force.
sshd-honeypot is free. Download and setup instructions are at https://github.com/amv42/sshd-honeypot/.
Alternatives to sshd-honeypot listed on CybersecTools:
Compare all sshd-honeypot alternatives at https://cybersectools.com/alternatives/sshd-honeypot
sshd-honeypot is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A low-interaction SSH honeypot that logs connection attempts, usernames, and passwords without allowing actual login access.
A low-interaction SSH authentication logging honeypot that logs all authentication attempts in JSON format.
A low-interaction SSH honeypot written in C that simulates SSH services to capture and log unauthorized access attempts.
An easy to set up SSH honeypot for logging SSH connections and activity.
High-interaction SSH honeypot for logging SSH proxy with ongoing development.
A low-interaction SSH honeypot tool for recording authentication attempts.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
