# sshd-honeypot

sshd-honeypot is a Honeypots & Deception product. It runs on-premises. Pricing is free.

A modified version of OpenSSH deamon forwarding commands to Cowrie for logging brute force attacks and shell interactions.

Checked October 2026.

## What is sshd-honeypot?

The sshd-honeypot is a modified version of the OpenSSH deamon that forwards commands to Cowrie where all commands are interpreted and returned. The sshd-honeypot is designed to let Cowrie log brute force attacks and the shell interaction performed by the attacker. As the sshd-honeypot uses OpenSSH, it can not be fingerprinted based on protocol deviations or differences in error messages. [1] Bitter Harvest: Systematically Fingerprinting Low- and Medium-interaction Honeypots at Internet Scale, Proceedings of the 12th USENIX Workshop on Offensive Technologies (WOOT ’18) [PDF] Installing the sshd-honeypot Step 1: Install cowrie-sshd Step 2: Install dependencies Step 3: Checkout the code Step 4: Run the installer Step 5: Start the honeypot Step 1: Install cowrie-sshd First we need to install cowrie-sshd. Cowrie-sshd is a modified version of Cowrie which functions as backend for the sshd-honeypot to interpret commands and log interactions performed by the attacker. Step 2: Install dependencies On Debian based

Tags: SSH, Attack Detection, Brute Force

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Honeypots & Deception](https://cybersectools.com/categories/honeypots)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 28
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## sshd-honeypot FAQ

### What is sshd-honeypot?

sshd-honeypot is a product in the Honeypots & Deception category. It covers SSH, Attack Detection and Brute Force.

### What is the pricing for sshd-honeypot?

sshd-honeypot is free. Download and setup instructions are at https://github.com/amv42/sshd-honeypot/.

### What are alternatives to sshd-honeypot?

Alternatives to sshd-honeypot listed on CybersecTools:

1. [Trapster](https://cybersectools.com/tools/trapster) - Honeypot platform deploying network decoys to detect intrusions with zero false positives (Commercial)
2. [Deception Check Fleet Status](https://cybersectools.com/tools/deception-check-fleet-status) - Public honeypot fleet dashboard showing global attack telemetry and threat intel. (Commercial)
3. [Acalvio ShadowPlex](https://cybersectools.com/tools/acalvio-shadowplex) - Deception platform using external-facing decoys for threat intel & recon detection (Commercial)
4. [Anantis TrapEye](https://cybersectools.com/tools/anantis-trapeye) - Detects intruders the moment they interact with your network. (Commercial)
5. [Tropico Security - AI Powered Deception](https://cybersectools.com/tools/tropico-security-ai-powered-deception) - AI-powered deception platform that predicts, traps, and neutralizes attackers. (Commercial)

Compare all sshd-honeypot alternatives at [https://cybersectools.com/alternatives/sshd-honeypot](https://cybersectools.com/alternatives/sshd-honeypot)

### What deployment and organization size does sshd-honeypot fit?

sshd-honeypot is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare sshd-honeypot with similar solutions

- [sshd-honeypot vs Trapster](https://cybersectools.com/compare/sshd-honeypot-vs-trapster)
- [sshd-honeypot vs Deception Check Fleet Status](https://cybersectools.com/compare/deception-check-fleet-status-vs-sshd-honeypot)
- [sshd-honeypot vs Acalvio ShadowPlex](https://cybersectools.com/compare/acalvio-shadowplex-vs-sshd-honeypot)

All alternatives to sshd-honeypot: [/alternatives/sshd-honeypot](https://cybersectools.com/alternatives/sshd-honeypot)

---

Source: https://cybersectools.com/tools/sshd-honeypot

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on sshd-honeypot: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md