SSH on System Overlord

Lessons Learned from SSH Credential Honeypots

david@systemoverlord.com (David Tomaschik) — Fri, 04 Sep 2020 00:00:00 +0000

For the past few months, I’ve been running a handful of SSH Honeypots on some cloud providers, including Google Cloud, DigitalOcean, and NameCheap. As opposed to more complicated honeypots looking at attacker behavior, I decided to do something simple and was only interested in where they were coming from, what tools might be in use, and what credentials they are attempting to use to authenticate. My dataset includes 929,554 attempted logins over a period of a little more than 3 months.

If you’re looking for a big surprise, I’ll go ahead and let you down easy: my analysis hasn’t located any new botnets or clusters of attackers. But it’s been a fascinating project nonetheless.

New Tool: sshdog

david@systemoverlord.com (David Tomaschik) — Wed, 04 Jan 2017 00:00:00 +0000

I recently needed an encrypted, authenticated remote bind shell due to a situation where, believe it or not, the egress policies were stricter than ingress! Ideally I could forward traffic and copy files over the link.
I was looking for a good tool and casually asked my coworkers if they had any ideas when one said “sounds like SSH.”

Well, shit. That does sound like SSH and I didn’t even realize it. (Tunnel vision, and the value of bouncing ideas off of others.) But I had a few more requirements in total:

Using an SSH Connection to Provide Remote Support (Part I)

david@systemoverlord.com (David Tomaschik) — Tue, 20 Sep 2011 15:37:46 +0000

Last week, at the ALE meeting, a question came up about using SSH to provide remote support for someone who is not especially Linux-literate. I suggested using an SSH reverse tunnel so the end-user wouldn't need to worry about firewalls, NAT, etc.

Thinking about the problem, I realize that it's a little more complicated than that. So in part 1, I'm going to discuss the general solution and the approach to the problem. In Part II, I'll present a more comprehensive solution that will (I think) scale better.

SSH across a Layer 7 Filter

david@systemoverlord.com (David Tomaschik) — Sat, 19 Feb 2011 03:14:50 +0000

Every once in a while, I find myself in a situation behind some sort of device that filters a lot of traffic. Most often, it's on my laptop at some facility (e.g., coffee shop) that only allows HTTP/HTTPS out. For a while, I just listened for SSH traffic on port 443 (HTTPS) to connect through port-based firewalls. However, a few times now I've seen a connection reset immediately after the SSH handshake started (during the protocol&cipher negotation). Looking at them through WireShark made it obvious it wasn't a server or client problem, but some intermediate device sending a RST.