The invention discloses a high-interaction SSH
honeypot implementation method, comprising the following steps: connecting the
system SSH port, judging whether there is SSH service, and entering the next step with the SSH service; using the
logit function and the authctxt structure in OpenSSH in Capture the authenticated user name /
password during
password authentication; after the
password authentication is successful, use the SSH service to process the
client data through the pipeline and the user
processing interactive session module, and modify the relevant module code to complete the shell
Record passwords; control the outgoing flow of the
honeypot system, including the two processes of
external data packet restriction and external
attack packet suppression; use javaweb technology to analyze, process and display the data captured by the
honeypot system. A high-interaction SSH honeypot implementation method of the present invention can solve the SSH
attack that passive defense technology cannot be continuously updated due to the bottom of the valley, and the low-interaction SSH honeypot has low interaction degree, insufficient deception, and is easy to be seen through. Improve the security defense capability of the SSH service.