[
  {
    "path": ".dockerignore",
    "content": ".git/\n.github/\nvolumes/\n.gitignore\ndocker-compose.yml\nLICENSE\nREADME.md\n"
  },
  {
    "path": ".github/FUNDING.yml",
    "content": "# These are supported funding model platforms\n\ngithub: fffaraz # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]\npatreon: # Replace with a single Patreon username\nopen_collective: # Replace with a single Open Collective username\nko_fi: # Replace with a single Ko-fi username\ntidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel\ncommunity_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry\nliberapay: # Replace with a single Liberapay username\nissuehunt: # Replace with a single IssueHunt username\notechie: # Replace with a single Otechie username\nlfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry\ncustom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']\n"
  },
  {
    "path": ".github/workflows/docker-image.yml",
    "content": "name: Docker Image CI\n\non:\n  push:\n    branches: [ \"master\" ]\n  pull_request:\n    branches: [ \"master\" ]\n\njobs:\n\n  build:\n\n    runs-on: ubuntu-latest\n\n    permissions:\n      contents: read\n      packages: write\n\n    steps:\n    - uses: actions/checkout@v4\n\n    - name: Set up QEMU\n      uses: docker/setup-qemu-action@v3\n\n    - name: Set up Docker Buildx\n      uses: docker/setup-buildx-action@v3\n\n    - name: Log in to GitHub Container Registry\n      if: github.event_name == 'push'\n      uses: docker/login-action@v3\n      with:\n        registry: ghcr.io\n        username: ${{ github.actor }}\n        password: ${{ secrets.GITHUB_TOKEN }}\n\n    - name: Extract Docker metadata\n      id: meta\n      uses: docker/metadata-action@v5\n      with:\n        images: ghcr.io/${{ github.repository }}\n        tags: |\n          type=raw,value=latest,enable={{is_default_branch}}\n          type=sha\n\n    - name: Build and push Docker image\n      uses: docker/build-push-action@v6\n      with:\n        context: .\n        platforms: linux/amd64,linux/arm64,linux/arm/v7\n        push: ${{ github.event_name == 'push' }}\n        tags: ${{ steps.meta.outputs.tags }}\n        labels: ${{ steps.meta.outputs.labels }}\n"
  },
  {
    "path": ".github/workflows/go.yml",
    "content": "# This workflow will build a golang project\n# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go\n\nname: Go\n\non:\n  push:\n    branches: [ \"master\" ]\n  pull_request:\n    branches: [ \"master\" ]\n\njobs:\n\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v3\n\n    - name: Set up Go\n      uses: actions/setup-go@v4\n      with:\n        go-version: '1.25'\n\n    - name: Build\n      run: go build -v ./...\n\n    - name: Test\n      run: go test -v ./...\n"
  },
  {
    "path": ".gitignore",
    "content": "volumes/\nfakessh\n*.exe\n"
  },
  {
    "path": "Dockerfile",
    "content": "FROM golang:alpine AS builder\nWORKDIR /app\nCOPY . .\nRUN CGO_ENABLED=0 go build -ldflags=\"-w -s\" .\n\nFROM scratch\nCOPY --from=builder /app/fakessh /fakessh\nEXPOSE 22\nENTRYPOINT [\"/fakessh\"]\n"
  },
  {
    "path": "LICENSE",
    "content": "BSD 3-Clause License\n\nCopyright (c) 2022, Faraz Fallahi <fffaraz@gmail.com>\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n   list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its\n   contributors may be used to endorse or promote products derived from\n   this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
  {
    "path": "README.md",
    "content": "# FakeSSH\n\nA dockerized SSH honeypot server written in Go that logs login attempts.\nPassword authentication always fails, so no terminal access is granted to the attacker.\n\n## Quick Start\n\n```\ngo install github.com/fffaraz/fakessh@latest\nsudo setcap 'cap_net_bind_service=+ep' ~/go/bin/fakessh\nfakessh [optional-log-directory]\n```\n\nOR\n\n```\ndocker run -it --rm -p 22:22 ghcr.io/fffaraz/fakessh\n```\n\nOR\n\n```\ndocker run -d --restart=always -p 22:22 --name fakessh ghcr.io/fffaraz/fakessh\ndocker logs -f fakessh\n```\n\n### See also\n\n* [jaksi/sshesame](https://github.com/jaksi/sshesame) - A fake SSH server that lets everyone in and logs their activity\n* [shazow/ssh-chat](https://github.com/shazow/ssh-chat) - Custom SSH server written in Go; instead of a shell, you get a chat prompt\n* [gliderlabs/ssh](https://github.com/gliderlabs/ssh) - Easy SSH servers in Golang\n* [gliderlabs/sshfront](https://github.com/gliderlabs/sshfront) - Programmable SSH frontend\n* [desaster/kippo](https://github.com/desaster/kippo) - SSH honeypot\n* [micheloosterhof/cowrie](https://github.com/micheloosterhof/cowrie) - SSH/Telnet honeypot\n* [fzerorubigd/go0r](https://github.com/fzerorubigd/go0r) - A simple SSH honeypot in Go\n* [droberson/ssh-honeypot](https://github.com/droberson/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords\n* [x0rz/ssh-honeypot](https://github.com/x0rz/ssh-honeypot) - Fake sshd that logs IP addresses, usernames, and passwords\n* [tnich/honssh](https://github.com/tnich/honssh) - Logs all SSH communications between a client and server\n* [Learn from your attackers - SSH HoneyPot](https://www.robertputt.co.uk/learn-from-your-attackers-ssh-honeypot.html)\n* [cowrie](https://github.com/cowrie/cowrie) - SSH/Telnet honeypot\n"
  },
  {
    "path": "docker-compose.yml",
    "content": "version: '3'\n\nservices:\n  fakessh:\n    build: .\n    image: fffaraz/fakessh:latest\n    restart: always\n    network_mode: host\n    container_name: fakessh\n    command: /log\n    volumes:\n      - ./volumes/fakessh:/log\n"
  },
  {
    "path": "fakessh.go",
    "content": "package main\n\nimport (\n\t\"crypto/rand\"\n\t\"crypto/rsa\"\n\t\"errors\"\n\t\"fmt\"\n\t\"log\"\n\t\"net\"\n\t\"os\"\n\t\"time\"\n\n\t\"golang.org/x/crypto/ssh\"\n)\n\nvar errBadPassword = errors.New(\"permission denied\")\n\nfunc main() {\n\tif len(os.Args) > 1 {\n\t\tlogPath := fmt.Sprintf(\"%s/fakessh-%s.log\", os.Args[1], time.Now().Format(\"2006-01-02-15-04-05-000\"))\n\t\tlogFile, err := os.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)\n\t\tif err != nil {\n\t\t\tlog.Println(\"Failed to open log file:\", logPath, err)\n\t\t\treturn\n\t\t}\n\t\tdefer logFile.Close()\n\t\tlog.SetOutput(logFile)\n\t}\n\n\tlog.SetFlags(log.LstdFlags | log.Lmicroseconds)\n\n\tserverConfig := &ssh.ServerConfig{\n\t\tMaxAuthTries:     6,\n\t\tPasswordCallback: passwordCallback,\n\t\tServerVersion:    randomServerVersion(),\n\t}\n\n\tprivateKey, _ := rsa.GenerateKey(rand.Reader, 2048)\n\tsigner, _ := ssh.NewSignerFromSigner(privateKey)\n\tserverConfig.AddHostKey(signer)\n\n\tlistener, err := net.Listen(\"tcp\", \":22\")\n\tif err != nil {\n\t\tlog.Println(\"Failed to listen:\", err)\n\t\treturn\n\t}\n\tdefer listener.Close()\n\n\tfor {\n\t\tconn, err := listener.Accept()\n\t\tif err != nil {\n\t\t\tlog.Println(\"Failed to accept:\", err)\n\t\t\tbreak\n\t\t}\n\t\tgo handleConn(conn, serverConfig)\n\t}\n}\n\nfunc randomServerVersion() string {\n\tserverVersions := []string{\n\t\t\"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3\",\n\t\t\"SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u3\",\n\t\t\"SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.10\",\n\t\t\"SSH-2.0-OpenSSH_7.4\",\n\t\t\"SSH-2.0-OpenSSH_8.0\",\n\t\t\"SSH-2.0-OpenSSH_8.4p1 Debian-2~bpo10+1\",\n\t\t\"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u1\",\n\t\t\"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6\",\n\t}\n\treturn serverVersions[time.Now().UnixNano()%int64(len(serverVersions))]\n}\n\nfunc passwordCallback(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {\n\tlog.Println(conn.RemoteAddr(), string(conn.ClientVersion()), conn.User(), string(password))\n\ttime.Sleep(100 * time.Millisecond)\n\treturn nil, errBadPassword\n}\n\nfunc handleConn(conn net.Conn, serverConfig *ssh.ServerConfig) {\n\tdefer conn.Close()\n\tconn.SetDeadline(time.Now().Add(30 * time.Second))\n\tlog.Println(conn.RemoteAddr())\n\tssh.NewServerConn(conn, serverConfig)\n}\n"
  },
  {
    "path": "go.mod",
    "content": "module github.com/fffaraz/fakessh\n\ngo 1.25.0\n\nrequire golang.org/x/crypto v0.49.0\n\nrequire golang.org/x/sys v0.42.0 // indirect\n"
  },
  {
    "path": "go.sum",
    "content": "golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=\ngolang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=\ngolang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=\ngolang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=\ngolang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=\ngolang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=\n"
  }
]