Build Your Own Honeypot with ContainerSSH
summary
ContainerSSH is an SSH server that launches user shells inside containers via Docker, Podman, Kubernetes, rewritten in Go with webhook-based pluggable authentication and configuration and optional Asciinema or a custom binary audit log. A live demo runs a honeypot, records non-interactive bot sessions and SFTP uploads (many bots upload tarballs then delete traces), and uncovers surprising payloads like SMS‑spamming malware. Audit logs can stream to S3 with multipart uploads and object‑locking; containers are removed on disconnect to limit persistence.
AI-written summary · about
chapters (17)
- 0:00Start
- 8:41Container Ssh
- 9:08Authentication Server
- 10:43Configuration Server
- 11:22Audit Logging
- 18:14Binary Logging
- 19:17Uploading the Data
- 19:44Program Execution
- 20:05Sftp Uploads
- 20:33How Does Audit Logging Work
- 25:13Motivation Why Would You Hack a Server
- 26:10Ssh Attacks
- 29:31Ssh Private Keys
- 30:35Running Security Updates
- 34:25Linux Learning Environments
- 35:11High Security Environment
- 36:26Warm Storage
related talks
26mWeb Honeypot Project
31mWeb Application Honeypot Threat Intelligence
23mHoneypots 2.0: A New ‘Twist’ on Defending Enterprise Networks
57mWhat vulnerabilities? Live hacking of containers and orchestrators
19mHacking Kubernetes
44mLayers of Deception: Intrusion Detection Honeypots w/ Security Onion
30mThe Bucket List: Experiences Operating S3 Honeypots
38mA Treasure Map of Hacking (and Defending) Kubernetes