Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup ssh so that one can login with any username or password and be accepted. If they chose a username and password of an actual user on the system they will successfully login and use ssh as it was intended to be used, but if it is an incorrect password or even an incorrect username I want to grant the user access to a "shell" I create for wasting this intruders time.

The shell (which I've already created - called trollsh) seemingly "lags" (so that it doesn't waste my cpu in the case that someone thought they could annoy me by spamming the fake shell) and though it looks like bash and talks like bash, it returns very extraneous results for common functions. Like cat sounds for "cat", ridiculous error messages and a completely spoofed file-system with traps in every part of it. Inability to clear the screen or exit (with the exit command) are also features of this shell. The failures of these victims will be logged of course to later be shown to my peers and generate some fun laughs.

I believe if I use this shell rather than "deny" the user, it actually helps to prevent from brute force because of the fact that they seemingly "successfully login" with no matter what entry they provide! I could of course further protect my precious CPU, RAM, and Bandwidth by limiting their resources, allowing only a certain amount of these instances and disconnecting them after a set number of commands.

Can I possibly do this with ssh? Or do I need to create a wrapper for myself that uses ssh's protocol with my specifications (always allowing, incorrect -> trollsh (using some no-privileged fake user), correct -> normal user login) Thank you!

share|improve this question
Uh, write your own SSH program? ;) – BenjiWiebe Feb 23 '13 at 2:02
so I'll have to do that after-all? was just wondering if I could use ssh to do it before making my own. – u8sand Feb 23 '13 at 2:54
I'm not positive, bit I am quite sure that you can not do that with any existing SSH server. Have fun writing code! – BenjiWiebe Feb 23 '13 at 2:55
thank you anyway, for now I'm just going to hack ssh's source to accomplish the task. – u8sand Feb 23 '13 at 2:59
up vote 2 down vote accepted

Have a look at which I believe runs a modified SSH and honeypot. (another similar utility is

share|improve this answer
Thank you for these recommendations, I like how the user in the second link was able to log many things about the numerous attackers using kippo. Kippo is also written in python making it easily modifiable for my needs so I might just go with that! – u8sand Feb 24 '13 at 4:04

I use fake-sshd set up at port 22, which is a very simple tarpit written in C that

  1. accepts connections
  2. gives a password prompt after a specified delay
  3. logs user+password if one is interested in that and
  4. denies the login after a specified amount of time.

There is some additional functionality as well, but that is the gist of it.

It should be easy to add a system call to your shell in the code instead of giving a user error, so take a look if you want.

I made some modifications and small bug fixes that are available here. It depends on libssh. Compilation instructions are on the initially linked page.

share|improve this answer
Thanks! I might take a look at the code of fake-sshd and modify it a bit because though it does do MOST of what I want, I also want the ssh to be usable for people who DO have valid usernames/passwords on the server. – u8sand Feb 24 '13 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .