The document discusses Kippo, a low-interaction honeypot that emulates SSH services. It describes what a honeypot is, types of honeypots including high and low interaction, and examples of lower interaction honeypots like Kippo. It provides instructions for getting Kippo, configuring its database and configuration file, and redirecting SSH traffic to Kippo's emulated SSH service using iptables. The document aims to demonstrate how to run Kippo as a honeypot.

1. EmilTan
Team Lead, Co-Founder
http://edgis-security.org
@EdgisSecurity
Research Guide
http://honeynet.sg
Kippo 101

2. What is honeypot?
 Information system resources which have no production
values.
 Its values lies in unauthorised or illicit use of the resource.
 Its value lies in being probed, attacked, or compromised.
-- Spitzner
 KnowYour Enemy.

3. Types of Honeypots.
 High Interactions –Actual Machine.
 Low Interactions –A program.
 Honeytokens.
 Hybrid.

4. Lower Interaction Honeypots
 Honeyd
 Tiny Honeypot
 Dionaea
 Glastopf
 Ghost USB
 Honeyports
 Conpot
 Thug
 Kippo

5. Emulating SSH

6. Getting the Codes
 Dependencies
 subversion
 python-twisted
 mysql-server
 python-mysqldb
 mysql-server
 http://kippo.googlecode.com/svn/trunk/

7. Kippo’s Database
 Tables
 auth
 clients
 downloads
 input
 sensors
 sessions
 ttyplog

8. Configuring Kippo
 Basic Configuration File: kippo.cfg
 ssh_port = 2222
 iptables –A PREROUTING –t nat –i eth0 –p tcp
--dport 22 –j REDIRECT --to-port 2222
 [database_mysql]
 log – log files
 dl – downloaded files
 honeyfs – virtual file contents
 txtcmds – Commands that output text

9. Run Kippo!
Demonstration
SpecialThanks to @lvdeijk for Sharing Some RecordedTTYs.