Skip to content

Commit

Permalink
Update readme to include recent changes
Browse files Browse the repository at this point in the history
  • Loading branch information
victpork committed Feb 14, 2018
1 parent 66bdbd5 commit 3e483ed
Showing 1 changed file with 15 additions and 8 deletions.
23 changes: 15 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,14 +9,15 @@ A SSH honeypot with rich features written in Go
- SFTP/SCP support for uploading/downloading files
- Logs client key fingerprints
- Logs in JSON format for easy parsing
- Push activities to [ElasticSearch](https://www.elastic.co) for analysis and storage
- Record local and remote host when client attempt to create port redirection
- Structure allows [extending command sets](https://github.com/mkishere/sshsyrup/wiki/Writing-new-commands) with ease

### See Recorded Session in Action!
[![asciicast](https://asciinema.org/a/rgr1KyY1Xn21bXIDMKL9fkGD0.png)](https://asciinema.org/a/rgr1KyY1Xn21bXIDMKL9fkGD0)

### Requirements
- Linux, Mac or Windows (I've only tested in Windows and WSL, suppose the other 2 platforms should work as expected)
- Linux, Mac or Windows (I've only tested in Windows/WSL/Linux on ARMv7, suppose the other platforms should work as expected)
- Go 1.9 or up (For building)
- [dep](https://github.com/golang/dep) (For building)

Expand All @@ -42,15 +43,15 @@ go build -ldflags "-s -w" -o createfs ./cmd/createfs
"server.allowRandomUser": false
}
```
* Prepare the virtual filesystem image by downloading the filesystem.zip from master branch or create your own by running
* Prepare the virtual filesystem image by downloading the filesystem.zip from master branch or create your own by running
```
./createfs -p / -o filesystem.zip
```

Since we'll need to read every file from the directory, it will take some time to load.
_For Windows, since there are no user/group information, the file/directory owner will always be root._
Since we'll need to read every file from the directory, it will take some time to load.
_For Windows, since there are no user/group information, the file/directory owner will always be root._

Alternatively, you can create your own image file by using `zip` in Linux (or any compatible zip utility file that is capable preserving _uid_/_gid_, symbolic links and timestamps in zip file). After all the image created is a standard zip file. Theoretically you can zip your entire filesystem into a zip file and hosted in Syrup, but remember to exclude sensitive files like `/etc/passwd`
Alternatively, you can create your own image file by using `zip` in Linux (or any compatible zip utility file that is capable preserving _uid_/_gid_, symbolic links and timestamps in zip file). After all the image created is a standard zip file. Theoretically you can zip your entire filesystem into a zip file and hosted in Syrup, but remember to exclude sensitive files like `/etc/passwd`

* Prepare user and passwd file
Put _passwd_ and _group_ file in the same directory as config.json. The format of both files are the same as their [real-life counterpart](http://www.linfo.org/etc_passwd.html) in _/etc_, except that passwd also stores the password in the second field of each line, and asterisk(*) in password field can be used to denote matching any password.
Expand All @@ -62,22 +63,28 @@ Put _passwd_ and _group_ file in the same directory as config.json. The format o
```
./sshsyrup
```
### Config params
### Configuration parameters
See [wiki](https://github.com/mkishere/sshsyrup/wiki/Detail-Configuration-Parameters)
### Logging
By default Syrup will create a logging file in _logs/_ directory with file name _activity.log_ in JSON format.

When available, the log will provide the information in following fields:
Some fields you may interested in:

Field Name | Description
---------- | -----------
clientStr | Client identification string
sessionId | Session ID in base64
sessionId | Session ID is the unique identifier for each SSH session
srcIP | Client IP
time | Log time
user | User account client used to login
password | Password used by client to login, only available when logging in
pubKeyFingerprint | Public key fingerprint client tries to authenticate
cmd | The command user type in shell
remoteHost | The remote host client instruct the server to connect to
localHost | The local host client instruct the server to connect to
path | The file/directory client is trying to access in SCP/SFTP

Please note that Syrup will no longer append dates to log files. Use a proper log rotation tool (e.g. logrotate) to do the work.

Also, each terminal session (the shell) will be logged into a separate file under logs/sessions in [asciinema v2 format](https://github.com/asciinema/asciinema/blob/develop/doc/asciicast-v2.md).

Expand Down

0 comments on commit 3e483ed

Please sign in to comment.