Harvesting SSH Credentials: Insights from My Honeypot Network (uphillsecurity.com)
23 points by whatbackup 3 hours ago
daneel_w 2 hours ago
No "credentials" are being "harvested" here. It's all worthless data, save for the statistics.
0cf8612b2e1e an hour ago
Do most installations create a git user account with login permissions?
inigyou an hour ago
There's no such thing as an account with or without login permissions. Normally you need a git account. And that means you can log in to it. And then you have to try and configure your ssh server so that after logging into the git account, you can only run the git server (I forget the command). If a mistake is made with this configuration then you can log in or port forward or X forward or file transfer as git.
This is a terrible idea because it's blacklist-based security. Places like GitHub have their own ssh server that only runs the git server and nothing else.
0cf8612b2e1e 18 minutes ago
I suppose /usr/sbin/nologin is not a thing?
tuetuopay 14 minutes ago
SSH bastions would like a word I guess. You can authenticate, but you definitely can’t login (which is also the case for git over SSH).
asveikau 2 hours ago
Having a root password of "toor" is very clever. Nobody will figure that one out.
erulastiel 2 hours ago
toor was a default password for many devices for decades.
asveikau 2 hours ago
I've used unix-like OS's for 28 years and I don't remember coming across it as a password.
It is a common username (see: https://en.wikipedia.org/wiki/Toor_(Unix) ), the machine I am typing this on has it.
PyWoody an hour ago
pudgywalsh an hour ago
Slackware used it in the late 90s IIRC.
sisve an hour ago
Did you check out the statistics on the site? They listed 1233456, 12345, 1234,123 and 1 on the toplist of password.
If we are going to be clever we should follow the statistics and go for 12 that where not on the toplist!!
youareinsuffera an hour ago
Or even better, 21. Reverse it to add another layer of obfuscation.