Implementación de un honeypot utilizando Kippo para mitigar las acciones no autorizadas de los intrusos al protocolo SSH.

Abstract

The objective of this technical project was to implement a honeypot using Kippo to mitigate the unauthorized actions of intruders to the SSH protocol, for which a test scenario was designed and developed using 3 virtual machines such as: Kali Linux, Centos and Windows 7, correctly configured with different operating systems, which were responsible for carrying out the attacks and a Linux-based operating system in which the honeypot was installed. The attacks executed and the logs analyzed were carried out using the Penetration Test Execution Standard (PTES), This security methodology is one of the most used because it contains phases and stages that guarantee that all the details are collected efficiently and that the penetration professional has a clear idea of the actions carried out; started from the reconnaissance where the most information about the SSH server to be compromised was searched and collected, later a scan was carried out obtaining detailed information of the entire network, that is, the operating systems, ports and services that are active, in this way access to the server was obtained, evading the protection mechanisms and having control of all the data. All the actions were registered and stored in a file, later the analysis of the data obtained was carried out, in which it was possible to observe the actions that the intruder carried out on the server. Through these actions, some recommendations were carried out, such as: creating more secure passwords and SSH keys, changing the SSH port that comes by default, automatically blocking attacks that arrive by brute force, disabling the OpenSSH server on personal computers and, above all, maintaining always updated SSH. In this way, it is concluded that by applying these recommendations in the SSH server, it considerably reduces the attacks and thus it is possible to mitigate the unauthorized actions of the intruders to the SSH protocol. It is recommended to have connectivity between the 3 virtual machines and to correctly install the Kippo honeypot.