Commit Graph

22 Commits

Author SHA1 Message Date
92ad118de2 Update config.ini.TEMPLATE
Update for incept5/llama3.1-claude LLM
2025-02-08 21:38:36 +00:00
2df4358356 Update config.ini.TEMPLATE
commented out Ollama
2025-02-08 21:17:22 +00:00
4bd3cfcdc2 Update config.ini.TEMPLATE
Added Ollama Config Option
2025-02-08 21:05:03 +00:00
f1f6c294e9 Update ssh_server.py
Added Ollama Model
2025-02-08 21:04:02 +00:00
1d0e046924 Added 'sensor_name' and 'sensor_protocol' to logs
* 'sensor_name` is an arbitrary string that identifies the specific honeypot sensor that generated the log. Set it in the config.ini file. If not set, it will default to the honeypot system's hostname.
* 'sensor_protocol' identifies the specific protocol this honeypot sensor uses. For SSH, it's always "ssh" but as other protocols are added to DECEIVE in the future, this will have different values for their logs.
2025-02-06 10:16:42 -05:00
dba537c58f removed debug statements 2025-02-04 16:11:48 -05:00
b222940de2 Wildcard password support
Setting a password to be "*" in the config file will cause the server to accept any password the client provides for that account, including an empty password.
2025-02-04 16:05:23 -05:00
0197b8b1df Update config.ini.TEMPLATE to support non-interactive commands
Oops, I forgot to commit this before.
2025-02-04 14:55:02 -05:00
5f27aeeabb Correctly handle both interactive and non-interactive SSH sessions
SSH servers can take user commands from an interactive session as normal, but users can also include commands on the ssh client command line which are executed on the server (e.g., "ssh <hostname> 'uname -a'"). We now execute these non-interactive commands properly as well.

Also added a new "interactive" flag to all user commands (true/false) to show which type of command execution this was.
2025-02-04 12:29:12 -05:00
585ee66009 Don't print ConnectionLost exceptions to the console
These are far too frequent. We still log them, though, we just don't print them.
2025-01-28 10:48:29 -05:00
7be73a7dff Make peername and sockname calls more robust across platforms
For whatever reason, MacOS returns 4 values from conn.get_extra_info('peername') and conn.get_extra_info('sockname'), but Linux systems only return 2.  On the Mac, it's only the first two that we need anyway. Now we retrieve them all, no matter how many there are, and just use the first two so it will work on both platforms.
2025-01-28 10:39:12 -05:00
788bd26845 Now print exceptions to console when SSH connection is lost 2025-01-28 10:21:27 -05:00
cea5dc28a2 New command line options for prompts and config files.
* --prompt-file to specify a file from which to read the prompt.
* --prompt to specify a prompt string on the command line
* --config to specify an alternate config file
2025-01-27 13:20:41 -05:00
cda3c5496b Streamline the prompting
The config file now contains a new "system_prompt" value in the [llm] section. This would be the same for all DECEIVE instances, and configures how the emulation itself will act. The honeypot administrator should mostly keep this intact. The prompt.txt file now focuses more on what type of system to emulate, and optional details such as valid users, contents to stage on the system, etc.
2025-01-17 14:37:07 -05:00
4967d44df9 User input (commands) now base64 encoded in the log file 2025-01-10 15:47:16 -05:00
52541ab1ed Session summaries now include a "judgement" field to make it easier to search/filter. 2025-01-10 14:12:59 -05:00
e9044ba2ad JSON, summary, and exit fixes
* All logging is now in JSON lines format!
* Fixed a bug where the session summary was generated twice for the same session
* Fixed a reversion in the exit handling when the user logged out gracefully.
2025-01-10 13:38:04 -05:00
7185c7f5c7 Fix session summary and ascii errors
* Session summaries now occur both at normal session termination (e.g., the user gracefully logs out) or abnormal termination, such as if the client disconnects suddenly.
* Now encode the AI results as UTF-8 instead of ASCII, because it would ocassionally send back non-ASCII characters which caused the server to throw errors
2025-01-10 12:33:36 -05:00
3b546126b6 New AI-powered session summary and judgement. Removed extra exit() statement. 2024-12-20 13:37:40 -05:00
b16c76c26a Updated README.md and reformatted SSH system prompt. 2024-11-12 14:12:29 -05:00
d1c3704924 Added SSH config file template 2024-11-07 15:27:34 -05:00
a73fefa9c4 Moved SSH honeypot to subdirectory 2024-08-26 14:31:52 -04:00