Purkki

Purkki (or BPF-Purkki) is a high-interaction SSH honeypot system based on eBPF-tracing. The configuration was tested on Debian system.

The system sets up a VM with a vulnerable SSH-configuration, allowing connections to it with preset username and password combinations. The connections are tracked, and activities in the VM are traced by system and and function calls.

This information is then sent to the controller (in the host machine) that gathers logs of activities in the target VM.

Before installing, some packages are required. Install with; sudo apt install git make bpftool libbpf-dev libpam-dev libssl-dev build-essential linux-headers-generic clang gcc-multilib vim tmux python-is-python3 qemu-system-x86 cloud-image-utils cloud-init qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils socat screen nftables dnsmasq

We recommend creating a "controller" user that is used to install and run the honeypot scripts. This way multiple users can check on the same machine, without running into permission errors. Make sure the user is included in the correct groups; usermod -aG sudo,kvm user

Assuming your personal user is also in sudo group, you can log into the controller with sudo su controller

Before running the installation or building the honeypot, make sure to have SSH access to the machine, and an SSH key configured for the controller user. After installing, logins to the host will use port 2200, while 22 is reserved for the honeypot traffic.

To set things up, we use 3 scripts;

install.sh in the project root changes network configuration install a toggle to allow/disallow connections to the honeypot. Reboot after the install script to make sure the settings take effect.

controller/build.sh builds a systen snapshot, and configures some settings for the decoy users and the tracing.

controller/runtmux.sh Runs the built honeypot image, starting 4 scripts in a TMUX session. This includes a live view and summary of events, CPU use monitor, and a login screen.

You can move between the windows by pressing CTRL+B, followed by an arrow key to the direction you want to switch to. To leave the honeypot running while you do something else, CTRL+B, followed by D, will detach from the session but leave it running. From the VM terminal, you can connect back to the session by running tmux attach.

Logs are stored in the /log directory from project root. The controller directory includes a log analysis script to give a summary of sessions in the defined directory, i.e.,

./controller/log-stats.py ./log/current/

To print the summary of the current sessions logs.

To stop the honeypot, CTRL+B, followed by typing :kill-session will end the session.