Opening SSH with Root Access to the World: A Controlled Honeypot Experiment
Last updated
Last updated
"If you're going to set a trap, make sure it looks like a jackpot."
Before any real hackers showed up, I decided to have a little fun. I shared the open SSH port with a friend and told him to "explore freely."
What followed was pure comedy.
He logged in, typed commands like clear, ls, cat, man, and even tried chatting with the server:
"what the f*** is the server""why have you even exposed this on internet to waste our time""please get a life bro"
Meanwhile, I sat back, silently watching him yell at a machine that logged everything without a response.
Here’s a live snapshot from that session
After laughing way too hard, I got serious. This wasn’t about trolling, it was about building a controlled honeypot designed to capture real-world attacker behaviour.
The mission:
Expose a fake SSH service offering root access.
Isolate the honeypot completely from the real internet.
Control entry points with tight firewalling and routing.
Observe and log attacker behaviour safely.
In short: ✅ Full control. ✅ Full visibility. ✅ Zero risk.
The setup involved two servers:
shaddykrupa
Cowrie SSH Honeypot
192.168.237.128 (host-only network)
No internet access
shaddy-reverse-proxy
Reverse Proxy
LAN Interface: ens33, Host-Only Interface: ens37
Port 2000 exposed to the Internet (exposed on port 22 publically so technically 3 layers of network translation 2 NAT and 1 PAT )
Traffic flow:
Here’s the exact firewall script I used on shaddy-reverse-proxy:
This setup ensures:
Only traffic on port 2000 is accepted and redirected.
Packets are rewritten so Cowrie sees them correctly.
Invalid traffic is dropped to harden the proxy itself.
Once the trap was live, it didn’t take long.
Bots, opportunistic attackers, and noisy scanners started pouring in each believing they had found an open root-access SSH server.
They spammed password attempts, tried wget malware downloads, dropped crypto-miners,
and some immediately fired off rm -rf /* like it was Christmas morning.
Meanwhile, Cowrie quietly logged everything.
Attackers behave differently when they think they have root: bold, reckless, and noisy.
Speed is insane: The first bot hit within minutes of exposure.
Defence in depth is non-negotiable: Even honeypots need strong isolation.
This is just the beginning.
I'm continuing to log and analyse all incoming activity. The real fun starts now: studying what the bots do, how they behave, and what tools and malware they attempt to deploy when they believe they've found root access.
Will try and put updates soon with:
Full analysis of attacker behaviour over time
Common attack patterns spotted in the wild
Tricks attackers use once they believe they "own" a system
This wasn’t just about catching hackers / Bots — it was about understanding them. Learning how fast they move, how they think, and how to outwit them.
By exposing fake root access in a controlled, isolated, and fortified environment, I got a front-row seat to the chaos without ever risking a real system.
And honestly? Watching my friend get mad at a fake server was just a bonus.
I opened SSH with root access to the world, but the only ones who got pwned were the bots.
And a little bit... my friend too.
