p3l1/sshloc

ELK Stack to analyse incoming SSH connections to linuxserver/endlessh

EndleSSH to ELK Stack

This project is based on the docker-elk template from deviantony.

Features

The given docker-compose.yml was extended to expose the endlessh service to provide an SSH honeypot on port 2222. Endlessh's log output is sent to Logstash by using a shared Docker volume. The log is then transformed using GROK patterns and sent to Elasticsearch.

Motivation

I run multiple servers for a variety of services, directly connected to the internet. In this kind of scenario the /var/log/auth.log file is pretty much flooded with failed SSH authentication attempts. To slow down attackers and to gather some information about them I wanted to monitor all incoming authentication attempts. So I moved the real SSH service to another port and deployed endlessh on port 22. To store and evaluate the collected data I chose the ELK stack, to learn how to work with it.

License

MIT