This project is based on the docker-elk template from deviantony.
The given docker-compose.yml
was extended to expose the endlessh service to provide an SSH honeypot on port 2222.
Endlessh's log output is sent to Logstash by using a shared Docker volume. The log is then transformed using GROK patterns and sent to Elasticsearch.
I run multiple servers for a variety of services, directly connected to the internet. In this kind of scenario the /var/log/auth.log
file is pretty much flooded with failed SSH authentication attempts. To slow down attackers and to gather some information about them I wanted to monitor all incoming authentication attempts. So I moved the real SSH service to another port and deployed endlessh on port 22.
To store and evaluate the collected data I chose the ELK stack, to learn how to work with it.