Oubliette

An SSH honeypot that logs login attempts, presents fake shells to "successful" logins, and tries to detect when a real human is poking around.

Named after the medieval dungeon - a place you throw people into and forget about them.

Status

Early development. See PLAN.md for the roadmap.

Usage

Build

# With Nix
nix build

# With Go
nix develop -c go build ./cmd/oubliette

Configure

Copy and edit the example config:

cp oubliette.toml.example oubliette.toml

Key settings:

• ssh.listen_addr — listen address (default :2222)
• ssh.host_key_path — Ed25519 host key, auto-generated if missing
• auth.accept_after — accept login after N failures per IP (default 10)
• auth.credential_ttl — how long to remember accepted credentials (default 24h)
• auth.static_credentials — always-accepted username/password pairs

Run

./oubliette -config oubliette.toml

Test with:

ssh -o StrictHostKeyChecking=no -p 2222 root@localhost