How andy25x/ssh-honeypot works
This is an SSH honeypot with a live Flask dashboard and activity reporting. An SSH client connects to the listener, which dispatches a session handler; credential attempts are geolocated and logged, while the fake shell emulates a filesystem and captures commands. The dashboard and HTML report present persisted activity. Edges follow explicit imports, calls, or documented behavior in the supplied excerpts and SOURCE INDEX; the README is empty, so detector and threat-intelligence connections are not asserted where callers were not shown.
Main entry points: handler.py SSH session handler · main.py Application launcher · app.py Dashboard and API · server.py SSH listener
Components 18
SSH capture
- Application launcher
Documents/VScode-Projects/SSH-Honeypot/main.py - Configuration
Documents/VScode-Projects/SSH-Honeypot/config.py - SSH listener
Documents/VScode-Projects/SSH-Honeypot/honeypot/server.py - SSH session handler
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - Fake filesystem
Documents/VScode-Projects/SSH-Honeypot/honeypot/filesystem.py
Session analysis
- IP geolocation
Documents/VScode-Projects/SSH-Honeypot/honeypot/geoip.py - Behavior detector
Documents/VScode-Projects/SSH-Honeypot/honeypot/detector.py - Threat intelligence
Documents/VScode-Projects/SSH-Honeypot/honeypot/threat_intel.py
Event storage
- Structured event logger
Documents/VScode-Projects/SSH-Honeypot/honeypot/logger.py - Persistence API
Documents/VScode-Projects/SSH-Honeypot/honeypot/database.py - Activity database
Documents/VScode-Projects/SSH-Honeypot/data/honeypot.db - JSONL event log
Documents/VScode-Projects/SSH-Honeypot/data/events.jsonl
Monitoring and reports
- Dashboard and API
Documents/VScode-Projects/SSH-Honeypot/dashboard/app.py - Dashboard page
Documents/VScode-Projects/SSH-Honeypot/dashboard/templates/index.html - HTML activity report
Documents/VScode-Projects/SSH-Honeypot/honeypot/report.py
Other components
- SSH client
- ip-api.com
- Dashboard user
Connections 23
- Application launcher → Persistence API: initializes
Documents/VScode-Projects/SSH-Honeypot/main.py - Application launcher → Structured event logger: sets up
Documents/VScode-Projects/SSH-Honeypot/main.py - Application launcher → SSH listener: starts
Documents/VScode-Projects/SSH-Honeypot/main.py - Application launcher → Dashboard and API: runs
Documents/VScode-Projects/SSH-Honeypot/main.py - Application launcher → HTML activity report: generates
Documents/VScode-Projects/SSH-Honeypot/main.py - SSH client → SSH listener: connects to
Documents/VScode-Projects/SSH-Honeypot/honeypot/server.py - SSH listener → SSH session handler: dispatches sessions
Documents/VScode-Projects/SSH-Honeypot/honeypot/server.py - SSH session handler → IP geolocation: looks up IP
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - SSH session handler → Structured event logger: logs credentials
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - SSH session handler → Fake filesystem: emulates shell
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - SSH session handler → Persistence API: records commands
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - SSH session handler → Structured event logger: logs commands
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - IP geolocation → ip-api.com: queries
Documents/VScode-Projects/SSH-Honeypot/honeypot/geoip.py - Structured event logger → JSONL event log: appends events
Documents/VScode-Projects/SSH-Honeypot/honeypot/logger.py - Persistence API → Activity database: reads and writes
Documents/VScode-Projects/SSH-Honeypot/honeypot/database.py - Dashboard and API → Persistence API: queries activity
Documents/VScode-Projects/SSH-Honeypot/dashboard/app.py - Dashboard and API → Dashboard page: renders
Documents/VScode-Projects/SSH-Honeypot/dashboard/app.py - Dashboard user → Dashboard and API: views and exports
Documents/VScode-Projects/SSH-Honeypot/dashboard/app.py - HTML activity report → Activity database: queries activity
Documents/VScode-Projects/SSH-Honeypot/honeypot/report.py - Application launcher → Configuration: overrides port
Documents/VScode-Projects/SSH-Honeypot/main.py - SSH listener → Configuration: uses settings
Documents/VScode-Projects/SSH-Honeypot/honeypot/server.py - SSH session handler → Configuration: uses settings
Documents/VScode-Projects/SSH-Honeypot/honeypot/handler.py - Dashboard and API → Configuration: uses settings
Documents/VScode-Projects/SSH-Honeypot/dashboard/app.py