mrzkexe/melisis

How mrzkexe/melisis works

Melisis is an SSH honeypot: network clients connect to a configurable listener, are handled according to one of four modes, and may be deceived, given a fake shell, or banned. The main runtime path is visible in the sampled Go sources. The README additionally documents systemd operation and Fail2Ban monitoring/configuration; source excerpts show Fail2Ban files being generated, but not the daemon’s runtime behavior. Shell command and ban logs are distinct outputs.

Main entry points: main.go Mode router · honeypot.go SSH trap · writeban.go Ban logger · highprotection.go High-protection mode

Components 19

Server runtime

App startup melisis/main.go
TCP listener melisis/main.go
Mode router melisis/main.go
Modes and IPs melisis/domain.go

SSH deception

SSH trap melisis/honeypot.go
Login deception melisis/honeypot.go
Session channels melisis/honeypot.go
Fake terminal melisis/honeypot.go
Command responses melisis/honeypot.go

Blocking and bans

High-protection mode melisis/highprotection.go
Ban logger melisis/writeban.go
Fail2Ban setup melisis/fail2ban.go
Fail2Ban rules melisis/fail2ban.go

Configuration and monitoring

Runtime config melisis/main.go
Command log melisis/honeypot.go
Ban log melisis/writeban.go

Other components

SSH client
Fail2Ban
systemd service

Connections 21

App startup → Fail2Ban setup: checks dependencies melisis/main.go
App startup → Runtime config: loads settings melisis/main.go
App startup → TCP listener: starts listener melisis/main.go
TCP listener → Mode router: routes connections melisis/main.go
SSH client → TCP listener: connects to README.md
Mode router → Modes and IPs: checks mode melisis/main.go
Mode router → High-protection mode: dispatches mode 0 melisis/main.go
Mode router → SSH trap: dispatches other modes melisis/main.go
SSH trap → Login deception: checks password melisis/honeypot.go
SSH trap → Session channels: processes channels melisis/honeypot.go
Session channels → Fake terminal: starts shell melisis/honeypot.go
Fake terminal → Command responses: generates replies melisis/honeypot.go
Command responses → Command log: writes commands melisis/honeypot.go
Fake terminal → Ban logger: bans on disconnect melisis/honeypot.go
SSH trap → Ban logger: records failed sessions melisis/honeypot.go
High-protection mode → Ban logger: registers ban melisis/highprotection.go
Ban logger → Ban log: writes record melisis/writeban.go
Fail2Ban setup → Fail2Ban rules: creates rules and filters melisis/fail2ban.go
Fail2Ban → Fail2Ban rules: uses configured rules README.md
Fail2Ban → Ban log: monitors ban log README.md
systemd service → App startup: starts service README.md

More Go diagrams: zmap/zannotate · dreadnode/dreadgoad · opentelekomcloud/terraform-provider-opentelekomcloud · stym06/rebuf · truenas/truenas-csi

Drawn by GitDiagram on September 30, 2026 from the repository's file tree, README and source files. Read as Markdown ·