Hacker News Reader

Comment by X86BSD | Hacker News Reader

I've been using something similar for a while now. I use pam_jail on freebsd to drop the ankle biters using common ssh login attempts like test, ubuntu, oracle etc into a FreeBSD jail where I watch what the do and get a copy of all their tools. I rate limit the outgoing traffic from that jail to something painfully slow to prevent them from causing any major issues. But being able to fire up 'watch' on freebsd and snoop the tty they are on in the jail is awesome for forensics.

It's secure, they can't break out of the jail.

It's rate limited to prevent them causing much damage to anyone.

It's easy to observe every thing they type and do in the jail from the host.

View on HN

That's...pretty awesome. Have any guides/blog posts/whatever on your setup?

I don't. When I was setting this up I didn't find any guides or blogs about doing this so I thought it was not of interest to anyone. So I just went about implementing it a piece at a time. Installing pam_jail, then getting /etc/pam.d/sshd configured to use it (which is a one-line addition, very easy). Now by default pam_jail simply puts the user into a jail of their home directory. This is where you can go a few routes with this. If simply jailing the user on the host OS to their home directory is all you are interested in doing you can stop there. Configure FreeBSD to not allow users to see other processes, user processes and group processes not owned by them, and they won't know anyone else is on the system.

security.bsd.see_other_gids

security.bsd.see_other_uids

The above are the two sysctl's you want to enable.

A simple ps will show you all the shells that are in a jail.

Tue 19 7:19PM priyanka.setecastronomy ~> ps -x

PID TT STAT TIME COMMAND

30308 - S 0:00.05 sshd: oracle@pts/0 (sshd)

Now you have the tty he/she is on (pts/0). There are many ways to get that including ps so use whatever method you prefer to get the tty.

Fire up watch to snoop on the tty.

Tue 19 7:48PM priyanka.setecastronomy ~> doas watch pts/0

And boom, you can watch the ankle biter do his/her thing.

You can do this on the host as described, because that is how pam_jail works. But if you prefer for some reason to make an actual jail with VNET etc and do this simply forward ssh on the host to the jail's IP. If you do rate limiting you will already be configuring pf or ipfw anyway so an extra line to forward 22 to the jail host is not big deal.

Yeah this is a crappy write-up but it's spur of the moment and in a HN reply post so it's worth the price paid.

I'm happy to answer questions or help you if you get stuck anyway I can just message me. It's pretty simple to do.

If this is in a corporate setting I would consult with legal before doing this. The world is a whacky place these days, and if the ankle biter does something evil from your honeypot jail you may be liable.

You know what would be cool? Piping these sessions to a web frontend and letting people watch these attempts in real time (or recorded) using a JS terminal emulator to display it all.

I would sit there and watch that.

That would be pretty cool!

Neat! I'd love to help!

I would pipe it to an LCD in an old fish tank.

Oh, look honey, this one's trying to use GNU options! Here's one who thinks he's on Ubuntu! Wow, I didn't know VIM could do _that_!

Take a look at http://honeycast.io/#!/0f9465db-3c01-49ba-9d81-16b1fd68627c. We are working on a new version of our honeypot software. The feature you mention will be supported.

Wow, everything I think of already exists. Nice.

This is great and should be something everyone should know how to do. Please write a more formal write-up

Miss World 2000 has "Too many secrets"...

Love those references. If you have not seen it yet go watch Sneakers (1992). I am getting old - I remember when it was fresh :-)

What have you seen them do?

Attempt to log in it would seem...

Might have changed by now, but what they used to do was usually:

* Download a large file (e.g. XP SP3) from Microsofts servers to test bandwidth * Download IP scanners and trying to run them (in order to find new hosts to attack) * Download botnet code that connects to some C2 server

Tools they download were often downloaded as source, which they then tried to compile in order to run it.

Searching for e.g. 'youtube kippo' will get you videos of honeypot sessions.

You should still be rather careful with this, as they have access to the same kernel as the host, and could potentially jailbreak through kernel vulnerabilities.

I have enough confidence in FreeBSD jails to not worry about that. If I found someone who could actually break out of a jail I would at the least buy them dinner anywhere, their choice. You can't modify a running kernel by direct access. And you can't load modules. So it would be a very interesting hack to see.

It's been done before, for example the "BadIRET" vulnerability (CVE-2015-5675) was used to jailbreak FreeBSD on the PS4 a couple of years ago.

Actually it hasn't been done before. That CVE required elevated privelages on the host already. They didn't break out of a jail.

They did break out of a jail, the vulnerability was used to gain arbitrary code execution in kernel mode, which was used to modify the cr_prison structure, thus performing a jailbreak.

Again, they already had elevated or root privs. If you've already got root privs nothing will save you.

They had root inside a jail, which isn't the same as being root outside the jail. To be able to gain arbitrary code execution in kernel mode from a jail is a security vulnerability.

Would love to read more about this setup, if you have it documented anywhere

I too would love to hear more about this, unfortunately this article on FreeBSD Jail Management Tools [1] seemed to be the most relevant thing I could come up with.

[1] https://blather.michaelwlucas.com/archives/2291

Would also love to see a write-up on this.

Reply on news.ycombinator.com