Harvesting SSH Credentials: Insights from My Honeypot Network
A security researcher deployed a global SSH honeypot network to meticulously log login attempts, revealing a treasure trove of data on common usernames, passwords, and attack origins. This raw, unfiltered look at persistent, unsophisticated brute-force attacks offers sobering insights into the state of internet security. The Hacker News community found the statistics both fascinating and concerning, sparking discussions on credential strength and the motivations behind such widespread automated attacks.
The Lowdown
This article details the insights gained from a newly established SSH honeypot network, which has been collecting data on login attempts for the past month. The project, currently a work in progress, offers an initial look at the scale and nature of automated attacks targeting internet-facing SSH services.
- Scope: The honeypot network comprises 15 dedicated IPv4 servers distributed globally across five VPS providers, all listening on SSH Port 22/TCP.
- Attack Volume: Over a 30-day period (July 2026), the network recorded more than 1.5 million login attempts from nearly 6,800 unique IP addresses.
- Geographical Distribution: Asia accounts for the most unique attacking IPs, but Europe (specifically the Netherlands) leads significantly in total login attempts, often with a much higher attempts-per-IP ratio.
- Top Credentials: The data highlights an alarming prevalence of extremely weak and common credentials, with "root" as the top username, frequently paired with passwords like "123456", "root", or "password".
- Technical Setup: The honeypots run on Ubuntu Server using Ansible for automation, Wireguard for secure management, and a custom Python/Paramiko-based SSH honeypot in a rootless Podman container. IP geolocation data is sourced from ipgeolocation.io.
- Future Plans: The author intends to enhance data presentation, increase automation, expand to other honeypot types (DB, web, FTP), grow the network, implement password hashing, cross-reference with known password lists, and potentially share intelligence with abuse reporting services.
Overall, the project provides concrete statistical evidence of the relentless, low-sophistication brute-force attacks prevalent across the internet, underscoring the critical need for strong, unique credentials and robust security practices.
The Gossip
Credential Catastrophe & Common Combinations
Commenters were both amused and dismayed by the prevalence of extremely weak credentials like "root" and simple number sequences (e.g., "123456"). Discussions revolved around specific examples like "toor" (root spelled backward), with some recalling its historical use as a default password in systems like Kali Linux or Slackware. The author even chimed in, noting the relatively low ranking of a simple password like '12' compared to other trivial choices.
Worthless or Wealthy Credentials?
A point of debate emerged regarding the term "harvesting SSH credentials." One commenter argued that since the honeypot captures *failed* login attempts using common, easily guessed passwords, the data primarily serves for statistical analysis rather than providing genuinely 'valuable' or 'harvested' credentials in the sense of compromised secrets. This highlights a distinction between collecting aggregate attack patterns and acquiring usable login pairs.
Securing Special-Purpose SSH Accounts
The presence of "git" in the top usernames sparked a conversation about securing non-standard SSH accounts. Commenters questioned whether typical installations permit direct login for a `git` user and discussed best practices. It was noted that robust security often involves using mechanisms like `ForceCommand` in `sshd_config` to restrict such accounts to specific actions (e.g., only running the git server), mitigating risks associated with misconfigurations that could allow broader access.