DOM and SSH honeypot
DOM is a solution comparable to fail2ban but it uses Suricata SSH log instead of SSH server logs. The goal of DOM is to redirect the attacker based on its SSH client version. This allows to send attacker to a honeypot like pshitt directly after the first attempt. And this can be done for a whole network as Suricata does not need to be on the targeted box.
Using DOM with nftables
I’ve pushed a basic nftables support to DOM. Instead of adding element via ipset it uses a nftables set.
It is simple to use it as you just need to add a -n flag to specify which table the set has been defined in:
./dom -f /usr/local/var/log/suricata/eve.json -n nat -s libssh -vvv -i -m OpenSSH
To activate the network address translation based on the set, you can use something like:
table ip nat {
set libssh {
type ipv4_addr
}
chain prerouting {
type nat hook prerouting priority -150;
ip saddr @libssh ip protocol tcp counter dnat 192.168.1.1:2200
}
}
A complete basic ruleset
Here’s the ruleset running on the box implementing pshitt and DOM:
table inet filter {
chain input {
type filter hook input priority 0;
ct state established,related accept
iif lo accept
ct state new iif != lo tcp dport {ssh, 2200} tcp flags == syn counter log prefix "SSH attempt" group 1 accept
iif br0 ip daddr 224.2.2.4 accept
ip saddr 192.168.0.0/24 tcp dport {9300, 3142} counter accept
ip saddr 192.168.1.0/24 counter accept
counter log prefix "Input Default DROP" group 2 drop
}
}
table ip nat {
set libssh {
type ipv4_addr
}
chain prerouting {
type nat hook prerouting priority -150;
ip saddr @libssh ip protocol tcp counter dnat 192.168.1.1:2200
}
chain postrouting {
type nat hook postrouting priority -150;
ip saddr 192.168.0.0/24 snat 192.168.1.1
}
}
There is a interesting rule in this ruleset. The first is:
ct state new iif != lo tcp dport {ssh, 2200} tcp flags == syn counter log prefix "SSH attempt" group 1 accept
It uses a negative construction to match on the interface iif != lo which means interface is not lo. Note that it also uses an unamed set to define the port list via tcp dport {ssh, 2200}. That way we have one single rule for normal and honeypot ssh. At least, this rule is logging and accepting and the logging is done via nfnetlink_log because of the group parameter. This allows to have ulogd to capture log message triggered by this rule.
