A low interaction honeypot (as Kippo) tries to mine a real service. Errors included. Unfortunately this is not always possible, which makes the trap detectable by human and some scan softwares.
Kippo uses Twisted conch, which doesn’t act always like a real OpenSSH server. One of the major issues is related to malformed data at connection that can disclose Kippo easily because Twisted responds to the client with:
[protocolbytes] bad packet length [protocolbytes]
With a real OpenSSH server, the client receives only this message:
Protocol mismatch.
But don’t worry (be happy), you will not be detected again! Apply this patch and the “bad response” will be intercepted and substituted with the right message.It’s just a workaround, but it works!
kippo-r246-bpl.patch
kippo-0.8-bpl.patch
Happy hunting!
