sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

06:34:42 $ ls -la /opt/stable
         total 28
         drwxr-xr-x  5 root root 4096 Aug 20 03:09 .
         drwxr-xr-x 18 root root 4096 Aug 20 03:09 ..
         drwxr-xr-x  2 root root 4096 Aug 20 03:09 bin
         drwxr-xr-x  3 root root 4096 Aug 20 03:09 src
         drwxr-xr-x  2 root root 4096 Aug 20 03:09 logs  (2074ms)
06:34:44 $ cat /etc/passwd | tail -4
         mustang:x:1004:1004::/home/mustang:/bin/bash
         pinto:x:1005:1005::/home/pinto:/bin/bash
         postgres:x:111:114:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
         brumby:x:1000:1000:Brumby Stable Admin,,,:/home/brumby:/bin/bash  (1133ms)
06:34:45 $ crontab -l
         # m h  dom mon dow   command
         17 * * * * /usr/local/bin/muck-out.sh >> /var/log/muck-out.log 2>&1
         */15 * * * * /usr/local/bin/feed-cycle.timer >> /var/log/feed-cycle.log 2>&1
         0 3 * * * /usr/local/bin/gallop-backup.sh >> /var/log/gallop-backup.log 2>&1
         */5 * * * * /usr/local/bin/bridle-sync >> /var/log/bridle-sync.log 2>&1
         30 2 * * 1 /usr/local/bin/canter-deploy.sh stable_prod >> /var/log/canter-deploy.log 2>&1  (1349ms)
06:34:47 $ ps aux | head -7
         USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
         root           1  0.0  1.1  29036 10480 ?        Ss   03:09   0:01 /sbin/init splash
         root         612  0.0  0.4  21980  4032 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-journald
         root         689  0.0  0.3  18840  3120 ?        Ss   03:09   0:00 /usr/lib/systemd/systemd-udevd
         postgres     744  0.0  2.1 221664 20096 ?        Ss   03:09   0:00 /usr/lib/postgresql/15/bin/postgres -D /var/lib/postgresql/15/main -c config_file=/etc/postgresql/15/main/postgresql.conf
         root         801  0.0  0.5  11240  4896 ?        Ss   03:09   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
         root         812  0.0  0.6  14488  5792 ?        Ss   03:09   0:00 node /opt/stable/src/server.js  (2946ms)
06:34:50 $ ls /var/backups
         total 16
         drwxr-xr-x  2 root root 4096 Aug 20 03:12 .
         drwxr-xr-x 14 root root 4096 Aug 20 03:09 ..
         -rw-r--r--  1 root root  842 Aug 19 23:00 bridle-sync.1.log
         -rw-r--r--  1 root root 1248 Aug 20 02:45 canter-deploy.1.log
         -rw-r--r--  1 root root 2048 Aug 20 03:05 gallop-backup.tar.gz  (1125ms)