jaksi/sshesame
An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity observed · 2026-08-28
Health v2 · maintenance only
23/100
- Activity 0
- Release rhythm 8
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 3592
- days_rel: n/a
- days_push: 681
- n_releases_24m: 0
Adoption not part of the score
1741 stars · 107 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
sshesame is an SSH honeypot written in Go that runs a fake SSH server accepting any connection and logging all activity without executing anything on the host. It is easy to deploy via binaries, Docker, or systemd and requires no configuration by default.
Use cases
- set up an SSH honeypot to log brute-force login attempts
- capture attacker commands and requests on a decoy SSH server
- monitor who is scanning my server's SSH port
- run a fake SSH service in Docker to collect threat intelligence
- log SSH activity without letting anyone actually execute commands
When to choose
- you want a zero-config, single-binary SSH honeypot
- you need to observe SSH attack activity safely without a real shell
- you want Docker or systemd deployment of a decoy service
When to avoid
- you need a high-interaction honeypot with real shells and file systems
- you need real SSH server functionality
- you need analysis dashboards or alerting built in
Facets
cli-tool · maturity active
security logging http-server security self-hosted windows cross-platform cli ssh honeypot fake-server intrusion-logging go command-line linux macos docker
1 source
- readme: https://github.com/jaksi/sshesame · fetched 2026-08-28 · 70c37ceee1ad
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| jaksi/sshesame | main | 23 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem