# jaksi/sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

Repository: https://github.com/jaksi/sshesame
Canonical: https://ross.abutalabs.com/products/sshesame
Language: Go
License: Apache-2.0
License Family: permissive
Topics: ssh, honeypot, go, golang, security
Last push: 2024-10-21T23:23:25+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3592, "days_push": 681, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1741, forks 107 (observed 2026-08-28T04:05:30.274289+00:00)

## What it is
sshesame is an SSH honeypot written in Go that runs a fake SSH server accepting any connection and logging all activity without executing anything on the host. It is easy to deploy via binaries, Docker, or systemd and requires no configuration by default.

## Use cases
- set up an SSH honeypot to log brute-force login attempts
- capture attacker commands and requests on a decoy SSH server
- monitor who is scanning my server's SSH port
- run a fake SSH service in Docker to collect threat intelligence
- log SSH activity without letting anyone actually execute commands

## When to choose
- you want a zero-config, single-binary SSH honeypot
- you need to observe SSH attack activity safely without a real shell
- you want Docker or systemd deployment of a decoy service

## When to avoid
- you need a high-interaction honeypot with real shells and file systems
- you need real SSH server functionality
- you need analysis dashboards or alerting built in

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, logging, http-server
- domain: security, self-hosted
- platform: windows, cross-platform, cli
- tags: ssh, honeypot, fake-server, intrusion-logging, go, command-line, linux, macos, docker

## Member repositories
- jaksi/sshesame (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:30.274289+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:30:02.810907+00:00, confidence not recorded.
  - readme: https://github.com/jaksi/sshesame (fetched 2026-08-28T04:05:30.274289+00:00, sha 70c37ceee1ad)
- Data as of 2026-08-30T08:39:29.467469+00:00.