Home
»
How To Install Kippo on Ubuntu 24.04

How To Install Kippo on Ubuntu 24.04 or Newer

If you’re looking to set up a honeypot to capture and analyze SSH attacks, Kippo is a great option. This medium-interaction SSH honeypot allows you to log and analyze attacks against your server while providing attackers with a false sense of security. In this blog post, we’ll walk you through the steps to install Kippo on an Ubuntu 24.04 (or newer) system.

Prerequisites

Before we start, make sure you have the following:

A server running Ubuntu 24.04 or newer.
Root or sudo access to install packages and make changes to the system.
Basic knowledge of the command line.

Step 1: Update Your System

First, it’s essential to update your package lists and upgrade any outdated packages. Open your terminal and run the following commands:

sudo apt update
sudo apt upgrade -y

Step 2: Install Required Dependencies

Kippo requires some dependencies to function correctly. Install them using the following command:

sudo apt install git python3 python3-pip python3-twisted python3-dev libssl-dev -y

Step 3: Clone the Kippo Repository

Next, you’ll need to clone the Kippo repository from GitHub. Navigate to your desired installation directory and run:

cd /opt
sudo git clone https://github.com/ikhalyavkin/kippo.git

Step 4: Set Up a Virtual Environment

To keep your dependencies organized, it’s a good idea to use a Python virtual environment. Here’s how to set it up:

cd kippo
sudo python3 -m pip install virtualenv
sudo virtualenv venv
source venv/bin/activate

Step 5: Install Kippo’s Python Dependencies

With the virtual environment activated, install Kippo’s Python dependencies:

pip install -r requirements.txt

Step 6: Configure Kippo

Now, you’ll need to configure Kippo. Start by copying the default configuration file:

cp kippo.cfg.dist kippo.cfg

Edit the kippo.cfg file to suit your needs. You can change the SSH port, the hostname, and other options. Use your favorite text editor:

nano kippo.cfg

Make any necessary changes, then save and exit.

Step 7: Set Up Kippo to Run on Startup

To ensure Kippo runs automatically, you’ll want to create a systemd service file. Create a new service file using:

sudo nano /etc/systemd/system/kippo.service

Add the following content to the file:

[Unit]
Description=Kippo SSH Honeypot
After=network.target

[Service]
User=www-data
Group=www-data
WorkingDirectory=/opt/kippo
ExecStart=/opt/kippo/venv/bin/python /opt/kippo/kippo.py
Restart=always

[Install]
WantedBy=multi-user.target

Step 8: Start and Enable the Kippo Service

Now that the service file is created, you can start and enable it to run at boot:

sudo systemctl start kippo
sudo systemctl enable kippo

Step 9: Check the Status

To verify that Kippo is running correctly, check the status of the service:

sudo systemctl status kippo

You should see an output indicating that the service is active and running.

Step 10: Access Kippo’s Logs

Kippo logs all interactions in the log directory within the Kippo installation folder. You can view the logs to analyze the captured data:

cd /opt/kippo/log
tail -f kippo.log

Conclusion

Congratulations! You’ve successfully installed Kippo on your Ubuntu 24.04 server. With this honeypot, you can now monitor SSH attacks and gather valuable data to strengthen your security measures. Remember to regularly check the logs and stay updated with any developments in the world of cybersecurity.