feat(ssh,telnet): add non-root user account for privesc + enum lure
Real Linux deployments (especially Ubuntu cloud images) ship a non-
root admin user; honeypots that only accept root logins are a tell.
Add a second account on both SSH and Telnet decoys, configurable
via service_cfg keys `user` / `user_password`, defaulting to
`ubuntu` / `admin` so the lure is live on every fresh deploy.
* `decnet/services/{ssh,telnet}.py` — two new ServiceConfigFields
(`user` string, `user_password` secret) and matching env vars
(`SSH_USER` / `SSH_USER_PASSWORD`, mirror for telnet) propagated
via the compose fragment.
* `decnet/templates/ssh/entrypoint.sh` — runtime `useradd -m -s
/usr/libexec/login-session -G sudo "$SSH_USER"` so the new user
inherits the same sessrec pty-recording shell as root and lands
in the sudo group. Privesc attempts (`sudo`) flow through the
existing sudo-log capture; network-enum from the user's shell
rides the recorded transcript.
* `decnet/templates/telnet/entrypoint.sh` — same useradd pattern
(no sudo group — busybox+login telnet image has no sudo
package; privesc rides `su -` which itself flows through the
existing PAM auth-helper at /etc/pam.d/login).
* New tests for default + custom user / password + independence
from root password. Updated the schema-keys assertion to match
the four-field shape.
The new account is ALSO the natural home for the body-aware
predicates that were previously gated on root-only sessions —
attackers who land on `ubuntu@host` and run network-recon /
privesc commands now generate the same structured TTP-rule
events as root sessions did, captured via the same auth-helper
+ sessrec + sudo-log pipes.
This commit is contained in:
@@ -17,8 +17,11 @@ class SSHService(BaseService):
|
||||
RFC 5424 via the rsyslog bridge baked into the image.
|
||||
|
||||
service_cfg keys:
|
||||
password Root password (default: "admin")
|
||||
hostname Override container hostname
|
||||
password Root password (default: "admin")
|
||||
user Non-root user name (default: "ubuntu") for
|
||||
realistic "ssh user@host" lures + privesc capture
|
||||
user_password Non-root user's password (default: "admin")
|
||||
hostname Override container hostname
|
||||
"""
|
||||
|
||||
name = "ssh"
|
||||
@@ -34,6 +37,33 @@ class SSHService(BaseService):
|
||||
secret=True,
|
||||
help="Plaintext root password for the in-container sshd.",
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="user",
|
||||
label="Non-root user",
|
||||
type="string",
|
||||
default="ubuntu",
|
||||
help=(
|
||||
"Username for the second account on the decoy. Real Linux "
|
||||
"boxes (especially Ubuntu cloud images) ship a non-root "
|
||||
"admin user — having one makes the decoy more lifelike, "
|
||||
"captures attackers who try `ssh user@host` for network "
|
||||
"enumeration, and surfaces sudo/privesc behaviour the root-"
|
||||
"only path misses."
|
||||
),
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="user_password",
|
||||
label="Non-root user password",
|
||||
type="password",
|
||||
default="admin",
|
||||
secret=True,
|
||||
help=(
|
||||
"Password for the non-root user. Captured at PAM auth time "
|
||||
"via the same auth-helper that handles root logins. The "
|
||||
"user is in the `sudo` group; subsequent privesc attempts "
|
||||
"fan out through the existing sudo-log capture."
|
||||
),
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="hostname",
|
||||
label="Container hostname",
|
||||
@@ -55,6 +85,13 @@ class SSHService(BaseService):
|
||||
cfg = service_cfg or {}
|
||||
env: dict = {
|
||||
"SSH_ROOT_PASSWORD": cfg.get("password", "admin"),
|
||||
# Non-root user account — created at runtime by the entrypoint
|
||||
# iff SSH_USER is non-empty. Defaults to "ubuntu"/"admin" so
|
||||
# `ssh ubuntu@<decky>` works out of the box (the conventional
|
||||
# cloud-init account on Ubuntu cloud images, very low-friction
|
||||
# for attackers running ssh enumeration scripts).
|
||||
"SSH_USER": cfg.get("user", "ubuntu"),
|
||||
"SSH_USER_PASSWORD": cfg.get("user_password", "admin"),
|
||||
# NODE_NAME is the authoritative decky identifier for log
|
||||
# attribution — matches the host path used for the artifacts
|
||||
# bind mount below. The container hostname (optionally overridden
|
||||
|
||||
@@ -16,8 +16,11 @@ class TelnetService(BaseService):
|
||||
are logged as RFC 5424 via the same rsyslog bridge used by the SSH service.
|
||||
|
||||
service_cfg keys:
|
||||
password Root password (default: "admin")
|
||||
hostname Override container hostname
|
||||
password Root password (default: "admin")
|
||||
user Non-root user name (default: "ubuntu") for
|
||||
realistic "telnet user@host" lures + privesc capture
|
||||
user_password Non-root user's password (default: "admin")
|
||||
hostname Override container hostname
|
||||
"""
|
||||
|
||||
name = "telnet"
|
||||
@@ -33,6 +36,33 @@ class TelnetService(BaseService):
|
||||
secret=True,
|
||||
help="Plaintext root password for the in-container telnetd.",
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="user",
|
||||
label="Non-root user",
|
||||
type="string",
|
||||
default="ubuntu",
|
||||
help=(
|
||||
"Username for the second account on the decoy. The telnet "
|
||||
"image is busybox + real /bin/login (PAM-aware), so a "
|
||||
"non-root user widens the attack surface — captures "
|
||||
"enumeration scripts that only try common usernames "
|
||||
"(`telnet ubuntu@host`) and post-login `su -` privesc "
|
||||
"attempts via the existing PAM auth-helper."
|
||||
),
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="user_password",
|
||||
label="Non-root user password",
|
||||
type="password",
|
||||
default="admin",
|
||||
secret=True,
|
||||
help=(
|
||||
"Password for the non-root user. Captured at PAM auth "
|
||||
"time via the same auth-helper that handles root logins. "
|
||||
"Telnet has no sudo (busybox+login image); privesc rides "
|
||||
"`su -` which itself flows through PAM."
|
||||
),
|
||||
),
|
||||
ServiceConfigField(
|
||||
key="hostname",
|
||||
label="Container hostname",
|
||||
@@ -54,6 +84,13 @@ class TelnetService(BaseService):
|
||||
cfg = service_cfg or {}
|
||||
env: dict = {
|
||||
"TELNET_ROOT_PASSWORD": cfg.get("password", "admin"),
|
||||
# Non-root user account — created at runtime by the
|
||||
# entrypoint iff TELNET_USER is non-empty. Defaults to
|
||||
# "ubuntu"/"admin" to mirror the SSH service shape and
|
||||
# match the Ubuntu-flavoured motd already baked into the
|
||||
# telnet image.
|
||||
"TELNET_USER": cfg.get("user", "ubuntu"),
|
||||
"TELNET_USER_PASSWORD": cfg.get("user_password", "admin"),
|
||||
# NODE_NAME is the authoritative decky identifier for log
|
||||
# attribution — matches the host path used for the artifacts
|
||||
# bind mount below.
|
||||
|
||||
Reference in New Issue
Block a user