Re: honeypots Digest 5 Jul 2006 18:33:45 -0000 Issue 691

Hi.

On 06.07.2006 10:49, George wrote:
> How you will intercept the crypted traffic from ssh? Is sebek so
> powerful to decrypt ssh? There is a honeypot that act as a ssh server
> but also write somewhere decrypted? You will make a forensics analyse?

I've been pondering on a tool that would decrypt ssh for some time now
(ethereal plugin maybe?), but since there hasn't been a real need, it's
not a priority. Of course, it would need the private keys to work (which
is not a problem for a honeypot).

Anyone knows of such a tool in existance already?

-- 
Siim Põder
"What the hell", he thought, "you're only young once", and threw himself 
out of the window. That would at least keep the element of surprise on 
his side.
	-- Douglas Adams