01 / OBSERVABILITY
Authentication events
Records source address and submitted username. Password values are never stored or printed.
Python · Paramiko · SSH · Security Lab
SSH Deception Lab
A controlled-environment prototype that records SSH authentication metadata and requested commands for security learning and defensive analysis. This page is a project overview, not a live honeypot or telemetry feed.
02 / SAFE HANDLING
Request inspection
Rejects interactive shells and records SSH exec requests without executing the submitted commands.
03 / DEPLOYMENT
Isolated lab
Python prototype with Docker support. Run inside a disposable VM or isolated network, never as a public production service.
SAMPLE EVENT · SYNTHETIC
Illustrative log structure
The following is fictional sample data for demonstrating the type of event metadata. It is not captured traffic.
{
"event": "authentication_attempt",
"source_ip": "192.0.2.24",
"username": "lab-user",
"password": "[not collected]",
"timestamp": "2026-01-15T10:42:00Z",
"environment": "isolated-lab"
}