Re: honeypots Digest 5 Jul 2006 18:33:45 -0000 Issue 691

[Siim Põder <siim.poder_1398 () eesti ee>]

Hi.

On 06.07.2006 10:49, George wrote:
> How you will intercept  the crypted traffic from ssh? Is sebek so
> powerful to decrypt ssh? There is a honeypot that act as a ssh server
> but also write somewhere decrypted? You will make a forensics analyse?

I've been pondering on a tool that would decrypt ssh for some time now 
(ethereal plugin maybe?), but since there hasn't been a real need, it's 
not a priority. Of course, it would need the private keys to work (which 
is not a problem for a honeypot).

Anyone knows of such a tool in existance already?

--
Siim Põder

"What the hell", he thought, "you're only young once", and threw himself 
out of the window. That would at least keep the element of surprise on 
his side.
        -- Douglas Adams