I don't. When I was setting this up I didn't find any guides or blogs about doing this so I thought it was not of interest to anyone. So I just went about implementing it a piece at a time. Installing pam_jail, then getting /etc/pam.d/sshd configured to use it (which is a one-line addition, very easy). Now by default pam_jail simply puts the user into a jail of their home directory. This is where you can go a few routes with this. If simply jailing the user on the host OS to their home directory is all you are interested in doing you can stop there. Configure FreeBSD to not allow users to see other processes, user processes and group processes not owned by them, and they won't know anyone else is on the system.
security.bsd.see_other_gids
security.bsd.see_other_uids
The above are the two sysctl's you want to enable.
A simple ps will show you all the shells that are in a jail.
Tue 19 7:19PM priyanka.setecastronomy ~> ps -x
PID TT STAT TIME COMMAND
30308 - S 0:00.05 sshd: oracle@pts/0 (sshd)
Now you have the tty he/she is on (pts/0). There are many ways to get that including ps so use whatever method you prefer to get the tty.
Fire up watch to snoop on the tty.
Tue 19 7:48PM priyanka.setecastronomy ~> doas watch pts/0
And boom, you can watch the ankle biter do his/her thing.
You can do this on the host as described, because that is how pam_jail works. But if you prefer for some reason to make an actual jail with VNET etc and do this simply forward ssh on the host to the jail's IP. If you do rate limiting you will already be configuring pf or ipfw anyway so an extra line to forward 22 to the jail host is not big deal.
Yeah this is a crappy write-up but it's spur of the moment and in a HN reply post so it's worth the price paid.
I'm happy to answer questions or help you if you get stuck anyway I can just message me. It's pretty simple to do.
If this is in a corporate setting I would consult with legal before doing this. The world is a whacky place these days, and if the ankle biter does something evil from your honeypot jail you may be liable.
security.bsd.see_other_gids
security.bsd.see_other_uids
The above are the two sysctl's you want to enable.
A simple ps will show you all the shells that are in a jail.
Tue 19 7:19PM priyanka.setecastronomy ~> ps -x
PID TT STAT TIME COMMAND
30308 - S 0:00.05 sshd: oracle@pts/0 (sshd)
Now you have the tty he/she is on (pts/0). There are many ways to get that including ps so use whatever method you prefer to get the tty.
Fire up watch to snoop on the tty.
Tue 19 7:48PM priyanka.setecastronomy ~> doas watch pts/0
And boom, you can watch the ankle biter do his/her thing.
You can do this on the host as described, because that is how pam_jail works. But if you prefer for some reason to make an actual jail with VNET etc and do this simply forward ssh on the host to the jail's IP. If you do rate limiting you will already be configuring pf or ipfw anyway so an extra line to forward 22 to the jail host is not big deal.
Yeah this is a crappy write-up but it's spur of the moment and in a HN reply post so it's worth the price paid.
I'm happy to answer questions or help you if you get stuck anyway I can just message me. It's pretty simple to do.
If this is in a corporate setting I would consult with legal before doing this. The world is a whacky place these days, and if the ankle biter does something evil from your honeypot jail you may be liable.