lnxgeek<p>Found this very interesting "ssh/su" trap script from @freebsdfrau (<a href="https://x.com/freebsdfrau/status/1783929733471965257" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">x.com/freebsdfrau/status/17839</span><span class="invisible">29733471965257</span></a>)</p><p>You can find my modified version of it here: <a href="https://lnxgeek.org/doku.php/howtos:ssh-su_trap" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">lnxgeek.org/doku.php/howtos:ss</span><span class="invisible">h-su_trap</span></a></p><p>It is a simple and brilliant idea. It is not perfect but if you don't have root on a server this will be a perfect middleground.</p><p><a href="https://soc42.com/tags/honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>honeypot</span></a> <a href="https://soc42.com/tags/sutrap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sutrap</span></a> <a href="https://soc42.com/tags/sshtrap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sshtrap</span></a></p>