iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Kippo can still be deployed on an Ubuntu VPS, but it is legacy software rather than a current, supported honeypot. The upstream project expects Python 2-era dependencies, including Twisted 8.0–15.1.0, PyCrypto and Zope Interface, while the optional kippo-extra package does not support Python 3.x. Use a disposable VPS, keep your real SSH service separate, and verify that the required packages exist in the exact Ubuntu image you choose before exposing Kippo to the Internet.
What Kippo does and why its age matters
Kippo is a medium-interaction SSH honeypot. Its purpose is to accept connections that look like an SSH server, record password-guessing activity and capture the commands an intruder types after login. The upstream README describes a fake Debian-like filesystem, configurable fake file contents, replayable UML-compatible session logs, SSH command trickery and capture of files downloaded with wget.
That behavior makes Kippo useful for learning how automated attacks behave and for collecting indicators such as usernames, commands and downloaded payloads. It is not a hardened replacement for an SSH server, an intrusion-prevention system or a production monitoring platform. The software is no longer maintained; a DigitalOcean installation tutorial identifies Cowrie as its successor. Treat any Kippo deployment as a controlled, disposable experiment.
The compatibility warning is substantial. The upstream README lists Python 2.5 or later, Twisted from 8.0 through 15.1.0, PyCrypto and Zope Interface. The optional kippo-extra package requires Python 2.7 or later and explicitly does not support Python 3.x. Modern Ubuntu releases generally center on Python 3, so an installation that worked on an older image may fail before the honeypot starts.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Plan the VPS before installing anything
Use a separate, disposable machine
Provision a small Ubuntu VPS that contains no production data. Do not install Kippo beside private repositories, cloud credentials, customer data or administrative jump-host functions. A honeypot is intentionally exposed and will receive hostile input; compromise of the VPS must not provide a path into anything valuable.
- Use a dedicated provider account or project where possible.
- Keep provider-level console or out-of-band recovery access available.
- Apply the provider firewall only to the ports you intend to observe and administer.
- Use a dedicated, non-root service account for Kippo.
- Never place real passwords, SSH private keys, API tokens or cloud credentials in the fake filesystem.
Decide how SSH ports will work
Kippo’s upstream default listener is TCP port 2222. Your real SSH daemon must remain reachable through a separately tested administrative path. The safest arrangement is to leave the real daemon on an unused high port and let Kippo listen on its default port, or to forward public port 22 to Kippo while keeping the real daemon on the administrative port.
Binding Kippo directly to port 22 normally requires root privileges, which conflicts with the least-privilege design. The upstream README warns about that requirement. A historical Ubuntu tutorial discusses authbind as an alternative for allowing a non-root process to bind a privileged port, but the package and configuration must match the Ubuntu release you select.
Verify the operating-system choice
Before creating accounts or changing firewall rules, check the Ubuntu release and architecture, then confirm that the legacy Python, Twisted, PyCrypto and Zope Interface packages needed by your selected Kippo source revision are available. Package names and repository contents differ by release. Do not paste an installation command written for an obsolete Ubuntu version into a current image without checking every package and service name.
Understand the installation components
| Component | Requirement or role | Qualification |
|---|---|---|
| Python | Python 2.5 or later | Upstream Kippo requirement; kippo-extra requires Python 2.7 or later and does not support Python 3.x. |
| Twisted | 8.0 through 15.1.0 | Upstream dependency range; newer distributions may not provide a compatible build. |
| PyCrypto | Required cryptographic library | Listed by the upstream README; it is a legacy dependency. |
| Zope Interface | Required Python package | Listed by the upstream README. |
| OpenSSL and PyASN1 packages | May be needed by the Ubuntu image | Package requirements vary with the selected release and source revision. |
| Dedicated service account | Runs Kippo without root privileges | The historical Ubuntu procedure uses an account named kippo; you may choose another dedicated name. |
These versions describe what the old software expects, not a guarantee that a particular Ubuntu repository still carries them. If the dependency set cannot be installed cleanly, stop and choose a compatible legacy image or a maintained successor rather than weakening the VPS security model.
Install Kippo step by step
1. Create and harden the administrative path
Log in through the provider console or your initial administrative SSH account. Create a separate account for operating the VPS, install only the keys you actually need, and confirm that you can reconnect after every SSH configuration change. Keep a second session or console open while testing; closing your only working session before a port change is a common way to lock yourself out.
Choose the administrative SSH port before starting Kippo. If the real daemon will move, edit the Ubuntu SSH daemon configuration using the release’s documented service name, reload it, and verify a new connection from another terminal before terminating the original session. Update the provider firewall and any host firewall at the same time.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
2. Create the dedicated Kippo account
Create a non-root account solely for the honeypot and place the source tree in that account’s home or another directory it owns. Do not grant it access to administrator home directories, private keys, backup locations or shared application directories. The account should be able to write Kippo’s logs and download directory, but nothing else it does not require.
3. Install the legacy runtime and libraries
Install the Python 2-era interpreter and the exact Twisted, PyCrypto and Zope Interface versions accepted by your Kippo source revision. Add OpenSSL or PyASN1 packages only when the chosen Ubuntu image or revision requires them. Because package names differ by Ubuntu release, use that release’s package index and verify the interpreter and library versions after installation.
Do not substitute Python 3 merely because it is the system default. The kippo-extra documentation states that Python 3.x is unsupported, and an apparently successful checkout can still fail at import time or during protocol negotiation when run under the wrong interpreter.
Recommended Free Tools
4. Obtain the source and create the configuration
Place the Kippo source under the dedicated account, enter the project directory and copy the distributed configuration before editing it:
cp kippo.cfg.dist kippo.cfgThe upstream project expects you to edit kippo.cfg before startup. Set the listener address and port, the hostname presented by the fake system, the credentials that attackers may try, logging destinations and fake-filesystem behavior. Use fictional credentials only. A password that exists anywhere else in your environment should never appear in this file.
5. Configure the listener without sacrificing administration
For an initial test, keep Kippo on its default port 2222 and restrict access with the provider firewall or a temporary source-address rule. Once the service works locally, decide whether to expose 2222 publicly or forward public port 22 to it. A forwarding design lets Kippo receive normal SSH scans while the real daemon remains on its separate administrative port.
Directly assigning port 22 to Kippo is the least attractive option because a privileged bind normally requires root. If you evaluate the historical authbind method, test it on a non-public interface first and confirm that the Kippo process, not the entire account, receives only the permission it needs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
6. Set a believable but harmless fake environment
Choose a hostname and fake files that do not reveal real infrastructure. Kippo can present a Debian-like filesystem and configurable file contents, so remove anything that resembles an actual key, token, customer record or internal hostname. The purpose is to observe behavior, not to give an attacker usable information.
Keep the fake environment small enough to understand. Every file you add becomes something an attacker may parse, copy or use as a prompt for further commands. Record the intentional contents separately so that later analysis can distinguish your bait from files an attacker created.
7. Start in the foreground first
Run Kippo in the foreground while solving dependency, permission and port problems:
twistd -y kippo.tac -nThe -n option keeps the process attached to the terminal, allowing import errors, bind failures and configuration mistakes to appear immediately. Stop the process with the normal interrupt mechanism after testing. Once the foreground run is clean, use the project’s background launcher:
./start.shRun the launcher as the dedicated account, not as root. If the script cannot find the expected interpreter or Twisted entry point, return to the dependency check instead of copying a system-wide Python installation into the project.
8. Confirm the service from another machine
Test from a machine other than the VPS. Confirm that the selected port accepts an SSH connection, that the fake hostname and login behavior match your configuration, and that a harmless command creates the expected log entry. Then test the public path after firewall or forwarding changes. A local connection alone does not prove that provider rules, network address translation and host firewall rules are correct.
9. Record the exact deployment
Write down the Ubuntu release, Kippo source revision, Python interpreter, dependency versions, listener design, firewall rules and account name. Legacy software is difficult to reproduce from memory. Keep this record outside the honeypot account and do not include passwords or private keys.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Move SSH safely so Kippo can listen publicly
Option A: expose Kippo on port 2222
This is the simplest first deployment. Leave the real SSH daemon on its administrative port and allow TCP 2222 through the provider firewall only after Kippo is verified. Scanners that target port 22 will not see the honeypot, but the arrangement minimizes the chance of losing administrative access.
Option B: forward public port 22 to Kippo
Use a host- or provider-level forwarding rule that sends incoming port-22 traffic to Kippo’s listener while the real SSH daemon stays on the separate administrative port. Test the forwarding rule from an external network, then test the administrative connection again. Ensure return traffic, source logging and firewall state are correct. Document how to disable the rule from the provider console in case Kippo misbehaves.
Option C: bind Kippo directly to port 22
This requires a privileged bind unless a carefully configured mechanism such as the historical authbind approach is available. Running the whole honeypot as root increases the impact of a flaw and should not be the default. Use this only for a controlled experiment after confirming that the Ubuntu release, service account and privilege boundaries behave as intended.
Port-change recovery checklist
- Keep the original SSH session open.
- Open a second session through the new administrative port.
- Verify the provider firewall and host firewall independently.
- Confirm Kippo’s listener with a socket check and an external connection.
- Only then close the original session or remove temporary access rules.
Where Kippo stores evidence
The default project layout separates operational logs, session recordings and downloaded files. Preserve this directory structure when you archive a run:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Path | Contents | Handling advice |
|---|---|---|
log/kippo.log |
Debug and operational output | Check first for startup errors, authentication events and listener problems. |
log/tty/ |
TTY session recordings | These recordings capture the shell interaction and can be replayed with compatible UML tooling. |
dl/ |
Files fetched through wget |
Treat every file as hostile and analyze it on an offline system. |
Restrict read access to these directories and copy evidence out through a controlled administrative channel. Do not execute a downloaded file on the VPS, inspect it with production tools, or upload it to a service that could expose sensitive honeypot data. Preserve timestamps and hashes when moving samples for analysis.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and how to diagnose them
Kippo exits with an import or syntax error
This usually indicates an incompatible Python interpreter or one of the legacy libraries. Confirm that the process is using the intended Python 2 runtime and that Twisted falls within the upstream 8.0–15.1.0 range. Check PyCrypto and Zope Interface imports under that same interpreter. Do not fix the error by mixing packages from unrelated Ubuntu releases.
The process cannot bind the port
Another service may already own the port, or the dedicated account may lack permission for a privileged port. Inspect listeners, stop or relocate the conflicting service only after preserving administration, and use port 2222 or a tested forwarding rule instead of granting root unnecessarily.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Remote connections time out
Check the provider firewall first, then the host firewall, listener address and forwarding rule. A service bound only to loopback will appear healthy locally while remaining unreachable externally. Test from a separate network and compare the observed destination port with the one configured in kippo.cfg.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The service starts but writes no logs
Verify that the Kippo account owns the project’s log directories and that the configured paths are writable. Run twistd -y kippo.tac -n in the foreground to expose path and permission errors, then repeat a harmless external login attempt and inspect log/kippo.log.
Downloaded files are missing
Kippo’s capture behavior applies to files fetched with wget. Confirm that the download directory exists and is writable, then review the session recording to see whether the attacker used another transfer method. Absence of a file in dl/ does not prove that no payload was attempted.
You lost SSH access after a port change
Use the provider’s out-of-band console, restore the last known-good SSH configuration, and reopen only the administrative port. This is why a second session and console access should be available before changing listeners or firewall rules.
Operate the honeypot as an isolation project
- Do not route the VPS into production networks.
- Do not reuse real authentication material in Kippo’s fake accounts or files.
- Limit outbound access where your observation goals permit it, while remembering that downloaded payloads are untrusted.
- Patch the underlying Ubuntu system according to the provider’s supported process, but isolate legacy runtime packages from unrelated services.
- Rotate and export logs before disk usage becomes a service failure.
- Review sessions for exposed internal details and remove any bait that accidentally mirrors real infrastructure.
- Destroy and rebuild the VPS when the experiment ends instead of gradually turning it into a permanent server.
A honeypot produces intelligence only when its evidence is trustworthy. Keep a timeline of configuration changes, note when the public listener was enabled, and distinguish your own test connections from unsolicited activity. Never treat a captured command or file as safe merely because it came through Kippo.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsKippo or a maintained successor?
Kippo is appropriate when you specifically need its historical fake-Debian behavior, existing session corpus or compatibility with an old training exercise. For a new Internet-facing deployment, compare it with a maintained successor such as Cowrie before committing to the legacy dependency stack.
Make that decision using concrete criteria:
- Runtime support: whether the project supports the Python version and Ubuntu release you can securely maintain.
- Maintenance activity: whether fixes and documentation are current enough for an exposed service.
- Protocol emulation: which SSH or related interactions the honeypot can reproduce.
- Logging and export: whether session data, alerts and downloaded files integrate with your analysis workflow.
- Isolation model: how the project limits filesystem, process and network impact.
- Installation documentation: whether there is a tested procedure for the exact operating-system image you intend to use.
The available Kippo documentation establishes its legacy status and dependency range, but it does not provide a current compatibility matrix or a reliable installation-success rate, attack-volume figure or resource benchmark. Evaluate those items on the candidate project and Ubuntu release rather than assuming that an old tutorial remains valid.
Final deployment checklist
- The VPS is disposable and isolated from production.
- Provider console access works.
- The real SSH daemon is reachable on its separate administrative path.
- The dedicated Kippo account has no unnecessary privileges.
- The selected Ubuntu image contains compatible Python 2-era dependencies.
kippo.cfguses fictional credentials and harmless fake content.- Kippo starts successfully in the foreground before background launch.
- The provider firewall, host firewall and forwarding rules expose only intended ports.
- An external test confirms the listener and creates entries in
log/kippo.logandlog/tty/. - The
dl/directory is monitored and downloaded samples are handled offline. - The deployment record contains versions and recovery steps but no secrets.
With those controls in place, Kippo can serve as a contained legacy honeypot for observing SSH abuse. Without them, exposing an obsolete Python application directly to the Internet creates more operational risk than useful telemetry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
