Heralding (johnnykv)¶
Status: Informative · evaluation proof
Upstream: https://github.com/johnnykv/heralding · GitHub last push 2024-02-28
Runtime: heralding:uhbs-lab with lab configs enabling SSH + FTP (shared container) and SMTP (dedicated container)
Credential-harvesting multi-protocol honeypot; SSH, FTP, and SMTP graded in this round.
What this decoy is¶
Multi-protocol credential-harvesting honeypot; UHBS proofs cover SSH, FTP, and SMTP listeners documented below.
Protocol survey¶
| Surface | UHBS plugin? | Graded? | Quick | Full |
|---|---|---|---|---|
| SSH | yes | yes | 44.38 / F | 44.18 / F |
| FTP | yes | yes | 35.96 / F | 35.85 / F |
| SMTP | yes | yes | 45.07 / F | 45.07 / F |
Named product is evaluation proof only — not a UHBS endorsement.
For CTI analysts¶
- Designed to capture credentials across protocols — UHBS shows strong protocol speak (A) but weak post-auth behavior (B) because auth is rejected by design.
- Interpret low B/C as “credential sink,” not failure to attract scanners.
Primary signals you can expect (when logging is wired): Rejected auth attempts with captured credentials on SSH/FTP (per Heralding logging).
For blue teams / detection engineering¶
- Excellent mental model for auth-only sensors: alert on username/password pairs, never on “missing shell”.
- Protect credential logs as highly sensitive; hash or encrypt at rest per policy.
- Only SSH+FTP share one container; SMTP uses
heralding-smtp-lab.ymlon port 17025 — other Heralding protocols were not tested here.
Trust & limitations¶
- This page is evaluation proof under UHBS 4.2.2 — not a certification or vendor ranking.
- Prefer full/ artifacts over quick/ for operational decisions.
- Re-run via TUTORIAL.md; environment notes in METHODOLOGY.md.
- How to read modules: READING-UHQS.md