Skip to content

ssh-auth-logger — SSH

Status: Informative · evaluation proof
UHBS: v4.2.2 · Class: Low-Interaction · Protocol: ssh
Target id: ssh-auth-logger-ssh · Evaluated: 2026-07-29

Run UHQS Grade δ_C Artifacts
Quick 44.38 F 1.0 SCORECARD.txt · report.json
Full 44.38 F 1.0 SCORECARD.txt · report.json

Full run — module breakdown (analyst view)

Module Score Weight Status Notes
Module A: Protocol Fidelity 70.6 0.30 PASSED accepted null ID
Module B: Behavioral Realism 6.2 0.15 PARTIAL No existing session
Module C: Telemetry Quality 25.0 0.25 PARTIAL Error reading SSH protocol banner
Module D: Safety & Containment (C) 96.0 GATE PASSED Authentication failed.
Module E: Scalability & Latency 20.0 0.10 PARTIAL P50=0.0ms P95=0.0ms P99=0.0ms TPS_limit=3000.0ms proto=ssh
Module F: Static Code Audit 70.0 0.20 PASSED POSIX coverage 0% (0/104)
Safety Gate δ_C 1.0 GATE — Containment multiplier

Full scorecard (verbatim)

====================================================================================
                  UNIVERSAL HONEYPOT BENCHMARK SCORECARD v4.2.2
====================================================================================
Target System         : ssh-auth-logger-ssh
System Profile Class  : Low-Interaction
Protocols             : ssh
Evaluation Date       : 2026-07-29
Evaluation Type       : Full-Spectrum (Static Audit + Dynamic Sandbox)
Environment           : Isolated Sandbox
MCP Surface Depth     : unknown
------------------------------------------------------------------------------------
EVALUATION MODULE                     SCORE (0-100)    WEIGHT    STATUS
------------------------------------------------------------------------------------
Module A: Protocol Fidelity         :  70.6/100       0.30     PASSED (accepted null ID)
Module B: Behavioral Realism        :   6.2/100       0.15     PARTIAL (No existing session)
Module C: Telemetry Quality         :  25.0/100       0.25     PARTIAL (Error reading SSH protocol banner)
Module D: Safety & Containment (C)  :  96.0/100       GATE     PASSED (Authentication failed.)
Module E: Scalability & Latency     :  20.0/100       0.10     PARTIAL (P50=0.0ms P95=0.0ms P99=0.0ms TPS_limit=3000.0ms proto=ssh)
Module F: Static Code Audit         :  70.0/100       0.20     PASSED (POSIX coverage 0% (0/104))
------------------------------------------------------------------------------------
SAFETY GATE MULTIPLIER                : δ_C = 1.0 (Containment Score C = 96.0 >= 95)
FINAL COMPOSITE SCORE (UHQS 4.2.2)      : 44.38 / 100
OVERALL EVALUATION GRADE              : GRADE F (Fail)
====================================================================================

CTI & blue-team reading

This page is the protocol-level proof hub for ssh-auth-logger on ssh. Prefer the full run over quick for operational decisions. Numbers without the verbatim SCORECARD (or report.json) are not trustworthy citations.

Module interpretation (this protocol)

Module Score Analyst reading
A — Protocol Fidelity 70.6 Protocol speak / banner-handshake quality for keeping automated clients engaged.
B — Behavioral Realism 6.2 Post-connect realism (auth/session). Low often means credential-only or reject-by-design. CTI: treat primarily as auth/connection intelligence.
C — Telemetry Quality 25.0 How much useful telemetry the graded lab exposed to UHBS — not your SIEM maturity. Blue team: plan explicit log shipping; do not assume UHBS C equals production visibility.
D — Safety & Containment (C) 96.0 Containment/Safety Gate. Below threshold collapses UHQS via δ_C. Safety Gate passed in this lab configuration.
E — Scalability & Latency 20.0 Latency vs profile P95. Low can mean timeouts, tarpits, or slow handlers.
F — Static Code Audit 70.0 Static audit of the lab source tree — hygiene signal, not a full CVE program.
δ_C 1.0 Safety Gate multiplier applied to composite UHQS.
  • CTI: use Module A/B to judge engagement depth (scanner noise vs post-auth TTPs). Low B usually means credential/connection intelligence, not interactive malware staging.
  • Blue team: verify Safety Gate (Module D / δ_C) before Internet exposure; wire SIEM shipping yourself — Module C is harness visibility, not your pipeline.
  • Replication: commands live in the product tutorial; environment limits in the methodology.

Guides

Named products appear only under conformance as evaluation proof — not UHBS requirements or endorsements.