Telnet

Synopsis

Creates an emulated Telnet server that logs every authentication attempt, including the cleartext password, without exposing a real system. A credential that matches the credentials list opens a fake interactive shell that returns canned responses to a fixed set of commands; nothing is ever executed on the host.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: telnet
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    hostname: <string>
    banner: <string>
    max_auth_tries: <numeric>
    timeout: <numeric>
    credentials:
      - username: <string>
        password: <string>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be telnet
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	Y		Listen port
max_auth_tries	N	3	Failed authentications per connection before disconnect
timeout	N	30	Deadline in seconds for each connection, set once when the client connects. Activity does not extend it, so a session is closed this long after it opened

Appearance

Field	Required	Default	Description
hostname	N	"server"	Host name shown in the login prompt and canned command output
banner	N	"Ubuntu 22.04.4 LTS"	Pre-login issue text

warning

Unlike the SSH honeypot, where banner selects a named distro preset, on Telnet banner is the literal pre-login issue text printed verbatim. Setting banner: ubuntu here prints the literal word "ubuntu" as the banner, not an Ubuntu-styled preset.

Authentication

The credentials property is the list of username/password pairs the honeypot accepts. Every login attempt is logged regardless of the outcome — the list only decides whether the attacker is granted a session afterwards.

Field	Required	Default	Description
credentials	N	-	Accepted username/password pairs. Omit to reject every login.
credentials[].username	Y		Username to accept. An entry with an empty username is discarded.
credentials[].password	N	-	Password to accept. An empty value accepts any password for that username.

Matching rules:

• Omitted or empty list: no login ever succeeds. Attempts are still logged, so the honeypot keeps collecting credentials without ever handing out a session.
• Empty password: any password is accepted for that username — useful for emulating a service that permits anonymous or unauthenticated access.
• Failed attempts are counted per connection, and the client is disconnected once max_auth_tries is reached.

Both fields accept plain text, ${ENV_VAR} environment references, and $secret{...} vault tokens.

warning

Credentials configured here are decoys, not access control. Anything an attacker types is written to the event stream in cleartext, including the password. Never reuse a real credential as a honeypot credential.

Ingest Buffer

Field	Required	Default	Description
max_buffer_size	N	128MB	Ingest buffer admission cap. Also sizes this listener's ingest buffers: 3/8 of this value at start, growing to at most 3x

note

max_buffer_size is the ingest-buffer admission cap, and is distinct from any buffer_size field above, which sizes the network read buffer. Left unset it is 128MB, whose buffers take 48 MiB of heap per listener worker at start and grow to at most 384 MiB as bursts need the room — and with reuse: true a device runs one worker per listener. Size strings are binary, and 32MB and 32MiB are exact synonyms.

See Listener Memory Sizing for the arithmetic, the sizing table, and what happens when the cap is exhausted.

Details

Emulated Shell

The Telnet honeypot is a hand-rolled server, not a wrapper around a real shell. On connection it writes the banner, then loops a <hostname> login: prompt followed by a Password: prompt, up to max_auth_tries times. It sends IAC WILL ECHO before the password prompt and IAC WONT ECHO after, so well-behaved clients suppress local echo of the typed password. Telnet option negotiation is handled inline: every DO/WILL option requested by the client is declined with WONT/DONT, and subnegotiations are drained through to IAC SE, so real clients do not stall waiting on unsupported options.

A failed login prints Login incorrect and the prompt loop restarts; the connection is dropped once max_auth_tries is exhausted. A successful login opens the same canned-command shell as the SSH honeypot, but with an -sh: prompt prefix instead of -bash:. exit, logout, and quit each print logout and close the connection. Nothing is ever executed on the host, and no file system is touched.

Logged Events

Every connection generates one or more of the following event types:

event_type	Emitted when
auth_attempt	A username/password pair is submitted at the login prompt
session_open	A shell session opens after a successful authentication
session_command	A command is entered at the emulated shell prompt
session_close	The session closes

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
username	Username submitted in the attempt
password	Password submitted in the attempt, in cleartext
success	Whether the attempt or session matched an accepted credential
session_id	Identifier of the emulated shell session
command	Command entered at the emulated shell prompt
args	Arguments parsed from the command

Examples

The following are commonly used configuration types.

Basic

Creating a minimal Telnet honeypot on the standard port...

devices: - id: 1 name: basic_telnet type: telnet properties: port: 23

Accepted Credentials

Accepting one fixed credential and any password for a second username...

devices: - id: 2 name: telnet_credentials type: telnet properties: port: 23 credentials: - username: admin password: admin123 - username: root password: ""

With Pre-Processing

Routing captured attempts through a pre-processing pipeline before ingestion...	devices: - id: 3 name: telnet_preprocessed type: telnet pipelines: - decoy-honeypot-enrich properties: port: 23
A failed login is logged with the cleartext credential before pipeline processing...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "auth_attempt", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.4.12:23", "username": "admin", "password": "admin123", "success": false }