Is there a hook for ssh on linux?

Question

linux

Hello. I recently bought a VPS. Within a couple of days, my VM was blocked 2 times due to "colossal load". Later, having studied the logs on the server, I found out that the VM was hacked via ssh (the passwords were simple). Now I see that every minute several dozen ips are knocking on me via ssh (probably a botnet). There is fake ssh, so that I would specify a simple login and password, and they would connect to me. Of course, not with real ssh, but with fake one, so that you can see what kind of commands they send me.

Answer 1

https://github.com/cowrie/cowrie
https://github.com/desaster/kippo

Answer 2

fail2ban not?

Answer 3

Create a user without rights and with chroot in /tmp with a limit of 1 MB and logging all entered commands.

Answer 4

Endless

The Endlessh project is presented, within which a simple dummy SSH server is prepared, which tries to keep established connections open for as long as possible at the initial stage of connecting to the SSH server. Endlessh can be used to hinder the work of various malicious systems that constantly brute force passwords and scan hosts for certain network services.

Answer 5

Set up key login and disable password authentication.

Answer 6

Trap (tarpit)
https://m.habr.com/ru/company/globalsign/blog/445318/

Answer 7

Use fail2ban to restrict bot activity. A non-standard port also greatly reduces the chance of being targeted.
If you want to play around, try configuring lshell