[haccur]

Very nice guide but here is my "tips" of this guide:
Don't use Kippo is old and when the attacker try to login it to access to the shell is like 35/40 seconds for access to it so maybe the bruteforce script they using detect the shell as pinged out so you don't can collect anything of the attacker only failed logins use Cowrie instead here's the link
Use the ultimate version of kippo-graph i don't try it with cowrie but i think is working well since cowrie is a fork of kippo
Change the SSH banner to something "new" a box running debian 5.0 on 2016 is suspicious as hell so maybe the attacker skip that boxes since is kippo default banner
Kali Linux is not necessary at all just use raspbian lite of other distro you like