feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/refine_canary_watcher.py

@@ -0,0 +1,36 @@
+import paramiko
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
+
+py_patch = """
+path = '/opt/opencanary/alert_watcher.py'
+with open(path, 'r') as f:
+    text = f.read()
+
+target = 'def send_alert(event):'
+replacement = '''def send_alert(event):
+    src_host = event.get("src_host", "")
+    src_port = event.get("src_port", -1)
+    # Ignore empty or internal startup events
+    if not src_host or src_port == -1:
+        return'''
+
+if target in text and 'if not src_host or src_port == -1:' not in text:
+    text = text.replace(target, replacement)
+    with open(path, 'w') as f:
+        f.write(text)
+    print("Patched alert_watcher.py with filter")
+else:
+    print("Filter already present or target not found")
+"""
+c.exec_command(f'python3 -c "{py_patch}"')
+c.exec_command("systemctl restart opencanary-watcher.service")
+print("Restarted watcher service")
+
+c.close()