feat(security): deploy OpenCanary honeypot on VLAN 50 with Gotify and Discord alerting

scripts/update_watcher.py

@@ -0,0 +1,128 @@
+import paramiko
+import sys
+
+sys.stdout.reconfigure(encoding='utf-8')
+key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
+
+c = paramiko.SSHClient()
+c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
+
+new_watcher = """#!/usr/bin/env python3
+import json
+import os
+import sys
+import time
+import urllib.request
+import urllib.error
+
+sys.stdout.reconfigure(line_buffering=True)
+
+LOG_FILE = "/opt/opencanary/logs/opencanary.log"
+GOTIFY_URL = "http://127.0.0.1:8090/message?token=A9oPeNcAnArYhOnEyPoT"
+
+LOGTYPE_NAMES = {
+    1000: "Portscan Syn Probe",
+    1001: "Canary System Event",
+    1002: "Portscan Null Scan",
+    1003: "Portscan Xmas Scan",
+    1004: "Portscan Fin Scan",
+    2000: "FTP Connection",
+    2001: "FTP Auth Attempt",
+    3000: "HTTP Connection",
+    3001: "HTTP Web Login Attempt",
+    4000: "SSH Connection",
+    4001: "SSH Auth Attempt",
+    5000: "SMB Session Request",
+    6001: "Telnet Login Attempt",
+    7001: "HTTP Proxy Request",
+    8001: "MySQL Login Attempt",
+    9001: "MSSQL Login Attempt",
+    10001: "VNC Connection",
+    11001: "Git Clone / Pull Attempt",
+    12001: "RDP Connection"
+}
+
+def send_alert(event):
+    logtype = event.get("logtype", 0)
+    # Don't alert on internal canary startup messages
+    if logtype == 1001 and "Canary" in str(event.get("logdata", {})):
+        return
+        
+    service_name = LOGTYPE_NAMES.get(logtype, f"Canary Event {logtype}")
+    src_host = event.get("src_host", "Unknown IP")
+    src_port = event.get("src_port", "Unknown Port")
+    dst_port = event.get("dst_port", "")
+    logdata = event.get("logdata", {})
+    
+    title = f"🚨 [Honeypot Alert] {service_name} from {src_host}"
+    
+    details = []
+    details.append(f"• Attacker IP: {src_host}:{src_port}")
+    if dst_port and dst_port != -1:
+        details.append(f"• Targeted Port: {dst_port}")
+    details.append(f"• Decoy IP: 14.4.4.99 (VLAN 50 Smart Home)")
+    
+    if isinstance(logdata, dict):
+        if "USERNAME" in logdata:
+            details.append(f"• Username attempted: {logdata.get('USERNAME')}")
+        if "PASSWORD" in logdata:
+            details.append(f"• Password attempted: {logdata.get('PASSWORD')}")
+        if "PATH" in logdata:
+            details.append(f"• Path: {logdata.get('PATH')}")
+        if "USERAGENT" in logdata:
+            details.append(f"• User-Agent: {logdata.get('USERAGENT')}")
+    elif logdata:
+        details.append(f"• Payload: {str(logdata)[:200]}")
+        
+    body = "\\n".join(details)
+    
+    payload = {
+        "title": title,
+        "message": body,
+        "priority": 8
+    }
+    
+    try:
+        req = urllib.request.Request(
+            GOTIFY_URL,
+            data=json.dumps(payload).encode('utf-8'),
+            headers={"Content-Type": "application/json"}
+        )
+        with urllib.request.urlopen(req, timeout=5) as r:
+            pass
+        print(f"[Alert Sent] {title}", flush=True)
+    except Exception as e:
+        print(f"[Alert Error] {e}", flush=True)
+
+def main():
+    print("OpenCanary Gotify Watcher started...", flush=True)
+    if not os.path.exists(LOG_FILE):
+        open(LOG_FILE, 'a').close()
+        
+    f = open(LOG_FILE, 'r')
+    f.seek(0, os.SEEK_END)
+    
+    while True:
+        line = f.readline()
+        if line:
+            line = line.strip()
+            if line:
+                try:
+                    event = json.loads(line)
+                    send_alert(event)
+                except Exception as e:
+                    pass
+        else:
+            time.sleep(0.5)
+
+if __name__ == '__main__':
+    main()
+"""
+
+c.exec_command("cat << 'EOF' > /opt/opencanary/alert_watcher.py\n" + new_watcher + "\nEOF\n")
+c.exec_command("systemctl restart opencanary-watcher.service")
+print("Restarted watcher service")
+
+c.close()
+