# OpenCanary Decoy Honeypot Architecture & Configuration

## 1. Overview
As part of the **Snarfnet Network Security Hardening Blueprint (Phase 3)**, an **OpenCanary Honeypot** has been deployed to detect lateral movement, unauthorized reconnaissance, and compromised devices inside the **Smart Home VLAN (VLAN 50, `14.4.4.0/25`)**.

* **Decoy IP:** `14.4.4.99` (Subnet: `14.4.4.0/25`, Gateway: `14.4.4.1`)
* **Host Machine:** `snshpd4lnxswm01` (`140.44.4.71`)
* **Physical Uplink:** Direct 802.1Q trunk port with tagged VLAN 50 support.
* **Network Mode:** Native Docker `macvlan` attached to subinterface `eth0.50`.

---

## 2. Emulated Services & Ports

The honeypot presents realistic service banners designed to trap automated scanners and unauthorized intruders without exposing real systems:

| Port | Protocol | Emulated Service | Decoy Profile |
|:---:|:---:|:---|:---|
| **21** | TCP | **FTP** | Linux FTP server (`FTP server ready`) |
| **22** | TCP | **SSH** | Ubuntu OpenSSH banner (`SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10`) |
| **23** | TCP | **Telnet** | Ubuntu login prompt (`Ubuntu 22.04 LTS login: `) |
| **80** | TCP | **HTTP Web** | Synology/NAS Web Admin Login skin |
| **1433** | TCP | **MSSQL** | Microsoft SQL Server 2012 |
| **3306** | TCP | **MySQL** | MySQL 5.7 database server |
| **3389** | TCP | **RDP** | Windows Remote Desktop Protocol listener |
| **5000** | TCP | **VNC** | Remote framebuffer / VNC listener |
| **8080** | TCP | **HTTP Proxy** | Squid HTTP proxy decoy |
| **9418** | TCP | **Git** | Git daemon repository service |

---

## 3. Real-Time Alerting Pipeline

```mermaid
flowchart LR
    Attacker["Suspicious Host / IoT Device<br>(e.g. 14.4.4.15)"] -->|TCP / Port Probe| Decoy["OpenCanary (14.4.4.99:22/80/445/3389)"]
    Decoy -->|Structured JSON Log| LogFile["/opt/opencanary/logs/opencanary.log"]
    LogFile -->|Real-Time Tail| Watcher["opencanary-watcher.service<br>(Python Daemon)"]
    Watcher -->|HTTP POST (Priority 8)| Gotify["Gotify Server (App 6)<br>(gotify.snarfnet.net)"]
    Gotify -->|Instant Push Notification| Phone["Admin Mobile App"]
    Gotify -->|Discord Webhook Bridge| Discord["Discord #infra-alerts"]
```

1. Any TCP connection, banner grab, authentication attempt, or probe arriving on `14.4.4.99` generates a structured event in `/opt/opencanary/logs/opencanary.log`.
2. The `opencanary-watcher.service` daemon ingests the event in real-time, extracts the attacker's source IP, source port, targeted port, service type, and credentials (if entered).
3. The event is posted to **Gotify Application #6** (`A9oPeNcAnArYhOnEyPoT`) with high priority (`8`).
4. `gotify-discord-bridge` formats a rich embed and posts the alert directly into the Discord `#infra-alerts` channel.

---

## 4. Systemd Services & Maintenance

* **VLAN Subinterface Service:**
  `/etc/systemd/system/opencanary-vlan.service` (Ensures `eth0.50` is brought up on boot).
* **Alert Watcher Service:**
  `/etc/systemd/system/opencanary-watcher.service` (Tails log file and delivers push alerts).
* **Docker Container:**
  `opencanary` (Managed via Docker with `restart: unless-stopped` on network `opencanary_net`).