60 lines
3.1 KiB
Markdown
60 lines
3.1 KiB
Markdown
# OpenCanary Decoy Honeypot Architecture & Configuration
|
|
|
|
## 1. Overview
|
|
As part of the **Snarfnet Network Security Hardening Blueprint (Phase 3)**, an **OpenCanary Honeypot** has been deployed to detect lateral movement, unauthorized reconnaissance, and compromised devices inside the **Smart Home VLAN (VLAN 50, `14.4.4.0/25`)**.
|
|
|
|
* **Decoy IP:** `14.4.4.99` (Subnet: `14.4.4.0/25`, Gateway: `14.4.4.1`)
|
|
* **Host Machine:** `snshpd4lnxswm01` (`140.44.4.71`)
|
|
* **Physical Uplink:** Direct 802.1Q trunk port with tagged VLAN 50 support.
|
|
* **Network Mode:** Native Docker `macvlan` attached to subinterface `eth0.50`.
|
|
|
|
---
|
|
|
|
## 2. Emulated Services & Ports
|
|
|
|
The honeypot presents realistic service banners designed to trap automated scanners and unauthorized intruders without exposing real systems:
|
|
|
|
| Port | Protocol | Emulated Service | Decoy Profile |
|
|
|:---:|:---:|:---|:---|
|
|
| **21** | TCP | **FTP** | Linux FTP server (`FTP server ready`) |
|
|
| **22** | TCP | **SSH** | Ubuntu OpenSSH banner (`SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10`) |
|
|
| **23** | TCP | **Telnet** | Ubuntu login prompt (`Ubuntu 22.04 LTS login: `) |
|
|
| **80** | TCP | **HTTP Web** | Synology/NAS Web Admin Login skin |
|
|
| **1433** | TCP | **MSSQL** | Microsoft SQL Server 2012 |
|
|
| **3306** | TCP | **MySQL** | MySQL 5.7 database server |
|
|
| **3389** | TCP | **RDP** | Windows Remote Desktop Protocol listener |
|
|
| **5000** | TCP | **VNC** | Remote framebuffer / VNC listener |
|
|
| **8080** | TCP | **HTTP Proxy** | Squid HTTP proxy decoy |
|
|
| **9418** | TCP | **Git** | Git daemon repository service |
|
|
|
|
---
|
|
|
|
## 3. Real-Time Alerting Pipeline
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
Attacker["Suspicious Host / IoT Device<br>(e.g. 14.4.4.15)"] -->|TCP / Port Probe| Decoy["OpenCanary (14.4.4.99:22/80/445/3389)"]
|
|
Decoy -->|Structured JSON Log| LogFile["/opt/opencanary/logs/opencanary.log"]
|
|
LogFile -->|Real-Time Tail| Watcher["opencanary-watcher.service<br>(Python Daemon)"]
|
|
Watcher -->|HTTP POST (Priority 8)| Gotify["Gotify Server (App 6)<br>(gotify.snarfnet.net)"]
|
|
Gotify -->|Instant Push Notification| Phone["Admin Mobile App"]
|
|
Gotify -->|Discord Webhook Bridge| Discord["Discord #infra-alerts"]
|
|
```
|
|
|
|
1. Any TCP connection, banner grab, authentication attempt, or probe arriving on `14.4.4.99` generates a structured event in `/opt/opencanary/logs/opencanary.log`.
|
|
2. The `opencanary-watcher.service` daemon ingests the event in real-time, extracts the attacker's source IP, source port, targeted port, service type, and credentials (if entered).
|
|
3. The event is posted to **Gotify Application #6** (`A9oPeNcAnArYhOnEyPoT`) with high priority (`8`).
|
|
4. `gotify-discord-bridge` formats a rich embed and posts the alert directly into the Discord `#infra-alerts` channel.
|
|
|
|
---
|
|
|
|
## 4. Systemd Services & Maintenance
|
|
|
|
* **VLAN Subinterface Service:**
|
|
`/etc/systemd/system/opencanary-vlan.service` (Ensures `eth0.50` is brought up on boot).
|
|
* **Alert Watcher Service:**
|
|
`/etc/systemd/system/opencanary-watcher.service` (Tails log file and delivers push alerts).
|
|
* **Docker Container:**
|
|
`opencanary` (Managed via Docker with `restart: unless-stopped` on network `opencanary_net`).
|
|
|