SnarfCode/docs/opencanary_honeypot.md

OpenCanary Decoy Honeypot Architecture & Configuration

1. Overview

As part of the Snarfnet Network Security Hardening Blueprint (Phase 3), an OpenCanary Honeypot has been deployed to detect lateral movement, unauthorized reconnaissance, and compromised devices inside the Smart Home VLAN (VLAN 50, 14.4.4.0/25).

• Decoy IP: 14.4.4.99 (Subnet: 14.4.4.0/25, Gateway: 14.4.4.1)
• Host Machine: snshpd4lnxswm01 (140.44.4.71)
• Physical Uplink: Direct 802.1Q trunk port with tagged VLAN 50 support.
• Network Mode: Native Docker macvlan attached to subinterface eth0.50.

---

2. Emulated Services & Ports

The honeypot presents realistic service banners designed to trap automated scanners and unauthorized intruders without exposing real systems:

Port	Protocol	Emulated Service	Decoy Profile
21	TCP	FTP	Linux FTP server (FTP server ready)
22	TCP	SSH	Ubuntu OpenSSH banner (SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10)
23	TCP	Telnet	Ubuntu login prompt (Ubuntu 22.04 LTS login: )
80	TCP	HTTP Web	Synology/NAS Web Admin Login skin
1433	TCP	MSSQL	Microsoft SQL Server 2012
3306	TCP	MySQL	MySQL 5.7 database server
3389	TCP	RDP	Windows Remote Desktop Protocol listener
5000	TCP	VNC	Remote framebuffer / VNC listener
8080	TCP	HTTP Proxy	Squid HTTP proxy decoy
9418	TCP	Git	Git daemon repository service

---

3. Real-Time Alerting Pipeline

flowchart LR
    Attacker["Suspicious Host / IoT Device<br>(e.g. 14.4.4.15)"] -->|TCP / Port Probe| Decoy["OpenCanary (14.4.4.99:22/80/445/3389)"]
    Decoy -->|Structured JSON Log| LogFile["/opt/opencanary/logs/opencanary.log"]
    LogFile -->|Real-Time Tail| Watcher["opencanary-watcher.service<br>(Python Daemon)"]
    Watcher -->|HTTP POST (Priority 8)| Gotify["Gotify Server (App 6)<br>(gotify.snarfnet.net)"]
    Gotify -->|Instant Push Notification| Phone["Admin Mobile App"]
    Gotify -->|Discord Webhook Bridge| Discord["Discord #infra-alerts"]

1. Any TCP connection, banner grab, authentication attempt, or probe arriving on 14.4.4.99 generates a structured event in /opt/opencanary/logs/opencanary.log.
2. The opencanary-watcher.service daemon ingests the event in real-time, extracts the attacker's source IP, source port, targeted port, service type, and credentials (if entered).
3. The event is posted to Gotify Application #6 (A9oPeNcAnArYhOnEyPoT) with high priority (8).
4. gotify-discord-bridge formats a rich embed and posts the alert directly into the Discord #infra-alerts channel.

---

4. Systemd Services & Maintenance

• VLAN Subinterface Service: /etc/systemd/system/opencanary-vlan.service (Ensures eth0.50 is brought up on boot).
• Alert Watcher Service: /etc/systemd/system/opencanary-watcher.service (Tails log file and delivers push alerts).
• Docker Container: opencanary (Managed via Docker with restart: unless-stopped on network opencanary_net).