Example honeypots
In this section, we'll discuss building and deploying various honeypot solutions. We'll cover how to build them, where you might want to place them, and why. We'll focus on the following:
- Basic "TCP port" honeypots, where we alert on attacker port scans and attempted connections to our various services. We'll discuss these both as alerts with no open ports (so the attacker doesn't know they tripped an alarm), and as actual open-port services that will slow your attacker down.
- Pre-built honeypot applications, both open source and commercial.
- The Internet Storm Center's DShield Honeypot, which is both distributed and internet-based.
Let's get to it, starting with a few different approaches to standing up "open port" honeypot hosts.
Basic port alerting honeypots – iptables, netcat, and portspoof
Basic port connection requests are easy to catch in Linux, you don't even need...