---
# System prepended metadata

title: Honeypots

---

Honeypots
===

## Tasks
- [ ] List all relevant honeypots should be used and focus on 3 of them
- [ ] Automate the deployment
    - [ ] Choose soft (ansible/puppet/salt/whatever)
    - [ ] Choose how to deploy the honeypot (inside docker, jail etc ...)
    - [ ] Choose first provider and deploy the honeypot
    - [ ] Test and validate the deploy
- [ ] Log centralization
- [ ] Make a POC
- [ ] Choose Hosters (should be geographically large and in term of IP ranges large also)


## Links

https://resources.infosecinstitute.com/honeypots-in-the-cloud/#gref
https://threatstream.github.io/mhn/
http://pages.cs.wisc.edu/~sbrown/downloads/honeypots-in-the-cloud-presentation.pdf
https://fr.slideshare.net/andrewwantsyou/the-background-noise-of-the-internet
https://github.com/paralax/awesome-honeypots
https://github.com/dtag-dev-sec/tpotce

# HES

## Draft
### How to 
There is 2 different ways to deploy honeypots :
* deploy them one by one on docker
    * Pros: 
        * lightweight config
    * Cons: 
        * deployment effort
* use honeypot plateform with all honeypots
    * Pros: 
        * easy to deploy
    * Cons:
        * To many tools and plugins already installed that we don't necessary want

Hamza: focus on 3-4 honeypots (SSH, HTTP, FTP or Telnet) and build or use existing docker images instead of using honeypots plateforms which include a lot of useless components like ELK, databases to analyze the data. In our case, we will already have pepito to analyze the data. We can look at which honeypots the plateforms are using to choose the best ones.

### infra as code, which tool ?
* **Ansible**: very popular, simple to use but poor cloud providers integration:
    * AWS/GCP/Azure/Openstack

* **Terraform**: popular, not simple but need some effort to learn how does it work but some of us already have experience with this tool and the benefit is that the cloud providers integration is almost complete, there is lot of providers (all the major cloud actors and lot of cloud providers).
    https://www.terraform.io/docs/providers/type/major-index.html

Hamza: as explained on terraform, is for me the best tool to use to deploy ressources in different cloud providers.

### Honeypots

* cowrie (SSH/Telnet): https://github.com/cowrie/cowrie
* https://github.com/DinoTools/dionaea
* snare + tanner ? (HTTP)
* https://github.com/citronneur/rdpy RDP ?

### Honeypots plateforms
* https://github.com/dtag-dev-sec/tpotce
* https://threatstream.github.io/mhn/



# KKA

## POC

For the POC:

- Being able to deploy automatically different kind of honeypot
- Being able to centralized logs
- Have some stats?
- Being able to cover large number of service/vuln



## Steps

#### Logs collection

- rabbitMQ
- Kafka

#### Log forwarding

- rsyslogd
- syslog-ng
- Logstash

#### Database (message storage)

- cassandra ?
- postgre?
- ES?
- mongodb?


#### Messages/IPs enrichment

When message from honeypot are in DB, enrich them (or enrich them while in kafka/rabbitMQ ?)

Enrichment:
 - ASN
 - country
 - City
 - organization?
 - anonymousProxy ?

This free API ? https://www.arin.net/resources/manage/regrws/methods/

#### Data analysis

Tag/Categorize the data (maybe can be a part of the enrichment)
