A honeypot server is a decoy system deployed on a network to attract and detect unauthorized access attempts. These servers mimic vulnerable services, such as outdated SSH, vulnerable MySQL, or exploitable web applications, to lure attackers. By observing interactions with a honeypot, security professionals can gather intelligence on current attack vectors, identify new exploitation methods, and assess the threat landscape. This information can then be used to strengthen the security of critical internal and external-facing systems.

Honeypots can be deployed in two primary strategies:

• External Deployment: Placed on the internet to attract and analyze attacks originating from the wider web. This allows for broad threat research.
• Internal Deployment: Situated within a private network to detect malicious insiders, identify malware that has bypassed perimeter defenses, or catch attackers in the early stages of reconnaissance before they reach critical assets.

Teapot: An All-in-One Honeypot Solution

Teapot is an open-source project available on GitHub that simplifies honeypot deployment. It leverages Docker to host a variety of pre-configured honeypot services, including emulations of vulnerable Cisco ASA, SSH, web applications, and RDP services. Teapot also integrates with network intrusion detection systems like Suricata to capture and analyze network traffic.

Installation and Configuration

The recommended hardware for Teapot includes at least 8GB of RAM and a 128GB SSD. The system can be configured with a DHCP or static IP address. A non-proxied internet connection is required for downloading Docker images during installation.

Installation can be performed using several methods:

• Pre-built ISO: For virtualized environments like VMware vSphere.
• Install Script: Cloning the Teapot repository and running the provided installation script on an Ubuntu system.
• Custom ISO Creation: Building a personalized ISO image.

The installation script automates the setup process, including the configuration of Dockerized honeypots and the necessary logging infrastructure.

Key Installation Steps and Considerations:

1. Cloning the Repository:

   git clone <repository_url>
   cd teapot/installer/
   ./install.sh
   

2. SSH Port Change: The installation process may reconfigure the default SSH port (22) to a non-standard port (e.g., 64295) to accommodate honeypot services like Cowrie, which mimics a vulnerable SSH server on port 22.
3. Honeypot Selection: Teapot offers various deployment profiles, including a "standard" setup and specialized profiles like "industrial" for emulating PLCs or medical devices, depending on the network environment.
4. Logging Infrastructure: Teapot can deploy its own Elasticsearch and Kibana cluster for log aggregation and visualization. Alternatively, it can be configured to forward logs to an existing Elasticsearch cluster.
5. Docker Image Downloads: The installer downloads Docker images for various honeypot sensors such as Honeytrap, Cowrie, and RDpy. Suricata is also utilized for network packet capture and analysis.

Post-Installation Access and Verification

After installation and a system reboot, users can access the honeypot server via SSH on the configured port (e.g., 64295). Network status can be verified using netstat to confirm that honeypot services are listening on their respective ports.

The Teapot web UI is accessible via a web browser at the server's IP address and a specific port (e.g., 64297). This UI provides access to Kibana dashboards for analyzing captured attack data.

Configuration File (teapot.yaml)

The teapot.yaml file, located in /etc/teapot/, allows for customization of the honeypot deployment. Users can:

• Enable/Disable Services: Comment out specific honeypot services (e.g., Cisco ASA) if they are not relevant to the deployment environment.
• Modify Ports and Protocols: Adjust the listening ports and protocols for individual honeypot services.
• Configure Log Forwarding: Set up log forwarding to external systems like Elasticsearch.

Changes to teapot.yaml require restarting the Teapot service using systemctl restart teapot.

Monitoring and Analysis with Kibana

Teapot integrates with Kibana, providing pre-built dashboards for visualizing attack data. These dashboards offer insights into:

• Attacked Services: Identifying which honeypot services are being targeted.
• Attacker IP Addresses: Displaying the source IP addresses of attackers.
• Exploited Vulnerabilities: Highlighting attempts to exploit known CVEs.
• Geographic Location: Visualizing the origin of attacks on a map.
• HTTP Methods and Payloads: Analyzing the types of HTTP requests and commands used by attackers.
• Credentials: Capturing attempted usernames and passwords for services like SSH.

The "Discover" tab in Kibana allows for viewing raw log alerts, including Suricata alerts detailing specific attack payloads and attempted exploits.

Mimicking Legitimate Systems

To enhance effectiveness, honeypots should appear as legitimate systems. This can involve:

• Customizing Hostnames: Changing the default random hostname generated by Teapot to match an organization's naming convention (e.g., prod-5625). This requires modifying the system's hostname configuration and rebooting.
• Presenting Realistic Services: Configuring honeypot services, such as web applications, to appear as authentic as possible to avoid deterring attackers. This may involve creating custom HTML pages for web applications.

Network Scanning and Attacker Perspective

Tools like Nmap can be used to scan the honeypot from an attacker's perspective, revealing the open ports and services that would be visible to malicious actors. A legitimate server typically would not expose as many open ports as a default honeypot configuration. For internal deployments, disabling unnecessary services in teapot.yaml can make the honeypot appear less conspicuous.

Benefits of Honeypot Deployment

• Threat Intelligence: Gathers data on active attack methods and trends.
• Early Detection: Identifies potential breaches or malware activity within the network.
• Attacker Diversion: Wastes attackers' time and resources on decoy systems.
• IP Blacklisting: Enables the identification and blacklisting of malicious IP addresses before they target legitimate servers.
• Insider Threat Detection: Helps uncover malicious activities by internal users.

Future steps in honeypot deployment may include installing agents like WAZUH for log forwarding to an existing Elasticsearch cluster and configuring real-time alerting to notify security teams of interactions with the honeypot.