标题: Install and setup cowrie honeypot on Ubuntu [打印本页] 作者: 小秦哥 时间: 2025-3-19 00:36 标题: Install and setup cowrie honeypot on Ubuntu Install and setup cowrie honeypot on Ubuntu
What is Cowrie honeypot?
The Cowrie honeypot is designed to impersonate SSH servers, specifically one with easily cracked credentials. Once an attacker logs in they will be accessing a fake Linux shell where they can execute commands which will look realistic. It will record all the sessions of an attacker. With Cowrie, the attacker will think they have hacked/attacked your server as if it was real. When an attacker tries to log into your server with the right username and password, the system will let them access a fake system in which they are not supposed to be. Honeypot keeps records of the attacker such as the commands he typed or the keys he pressed and all the activities of the attacker. The hosts SSH daemon will run on a highest port which is 22222, Cowrie will run on 2222, and port 22 (default SSH) will be redirected to 2222 using iptables. When the attacker connects to port 22 it will be redirected to our Honeypot on port 2222.
Before install Cowrie
If you have an ubuntu system, you should install the following dependencies before using it。 Pre-installation of python3
sudo apt update && sudo apt install python3
复制代码
Verify installation and check python version:python3 --version ps : python < 3.9 is not supported when it comes to employ Cowrie. pip (Python package management tool)
Tools for installing third-party libraries and virtual environments
The venv module is a virtual environment tool that comes with Python 3.3+ and needs to be installed separately.
sudo apt install python3-venv
复制代码
This is a necessary component for creating a virtual environment
Install Python, pip, and venv all at once:
sudo apt install python3 python3-pip python3-venv
复制代码
SSH Service Core Dependency Packages
sudo apt install openssh-server
复制代码
check ssh service status:sudo systemctl status ssh
manual activation:sudo systemctl start ssh
Setting up boot-up:sudo systemctl enble ssh
edition tool(anything you like)
sudo apt install vim
复制代码
Before installing cowrie and our dependencies, change the default SSH port 22 to port 22222 in sshd_config file so that the attacker thinks that they are in real SSH port and restart SSH to see if it is listening to the newly configured port.
(sshd_config is only visible if openssh-server is installed.)
root@localhost:~# vim /etc/ssh/sshd_config
Replace port 22 with the highest port 22222 and restart ssh
root@localhost:~# systemctl restart ssh
root@localhost:~# systemctl status ssh
复制代码
To confirm if it is listening to the newly configured port run the below command:
The configuration for Cowrie is stored in cowrie.cfg.dist and cowrie.cfg (Located in cowrie/etc). Both files are read on startup, where entries from cowrie.cfg take precedence. The .dist file can be overwritten by upgrades, cowrie.cfg will not be touched. To run with a standard configuration, there is no need to change anything.
