but before I do, I figured I'd ask if anyone's aware of any tools/software that covers my basic needs of setting something basic that may alert me if there are any intruders in the network?
Needs:
- Fake ssh login that can trigger a script so I can take care of the rest.
- Fake network share (cifs/samba) that can trigger a script if anything tries to access it.
Would be great if there are any docker images I can just pull, make some minor edits, and run.
Thanks!
17 Comments
blarg_dunsen@sh.itjust.works · 31 pts · 2y
People were close, but what you actually want is OpenCanary. It fakes SSH and Samba services and can be configured to alert you when triggered.
notexecutive@sh.itjust.works · 22 pts · 2y
....why would you do this?
KLISHDFSDF@lemmy.ml · 28 pts · 2y
I plan on making it available inside my own network, not public. This way if someone makes it past my security, I at least have something that might "catch" them in the act and disable my network so I can intervene. Just another security layer.
chandz05@lemmy.world · 3 pts · 2y
I have never thought about doing this... But this is actually such a good idea. I'm probably going to set this up myself
lilShalom@lemmy.basedcount.com · 20 pts · 2y
If you place this on the inside of your network and it triggers, youre either compromised or a scanner/ person triggered it.
finestnothing@lemmy.world · 1 pts · 2y
recursive_recursion@programming.dev · 15 pts · 2y
one of the best ways to protect your friends is to leave juicy bait that only zero-sum people would try to steal
plus wasting malicious user's time also provides multiple benefits such as reducing the prevalence of spam and DDoS attacks
FuntyMcCraiger@sh.itjust.works · 9 pts · 2y
Do you not feel the itch of curiosity?
Smk@lemmy.ca · 3 pts · 2y
FOR SCIENCE!1!!
waspentalive@lemmy.one · 7 pts · 2y
I am not affiliated with them, but you can get a trigger file (Canary Token) from the people at Thinkst. I quickly looked around their site, and did not see how, but their adds say you can get them for free, without having to buy their canary hardware device.
Racle@sopuli.xyz · 5 pts · 2y
https://canarytokens.org/generate should work just fine
anzo@programming.dev · 6 pts · 2y
Check this out, is super fun! https://github.com/skeeto/endlessh
lilShalom@lemmy.basedcount.com · 5 pts · 2y
You can also use something called canary tokens. You would put a file on a share that triggers an action to alert you.
electromage@lemm.ee · 4 pts · 2y
I'd like to create a funnypot
Bristlerock@kbin.social · 4 pts · 2y
The Honeynet Project, related to the SANS Institute when I last checked, has a lot of resources on honeypots that are worth a look, if you haven't already.
iMeddles@infosec.pub · 1 pts · 2y
Thinkst have also published opencanary which you can run yourself and contains a decent subset of what their hardware canaries run, including SSH and cifs.
matejc@matejc.com · 1 pts · 2y
I haven't used it, but here is my first web search result: https://github.com/droberson/ssh-honeypot Also: https://github.com/paralax/awesome-honeypots
lilShalom@lemmy.basedcount.com · -1 pts · 2y
Honeypy