> For the complete documentation index, see [llms.txt](https://kchuene.gitbook.io/data-communication-project/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kchuene.gitbook.io/data-communication-project/archive/quickstart.md).
# Ubuntu Server (HoneyPot) Setup
Setup the HoneyPot server with Cowie.
## VM Specifications
| Category | Specification |
| --------------- | -------------------------------- |
| OS Versions | Ubuntu Server 22.4.5 (LTS) |
| RAM | 1280 MB |
| Storage | 8 GB, Dynamic |
| CPU | 1 |
| Network Adapter | NAT Network, DHCP, `10.0.2.0/24` |
| Honeypot | Cowrie |
| Log Forwarder | Fluent Bit 4.2.3 |
| User | pooh:pooh |
## Firewall Configuration
Add rule for `ssh`, `cowie` and enable firewall.
```
sudo ufw allow ssh
sudo ufw allow 2222/tcp
sudo ufw enable
```
## Cowrie Setup
**Update**
```
sudo apt update
```
**Dependency Installations**
{% code overflow="wrap" %}
```
sudo apt install -y python3 python3-venv python3-dev git libssl-dev libffi-dev build-essential authbind
```
{% endcode %}
**Create Cowrie User**
```
sudo adduser --disabled-password cowrie
```
**Installation**
Clone the github repository from `https://github.com/cowrie/cowrie.git`
```
sudo su - cowrie
git clone https://github.com/cowrie/cowrie.git
cd cowrie
```
Install requisite python modules in virtual environment.
```
python3 -m venv cowrie-env
source cowrie-env/bin/activate
python3 -m pip install -r requirements.txt
```
Install `cowrie` startup script/command
```
python3 -m pip install -e .
```
**Configuration**
Keep default bind port (`2222`) and enable JSON log output
```
# Listen on 2222, will authbind and forward 22 to 2222 to fake SSH
listen_endpoints = tcp:2222:interface:0.0.0.0
# [ssh]
# listen_endpoints = tcp:22:interface=0.0.0.0
# Enable JSON logging
[output_jsonlog]
enabled = true
```
Allow `cowrie` to bind to - privileged - port `22` for fake SSH.
```
deactivate
exit
```
```
sudo touch /etc/authbind/byport/22
sudo chown cowrie:cowrie /etc/authbind/byport/22
sudo chmod 500 /etc/authbind/byport/22
```
{% hint style="info" %}
Having sufficient restrictive permissions, the file `/etc/authbind/byport/22` tells `authbind` to grant permission to the owner of the file (ie. `cowrie`) to bind to the port specified by the file, ie. port `22`.
{% endhint %}
Running `cowrie` with `autbind` enabled
```
AUTHBIND_ENABLED=yes cowrie start
```
OR
```
authbind --deep cowrie start
```
{% hint style="info" %}
If `AUTHBIND_ENABLED=yes` , Cowrie will wrap it's normal start command under `authbind` to make binding to port `22` possible.
{% endhint %}
**Add a cowrie systemd service (admin)**
Disable OpenSSH service to avoid conflicts in binding at startup
```
sudo systemctl disable ssh
```
Create the service configuration `cowrie.service`:
{% code overflow="wrap" %}
```
[Unit]
Description=Cowrie SSH/Telnet Honeypot
After=network.target
[Service]
User=cowrie
Group=cowrie
WorkingDirectory=/home/cowrie/cowrie
Type=forking
ExecStart=/bin/bash -c 'source /home/cowrie/cowrie/cowrie-env/bin/activate && authbind --deep cowrie start'
ExecStop=/bin/bash -c 'source /home/cowrie/cowrie/cowrie-env/bin/activate && cowrie stop && deactivate'
Restart=on-failure
[Install]
WantedBy=multi-user.target
```
{% endcode %}
```
cp cowrie.service /etc/systemd/system/
```
Enable `cowrie` to run at startup
```
sudo systemctl daemon-reload
sudo systemctl enable cowrie
sudo systemctl start cowrie
```
**Setup fake users file**
By default `cowrie` ships with the `cowrie/etc/userdb.example` file containing a configuration of fake user accounts that will be allowed login into the emulated ssh service.
Copy `userdb.example` to `userdb.txt` (or create a new one) within the same `cowrie/etc` folder so that `cowrie` starts validating authentication attempts from that file - edit the allowed credentials as fit.
```
# Example userdb.txt
# This file may be copied to etc/userdb.txt.
# If etc/userdb.txt is not present, built-in defaults will be used.
#
# ':' separated fields, file is processed line for line
# processing will stop on first match
#
# Field #1 contains the username
# Field #2 is currently unused
# Field #3 contains the password
# '*' for any username or password
# '!' at the start of a password will not grant this password access
# '/' can be used to write a regular expression
#
root:x:!root
root:x:!123456
root:x:!/honeypot/i
root:x:*
tomcat:x:*
oracle:x:*
*:x:somepassword
*:x:*
```
## Fluent Bit Setup
**Server GPG Key**
Adding the Fluent Bit server GPG key to our keyring to ensure we can get the correct signed packages.
{% code overflow="wrap" %}
```
curl https://packages.fluentbit.io/fluentbit.key | gpg --dearmor | sudo tee /usr/share/keyrings/fluentbit-keyring.gpg
```
{% endcode %}
**Update Sources List**
Get specific ubuntu release name
{% code overflow="wrap" %}
```
codename=$(grep -oP '(?<=VERSION_CODENAME=).*' /etc/os-release 2>/dev/null || lsb_release -cs 2>/dev/null)
```
{% endcode %}
Update sources list
{% code overflow="wrap" %}
```
echo "deb [signed-by=/usr/share/keyrings/fluentbit-keyring.gpg] https://packages.fluentbit.io/ubuntu/$codename $codename main" | sudo tee /etc/apt/sources.list.d/fluent-bit.list
```
{% endcode %}
```
sudo apt update
```
**Install Fluent Bit**
```
sudo apt install fluent-bit
```
**Configure Fluent Bit**
Create `fluent-bit.yaml` **YAML** configuration `/etc/fluent-bit`
{% code overflow="wrap" %}
```
sudo nano /etc/fluent-bit/fluent-bit.yaml
```
{% endcode %}
Edit `fluent-bit` config to contain the following configurations for forwarding logs from `cowrie` to `fluentd` (or other) log receiver at a designated IP and `HTTP` port.
```yaml
service:
flush: 5 ## forward buffered logs ever 5 seconds
daemon: off
log_level: info ## verbosity
parsers_file: parsers.conf
pipeline:
inputs:
- name: tail ## constant tracking, add every new line (CAREFUL won't forward if there is nothing new)
tag: cowrie.log
path: /home/cowrie/cowrie/var/log/cowrie/cowrie.json
parser: json
refresh_interval: 5
rotate_wait: 30
## Add more inputs (Glastopf, Dionaea, Suricata)
filters:
## Metadata
- name: record_modifier
match: "*" ## on all cowrie log input/output
record:
- host honeypot_vm
- source cowrie_honeypot
outputs:
- name: forward
match: "*" ## forward all input
host: 10.0.2.15
port: 9880
- name: stdout
match: "*"
```
{% embed url="" %}
{% embed url="" %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://kchuene.gitbook.io/data-communication-project/archive/quickstart.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.