Preparing a VM Honeypot host

Seedata is able to deploy "honeypot" seeds to a host that you have already commisioned in your cloud hosting platform, though there are a few prerequisites to be aware of. This page will describe these requirements, and walk you through how to implement them

Host system requirements

Seedata.io requires the following specification for a host:

  • Linux kernel>= 5.6

  • Installation of a supported operating system

    • Ubuntu 20.04 or above

    • Red Hat Enterprise Linux 8 or above

    • Rocky Linux 9.0 or above

    • Fedora 33 or above

  • Minimum of 1 vCPU, 0.5 GB of ram and 1GB of storage (equivalent to Amazon t2micro)

  • ROOT access by ssh

  • Network connectivity to the internet (outbound, from host to internet-based resources)

  • An IP address per honeypot. This should be available on the Network Interface Card (NIC) that faces the network segment you wish your honeypot to be present in.

Configuring additional IP addresses

Each host will require an additional IP address for each honeypot you wish to deploy to it. These IP addresses should be available on the Network Interface Card (NIC) that faces the network segment you want your honeypot to be available in.

Typically, the additional IP addresses need configuring during the commisioning process (you can't add them after the host has been created)

Amazon (AWS)

With AWS, you can create a new host, complete with a secondary IP address, in one swift move. These instructions assume you already have an account, with a VPC, a public subnet and security group that provides access to hosts within it

  1. From the Console, go to the EC2 Dashboard, and click Launch An Instance

  2. Give your new instance a Name

  3. Select the Operating System to use for the underlying host. We recommend Ubuntu 22

  4. Either provide a previously created Key Pair Name, or select Create new key pair, so that you can use SSH to access your new host

  5. You must Edit the Network Settings to select the correct Subnet, remembering to choose your public subnet if you want external access) and Auto-assign a public IP.

  6. Ensure that appropriate Security Group entitlements are associated to your new host

  7. You'll need to add an extra IP address for each honeypot you wish to plant on this host. to do this you'll need to enter the Advanced Network Configuration screens

  8. Add your desired Secondary IP (remember that smaller machines have fewer Secondary IP available), and set them to Automatically Assign (assuming you want AWS to manage that process).

  9. Launch your instance, and wait for confirmation that everything has gone smoothly

  10. Once you get confirmation, you can now launch an SSH session to your new host and be prepared to plant a new honeypot.

Azure

New hosts on Microsoft Azure require you to first create the Virtual Machine, then add an addition ip-configuration to the network interface card, then restart the VM. The instructions below assume you already have an Azure account with an active subscription, and a resource group.

  1. From the HOME screen in Azure, click Create A Resource, then find the Virtual Machine image and click Create

  2. Select your Resource Group

  3. Set a new Virtual Machine Name

  4. Specify the SSH Key you will use to connect to the virtual machine

  5. Configure the ports you wish to expose for inbound connection from the internet.

  6. Click on Review & Create then click Create

  7. Once your new virtual machine has been created, click Go To Resource so that you can add an additional IP address

  8. Click on Network Settings, then click on the name of the default Network Interface Card

  9. Click on IP Configurations

  10. Click on the "+" sign to add an additional configuration

  11. Provide a new, unique Name for the new IP configuration

  12. Assuming you want a public address, enable Associate a Public IP Address, then click Create a Public IP Address

  13. You must leave the new IP Address as "Basic" SKU, but you can choose static or dynamic, then click OK and Add

  14. Once the new IP address is added, you should see two IP configurations available. At this point, you should Restart the virtual machine by clicking the link in the title bar.

  15. Once the VM is restarted, you should establish an SSH session and confirm the two IP addresses are available.

That's it. Your Azure host is now ready to receive honeypots. You can follow instructions for that, here: https://docs.seedata.io/tutorials/deploying-a-honeypot-seed

Google (GCP)

Create a new instance

The following steps will provide you with a compatible virtual host within your GCP project. They are written with the expectation that you already have a "Project" with access to your intended network locations, and that you have configured networking to provide the outbound route to the internet.

  1. Within the appropriate GCP Project, and from the Compute Engine blade, click Create Instance

  2. Give your new instance a Name

  3. Select a Machine Type of suitable specification for your needs. It's possible to run our assets on a minimum spec instance, to keep costs down

  4. Configure the Boot Disk - Image to use an operating system of your preference, from the list of supported OS's at the top of this page

  5. Open Advanced Options, and Networking, then select the relevant Network Interface Card

  6. Within the Network Interfaces section, expand your Default interface

  7. Go to Alias IP Ranges and click Add IP Range

  8. Add a new alias IP address taken from the appropriate subnet

  9. Repeat steps 7 and 8 for as many alias IP addresses as you wish to add

  10. Click Done, then Create

Configure additional IP addresses

Once your new instance is created, you will need to bind the alias IP addresses by creating a Netplan configuration.

  1. Start an SSH session with your new instance

  2. Create a new file to disable the cloud-init config and allow your custom netplan to persist. Type the following command:

    • sudo vi /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

  3. in this new file, add the following text : 

    • network: {config: disabled}

  4. Write and Quit vi ... You can "vi", can't you? If not, go here: https://www.redhat.com/sysadmin/introduction-vi-editor

  5. Next, you're to create you new netplan file. Type the following command

    • sudo vi /etc/netplan/99-custom-iface.yaml

  6. Then, you're going to enter the folllowing content. You'll need to change the IP addresses to match those that you entered during the instance creation steps above, and you'll need to change the NIC (it says "enp0s1" in my example below) to match that of your new instance (run "ip a" first and note the NIC name

    • network:
version: 2
    renderer: networkd
    ethernets:
        enp0s1:
            addresses:
            - 192.168.64.201/24
            - 192.168.64.202/24
            - 192.168.64.203/24

  7. Again, Write and Quit vi... You know by now that it's ":wq!", right ?

  8. Finally, you're going to restart netplan with the following command. 

    • sudo netplan apply

These netplan files are really particular about spaces and indentation, so be attentive

That's it. Your GCP host is now ready to receive honeypots. You can follow instructions for that, here: https://docs.seedata.io/tutorials/deploying-a-honeypot-seed

PreviousPlanting a VM honeypot seedNextPlanting an EC2 honeypot seed

Last updated