Preparing a VM Honeypot host
Seedata is able to deploy "honeypot" seeds to a host that you have already commisioned in your cloud hosting platform, though there are a few prerequisites to be aware of. This page will describe these requirements, and walk you through how to implement them
Host system requirements
Seedata.io requires the following specification for a host:
Linux kernel>= 5.6
Installation of a supported operating system
Ubuntu 20.04 or above
Red Hat Enterprise Linux 8 or above
Rocky Linux 9.0 or above
Fedora 33 or above
Minimum of 1 vCPU, 0.5 GB of ram and 1GB of storage (equivalent to Amazon t2micro)
ROOT access by ssh
Network connectivity to the internet (outbound, from host to internet-based resources)
An IP address per honeypot. This should be available on the Network Interface Card (NIC) that faces the network segment you wish your honeypot to be present in.
Configuring additional IP addresses
Each host will require an additional IP address for each honeypot you wish to deploy to it. These IP addresses should be available on the Network Interface Card (NIC) that faces the network segment you want your honeypot to be available in.
Typically, the additional IP addresses need configuring during the commisioning process (you can't add them after the host has been created)
Amazon (AWS)
With AWS, you can create a new host, complete with a secondary IP address, in one swift move. These instructions assume you already have an account, with a VPC, a public subnet and security group that provides access to hosts within it
From the Console, go to the EC2 Dashboard, and click Launch An Instance
Give your new instance a Name
Select the Operating System to use for the underlying host. We recommend Ubuntu 22
Either provide a previously created Key Pair Name, or select Create new key pair, so that you can use SSH to access your new host
You must Edit the Network Settings to select the correct Subnet, remembering to choose your public subnet if you want external access) and Auto-assign a public IP.
Ensure that appropriate Security Group entitlements are associated to your new host
You'll need to add an extra IP address for each honeypot you wish to plant on this host. to do this you'll need to enter the Advanced Network Configuration screens
Add your desired Secondary IP (remember that smaller machines have fewer Secondary IP available), and set them to Automatically Assign (assuming you want AWS to manage that process).
Launch your instance, and wait for confirmation that everything has gone smoothly
Once you get confirmation, you can now launch an SSH session to your new host and be prepared to plant a new honeypot.
Azure
New hosts on Microsoft Azure require you to first create the Virtual Machine, then add an addition ip-configuration to the network interface card, then restart the VM. The instructions below assume you already have an Azure account with an active subscription, and a resource group.
From the HOME screen in Azure, click Create A Resource, then find the Virtual Machine image and click Create
Select your Resource Group
Set a new Virtual Machine Name
Specify the SSH Key you will use to connect to the virtual machine
Configure the ports you wish to expose for inbound connection from the internet.
Click on Review & Create then click Create
Once your new virtual machine has been created, click Go To Resource so that you can add an additional IP address
Click on Network Settings, then click on the name of the default Network Interface Card
Click on IP Configurations
Click on the "+" sign to add an additional configuration
Provide a new, unique Name for the new IP configuration
Assuming you want a public address, enable Associate a Public IP Address, then click Create a Public IP Address
You must leave the new IP Address as "Basic" SKU, but you can choose static or dynamic, then click OK and Add
Once the new IP address is added, you should see two IP configurations available. At this point, you should Restart the virtual machine by clicking the link in the title bar.
Once the VM is restarted, you should establish an SSH session and confirm the two IP addresses are available.
That's it. Your Azure host is now ready to receive honeypots. You can follow instructions for that, here: https://docs.seedata.io/tutorials/deploying-a-honeypot-seed
Google (GCP)
Create a new instance
The following steps will provide you with a compatible virtual host within your GCP project. They are written with the expectation that you already have a "Project" with access to your intended network locations, and that you have configured networking to provide the outbound route to the internet.
Within the appropriate GCP Project, and from the Compute Engine blade, click Create Instance
Give your new instance a Name
Select a Machine Type of suitable specification for your needs. It's possible to run our assets on a minimum spec instance, to keep costs down
Configure the Boot Disk - Image to use an operating system of your preference, from the list of supported OS's at the top of this page
Open Advanced Options, and Networking, then select the relevant Network Interface Card
Within the Network Interfaces section, expand your Default interface
Go to Alias IP Ranges and click Add IP Range
Add a new alias IP address taken from the appropriate subnet
Repeat steps 7 and 8 for as many alias IP addresses as you wish to add
Click Done, then Create
Configure additional IP addresses
Once your new instance is created, you will need to bind the alias IP addresses by creating a Netplan configuration.
Start an SSH session with your new instance
Create a new file to disable the cloud-init config and allow your custom netplan to persist. Type the following command:
in this new file, add the following text :
Write and Quit vi ... You can "vi", can't you? If not, go here: https://www.redhat.com/sysadmin/introduction-vi-editor
Next, you're to create you new netplan file. Type the following command
Then, you're going to enter the folllowing content. You'll need to change the IP addresses to match those that you entered during the instance creation steps above, and you'll need to change the NIC (it says "enp0s1" in my example below) to match that of your new instance (run "ip a" first and note the NIC name
Again, Write and Quit vi... You know by now that it's ":wq!", right ?
Finally, you're going to restart netplan with the following command.
These netplan files are really particular about spaces and indentation, so be attentive
That's it. Your GCP host is now ready to receive honeypots. You can follow instructions for that, here: https://docs.seedata.io/tutorials/deploying-a-honeypot-seed
Last updated