but before I do, I figured I’d ask if anyone’s aware of any tools/software that covers my basic needs of setting something basic that may alert me if there are any intruders in the network?
Needs:
Fake ssh login that can trigger a script so I can take care of the rest.
Fake network share (cifs/samba) that can trigger a script if anything tries to access it.
Would be great if there are any docker images I can just pull, make some minor edits, and run.
I am not affiliated with them, but you can get a trigger file (Canary Token) from the people at Thinkst. I quickly looked around their site, and did not see how, but their adds say you can get them for free, without having to buy their canary hardware device.
The Honeynet Project, related to the SANS Institute when I last checked, has a lot of resources on honeypots that are worth a look, if you haven’t already.
Thinkst have also published opencanary which you can run yourself and contains a decent subset of what their hardware canaries run, including SSH and cifs.
I plan on making it available inside my own network, not public. This way if someone makes it past my security, I at least have something that might “catch” them in the act and disable my network so I can intervene. Just another security layer.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I haven’t used it, but here is my first web search result: https://github.com/droberson/ssh-honeypot Also: https://github.com/paralax/awesome-honeypots
I am not affiliated with them, but you can get a trigger file (Canary Token) from the people at Thinkst. I quickly looked around their site, and did not see how, but their adds say you can get them for free, without having to buy their canary hardware device.
https://canarytokens.org/generate should work just fine
People were close, but what you actually want is OpenCanary. It fakes SSH and Samba services and can be configured to alert you when triggered.
You can also use something called canary tokens. You would put a file on a share that triggers an action to alert you.
I’d like to create a funnypot
Honeypy
Check this out, is super fun! https://github.com/skeeto/endlessh
The Honeynet Project, related to the SANS Institute when I last checked, has a lot of resources on honeypots that are worth a look, if you haven’t already.
Thinkst have also published opencanary which you can run yourself and contains a decent subset of what their hardware canaries run, including SSH and cifs.
…why would you do this?
Do you not feel the itch of curiosity?
FOR SCIENCE!1!!
I plan on making it available inside my own network, not public. This way if someone makes it past my security, I at least have something that might “catch” them in the act and disable my network so I can intervene. Just another security layer.
I have never thought about doing this… But this is actually such a good idea. I’m probably going to set this up myself
one of the best ways to protect your friends is to leave juicy bait that only zero-sum people would try to steal
plus wasting malicious user’s time also provides multiple benefits such as reducing the prevalence of spam and DDoS attacks
If you place this on the inside of your network and it triggers, youre either compromised or a scanner/ person triggered it.
That’s the idea I think