just5ky/honeypots
GitHub: just5ky/honeypots
将 qeeqbox/honeypots 的 25 个多协议蜜罐封装为 Docker 镜像，实现一键容器化部署与集中式威胁监控日志采集。
Stars: 8 | Forks: 0
# [qeeqbox/honeypots](https://github.com/qeeqbox/honeypots) Docker 化
Dockerhub 仓库链接：[justsky/honeypots](https://hub.docker.com/r/justsky/honeypots)
   ## docker run --rm justsky/honeypots -h ``` Qeeqbox/honeypots customizable honeypots for monitoring network traffic, bots activities, and username\password credentials Arguments: --setup target honeypot E.g. ssh or you can have multiple E.g ssh,http,https --list list all available honeypots --kill kill all honeypots --verbose Print error msgs Honeypots options: --ip Override the IP --port Override the Port (Do not use on multiple!) --username Override the username --password Override the password --config Use a config file for honeypots settings --options Extra options (capture_commands for capturing all threat actor data) General options: --termination-strategy {input,signal} Determines the strategy to terminate by --test Test a honeypot --auto Setup the honeypot with random port ``` ## 自定义配置与日志位置 带终端输出 ` docker run -i -p 80:80 -v ~/honeypot_logs:/honeypots/logs justsky/honeypots --setup all` 不带终端输出 ` docker run -d -i -p 80:80 -v ~/honeypot_logs:/honeypots/logs justsky/honeypots --setup all` Docker compose ``` version: '3.3' services: honeypots: container_name: honeypots image: justsky/honeypots:latest # latest, dev restart: unless-stopped stdin_open: true command: --setup all # 将您的自定义路径添加到此文件夹 volumes: - '~/honeypot_logs:/honeypots/logs' # 请勿更改内部端口，仅更改外部端口 ports: - 21:21 # FTP - 22:22 # SSH - 23:23 # TELNET - 25:25 # SMTP - 80:80 # HTTP - 110:110 # POP3 - 123:123 # NTP - 143:143 # IMAP - 161:161 # SNMP - 389:389 # LDAP - 443:443 # HTTPS - 445:445 # SMB - 1080:1080 # SOCKS5 - 1433:1433 # MSSQL - 1521:1521 # ORACLE - 3306:3306 # MYSQL - 5060:5060 # SIP - 5432:5432 # POSTGRES - 5900:5900 # VNC - 6379:6379 # REDIS - 6667:6667 # IRC - 8080:8080 # HTTPPROXY - 9200:9200 # ELASTIC - 11211:11211 # MEMCACHE ``` ### 内部暴露的端口 `21, 22, 23, 25, 80, 110, 123, 143, 161, 389, 443, 445, 1080, 1433, 1521, 3306, 5432, 5060, 5900, 6379, 6667, 8080, 9200, 11211` #### config.json（输出到文件夹） ``` { "logs": "file,json", "logs_location": "/var/log/honeypots/", "syslog_address": "", "syslog_facility": 0, "postgres": "", "sqlite_file":"", "db_options": [], "sniffer_filter": "", "sniffer_interface": "", "honeypots": { "ftp": { "port": 21, "ip": "0.0.0.0", "username": "ftp", "password": "anonymous", "log_file_name": "ftp.log", "max_bytes": 1000000, "backup_count": 10 } } } ``` ## 所有输出值 ``` 'error' :'Information about current error' 'server' :'Server name' 'timestamp' :'Time in ISO' 'action' :'Query, login, etc..' 'data' :'More info about the action' 'status' :'The return status of the action (success or fail)' 'dest_ip' :'Server address' 'dest_port' :'Server port' 'src_ip' :'Attacker address' 'src_port' :'Attacker port' 'username' :'Attacker username' 'password' :'Attacker password' ``` ### 待添加内容 - Docker compose - OpenSearch 集成
Dockerhub 仓库链接：[justsky/honeypots](https://hub.docker.com/r/justsky/honeypots)   ## docker run --rm justsky/honeypots -h ``` Qeeqbox/honeypots customizable honeypots for monitoring network traffic, bots activities, and username\password credentials Arguments: --setup target honeypot E.g. ssh or you can have multiple E.g ssh,http,https --list list all available honeypots --kill kill all honeypots --verbose Print error msgs Honeypots options: --ip Override the IP --port Override the Port (Do not use on multiple!) --username Override the username --password Override the password --config Use a config file for honeypots settings --options Extra options (capture_commands for capturing all threat actor data) General options: --termination-strategy {input,signal} Determines the strategy to terminate by --test Test a honeypot --auto Setup the honeypot with random port ``` ## 自定义配置与日志位置 带终端输出 ` docker run -i -p 80:80 -v ~/honeypot_logs:/honeypots/logs justsky/honeypots --setup all` 不带终端输出 ` docker run -d -i -p 80:80 -v ~/honeypot_logs:/honeypots/logs justsky/honeypots --setup all` Docker compose ``` version: '3.3' services: honeypots: container_name: honeypots image: justsky/honeypots:latest # latest, dev restart: unless-stopped stdin_open: true command: --setup all # 将您的自定义路径添加到此文件夹 volumes: - '~/honeypot_logs:/honeypots/logs' # 请勿更改内部端口，仅更改外部端口 ports: - 21:21 # FTP - 22:22 # SSH - 23:23 # TELNET - 25:25 # SMTP - 80:80 # HTTP - 110:110 # POP3 - 123:123 # NTP - 143:143 # IMAP - 161:161 # SNMP - 389:389 # LDAP - 443:443 # HTTPS - 445:445 # SMB - 1080:1080 # SOCKS5 - 1433:1433 # MSSQL - 1521:1521 # ORACLE - 3306:3306 # MYSQL - 5060:5060 # SIP - 5432:5432 # POSTGRES - 5900:5900 # VNC - 6379:6379 # REDIS - 6667:6667 # IRC - 8080:8080 # HTTPPROXY - 9200:9200 # ELASTIC - 11211:11211 # MEMCACHE ``` ### 内部暴露的端口 `21, 22, 23, 25, 80, 110, 123, 143, 161, 389, 443, 445, 1080, 1433, 1521, 3306, 5432, 5060, 5900, 6379, 6667, 8080, 9200, 11211` #### config.json（输出到文件夹） ``` { "logs": "file,json", "logs_location": "/var/log/honeypots/", "syslog_address": "", "syslog_facility": 0, "postgres": "", "sqlite_file":"", "db_options": [], "sniffer_filter": "", "sniffer_interface": "", "honeypots": { "ftp": { "port": 21, "ip": "0.0.0.0", "username": "ftp", "password": "anonymous", "log_file_name": "ftp.log", "max_bytes": 1000000, "backup_count": 10 } } } ``` ## 所有输出值 ``` 'error' :'Information about current error' 'server' :'Server name' 'timestamp' :'Time in ISO' 'action' :'Query, login, etc..' 'data' :'More info about the action' 'status' :'The return status of the action (success or fail)' 'dest_ip' :'Server address' 'dest_port' :'Server port' 'src_ip' :'Attacker address' 'src_port' :'Attacker port' 'username' :'Attacker username' 'password' :'Attacker password' ``` ### 待添加内容 - Docker compose - OpenSearch 集成
标签：Docker, Python, 威胁情报, 安全, 安全防御评估, 开发者工具, 无后门, 版权保护, 蜜罐, 证书利用, 请求拦截, 超时处理, 逆向工具