Watching the Bad Guys with Cowrie

This Is the End

There are a number of uses for clever tools like Cowrie. Hopefully, you can see the value of honeypots, whether it be for security research or as an early warning tool on a LAN.

In the past, I’ve used honeypots to be more active at denying access to external resources for a short period of time (rate limiting essentially), so that after a few alerts a human could figure out if the issue was serious or a misconfiguration somewhere.

If you’re more interested in malware detection, then I also suggest a sophisticated malware-catching honeypot called Dionaea, which looks readily maintained on GitHub with commits of only about a month old. Dionaea uses libemu to detect shellcodes and supports Ipv6 and TLS. If Dionaea appears complex, then fret not as the documentation looks excellent.

I’ll leave you to decide your software preference as a few are available. I trust you to find an ISP or host that allows you to run honeypots responsibly and then to find a way to put them to good use.

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More