honeypot-templates — templates for honeypot deployments with logging and dashboards for monitoring attacks in educational networks.

Features

• Honeypot templates: Cowrie (SSH/Telnet), Dionaea (multiple protocols)
• Logging: Loki + Promtail (Docker-based service discovery)
• Monitoring: Grafana with pre-provisioned data source and a starter dashboard
• Startup templates: simple scripts and .env templates

Quick Start

1. Install Docker and Docker Compose
2. Copy .env.example to .env and adjust values as needed
3. Bring up monitoring:

   ./scripts/up-monitoring.sh

4. Bring up a honeypot template (e.g., Cowrie):

   ./scripts/up-cowrie.sh

5. Open Grafana (http://localhost:3000), sign in (default admin/admin), and open the Honeypot Overview dashboard

Structure

• docker-compose.monitoring.yml — Loki+Grafana+Promtail stack
• grafana/ — provisioning and dashboards
• loki/ — Loki configuration
• promtail/ — Promtail configuration (with Docker service discovery)
• templates/ — honeypot templates: cowrie/, dionaea/
• scripts/ — scripts to start/stop stacks

Security Notes

• These templates are intended for educational/lab networks. Do not run honeypots in production without additional isolation and safeguards.
• Promtail reads the Docker socket (read-only) — ensure you understand the risks.
• Restrict access to Grafana (change the default password) and avoid exposing unnecessary ports externally.

Ethical Use and Scope

• This repository is for defensive, educational, and research purposes in controlled environments only.
• It does not include offensive tooling: exploits, payload builders, C2, etc.
• See ETHICS.md and DISCLAIMER.md.

Non-goals

• Stealth, obfuscation, persistence, and long-term footholds
• Scalable C2/botnet-style control and infection orchestration
• Automated propagation or defensive evasion mechanisms

Threat Model (Defensive)

• Decoy services collect attack telemetry
• Priority is visibility and explainability rather than stealth
• High discoverability of services and dashboards is an intentional tradeoff

License

MIT