Self-hosting is both an entertaining hobby if you like computers, and a reasonable way to save a few dollars if you swap out your subscription services for something you host yourself.It does come with a bit of risk, however, if you put your self-hosted services online so they're accessible from the internet.I was curious about what kind of attacks my server was getting, so I set up a honeypot to see what happened.
What is a honeypot? A trap, or possibly a diversion In the cybersecurity world, a honeypot is a tool that is designed to attract the attention of hackers (or other kinds of cybercriminals).Honeypots take a few different forms and provide a few important functions.Sometimes a honeypot can take the form of a fake download that is used to harvest the IP addresses of people trying to collect illegal content.
In other cases, a honeypot is a program that runs on a server that is designed to look like a vulnerable target for hackers.That provides a few benefits.First and foremost, a honeypot allows cybersecurity experts (or a dedicated self-hoster) to determine what kind of attacks their server is experiencing.
Are the hackers attempting to attack a specific port, which indicates they're aiming to exploit a specific service? When do they attack, and where does their traffic originate? All of these factors can provide insight into just how hackers (or other types of malicious actors) are attacking, and that insight can be used to prevent them from being successful in the future.Additionally, a honeypot can be used to draw attackers away from legitimate targets.If they're busy hitting what looks like a very vulnerable target that is actually a dead-end, maybe they'll miss your Minecraft server that has been appropriately secured.
Picking a honeypot for my server I didn't even need to build it myself If you search the internet for server honeypot you'll find a huge range of options with extremely technical descriptions.If you don't know what you're looking for in advance, most of it isn't helpful.However, there is a project that brings together a huge range of different honeypots into one convenient package: T-Pot.
T-Pot offers distinct honeypots, plus a dozen tools that do things like automatically restart broken honeypots, encrypt your honeypot data, visualization tools, and a web-based frontend that makes running the entire setup as easy as possible.To run T-Pot, the creators recommend at least 16GB of RAM and 256GB of storage, though you can squeeze by with a bit less.I actually set up T-Pot on my 8GB Raspberry Pi 4 with a 128GB microSD card.
It has been running for quite a while now without an issue.What did my honeypot find? Not too much, and that's a good thing Despite running several servers on my network (a few of which are exposed to the internet), I had fewer hits on my honeypot than I'd expect, and none of them were serious.My honeypots have received a total of 227 hits over the last 5 days, literally of them from IPs controlled by Talos Intelligence, which is a cybersecurity group run by Cisco.
Though my actual results are a bit tame, when you're talking about cybersecurity, boring is good! You don't want a ton of attacks hitting your servers all the time if it can be avoided.Related 4 common ways Windows PCs get hacked and how to prevent them Most Windows hacks are made possible by your everyday habits, not sophisticated attacks.Posts 2 By Rich Hein Setting up T-Pot on your server Give it a shot! T-Pot is designed to be as user-friendly as possible, and if you want, you can set it up on your server with a single command.
First, begin by connecting to your Linux server as you usually do.If you're using a headless server, connect over SSH, or if you have a mouse and keyboard set up at your server, you can manually enter it that way instead.However, you use a GUI with T-Pot on a Linux server—it won't work.
T-Pot is available for Windows and macOS too.However you control your server, enter the following command in the terminal: env bash -c "$(curl -sL https://github.com/telekom-security/tpotce/raw/master/install.sh)" That will automatically download and install everything you need.During the setup process, you'll be prompted to create a username a password.
.Those credentials are how you access T-Pot's web interface.Once everything is done installing, just restart your server, wait for it to come back online, and run the dps command.
If everything went well, you should see a list of running honeypots.Then, in your browser, enter https://(Your IP Here):64297/ to view the web interface.I'd recommend starting with Kibana.
It presents a great overview of what your honeypots are doing.You don't really need a honeypot, but it's a fun project! A honeypot isn't a strictly essential part of my self-hosting setup, but considering how incredibly easy it is to set up and monitor, I'm going to continue using it for the foreseeable future.In a worst scenario, I waste some storage space and have to delete old logs intermittently.
At best, I gain insight into the kinds of attacks that may hit my self-hosted services, and can better protect myself in the future.
Read More
