OpenCaning Cheatsheet
generieren
OpenCanary ist ein Daemon, der Kanariendienste betreibt, die auf (ab)use auslösen. Es ist entworfen, um von unbekannten Benutzern in Ihrem Netzwerk ausgelöst werden und bietet eine frühzeitige Warnung an potenzielle Intrusionen. OpenCanary erstellt Honeypots, die als legitime Dienste erscheinen, aber Alarmadministratoren, wenn sie von nicht autorisierten Benutzern aufgerufen werden.
## Installation und Inbetriebnahme
### Ubuntu/Debian Installation
** Installation:**
# Update package list
sudo apt update
# Install dependencies
sudo apt install python3-dev python3-pip python3-virtualenv python3-venv python3-scapy libssl-dev libpcap-dev
# Create virtual environment
python3 -m venv opencanary-env
source opencanary-env/bin/activate
# Install OpenCanary
pip install opencanary
# Install additional dependencies for specific services
pip install scapy pcapy-ng
# Verify installation
opencanaryd --help
```_
**Von Quelle:**
```bash
# Clone repository
git clone https://github.com/thinkst/opencanary.git
cd opencanary
# Create virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Install OpenCanary
python setup.py install
# Verify installation
opencanaryd --version
```_
### Konfiguration
**Generate Standardkonfiguration:**
```bash
# Create configuration directory
sudo mkdir -p /etc/opencanary
# Generate default configuration
opencanaryd --copyconfig
# Copy to system location
sudo cp ~/.opencanary.conf /etc/opencanary/opencanary.conf
# Set proper permissions
sudo chown root:root /etc/opencanary/opencanary.conf
sudo chmod 644 /etc/opencanary/opencanary.conf
```_
**Basic Konfiguration:**
```json
\\\\{
"device.node_id": "opencanary-1",
"device.name": "Production Server",
"device.description": "Honeypot canary",
"git.enabled": false,
"git.port": 9418,
"ftp.enabled": true,
"ftp.port": 21,
"ftp.banner": "FTP server ready",
"http.enabled": true,
"http.port": 80,
"http.banner": "Apache/2.2.22",
"http.skin": "nasLogin",
"httpproxy.enabled": false,
"httpproxy.port": 8080,
"httpproxy.skin": "squid",
"httpsProxy.enabled": false,
"httpsProxy.port": 8443,
"logger": \\\\{
"class": "PyLogger",
"kwargs": \\\\{
"formatters": \\\\{
"plain": \\\\{
"format": "%(asctime)s %(name)s: %(message)s"
\\\\}
\\\\},
"handlers": \\\\{
"console": \\\\{
"class": "logging.StreamHandler",
"stream": "ext://sys.stdout"
\\\\},
"file": \\\\{
"class": "logging.FileHandler",
"filename": "/var/log/opencanary.log"
\\\\}
\\\\}
\\\\}
\\\\},
"portscan.enabled": true,
"portscan.ignore_localhost": false,
"smb.enabled": true,
"smb.auditfile": "/var/log/opencanary-audit.log",
"smb.domain": "corp.company.com",
"mysql.enabled": true,
"mysql.port": 3306,
"mysql.banner": "5.5.43-0ubuntu0.14.04.1",
"ssh.enabled": true,
"ssh.port": 22,
"ssh.version": "SSH-2.0-OpenSSH_5.1p1 Debian-4",
"redis.enabled": false,
"redis.port": 6379,
"rdp.enabled": false,
"rdp.port": 3389,
"sip.enabled": false,
"sip.port": 5060,
"snmp.enabled": false,
"snmp.port": 161,
"ntp.enabled": true,
"ntp.port": 123,
"tftp.enabled": false,
"tftp.port": 69,
"tcpbanner.maxnum": 10,
"tcpbanner.enabled": false,
"tcpbanner_1.enabled": false,
"tcpbanner_1.port": 8001,
"tcpbanner_1.datareceivedbanner": "",
"tcpbanner_1.initbanner": "",
"tcpbanner_1.alertstring.enabled": false,
"tcpbanner_1.alertstring": "",
"tcpbanner_1.keep_alive.enabled": false,
"tcpbanner_1.keep_alive_secret": "",
"tcpbanner_1.keep_alive_probes": 11,
"tcpbanner_1.keep_alive_idle": 300,
"tcpbanner_1.keep_alive_interval": 300,
"telnet.enabled": true,
"telnet.port": 23,
"telnet.banner": "",
"telnet.honeycreds": [
\\\\{
"username": "admin",
"password": "$pbkdf2-sha512$19000$bG1NaY3xvlRMwcplEs8u9w$dqK6J8UfzSXK6lZaFXJVUd.nVHLOdlVwIWaLxKqurLx6XRgRHMKe4lhDtdY8DwlnWqBJSEJyXP8RQOmvKjgdPw"
\\\\}
],
"mssql.enabled": false,
"mssql.version": "2012",
"mssql.port": 1433,
"vnc.enabled": false,
"vnc.port": 5900
\\\\}
```_
## Service Konfiguration
### SSH Honeypot
**SSH Konfiguration:**
```json
\\\\{
"ssh.enabled": true,
"ssh.port": 22,
"ssh.version": "SSH-2.0-OpenSSH_5.1p1 Debian-4",
"ssh.listen_addr": "0.0.0.0"
\\\\}
```_
**Kunde SSH Banner:**
```bash
# Create custom SSH banner
sudo tee /etc/opencanary/ssh_banner.txt << EOF
Welcome to Production Database Server
Unauthorized access is prohibited
All connections are logged and monitored
EOF
# Update configuration
\\\\{
"ssh.enabled": true,
"ssh.port": 22,
"ssh.version": "SSH-2.0-OpenSSH_5.1p1 Debian-4",
"ssh.banner": "/etc/opencanary/ssh_banner.txt"
\\\\}
```_
### HTTP/HTTPS Honeypot
**HTTP Konfiguration:**
```json
\\\\{
"http.enabled": true,
"http.port": 80,
"http.banner": "Apache/2.2.22 (Ubuntu)",
"http.skin": "nasLogin",
"http.listen_addr": "0.0.0.0"
\\\\}
```_
**Verfügbare HTTP Skins:**
```json
# Login page skins
"http.skin": "basicLogin" # Basic login form
"http.skin": "nasLogin" # NAS device login
"http.skin": "sindLogin" # Synology login
"http.skin": "meraki" # Cisco Meraki login
"http.skin": "ubnt" # Ubiquiti login
# Custom skin directory
"http.skin": "custom",
"http.skindir": "/etc/opencanary/skins/"
```_
**HTTPS Konfiguration:**
```json
\\\\{
"https.enabled": true,
"https.port": 443,
"https.banner": "Apache/2.2.22 (Ubuntu)",
"https.skin": "nasLogin",
"https.cert": "/etc/opencanary/cert.pem",
"https.key": "/etc/opencanary/key.pem"
\\\\}
```_
### SMB Honeypot
**SMB Konfiguration:**
```json
\\\\{
"smb.enabled": true,
"smb.auditfile": "/var/log/opencanary-audit.log",
"smb.domain": "WORKGROUP",
"smb.serverName": "FILESERVER",
"smb.netbiosName": "FILESERVER",
"smb.workgroup": "WORKGROUP"
\\\\}
```_
**SMB Teile Konfiguration:**
```json
\\\\{
"smb.enabled": true,
"smb.shares": [
\\\\{
"name": "Documents",
"comment": "Shared Documents",
"path": "/tmp/documents",
"readonly": true
\\\\},
\\\\{
"name": "Backup",
"comment": "Backup Files",
"path": "/tmp/backup",
"readonly": false
\\\\}
]
\\\\}
```_
### Datenbank Honeypots
**MySQL Konfiguration:**
```json
\\\\{
"mysql.enabled": true,
"mysql.port": 3306,
"mysql.banner": "5.5.43-0ubuntu0.14.04.1",
"mysql.listen_addr": "0.0.0.0"
\\\\}
```_
**MSSQL Konfiguration:**
```json
\\\\{
"mssql.enabled": true,
"mssql.version": "2012",
"mssql.port": 1433,
"mssql.listen_addr": "0.0.0.0"
\\\\}
```_
**Redis Konfiguration: **
```json
\\\\{
"redis.enabled": true,
"redis.port": 6379,
"redis.listen_addr": "0.0.0.0"
\\\\}
```_
### Netzwerk Service Honeypots
**Telnet Konfiguration:**
```json
\\\\{
"telnet.enabled": true,
"telnet.port": 23,
"telnet.banner": "Welcome to Cisco Router",
"telnet.honeycreds": [
\\\\{
"username": "admin",
"password": "admin123"
\\\\},
\\\\{
"username": "cisco",
"password": "cisco"
\\\\}
]
\\\\}
```_
**FTP Konfiguration:**
```json
\\\\{
"ftp.enabled": true,
"ftp.port": 21,
"ftp.banner": "FTP server ready",
"ftp.listen_addr": "0.0.0.0"
\\\\}
```_
**SNMP Konfiguration:**
```json
\\\\{
"snmp.enabled": true,
"snmp.port": 161,
"snmp.listen_addr": "0.0.0.0"
\\\\}
```_
## Erweiterte Konfiguration
### Port Scan Detection
**Port Scan Konfiguration:**
```json
\\\\{
"portscan.enabled": true,
"portscan.ignore_localhost": false,
"portscan.ports": [22, 23, 80, 443, 3389, 5900],
"portscan.logfile": "/var/log/opencanary-portscan.log"
\\\\}
```_
### Benutzerdefinierte TCP Banner
**TCP Banner Konfiguration: **
```json
\\\\{
"tcpbanner.maxnum": 10,
"tcpbanner.enabled": true,
"tcpbanner_1.enabled": true,
"tcpbanner_1.port": 8001,
"tcpbanner_1.datareceivedbanner": "Welcome to Custom Service",
"tcpbanner_1.initbanner": "Custom Service v1.0",
"tcpbanner_1.alertstring.enabled": true,
"tcpbanner_1.alertstring": "ADMIN",
"tcpbanner_1.keep_alive.enabled": true,
"tcpbanner_1.keep_alive_secret": "keepalive123",
"tcpbanner_1.keep_alive_probes": 11,
"tcpbanner_1.keep_alive_idle": 300,
"tcpbanner_1.keep_alive_interval": 300
\\\\}
```_
### Logging Konfiguration
**Erweiterte Anmeldung: **
```json
\\\\{
"logger": \\\\{
"class": "PyLogger",
"kwargs": \\\\{
"formatters": \\\\{
"plain": \\\\{
"format": "%(asctime)s %(name)s[%(process)d]: %(levelname)s %(message)s"
\\\\},
"syslog": \\\\{
"format": "opencanary[%(process)d]: %(name)s %(levelname)s %(message)s"
\\\\}
\\\\},
"handlers": \\\\{
"console": \\\\{
"class": "logging.StreamHandler",
"stream": "ext://sys.stdout",
"formatter": "plain"
\\\\},
"file": \\\\{
"class": "logging.handlers.RotatingFileHandler",
"filename": "/var/log/opencanary.log",
"maxBytes": 10485760,
"backupCount": 5,
"formatter": "plain"
\\\\},
"syslog": \\\\{
"class": "logging.handlers.SysLogHandler",
"address": ["localhost", 514],
"facility": "local0",
"formatter": "syslog"
\\\\}
\\\\},
"loggers": \\\\{
"opencanary": \\\\{
"level": "INFO",
"handlers": ["console", "file", "syslog"]
\\\\},
"twisted": \\\\{
"level": "ERROR",
"handlers": ["file"]
\\\\}
\\\\}
\\\\}
\\\\}
\\\\}
```_
## OpenCanary
### Manuelle Ausführung
**Start OpenCanary:**
```bash
# Start with default configuration
opencanaryd --start
# Start with custom configuration
opencanaryd --start --config=/etc/opencanary/opencanary.conf
# Start in foreground (for debugging)
opencanaryd --dev
# Start with specific log level
opencanaryd --start --logLevel=DEBUG
```_
**Stop OpenCanary:**
```bash
# Stop OpenCanary daemon
opencanaryd --stop
# Force stop
sudo pkill -f opencanaryd
```_
### Service Management
**Systemd Service:**
```bash
# Create systemd service file
sudo tee /etc/systemd/system/opencanary.service << EOF
[Unit]
Description=OpenCanary Honeypot
After=network.target
[Service]
Type=forking
User=nobody
Group=nogroup
ExecStart=/usr/local/bin/opencanaryd --start --config=/etc/opencanary/opencanary.conf
ExecStop=/usr/local/bin/opencanaryd --stop
PIDFile=/var/run/opencanary.pid
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.target
EOF
# Enable and start service
sudo systemctl enable opencanary
sudo systemctl start opencanary
# Check service status
sudo systemctl status opencanary
```_
**Init Script (SysV): * *
```bash
# Create init script
sudo tee /etc/init.d/opencanary << 'EOF'
#!/bin/bash
### BEGIN INIT INFO
# Provides: opencanary
# Required-Start: $network $local_fs $remote_fs
# Required-Stop: $network $local_fs $remote_fs
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: OpenCanary Honeypot
# Description: OpenCanary Honeypot Service
### END INIT INFO
DAEMON="opencanaryd"
CONFIG="/etc/opencanary/opencanary.conf"
USER="nobody"
case "$1" in
start)
echo "Starting OpenCanary..."
su - $USER -c "$DAEMON --start --config=$CONFIG"
;;
stop)
echo "Stopping OpenCanary..."
su - $USER -c "$DAEMON --stop"
;;
restart)
$0 stop
sleep 2
$0 start
;;
status)
if pgrep -f $DAEMON > /dev/null; then
echo "OpenCanary is running"
else
echo "OpenCanary is not running"
fi
;;
*)
| echo "Usage: $0 \\\\{start | stop | restart | status\\\\}" |
exit 1
;;
esac
exit 0
EOF
# Make executable and enable
sudo chmod +x /etc/init.d/opencanary
sudo update-rc.d opencanary defaults
```_
## Überwachung und Alarmierung
### Analyse der Ergebnisse
**Parse OpenCanary Logs:**
```bash
# View recent alerts
tail -f /var/log/opencanary.log
# Filter by service
grep "ssh" /var/log/opencanary.log
grep "http" /var/log/opencanary.log
grep "smb" /var/log/opencanary.log
# Extract source IPs
| grep -oP 'src_host=\K[^,]*' /var/log/opencanary.log | sort | uniq -c | sort -nr |
# Count alerts by service
| grep -oP 'logtype=\K[^,]*' /var/log/opencanary.log | sort | uniq -c | sort -nr |
# Extract failed login attempts
| grep "login" /var/log/opencanary.log | grep -oP 'username=\K[^,]*' | sort | uniq -c |
```_
**Log Format Beispiele:**
Dieses umfassende OpenCanary-Catsheet umfasst Installations-, Konfigurations-, Service-Setup-, Monitoring-, Alarm- und Sicherheitsaspekte für eine effektive Honeypot-Bereitstellung und Bedrohungserkennung.