Building my first honeypot on AWS

A walkthrough of turning a fresh EC2 instance into an SSH honeypot with Cowrie, without losing real SSH access in the process.

Step 1: Move real SSH off port 22

Real sshd has to leave port 22 before anything else, so Cowrie can take it over later.

sudo sed -i '/^#Port 22$/a Port 22\nPort 2222' /etc/ssh/sshd_config
sudo systemctl restart sshd

Tested the new port from a second terminal before touching anything else, then dropped the old one:

sudo sed -i '/^Port 22$/d' /etc/ssh/sshd_config
sudo systemctl restart sshd

Step 2: Dedicated user for Cowrie

sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie

Step 3: Install Cowrie

sudo dnf install -y git python3.11 python3-pip python3-devel openssl-devel libffi-devel gcc gcc-c++ make
sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
pip install -e .
cp src/cowrie/data/etc/cowrie.cfg.dist etc/cowrie.cfg

Cowrie's default SSH port (2222) collided with the real sshd sitting on the same port now, so it got moved to 2223:

sed -i 's/listen_endpoints = tcp:2222:interface=0.0.0.0/listen_endpoints = tcp:2223:interface=0.0.0.0/' etc/cowrie.cfg
cowrie start

Step 4: Redirect port 22 into the honeypot

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

Anyone hitting port 22 from the internet now lands in Cowrie's fake shell instead of a real login prompt.

Step 5: Automate reporting

A small Python script reads cowrie.json, tallies the day's connections and top source IPs, and writes both a live stats file and a new blog post whenever there's activity. It runs via cron every 15 minutes so this blog updates itself.

First bot showed up within hours of opening port 22.