Every command

A reference dump of every command from the honeypot and domain/HTTPS posts — no narrative, just the commands, grouped by post.

From: Building my first honeypot on AWS

sudo sed -i '/^#Port 22$/a Port 22\nPort 2222' /etc/ssh/sshd_config
sudo systemctl restart sshd
sudo sed -i '/^Port 22$/d' /etc/ssh/sshd_config
sudo systemctl restart sshd
sudo useradd -m -s /bin/bash cowrie
sudo passwd -l cowrie
sudo dnf install -y git python3.11 python3-pip python3-devel openssl-devel libffi-devel gcc gcc-c++ make
sudo su - cowrie
git clone https://github.com/cowrie/cowrie
cd cowrie
python3.11 -m venv cowrie-env
source cowrie-env/bin/activate
pip install -r requirements.txt
pip install -e .
cp src/cowrie/data/etc/cowrie.cfg.dist etc/cowrie.cfg
sed -i 's/listen_endpoints = tcp:2222:interface=0.0.0.0/listen_endpoints = tcp:2223:interface=0.0.0.0/' etc/cowrie.cfg
cowrie start
sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2223

From: Getting a real domain and real HTTPS

sudo sed -i 's/OLD_IP/NEW_IP/g' bl-content/databases/site.php
sudo dnf install -y python3 augeas-libs
sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install --upgrade pip
sudo /opt/certbot/bin/pip install certbot certbot-nginx
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d DOMAIN
sudo certbot install --cert-name DOMAIN
sudo sed -i 's/http:\/\/DOMAIN/https:\/\/DOMAIN/g' bl-content/databases/site.php

Automating the blog

sudo dnf install -y cronie
sudo systemctl enable --now crond
echo '*/15 * * * * root /usr/bin/python3 /usr/local/bin/honeypot_blog.py >> /var/log/honeypot_blog.log 2>&1' | sudo tee /etc/cron.d/honeypot-blog