# # Cowrie configuration file (cowrie.cfg) # # ============================================================================ # General Honeypot Options # ============================================================================ [honeypot] # Sensor name is used to identify this Cowrie instance. Used by the database # logging modules such as mysql. # # If not specified, the logging modules will instead use the IP address of the # server as the sensor name. # # (default: not specified) #sensor_name=myhostname # Hostname for the honeypot. Displayed by the shell prompt of the virtual # environment # # (default: svr04) hostname = svr04 # Directory where to save log files in. # # (default: log) log_path = log # Directory where to save downloaded artifacts in. # # (default: dl) download_path = dl # Directory for miscellaneous data files, such as the password database. # # (default: data_path) data_path = data # Directory where virtual file contents are kept in. # # This is only used by commands like 'cat' to display the contents of files. # Adding files here is not enough for them to appear in the honeypot - the # actual virtual filesystem is kept in filesystem_file (see below) # # (default: honeyfs) contents_path = honeyfs # File in the python pickle format containing the virtual filesystem. # # This includes the filenames, paths, permissions for the Cowrie filesystem, # but not the file contents. This is created by the bin/createfs utility from # a real template linux installation. # # (default: fs.pickle) filesystem_file = data/fs.pickle # Directory for creating simple commands that only output text. # # The command must be placed under this directory with the proper path, such # as: # txtcmds/usr/bin/vi # The contents of the file will be the output of the command when run inside # the honeypot. # # In addition to this, the file must exist in the virtual filesystem # # (default: txtcmds) txtcmds_path = txtcmds # Maximum file size (in bytes) for downloaded files to be stored in 'download_path'. # A value of 0 means no limit. If the file size is known to be too big from the start, # the file will not be stored on disk at all. # # (default: 0) #download_limit_size = 10485760 # Session management interface. # # This is a telnet based service that can be used to interact with active # sessions. Disabled by default. The interact feature is only available on # the loopback interface. # # (default: false) interact_enabled = false # (default: 5123) interact_port = 5123 # ============================================================================ # Network Specific Options # ============================================================================ # IP address to bind to when opening outgoing connections. Used by wget and # curl commands. # # (default: not specified) #out_addr = 0.0.0.0 # Fake address displayed as the address of the incoming connection. # This doesn't affect logging, and is only used by honeypot commands such as # 'w' and 'last' # # If not specified, the actual IP address is displayed instead (default # behaviour). # # (default: not specified) #fake_addr = 192.168.66.254 # The IP address on which this machine is reachable on from the internet. # Useful if you use portforwarding or other mechanisms. If empty, Cowrie # will determine by itself. Used in 'netstat' output # #internet_facing_ip = 9.9.9.9 # Enable to log the public IP of the honeypot (useful if listening on 127.0.0.1) # IP address is obtained by querying http://myip.threatstream.com #report_public_ip = true # ============================================================================ # Authentication Specific Options # ============================================================================ # Class that implements the checklogin() method. # # Class must be defined in cowrie/core/auth.py # Default is the 'UserDB' class which uses the password database. # # Alternatively the 'AuthRandom' class can be used, which will let # a user login after a random number of attempts. # It will also cache username/password combinations that allow login. # auth_class = UserDB # When AuthRandom is used also set the # auth_class_parameters: , , # for example: 2, 5, 10 = allows access after randint(2,5) attempts # and cache 10 combinations. # #auth_class = AuthRandom #auth_class_parameters = 2, 5, 10 # No authentication checking at all # enabling 'auth_none' will enable the ssh2 'auth_none' authentication method # this allows the requested user in without any verification at all # # (default: false) #auth_none_enabled = false # ============================================================================ # SSH Specific Options # ============================================================================ # IP addresses to listen for incoming SSH connections. # # (default: 0.0.0.0) = any IPv4 address #listen_addr = 0.0.0.0 # (use :: for listen to all IPv6 and IPv4 addresses) #listen_addr = :: # Port to listen for incoming SSH connections. # # (default: 2222) #listen_port = 2222 # SSH Version String # # Use these to disguise your honeypot from a simple SSH version scan # Examples: # SSH-2.0-OpenSSH_5.1p1 Debian-5 # SSH-1.99-OpenSSH_4.3 # SSH-1.99-OpenSSH_4.7 # SSH-1.99-Sun_SSH_1.1 # SSH-2.0-OpenSSH_4.2p1 Debian-7ubuntu3.1 # SSH-2.0-OpenSSH_4.3 # SSH-2.0-OpenSSH_4.6 # SSH-2.0-OpenSSH_5.1p1 Debian-5 # SSH-2.0-OpenSSH_5.1p1 FreeBSD-20080901 # SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu5 # SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu6 # SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7 # SSH-2.0-OpenSSH_5.5p1 Debian-6 # SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze1 # SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2 # SSH-2.0-OpenSSH_5.8p2_hpn13v11 FreeBSD-20110503 # SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1 # SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2 # SSH-2.0-OpenSSH_5.9 # # (default: "SSH-2.0-SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2") ssh_version_string = SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2 # Source Port to report in logs (useful if you use iptables to forward ports to Cowrie) #reported_ssh_port = 22 # Public and private SSH key files. If these don't exist, they are created # automatically. rsa_public_key = data/ssh_host_rsa_key.pub rsa_private_key = data/ssh_host_rsa_key dsa_public_key = data/ssh_host_dsa_key.pub dsa_private_key = data/ssh_host_dsa_key # sftp_enabled enables the sftp subsystem sftp_enabled = true # SSH forwarding # Useful for forwarding protocols to other honeypots # This enables redirecting forwarding requests to another address ssh_forward_redirect = false # (default: false) # forward_redirect_ = : forward_redirect_80 = 127.0.0.1:8080 forward_redirect_443 = 127.0.0.1:8443 # If you want to record SMTP traffic, install SMTP honeypoint. # (e.g https://github.com/awhitehatter/mailoney), run # python mailoney.py -s yahoo.com -t schizo_open_relay -p 12525 forward_redirect_25 = 127.0.0.1:12525 forward_redirect_587 = 127.0.0.1:12525 # ============================================================================ # Database logging Specific Options # ============================================================================ # XMPP Logging # Log to an xmpp server. # #[database_xmpp] #server = sensors.carnivore.it #user = anonymous@sensors.carnivore.it #password = anonymous #muc = dionaea.sensors.carnivore.it #signal_createsession = cowrie-events #signal_connectionlost = cowrie-events #signal_loginfailed = cowrie-events #signal_loginsucceeded = cowrie-events #signal_command = cowrie-events #signal_clientversion = cowrie-events #debug=true # ============================================================================ # Output Plugins # These provide an extensible mechanism to send audit log entries to third # parties. The audit entries contain information on clients connecting to # the honeypot. # ============================================================================ # JSON based logging module # [output_jsonlog] logfile = log/cowrie.json # Supports logging to Elasticsearch # This is a simple early release # #[output_elasticsearch] #host = localhost #port = 9200 #index = cowrie #type = cowrie # Send login attemp information to SANS DShield # See https://isc.sans.edu/ssh.html # You must signup for an api key. # Once registered, find your details at: https://isc.sans.edu/myaccount.html # #[output_dshield] #userid = userid_here #auth_key = auth_key_here #batch_size = 100 # Local Syslog output module # # This sends log messages to the local syslog daemon. # Facility can be: # KERN, USER, MAIL, DAEMON, AUTH, LPR, NEWS, UUCP, CRON, SYSLOG and LOCAL0 to LOCAL7. # # Format can be: # text, cef # #[output_localsyslog] #facility = USER #format = text # Text output # This writes audit log entries to a text file # # Format can be: # text, cef # #[output_textlog] #logfile = log/audit.log #format = text # MySQL logging module # Identical functionality as [database_mysql] but with different internals # Database structure for this module is supplied in doc/sql/mysql.sql # #[output_mysql] #host = localhost #database = cowrie #username = cowrie #password = secret #port = 3306 # SQLite3 logging module # # Logging to SQLite3 database. To init the database, use the script # doc/sql/sqlite3.sql: # sqlite3 < doc/sql/sqlite3.sql # #[output_sqlite] #db_file = cowrie.db # Splunk SDK output module - EARLY RELEASE NOT RECOMMENDED # This sends logs directly to Splunk using the Python REST SDK # #[output_splunk] #host = localhost #port = 8889 #username = admin #password = password #index = cowrie # HPFeeds # #[database_hpfeeds] #server = hpfeeds.mysite.org #port = 10000 #identifier = abc123 #secret = secret #debug=false # VirusTotal output module # You must signup for an api key. # #[output_virustotal] #api_key = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef #