Rooba
/
cowrie
mirror of https://github.com/cowrie/cowrie.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io
1,998 Commits 2 Branches 21 Tags 58 MiB
Python 98.4%
Shell 0.7%
Makefile 0.5%
Dockerfile 0.4%
Go to file
Florian Pelgrim be3a7235a5 Small config changes (#845) 
* Adding /etc/cowrie/cowrie.cfg to possible configurations

We want also to look for /etc/cowrie/cowrie.cfg as a possible
configuration.

* Write ssh host keys into /var/lib/cowrie

Dynamical data should be written into /var/lib/cowrie.
I know that OpenSSH is doing this but we are not OpenSSH and we should
have only stuff written below /var.
So /var/log/cowrie and /var/lib/cowrie.

* Moving log and dl below var/, cleanup old folders

This helps keeping the writes of the daemon in one place and makes it
easier later when building a cowrie package.

Old paths have been removed from the repository to keep it clean.

* Fixing wrong log path

Path should be var/log/cowrie not var/log

* Fixing json output

The json output was not configured to use the default log path. This has
been fixed now.

* Change order of config reads

According to @micheloosterhof there is an order of precedence here.
 		2018-08-25 03:02:56 +04:00
.github add SUPPORT 2018-07-20 22:01:38 +04:00
bin Flake8 fixes (#857) 2018-08-18 15:52:45 +04:00
data move pickle file 2018-06-28 03:31:05 +04:00
docs doc/ -> docs/ 2018-07-20 22:12:30 +04:00
etc Small config changes (#845) 2018-08-25 03:02:56 +04:00
honeyfs throw off TSM 2018-04-20 10:29:56 -05:00
share add .dist setting, remove process.py, move json 2018-07-07 18:11:32 +00:00
src Small config changes (#845) 2018-08-25 03:02:56 +04:00
var Small config changes (#845) 2018-08-25 03:02:56 +04:00
.gitattributes cowrie rename 2015-05-12 14:57:29 +00:00
.gitignore Ignore PyCharm's folder (#724) 2018-04-09 10:56:19 +04:00
.travis.yml Flake8 fixes (#857) 2018-08-18 15:52:45 +04:00
CHANGELOG.md changelog with key update 2018-08-11 22:19:12 +04:00
CONTRIBUTING.md move contributing info to seperate file 2018-02-11 04:19:38 +00:00
Dockerfile Small config changes (#845) 2018-08-25 03:02:56 +04:00
INSTALL.md Update install guide steps for updating Cowrie (#840) 2018-08-02 12:40:37 +04:00
LICENSE.md move license file to more popular location 2017-07-10 15:49:44 +04:00
MANIFEST.in use graft 2018-02-04 18:50:39 +00:00
README.md remove duplicate docker entries 2018-07-28 19:16:12 +04:00
requirements-output.txt update docs for mysql 2018-08-12 11:06:29 +04:00
requirements.txt recent twisted no longer requires gmpy2 2017-07-16 20:30:41 +04:00
setup.py Flake8 fixes (#857) 2018-08-18 15:52:45 +04:00

README.md

Cowrie

Travis CI Status

Welcome to the Cowrie GitHub repository

This is the official repository for the Cowrie SSH and Telnet Honeypot effort.

What is Cowrie

Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.

Cowrie is developed by Michel Oosterhof.

Slack

You can join the Cowrie community at the following Slack workspace

Features

Some interesting features:

  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
  • Session logs are stored in an UML Compatible format for easy replay with original timings with the bin/playlog utility.
  • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection

Additional functionality over standard kippo:

  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
  • Logging in JSON format for easy processing in log management solutions
  • Many, many additional commands

Docker

Docker versions are available.

Requirements

Software required:

  • Python 2.7+, (Limited Python 3 support available for SSH only)
  • python-virtualenv

For Python dependencies, see requirements.txt

Files of interest:

  • cowrie.cfg - Cowrie's configuration file. Default values can be found in etc/cowrie.cfg.dist
  • data/fs.pickle - fake filesystem
  • data/userdb.txt - credentials allowed or disallowed to access the honeypot
  • dl/ - files transferred from the attacker to the honeypot are stored here
  • honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use bin/fsctl
  • honeyfs/etc/issue.net - pre-login banner
  • honeyfs/etc/motd - post-login banner
  • log/cowrie.json - transaction output in JSON format
  • log/cowrie.log - log/debug output
  • log/tty/*.log - session logs
  • txtcmds/ - file contents for the fake commands
  • bin/createfs - used to create the fake filesystem
  • bin/playlog - utility to replay session logs

Is it secure?

Maybe. See FAQ

I have some questions!

Please visit https://cowrie.slack.com/ and join the #questions channel

Contributors

Many people have contributed to Cowrie over the years. Special thanks to:

  • Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based
  • Dave Germiquet (davegermiquet) for TFTP support, unit tests, new process handling
  • Olivier Bilodeau (obilodeau) for Telnet support
  • Ivan Korolev (fe7ch) for many improvements over the years.
  • And many many others.