{"componentChunkName":"component---src-templates-post-template-js","path":"/honeypot-setup-on-azure-en","result":{"data":{"markdownRemark":{"id":"4d1c4a09-1851-52e9-a460-6043fcc9a4ac","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I’m planning to start playing around with Azure, and first of all, I’d like to deploy T-Pot, a honeypot I’ve been interested in for a while.

\n

Ever since I read the book Analyzing the Footprints of Cyber Attacks: Honeypot Observation Records, I’ve wanted to try this, but I couldn’t commit due to risks and cost concerns.

\n

This time, it seems I can do this nicely using Azure, so I’ll be setting up T-Pot on an Azure environment.

\n

I’m figuring things out as I go, but I’ll proceed with safety first.

\n

As I’m a beginner, the content of this article is not necessarily best practice, so I’ll add improvements as I find them.

\n

About this Article

\n

The content of this article is not intended to encourage acts that violate social order.

\n

Please be aware that attempting attacks on environments other than your own or those you have permission to access may violate the “Act on Prohibition of Unauthorized Computer Access (Unauthorized Access Prohibition Act)“.

\n

All statements are attributed to me personally, not to any organization I belong to.

\n\n

Table of Contents

\n\n

Things Decided & Confirmed in Advance

\n

Before creating a honeypot environment on Azure, I made the following two decisions and confirmations:

\n\n

I’ll pay particular attention to these two points.

\n

Avoiding Police Trouble

\n

I’m prioritizing this above all else lol

\n

If I were to be arrested and detained by the police, or summarily prosecuted like in the Coinhive case or Wizard Bible case, my PC would be seized and I wouldn’t be able to work, which would be game over.

\n

Even if I’m completely innocent, there can be losing events where the police misunderstand and conduct a home search, so it’s an impossible game, but I want to take as many countermeasures as possible.

\n

Reference: Life Continuation Plan in Case of Arrest - yashio

\n

In other cases, there are quite a few scary stories like “the police conducted a home search as a result of a site operated on a rental server being cracked” or “the administrator of a rental server where a fraudulent site was operated was questioned”.

\n

Honestly, I think there’s considerable risk for individuals living in Japan to engage in personal security-related activities.

\n

(That’s also why I’ve been avoiding setting up a honeypot for so long.)

\n

However, since I’ve decided to do it, I’ll work on operations that can avoid risks as much as possible.

\n

Specifically, as of 2022/02/09 when I decided to build this environment, I’m assuming the following points:

\n\n

Do Not Acquire or Store Malware or Unauthorized Programs

\n

First of all, T-Pot is roughly speaking a tool that can run various honeypots.

\n

Among these, there are honeypots aimed at collecting malware.

\n

Reference: What is a Honeypot? Actually Making and Touching One - Construction Edition | SIOS Tech. Lab

\n

For now, I plan to operate without using honeypots aimed at collecting malware.

\n

The reason is that I’m afraid of violating the crime related to unauthorized command electromagnetic records.

\n

While this law prohibits possession of malware “for malicious purposes”, unfortunately the criteria for this are quite ambiguous at present.

\n
\n

What is the crime of acquiring and storing viruses

\n

Without legitimate reason, for the purpose of having them executed automatically regardless of the user’s intention, acquiring or storing computer viruses or computer virus source code.

\n
\n

Reference: Crimes Related to Unauthorized Command Electromagnetic Records, Metropolitan Police Department

\n

The following site is very helpful as it summarizes the results of @it_giron’s disclosure requests to various prefectural police departments regarding the constituent requirements of “crimes related to unauthorized command electromagnetic records”.

\n

Reference: Status of Disclosure Requests to Prefectural Police Departments Regarding “Crimes Related to Unauthorized Command Electromagnetic Records” | IT Discussion

\n

Not 24/7 Operation, Automatic Shutdown Except When Manually Started

\n

For the time being, I plan to operate the honeypot machine by stopping it at night using Azure’s auto-shutdown function.

\n

Once the operation is established to some extent, I’ll extend the operating hours.

\n

Ensure Adequate Host Security Measures

\n

This is probably where the biggest risk lies.

\n

If the honeypot is compromised for some reason and becomes a BOT, it may attack other users or become a relay server for unauthorized files.

\n

To prevent this, I want to create security measures and monitoring mechanisms.

\n

For now, I’ll install the agent of Trend Micro Cloud One Workload Security on the machine where the honeypot is built.

\n

This security software can manage up to 5 machines for free, and can perform anti-malware, host-based IDS, critical file change monitoring, and application whitelist operations.

\n

(Also, I used it at my previous job and am personally familiar with its operation)

\n

Added note

\n

Unfortunately, as of 2022/01/31, the license system has changed and the free use of up to 5 machines is no longer available.

\n

Sad.

\n

Reference: “Free - 5 Computers” End of Support for Trend Micro Cloud One - Workload Security and Deep Security as a Service

\n

I’ll switch to an OSS EDR tool or similar soon.

\n

Establish Monitoring and Notification Systems for Host Operation Status

\n

I’ll properly monitor and operate the host’s operation status.

\n

I’ll forward various logs and events to Slack or Discord.

\n

For costs, I’m implementing SMS and email notifications.

\n

I summarized the cost alert settings in the following article.

\n

Reference: Checking Azure Active Directory ID Security Score

\n\n

Use a Bastion Machine Built on Azure to Connect to the Honeypot

\n

Since I’m not planning to collect malware this time, I don’t think there’s much risk, but to avoid accidentally bringing bad things from the honeypot to my environment, connections to the honeypot will be made via a bastion.

\n

Additional Note on Bastion Server

\n

Although I created a virtual machine for bastion access and allowed access via SSH port forwarding, the communication became very unstable.

\n

This is probably because the bastion machine has specs of 1vCPU / 1 RAM, but since increasing the bastion server’s specs is costly, I ultimately decided to access the T-Pot machine from a virtual machine built on my private machine.

\n

The bastion server on Azure will be used as a Syslog server running the Sentinel Agent, and for running honeypot monitoring tools and notification programs.

\n

Access to the T-Pot console was restricted by my home’s global IP address.

\n

Comply with Azure Terms

\n

This time I’m setting up a honeypot on Azure, so I checked the terms.

\n

Looking at Azure’s Q&A site, it seems that operating honeypots is not particularly prohibited.

\n

Reference: Deployed tpot on azure VM - Microsoft Q&A

\n

Reference: Investigating Whether Honeypot Operation Violates Terms #2 - Black Leopard’s Blog

\n

However, the following acts are prohibited, so care must be taken not to fall under these.

\n

In all cases, it’s okay if the scope of impact is only your own environment, and attacks on other users or Azure itself are NG.

\n

Prohibited Actions

\n\n

Permitted Actions

\n

Conversely, the following acts seem to be permitted:

\n\n

Building Virtual Machines on Azure

\n

The system requirements for T-Pot are as follows:

\n\n

To meet the above, I’ll create a Debian 10 (Buster) machine.

\n

To create the virtual machine, I’ll create the following resources first:

\n\n

Create Resource Group for Honeypot Environment

\n

By setting up a resource group, you can manage multiple resources together.

\n

Reference: Managing Resource Groups - Azure portal - Azure Resource Manager | Microsoft Docs

\n

This time I created a resource group as follows and also set tags.

\n

\n \n \n \n \n \n \n \n \n

\n

Create Security Group to Apply to Honeypot Machine

\n

Network security groups are filters for network traffic that Azure resources send and receive.

\n

Filters can be applied by associating them with virtual machine network interfaces or subnets.

\n

Reference: Azure Network Security Groups Overview | Microsoft Docs

\n

Reference: Network Security Groups - How It Works | Microsoft Docs

\n

\n \n \n \n \n \n \n \n \n

\n

Here, I created the following two types of security groups:

\n\n

The bastion server’s security group allows inbound connections from my private machine to SSH and HTTPS ports, and all outbound communications.

\n

For the SSH port, I’ll use a random port instead of port 22 just to be safe.

\n

By the way, security groups are designed with “default rules” that allow all inbound communication from VirtualNetwork, so here I explicitly add a setting to deny all inbound communication from VirtualNetwork.

\n

\n \n \n \n \n \n \n \n \n

\n

The idea is to set communications allowed on a VirtualNetwork basis, such as SSH, at higher priorities than this.

\n

Create Virtual Network for Honeypot Machine

\n

Azure virtual networks are elements that constitute private networks within Azure.

\n

By using Azure virtual networks, you can build private networks within Azure that are logically separated from other networks.

\n

Reference: Azure Virtual Network | Microsoft Docs

\n

Reference: What is Azure’s Virtual Network Azure VNet? Explaining Communication Methods and Fees

\n

This time I created a tightly restricted subnet space for now.

\n

\n \n \n \n \n \n \n \n \n

\n

You could also connect with a fixed IP, but it wastes costs and IP access lacks flexibility, so I think it’s good to set a DNS name.

\n

Building Azure Sentinel

\n

Azure Sentinel is a SIEM service provided by Azure.

\n

Reference: Azure Sentinel - Cloud-Native SIEM Solution | Microsoft Azure

\n\n

Install Linux Agent on Bastion Server

\n

For linking Cloud One and Azure Sentinel, detailed procedures are written in the “Data Connector” on the Azure Sentinel side as follows.

\n

\n \n \n \n \n \n \n \n \n

\n

This is all for now, but in the future it would be good to do some analysis on Azure Sentinel.

\n

Supplement: Expanding Honeypot Machine Disk

\n

If you need to add a disk to the virtual machine, after setting up the additional disk from the Azure console, you need to configure it the same way as mounting normally in Linux.

\n

First, check the disk list with `lsblk`.

\n

``` bash\n$ lsblk\nNAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT\nloop0 7:0 0 61.9M 1 loop /snap/core20/1328\nloop1 7:1 0 43.4M 1 loop /snap/snapd/14549\nloop2 7:2 0 67.2M 1 loop /snap/lxd/21835\nsda 8:0 0 128G 0 disk\nsdb 8:16 0 30G 0 disk\nsdb1 8:17 0 29.9G 0 part /\nsdb14 8:30 0 4M 0 part\nsdb15 8:31 0 106M 0 part /boot/efi\nsdc 8:32 0 16G 0 disk\nsdc1 8:33 0 16G 0 part /mnt\n```

\n

The disk I added this time is recognized as `sda`, so I’ll mount it.

\n

Since I added it as an empty new disk this time, I first need to create a partition.

\n

``` bash\nsudo parted /dev/sda —script mklabel gpt mkpart xfspart xfs 0% 100%\n```

\n

If you run `lsblk` again, `sda1` has been created, so format the XFS file system with the following command.

\n

``` bash\nsudo mkfs.xfs /dev/sda1\nsudo partprobe /dev/sda1\n```

\n

In the case of Debian instead of Ubuntu, you may need to install `xfsprogs` beforehand.

\n

``` bash\nsudo apt install xfsprogs\n```

\n

Reference: Fix “mkfs.xfs: No such file or directory” on CentOS/Ubuntu/Debian - TechViewLeo

\n

Finally, I created a `tpot` directory to install the honeypot and mounted `/dev/sda1`.

\n

``` bash\nmkdir ~/tpot\nsudo mount /dev/sda1 ~/tpot\n```

\n

If you run `lsblk` again, you can see that the mount is properly reflected.

\n

``` bash\n$ lsblk\nNAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT\nloop0 7:0 0 61.9M 1 loop /snap/core20/1328\nloop1 7:1 0 43.4M 1 loop /snap/snapd/14549\nloop2 7:2 0 67.2M 1 loop /snap/lxd/21835\nsda 8:0 0 128G 0 disk\nsda1 8:1 0 128G 0 part /home/azureuser/tpot\nsdb 8:16 0 30G 0 disk\nsdb1 8:17 0 29.9G 0 part /\nsdb14 8:30 0 4M 0 part\nsdb15 8:31 0 106M 0 part /boot/efi\nsdc 8:32 0 16G 0 disk\nsdc1 8:33 0 16G 0 part /mnt\n```

\n

Reference: Expanding Virtual Hard Disks for Linux VMs - Azure Virtual Machines | Microsoft Docs

\n

Creating Snapshots

\n

Since the preparation is mostly complete, I’ll finally install T-Pot, but before that, I’ll take a snapshot of the disk just in case.

\n

By taking a snapshot of the Azure disk, you can restore by rebuilding a new machine if there’s a problem.

\n

Honestly, even snapshots cost monthly fees which I don’t really want to use personally, but I’ll do it for now.

\n

The link below is easy to understand for detailed instructions.

\n

Reference: About VM Cloning Method part.3/3 Procedure to Clone from OS Disk Snapshot | Japan Azure IaaS Core Support Blog

\n

Just turn off the virtual machine and create a snapshot from the disk.

\n

Once the snapshot is created, finally install T-Pot.

\n

Installing T-Pot

\n

Before installing T-Pot, disable Cloud One’s anti-malware function.

\n

Then execute the following commands in order.

\n

``` bash\ncd ~/tpot\ngit clone https://github.com/telekom-security/tpotce\ncd tpotce/iso/installer/\n```

\n

Here, a file called `tpot.conf.dist` has the following settings written:

\n

``` bash

\n

tpot configuration file

\n

myCONFTPOTFLAVOR=[STANDARD, SENSOR, INDUSTRIAL, COLLECTOR, NEXTGEN, MEDICAL]

\n

myCONFTPOTFLAVOR=‘STANDARD’\nmyCONFWEBUSER=‘webuser’\nmyCONFWEBPW=‘w3b$ecret’\n```

\n

By default, the T-Pot type is `STANDARD`.

\n

Next, after changing the username and password arbitrarily, execute the following command.

\n

``` bash\ncp tpot.conf.dist tpot.conf\nsudo ./install.sh —type=auto —conf=tpot.conf\n```

\n

If this completes without problems, you’ll get output like the following.

\n

\n \n \n \n \n \n \n \n \n

\n

Now you can connect to the T-Pot machine’s local IP address via the bastion server.

\n

You can actually open the console by connecting to `https://:64297` in your browser.

\n

\n \n \n \n \n \n \n \n \n

\n

The T-Pot console looks cool!!

\n

\n \n \n \n \n \n \n \n \n

\n

Summary

\n

What I did this time is as follows:

\n\n

I haven’t yet opened the inbound ports of the T-Pot machine’s security group, so it’s not actually operational yet.

\n

I’ll decide from now on which honeypots included in T-Pot to use and what kind of analysis to do with Azure Sentinel.

\n

Reference Books

\n","fields":{"slug":"/honeypot-setup-on-azure-en","tagSlugs":["/tag/security-en/","/tag/honey-pot-en/","/tag/azure-en/","/tag/備忘録/","/tag/english/"]},"frontmatter":{"date":"2022-02-11","description":"","tags":["Security (en)","HoneyPot (en)","Azure (en)","備忘録","English"],"title":"A Novice Honeypotter Wants to Play Safely with T-Pot [Azure/Honeypot]","socialImage":{"publicURL":"/static/468e7a49d62ff965c34f93a43fc98e2c/honeypot-setup-on-azure.png"}}}},"pageContext":{"slug":"/honeypot-setup-on-azure-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}