Loading...
This Docker container starts a SSH honeypot (based on Cowrie) and enables the DShield output module to report statistics to the SANS ISC DShield project. Building the image: # git clone https://github.com/xme/dshield-docker # cd dshield-docker # docker build -t dshield/honeypot . Running the image: First, create a configuration file which will contain your DShield account details: # cat env.txt DSHIELD_UID=xxxxxxxxxx DSHIELD_APIKEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx DSHIELD_EMAIL=xxxxxxxxxxxxxxxxxxx Your credentials will be validated and the honeyport properly configured. Don't forget to register[1] if you don't already have an account. [1] https://www.dshield.org/register.html Boot the container: # docker run -d -p 2222:2222 --env-file=env.txt --restart=always --name dshield dshield/honeypot b56e526b6f7c9b6cb419245757b0586f73d7e99089fa93409f3626122990505a # docker logs dshield Validating provided credentials... API key verification succeeded! Starting cowrie... The honeypot is listening to port
Common questions about DShield Docker including features, pricing, alternatives, and user reviews.
DShield Docker is A Docker container that starts a SSH honeypot and reports statistics to the SANS ISC DShield project. It is a Security Operations solution designed to help security teams with SSH.
A low-interaction SSH authentication logging honeypot that logs all authentication attempts in JSON format.
A modified version of OpenSSH deamon forwarding commands to Cowrie for logging brute force attacks and shell interactions.
Get strategic cybersecurity insights in your inbox