Cowrie Honeypot

• SSH Honeypot

Installing Cowrie in seven steps — cowrie 2.6.1 documentation

sudo adduser --disabled-password cowrie

sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222

• -t nat specifies the table in which the rule should be added. Here, it is the network address translation (NAT) table.
• -A PREROUTING specifies that the rule should be appended to the PREROUTING chain. The PREROUTING chain is traversed by packets as soon as they come in, before any routing decisions are made.
• -p tcp specifies the protocol to which the rule should apply. Here, it is TCP.
• --dport 22 specifies the destination port. Here, it is port 22, which is commonly used for SSH (Secure Shell) connections.
• -j REDIRECT specifies the target of the rule. It instructs iptables to redirect the packet to another destination instead of its original destination. Here, the destination will be redirected.
• --to-port 2222 specifies the port to which the packet should be redirected. Here, it is port 2222. So, any incoming TCP packets to port 22 will be redirected to port 2222.

The Log files are in <Cowrie_Installation_Folder>/var/log/cowrie