Security Center:Configure Cloud Honeypot

Configuration process

Step 1: (Optional) Build a cloud proxy server for an on-premises IDC

If you want to deploy cloud honeypots on servers without public IP addresses in an on-premises IDC, you must build a cloud honeypot proxy server in the IDC. Then, configure the proxy IP address when you create a probe in Security Center to enable honeypot proxy access.

1. Prepare at least one server for the honeypot proxy and make sure that GCC and zlib-devel are installed on the server.

2. Download an NGINX version that supports reverse proxy.

   Cloud honeypots use HTTPS connections and require Layer 4 proxy. Add the --with-stream parameter when you compile and install NGINX.

   tar -xvf nginx-1.9.0.tar.gz
   cd nginx-1.9.0
   ./configure --without-http_rewrite_module --with-stream
   make
   make install

3. In the /usr/local/nginx/conf/ directory of the NGINX application, modify the nginx.conf configuration file.

   #user nobody;
   worker_processes auto;
   error_log logs/error.log;
   
   #error_log logs/error.log notice;
   error_log logs/error.log info;
   pid logs/nginx.pid;
   
   events {
       use epoll;
       worker_connections 60000;
   }
   
   stream {
           server {
               listen 1337;
               proxy_timeout 10m;
               proxy_connect_timeout 60s;
               proxy_pass proxy1337;
           }
           upstream proxy1337 {
              #You can view the management node IP on the Management Node tab of Cloud Honeypot > Configuration Management
              server #management-node-IP#:1337; 
           }
   
           server {
               listen 1338;
               proxy_timeout 10m;
               proxy_connect_timeout 60s;
               proxy_pass proxy1338;
           }
           upstream proxy1338 {
             #You can view the management node IP on the Management Node tab of Cloud Honeypot > Configuration Management
              server #management-node-IP#:1338; 
           }
   }
   				

4. After the configuration file is modified, run the following command to start NGINX.

   /usr/local/nginx/sbin/nginx

Step 2: Add a management node

A management node provides honeypot services. The traffic forwarded by probes is ultimately sent to various honeypot services configured on the management node. The management node is the core and foundation of the entire system.

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Risk Governance > Cloud Honeypot > Configuration Management.

3. On the Configuration Management page, click Manage Nodes tab, and then click Create Management Node. Configure the parameters to create a management node and click OK.

   Parameter	Description
   Management Node Name	Set the name of the management node.
   Assigned Probes	Set the number of probes for the management node. The number must be at least 20 and at most 100. If the value exceeds 100, the system automatically sets it to 100. We recommend that you install 2 to 3 host probes per CIDR block and 1 VPC black hole probe per VPC. Probes are used to redirect traffic. Cloud honeypots support host probes and VPC black hole probes. Host probe: installs a client on the host to forward traffic from local ports to the backend honeypot cluster. VPC black hole probe: When IP_A in a VPC accesses a non-existent internal IP address IP_B, the network device redirects the traffic to the VPC black hole probe. The VPC black hole probe establishes a normal connection between IP_A and honeypot IP_C based on the configured honeypot mapping rules. This operation is transparent to IP_A. A host probe is installed on a host to redirect port traffic to the honeypot service. A VPC black hole probe is deployed in a VPC to redirect traffic destined for non-existent internal IP addresses to the honeypot service.
   CIDR Block Allowed	Set the allowed CIDR blocks for the management node and host probes. These are the egress IP addresses of the probes that are allowed to access the management node. Default value: 0.0.0.0/0. You can specify up to 100 allowed CIDR blocks. Probes need to communicate with the management node during service. Make sure that the egress IP addresses of the probes are within the allowed CIDR blocks.
   Allow Honeypot Access Internet	Set whether to allow honeypots on this management node to access the Internet. Important If you enable this feature, security risks may arise. Attackers may successfully intrude into the honeypot and launch strong attacks. If this feature is disabled, only attack detection is supported. This is suitable for internal network scenarios.

4. After a management node is created, its Management Node Status is Preparing. This status lasts for about 5 minutes. Wait until the Management Node Status changes to Normal.

Step 3: (Optional) Honeypot templates

The honeypot template feature allows you to configure different custom attributes for different honeypot types to build honeypots that match your business scenarios and simulate more realistic applications. The honeypot types that support custom attributes include but are not limited to website titles, OA background images, and web page data. You can customize honeypot templates based on your business needs.

1. On the Configuration Management page, click the Honeypot Templates tab. Select a honeypot type on the left and click Create Template.

2. In the Create Template panel, configure the honeypot template parameters and click OK.

   Parameter	Description
   Template Name	Set the name of the honeypot template.
   Manage Nodes	Select the management node for deploying cloud honeypots. This is the management node created in Step 1.

   Note

   The settings of other parameters in the honeypot template may vary slightly depending on the honeypot type. For more information about the settings, contact technical support.

Step 4: Add a honeypot

A honeypot is the basic unit of the honeypot service. The system provides many built-in honeypot images. You can create honeypot instances from these images to provide honeypot services.

1. On the Configuration Management page, click the Honeypot Management tab and click Create Honeypot.

2. In the Create Honeypot panel, configure the honeypot parameters and click OK.

   Parameter	Description
   Name	Set the name of the honeypot.
   Manage Nodes	Select the management node for deploying cloud honeypots. This is the management node created in Step 1.
   Honeypot Type	Select the type of the honeypot. The following categories are available: Web Advanced Special Defect System Service Database
   Honeypot Custom Configurations	Select this checkbox to configure custom attributes for the honeypot. You can configure different custom attributes for different honeypot types to build honeypots that match your business scenarios and simulate more realistic applications. The honeypot types that support custom attributes include but are not limited to website titles, OA background images, and web page data. You can also configure Honeypot Templates in advance and then import the configurations by clicking Import Template Configurations. For information about how to configure custom honeypots and Honeypot Templates, contact technical support.

Step 5: Add a probe

A probe is a tool for traffic redirection. It redirects abnormal traffic from hosts or networks to the honeypot service. There are two types of probes: VPC probes and host probes.

1. On the Configuration Management page, click the Probe Management tab and choose Add Probe > Host Probe or VPC Probe.

2. In the probe configuration panel, configure the probe parameters and click OK.

   • The following table describes the parameters for adding a host probe:

     Parameter	Description
     Probe Name	Set the name of the probe.
     Manage Nodes	Select the management node corresponding to the server where the probe is deployed. This is the management node created in Step 1.
     Proxy IP Address	If you deploy cloud honeypots on on-premises IDC servers through a proxy server, enter the IP address of the proxy server. Otherwise, leave this field empty.
     Host for Probe Deployment	Select the server where the probe is deployed.
     Configure Service	Set the name and listening port of the honeypot to which access traffic is forwarded. Note The listening port is a port on the host (such as an ECS instance). The probe redirects traffic to the honeypot through this port. Make sure that no other services on the host occupy this port. This port is exclusively for the probe.

   • The following table describes the parameters for adding a VPC black hole probe:

     Important

     You can only create honeypot instances in Alibaba Cloud VPCs. Honeypot instances cannot be created in other networks. Each VPC supports only one honeypot instance. VPC black hole probes can be deployed only in specific regions. For more information, see Cloud honeypot overview.

     Parameter	Description
     Probe Name	Set the name of the probe.
     Manage Nodes	Select the management node corresponding to the server where the probe is deployed. This is the management node created in Step 1.
     Deployed VPC	Select the VPC where the probe is deployed.
     Configure Service	Set the name and listening port of the honeypot to which access traffic is forwarded.

What's next

After cloud honeypots are configured, the honeypots redirect attackers to decoy applications through probes. The honeypots record attack information and generate alert events. You can view and handle alert events to improve the security defense of your servers and VPCs. For more information, see View and handle alert events.