Security Center:Configure Cloud Honeypot

Prerequisites

Before you begin, ensure that you have:

• Enabled the cloud honeypot feature. For more information, see Purchase the cloud honeypot feature.

• (For data center servers without a public IP address) A proxy server configured in your data center. See Build a proxy server in a data center below.

Build a proxy server in a data center

Skip this section if your servers have public IP addresses.

Honeypots use HTTPS connections, so you need a Layer 4 HTTPS reverse proxy (not a Layer 7 proxy). NGINX 1.9.0 supports this via the --with-stream parameter.

Requirements: GNU Compiler Collection (GCC) and zlib-devel must be installed on the proxy server.

Step 1: Download and compile NGINX

1. Download NGINX 1.9.0.

2. Compile and install NGINX with stream module support:

   tar -xvf nginx-1.9.0.tar.gz
   cd nginx-1.9.0
   ./configure --without-http_rewrite_module --with-stream
   make
   make install

Step 2: Update the NGINX configuration

Edit /usr/local/nginx/conf/nginx.conf and replace the contents with the following. Substitute <management-node-ip> with the IP address shown in the IP address of management node column on the Management Node tab (navigate to Risk Governance > Cloud Honeypot > Configuration Management in the Security Center console).

#user nobody;
worker_processes auto;
error_log logs/error.log;

#error_log logs/error.log notice;
error_log logs/error.log info;
pid logs/nginx.pid;

events {
    use epoll;
    worker_connections 60000;
}

stream {
        server {
            listen 1337;
            proxy_timeout 10m;
            proxy_connect_timeout 60s;
            proxy_pass proxy1337;
        }
        upstream proxy1337 {
           server <management-node-ip>:1337;
        }

        server {
            listen 1338;
            proxy_timeout 10m;
            proxy_connect_timeout 60s;
            proxy_pass proxy1338;
        }
        upstream proxy1338 {
          server <management-node-ip>:1338;
        }
}

Step 3: Start NGINX

/usr/local/nginx/sbin/nginx

How it works

The setup involves three components working together:

• Management node — the central controller. Honeypots run on management nodes, and probes forward captured traffic to them.

• Honeypot — the decoy application (web server, database, etc.) that lures attackers.

• Probe — the traffic redirector deployed on a host or VPC. A host probe intercepts traffic on specified ports. A VPC probe intercepts traffic destined for non-existent internal IP addresses and transparently routes it to a honeypot.

Deploy in this order: management node → honeypot (and optionally a template) → probe.

Step 1: Create a management node

1. Log in to the Security Center console. In the top navigation bar, select the region of the asset: China or Outside China.Log on to the Security Center console.

2. In the left-side navigation pane, choose Risk Governance > Cloud Honeypot > Configuration Management.

3. On the Management Node tab, click Create Management Node.

4. In the panel that appears, configure the following parameters and click OK.

After creation, the management node status shows Preparing for approximately 5 minutes, then changes to Normal. Wait for Normal before continuing.

Step 2: (Optional) Create a honeypot template

Honeypot templates let you pre-configure custom attributes — such as website titles, office automation (OA) background images, and web page data — so honeypots better simulate your real applications. Create a template when you want to reuse the same custom configuration across multiple honeypots.

1. On the Honeypot Template tab of the Configuration Management page, select a honeypot type on the left and click Create Template.

2. In the Create Template panel, configure the parameters and click OK.

Available parameters vary by honeypot type. For additional customization options, submit a ticket to contact technical support.

Step 3: Create a honeypot

A honeypot is the individual decoy instance. The system provides built-in honeypot images for each supported type.

1. On the Honeypot Management tab of the Configuration Management page, click Create Honeypot.

2. In the Create Honeypot panel, configure the following parameters and click OK.

Step 4: Create a probe

A probe redirects unusual traffic from hosts or networks to a honeypot. Two probe types are available:

• Host probe — installs a client on the host and forwards traffic on specified ports to the honeypot cluster.

• VPC probe — when an IP address (IP_A) in the VPC tries to reach a non-existent internal IP address (IP_B), the VPC probe intercepts the traffic and transparently routes IP_A to the honeypot (IP_C).

1. On the Probe Management tab of the Configuration Management page, click Add Probe, then click Host Probe or VPC Probe.

2. Configure the parameters for your probe type and click OK.

Host probe parameters

VPC probe parameters

What's next

After the probe is deployed, the honeypot diverts attacks away from your real servers. Attackers interact with the decoy, and Security Center records their activity and generates alerts.

To review and respond to these alerts, see View and handle alert events.