v0.43.0 — optional Suricata IDS

Update both sides: Huginn, and the honeypot (update-honeypot.sh). Suricata itself is optional and stays off until you turn it on.

New

• Optional Suricata IDS on the honeypot. One command installs and starts it: ./update-honeypot.sh --suricata-on (or install-honeypot.sh --suricata). It matches the traffic to the honeypot against the free Emerging Threats Open rules (about 52,000) and Huginn names known attacks by rule and CVE.
  • Nothing to set up in your router. Suricata runs on the honeypot and only listens on its own network card: no mirror port, never blocks anything. Your admin SSH is left out (this machine's address and port, in each direction).
  • Where it shows: a card IDS alerts on each attacker page, Campaigns › IDS alerts with a page per rule and the addresses that tripped it, and Settings › Honeypot (on, running, age of the rules, last 7 days). A severity 1 rule (an attack) adds 3 to the score and tags the attacker ids-alert; scans and information are shown but not scored.
  • Locked down: only alerts on traffic to the honeypot are exported, as a few fixed fields (no payloads). Suricata drops root to its own user after opening the network card, runs in a systemd sandbox that cannot see /home, and is capped at 900 MB of memory. Its log folder stays root's.
  • Rules: updated daily when the honeypot has internet. Without internet, download emerging.rules.tar.gz elsewhere and load it with --suricata-rules FILE. New rules are always tested with the installed Suricata first and swapped in as a whole; the previous set is kept and comes back if Suricata does not start.
  • Needs about 500 MB of memory: give the honeypot 2 GB. See Suricata IDS (optional) in the README.
• Help has a section on IDS alerts; the JSON export of an attacker includes its IDS alerts.

Reviewed twice by a second AI (Codex) before release; the findings, including a capture filter that an attacker could have dodged by connecting from the admin port number, are fixed.

Update

On Huginn: cd Huginn && git pull && sudo ./update-huginn.sh (or the new huginn_all.deb / Docker image).
On the honeypot: cd Huginn && git pull && sudo ./update-honeypot.sh, then optionally sudo ./update-honeypot.sh --suricata-on.

Huginn 0.42.0: new Settings, goodbye toggle, clickable Overview

This release covers 0.41.0 and 0.42.0. Update both sides: Huginn and the honeypot (update-honeypot.sh, once, for the new Settings toggle).

New

• Settings, rebuilt. A menu of sections, one Save button per part that only saves that part, status badges (On, Off, Not configured, Update required) and shorter texts. Lookups state the free and keyed limits instead of guessing your traffic.
• Goodbye on logout from Settings. The optional logout note (0.40) is turned on and off under Settings › Honeypot, and the card shows how often it was shown and to how many addresses. It is the only thing Huginn can change on the honeypot: the locked export key accepts exactly goodbye on or goodbye off, checks the result, and gives the normal export for anything else.
• Clickable Overview. Every number at the top links to the list behind it: Took the bait opens the attackers who took the bait in the last 7 days, Files captured the Files page, Time wasted the receipt, On blocklist the Blocklist. New this week links its attackers, countries and malware families too.
• Account: the changelog is as tall as the System card and scrolls.
• Buy me a coffee in the footer and under Settings › About.

Fixed

• The metrics token is no longer written into the Settings page; Copy fetches it when clicked.
• The ntfy destination shows the host only, never user:password@ from the URL.
• Primary buttons on Settings have readable text in the dark theme.
• Demo: links with & resolved to the wrong page.

Update

On Huginn: cd Huginn && git pull && sudo ./update-huginn.sh (or the new huginn_all.deb / Docker image).
On the honeypot: cd Huginn && git pull && sudo ./update-honeypot.sh.

Huginn 0.40.0: optional goodbye on logout, faster Campaigns

Update both sides: Huginn and the honeypot (update-honeypot.sh) — the honeypot gets one new Cowrie patch.

New

• An optional goodbye, off by default. Turn it on with ./update-honeypot.sh --goodbye-on (off again with --goodbye-off, no restart). When someone who really logged in types exit or logout, they get a short note:

    Thanks for the 4 min 12 s, 203.0.113.7.
    You typed 9 lines. All of it is logged, along with your address.
    Say hi to the rest of the botnet.
  

  It only shows at the very end, after the session is fully logged, and never for sh -c, scripts, nested shells or bots that just disconnect. It does tell whoever reads it that this is a honeypot, and a bot that types exit can learn to recognise yours, which is why it is off unless you choose it. The session log shows who got it; Account › Honeypot protection shows whether it is on (never an alert).

Fixed and improved (from a review before release)

• Campaigns is fast with long scripts. 0.39's comparison of alike scripts could take seconds on crafted scripts with thousands of repeated commands. It now groups rows by the shape of their first commands, compares sorted neighbours and reads at most 1,000 commands per script (60 alike scripts: about 0.4 s instead of 8 s).
• Scripts that differ only in an address or number are compared as the same step; two rows that read the same no longer both say "ends after".
• Safer Cowrie upgrades. update-honeypot.sh --cowrie puts Huginn's patches back if git pull or pip install fails, and says honestly whether that worked.
• The honeypot's status report checks a file is regular and not a symlink before reading it.

Update

On Huginn: cd Huginn && git pull && sudo ./update-huginn.sh (or the new huginn_all.deb / Docker image).
On the honeypot: cd Huginn && git pull && sudo ./update-honeypot.sh.

Huginn 0.39.0: tell alike campaigns apart, script preview

Only the Huginn machine needs updating. The honeypot side is unchanged since 0.30.

New

• Campaigns: alike scripts are easy to tell apart. When several command scripts start with the same commands (telnet bots often share their first five or more), each such row now shows the first command where it differs from the others, marked in orange, for example differs at command 8: iptables -F. A script that is only a shorter copy of another says same start, ends after N commands. Differences are compared the same way campaigns are grouped, so another address or number does not count.
• Script preview on every Campaigns row: all commands numbered, the differing one marked, so you can choose what to open without opening it. Plain HTML, no script needed.

Changed

• The JSON log setting now says it is for log tools such as Grafana Loki, Graylog or Elasticsearch, not only Loki.

Thanks to the person on X who tried the demo and asked for this.

Update

cd Huginn && git pull && sudo ./update-huginn.sh (backup first, rolls back by itself if it fails), or install the new huginn_all.deb, or pull the new Docker image.

Huginn 0.38.0: Prometheus metrics, Grafana dashboard, JSON logs

Only the Huginn machine needs updating. The honeypot side is unchanged since 0.30.

New

• Prometheus metrics on /metrics, off until you turn them on in Settings > Metrics (or set HUGINN_METRICS_TOKEN). Read with a bearer token; a new token stops the old one at once. Events per source, kind and decoy service, active and new attackers, SSH/Telnet sessions and logins, captured files, blocklist size, repeated decoy tries not stored, sync time and errors, collection problems, lookup allowances, database size and the last backup. Counts only: never addresses, usernames, passwords or commands.
• Grafana dashboard ready to import: examples/grafana/huginn-dashboard.json, plus an example Prometheus job in examples/prometheus-huginn.yml.
• JSON logs for log tools such as Grafana Loki, Graylog or Elasticsearch, off by default: HUGINN_LOG_FORMAT=json gives one JSON object per line, so you can filter or alert on fields. It covers syncs, collection problems, logins to Huginn, refused metrics requests, failed backups, HTTP errors and every new error Huginn shows on its pages. HUGINN_LOG_LEVEL sets how much. Without it the journal stays as quiet as before.
• GreyNoise key on the Settings page, like the VirusTotal and MalwareBazaar keys (0.37). Without a key Huginn now asks at most 20 addresses a day, under the free allowance; with one, 40.

Upgrade

sudo ./update-huginn.sh from the new source (backup and automatic rollback), apt install ./huginn_all.deb, or docker compose pull && docker compose up -d.

Huginn 0.37.0: VirusTotal, MalwareBazaar and GreyNoise lookups, Engagement page, review fixes

Only the Huginn machine needs updating. The honeypot side is unchanged since 0.30.

New

• Outside lookups. VirusTotal verdicts for captured files (only the SHA-256 is sent, never the file), MalwareBazaar family names and tags, and GreyNoise for attacker addresses: is it a known mass scanner, and a benign one? Benign scanners count as research unless they logged in or ran something. All three keys can be pasted on the Settings page (Lookups), where they are tested and never shown again. Each service has its own daily allowance and pauses itself when it is used up.
• Engagement page. How far attackers get once they are in, day by day: left at once, proxy only, ran commands, went for a payload, sessions typed by hand, median stay, new or returning. Compare before and after a release.
• Terminal size of each session (most bots report 240×24).
• Help page and tooltips on every tag. Shortcut g h.

Fixed (deep security and bug review)

• A pasted chmod line with thousands of digits could make the attacker page slow (regex backtracking). The regex is bounded and the ATT&CK scan reads at most 64 KB of commands per page.
• The decoy cap never drops a web attack, a bait hit or a login with a new kind of password, and knows rows by their content, so two hits in the same second both count and a resent line is never counted twice.
• Lookups never follow redirects and only use HTTPS, so a key only ever goes to its own service.
• A changed GreyNoise answer takes the research mark off again; web exploits and bait use always keep an attacker on the blocklist.
• A collection source that stopped stays alerted for 30 days instead of two.
• MalwareBazaar copes with odd answers and pauses on a refused key.
• Engagement counts late commands of long sessions and uses a true median; the timeline always shows the newest activity; Files is faster.

Upgrade

sudo ./update-huginn.sh from the new source (backup and automatic rollback), apt install ./huginn_all.deb, or docker compose pull && docker compose up -d. Without a GreyNoise key Huginn now asks at most 20 addresses a day (HUGINN_GREYNOISE_DAILY overrides).

Huginn 0.31.0: attacker timeline, ATT&CK labels, collection health, programs that run

Update both the Huginn machine and the honeypot. The honeypot gets two new Cowrie patches and a new hp-export.

New

• Attacker timeline. The attacker page opens with the last 30 days across every service: web requests, tarpit, decoy logins, SSH and Telnet sessions, files and programs run, merged per kind of activity, each step with a phase (Recon, Access, Commands, Payload, Exploit).
• MITRE ATT&CK labels on commands, for example T1105 tool transfer, T1098.004 SSH keys, T1053.003 cron, T1496 mining, linked to MITRE, on the timeline and on every session.
• Folded sessions. The same command script is shown once with "×N like this"; sessions that only connected or only tried to log in are folded into two groups. Chips filter to sessions with commands or with logins.
• Uploaded programs "run". A program uploaded for the persona's CPU exits silently instead of failing with "Exec format error", so bots go on to their next step; the run, its arguments and the file's hash are logged. Nothing is ever executed.
• wget answers like the persona's own wget: BusyBox words on the camera, no "connected" before a connection fails, no name lookup for an address.
• Collection health. An alert (ntfy) when no sync works for 30 minutes or a source is quiet for longer than its own longest silence last week, and again when it is back. Account lists every source; /healthz adds collection_problems.
• Protection report. The honeypot reports its sandbox and memory/file limits per service, running services and every Huginn patch; Huginn shows it and alerts when something goes missing.
• Phone alert for web exploits recognised by the rules, with their CVE.
• Decoy cap. The first 2,000 decoy-service events per IP, service and day are stored, the rest only counted (HUGINN_DECOY_CAP); one VNC brute forcer alone was nearly a fifth of a database. Existing history is trimmed once on update. Account shows how fast the data folder grows and when the disk would be full.
• Wider screens get three columns on the Overview and two on Campaigns; Campaigns shows IPs in the last 7 days with an Active filter; Files has a chip per malware family; the Blocklist explains the whole scoring; visible keyboard focus and chart labels for screen readers.

Updating

git pull && ./update-huginn.sh      # on the Huginn machine
git pull && ./update-honeypot.sh    # on the honeypot (restarts Cowrie once)

The one-time decoy trim deletes stored repeats above the cap (they stay counted); update-huginn.sh takes a backup first.

Huginn 0.27.3: a new raven banner for light and dark

New

• A new raven banner on the Overview, in a dark and a light version. Huginn shows the one that matches your theme (Auto, Light or Dark), with the text colour to match. The crop keeps the raven's head and eye visible on wide screens and phones.

No changes to the honeypot side in this release.

Updating

git pull && ./update-huginn.sh      # on the Huginn machine

If the old banner still shows, reload the page once (the browser caches the picture).

Huginn 0.27.1: web attacks, fake replies, a proxy that seems to work, Cowrie fixes

This release contains security and robustness fixes for the honeypot. Please update both the Huginn machine and the honeypot.

Security and reliability

• One upload to the SSH honeypot could fill the disk or exhaust memory: Cowrie's upload limit only counted bytes received, so a single byte written far past the end of a file made a huge sparse file that Cowrie then read whole. Uploads are now capped at 10 MB by file size too, also when no limit is configured.
• Cowrie and OpenCanary get a memory cap and a 128 MB per-file limit (setup-sandbox.sh, drop-in huginn-limits.conf), so a flood restarts one service instead of taking the honeypot down. If a service does not start with the limits, they are removed again.
• The fake mail server's 10-minute session cap now covers the whole session, also while a message is being sent slowly.
• Huginn's patches to Cowrie and OpenCanary are written all at once or not at all, never through a symlink, and an earlier version of a patch is only replaced when it is recognised exactly.

New

• Board: a second Overview layout with every service side by side on one time axis.
• Web attacks: every request to the web trap is matched against about 3,100 rules from Krawl (MIT). CVE exploits, traversal, webshells, .env/.git hunting, scanners and MCP probes get a name, a tag (web-exploit, web-probe), a Campaigns page with a CVE link, and are searchable by CVE.
• Fake replies and a robots.txt trap: the web trap answers .env, .git, AWS, phpinfo, traversal, PHPUnit, actuator and MCP probes with fake files holding your bait values, and serves a robots.txt with paths found nowhere else (robots-trap).
• A proxy that seems to work: most bots that log in to the SSH honeypot only want a proxy. A plain HTTP proxy check now gets an empty 200 page and TLS is held for up to 30 s. Nothing is ever forwarded. Campaigns › Proxy use shows what they fetch.
• Slow replies: the fake mail server waits 1–2.5 s before "queued" (after the message is logged), and the robots-only backup file trickles out over about 4.5 s. Campaigns › Slow replies sums up 7 days.
• Two Cowrie fixes: ping -c N never worked in Cowrie, so the usual network check failed and most telnet bots left there. And a file uploaded over SFTP or scp vanished before the next command, so the bot's chmod +x failed. Both are patched; an uploaded file now stays for the whole connection.
• VNC passwords count as logins, and the mail relay trap keeps every recipient, the HELO name and the start of each message. Campaigns groups mail clients by HELO name.
• CI checks every week that all honeypot patches still fit the newest Cowrie and OpenCanary.

Updating

git pull && ./update-huginn.sh      # on the Huginn machine
git pull && ./update-honeypot.sh    # on the honeypot

update-honeypot.sh restarts Cowrie and OpenCanary once to apply the patches and limits.

Huginn 0.23.1: security fixes, web trap identities

This release contains security fixes. Please update.

Security and reliability

• A specially crafted command line sent to the honeypot could freeze Huginn for minutes. It needed no login and no page view. Fixed.
• Web requests containing / were counted as logins and ended up on the password lists and exports. Fixed for new data, and older lines are recognised.
• A failed update of the New page left permanent holes. It now resumes from a saved position.
• Backup and restore-db could collide, and an interrupted restore could lose recent data. Restore now takes the database for itself and folds in the write-ahead log first. It also refuses a database that is not Huginn's.
• One huge captured file could stop all file analysis.
• A reverse DNS name containing a word like research could keep an attacker off the blocklist. A name now has to be a known scanner domain that resolves back to the address.
• The ipset and MikroTik feeds now clear IPv6 when the list becomes empty. Use v6=0 on a firewall without IPv6.
• The database file is no longer readable by other users on the machine.

New

• The web trap on ports 80 and 443 can pretend to be 19 NAS and router brands and changes by itself every few weeks (hp-identity, ROTATE_DAYS). Personas shows hits per day for each device.
• A visual pass: clearer attacker pages, shorter lists on phones, commands before hashes in Campaigns and New, a warm colour for rare finds, a terminal-style Replay with a timeline, bars on Personas.
• Time wasted has a receipt, and the raven in the header reacts once to a new find.
• Releases include a Debian package and Docker files that work without cloning the repository.

Updating

git pull && ./update-huginn.sh      # on the Huginn machine
git pull && ./update-honeypot.sh    # on the honeypot

Scanners that were excluded because of their reverse DNS are looked up again after the update, so some may be on the blocklist for a short while.