Skip to content

v1.0 — first stable release

Choose a tag to compare

View all tags
@gistrec gistrec released this 04 Jul 02:41
v1.0
This tag was signed with the committer’s verified signature.
gistrec Aleksandr Kovalko
GPG key ID: 6DC26207619C9EDD
Verified
Learn about vigilant mode.
a09842f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

One script turns an nginx box into a scanner trap: the first probe of /.env, /.git/config, /backup.sql and friends gets a 404 — and its IP gets banned on all ports by fail2ban + nftables, with incremental bans up to a week.

Highlights

  • Safe by default. Detects and validates your admin IP, refuses to run without a whitelist (the ban covers SSH too), keeps backups outside the config tree, rolls everything back if nginx -t fails — and re-runs are idempotent.
  • Verified install, not hopeful install. At setup time the script proves the whole chain: the jail loaded, it watches the honeypot log through the file backend (not journald), and a synthetic ban of a TEST-NET IP (192.0.2.1) actually lands in nftables — then gets unbanned.
  • Honest CLI. Correct exit codes on every path, --help works when piped, and the summary never claims "Honeypot is live" when nothing got wired or nginx is down.
  • Documented uninstall — four copy-paste, symlink-safe steps.
  • EN + RU READMEs with CI-enforced script checksums for the verify-before-run step.

Install

Follow the quick start: download → verify → read → run.

Checksums of setup-honeypot.sh at this release:

  • MD5 294548fc150f9b812a50ee99aaeb6cff
  • SHA-256 efc79f2d1317bdb5aeb22e8570a6ecde0869bfbf227c8e61672a5847c27c5c28
Assets 3
Loading