GoPot — Multi-Port TCP Honeypot

GoPot is a lightweight, multi-port TCP honeypot written in Go. It listens on configurable ports, responds with realistic service banners, and logs all connection details in structured JSON — designed for network threat monitoring and integration with fail2ban.

Features

• Multi-Port Listening — Listen on arbitrary TCP ports simultaneously, configured via YAML.
• Realistic Service Banners — Per-port banners that mimic real services (SSH, HTTP, MySQL, RDP, SMB, etc.).
• Structured JSON Logging — Uses zerolog for structured logs written to both console (human-readable) and file (JSON), with automatic rotation via lumberjack.
• Concurrency Control — Configurable maximum concurrent connections with semaphore-based limiting.
• Connection Timeout — Configurable read/write deadline per connection.
• Payload Logging — Logs both raw and hex-encoded client data for binary protocol analysis.
• Graceful Shutdown — Context-based shutdown on SIGINT/SIGTERM, draining active connections cleanly.
• Fail2ban Integration — Ships with fail2ban filter and jail configs for automatic IP banning.

Getting Started

Prerequisites

• Go 1.21 or later
• Git

Install

git clone https://github.com/jackyes/GoPot.git
cd GoPot
go mod tidy
go build -o GoPot .

Usage

Edit config.yaml to set your ports, banners, and limits, then run:

./GoPot

Configuration

All settings are in config.yaml:

Key	Description	Default
ports	List of TCP ports to listen on	—
max_connections	Max concurrent connections (capped at 10000)	100
connection_timeout	Read/write deadline in seconds	10
banners	Per-port banner strings ("port": "banner")	—

Fail2ban Setup

1. Copy the filter config:

   cp fail2ban/mygopot.conf /etc/fail2ban/filter.d/mygopot.conf

2. Add the jail to /etc/fail2ban/jail.local:

   [mygopot]
   enabled = true
   port = all
   filter = mygopot
   logpath = /path/to/gopot.log
   maxretry = 1
   findtime = 600
   bantime = 3600
   backend = auto
   banaction = iptables-allports

3. Restart fail2ban:

   systemctl restart fail2ban

Logs

Logs are written to gopot.log in JSON format and rotated automatically (10 MB per file, 3 backups, 28 days retention, gzip compression). Console output is pretty-printed for real-time monitoring.

Contributing

Pull requests are welcome. For major changes, open an issue first.