SuckerPot v0.1.0

Added

• Bootstrap (M0) and foundations (M1): MIT licence, project rules, roadmap, architecture and security docs, a gitleaks pre-commit hook and CI; the shared event schema, a Redis Streams pipeline, a TimescaleDB schema with Alembic migrations, an ingest consumer and an API with a live WebSocket feed.
• Demo data generator (just demo): synthetic sessions across all four sensors with documentation IP ranges only, plus a live mode.
• SSH sensor: OpenSSH 9.6 fingerprint, configurable weak logins, an emulated shell on a fake filesystem, download recording without fetching, and timed session recording for replay.
• Telnet sensor: BusyBox telnetd look-alike with Mirai-style flows.
• Web sensor: byte-identical Apache 2.4.58 with PHP 8.3, fake WordPress and phpMyAdmin pages, and PHP2Shell (upload-progress) detection.
• RDP sensor: Windows Server look-alike with NLA and username capture.
• Enrichment: GeoIP and ASN from DB-IP Lite (no key) or MaxMind GeoLite2, optional AbuseIPDB and GreyNoise Community reputation with a 24 h cache and enforced daily quotas.
• Tagging: a declarative YAML rules engine without regular expressions (recon, mirai, crypto-miner, malware-drop, php2shell).
• Dashboard: Live (3D globe and event feed), Overview (KPIs and auto-written insights), Attacks, Session detail with terminal replay, Attackers, Trends, Malware (defanged URLs) and Settings, in dark and light on desktop and mobile; a design system; a screenshot mode (?mask=1); Playwright screenshots.
• Dashboard login: a single admin account with an argon2 password hash, CSRF protection and a rate-limited login.
• Retention and storage: raw events kept 90 days, aggregates forever, compression, a disk guard, and just backup / just restore.
• Hardened Docker Compose stack with a host firewall template in scripts/host/.
• Documentation site (Sphinx, Read the Docs) and a project page.
• Repository meta: README, CONTRIBUTING.md, SECURITY.md, issue and pull request templates, Dependabot and release-note configuration.

Security

• No attacker input is ever executed: every sensor passed several rounds of adversarial security review (the web sensor's final review is pending).
• Isolation: four networks with an internal backend, one Redis ACL user per sensor limited to XADD on its own stream, least-privilege database roles, no outbound route for the API, non-root read-only containers with all capabilities dropped.
• The first review of the M1 stack found unbounded stream growth, egress, poison-message and default-credential issues; all were fixed and the second pass passed.

Before exposing a host

Read the go-live checklist in the documentation (docs/deployment.md): apply the host firewall template, keep the dashboard port reachable only from your reverse tunnel, generate strong secrets, and run SuckerPot only on an isolated machine you are ready to lose.