T-Pot Honeypot Lab

A defensive honeypot lab for observing internet attack traffic and practicing Linux administration, access control, and security telemetry analysis.

Executive Summary

I deployed the T-Pot honeypot framework on a dedicated Ubuntu virtual machine and used Kibana to review the resulting attack telemetry. The lab gave me hands-on practice with Linux package management, non-root administration, SSH access, firewall configuration, and the analysis of source IP, reputation, geographic, and attack-pattern data.

The system was used only as a dedicated learning environment; it was never treated as a trusted host or connected to production data.

Architecture

flowchart LR
    A["Internet attack traffic"] --> B["Dedicated Ubuntu VM"]
    B --> C["T-Pot honeypot services"]
    C --> D["Centralized event data"]
    D --> E["Kibana dashboards"]
    E --> F["Analyst review"]

Loading

Skills Demonstrated

• Updating and administering an Ubuntu server
• Creating a non-root user with appropriate sudo access
• Configuring SSH and firewall rules for lab administration
• Deploying and validating T-Pot services
• Reviewing honeypot events in Kibana
• Interpreting source IPs, reputation data, geographic patterns, and attack telemetry
• Separating an exposed research system from trusted environments

Technology

Function	Tool
Operating system	Ubuntu Linux
Honeypot platform	T-Pot
Log exploration and visualization	Kibana
Infrastructure	Dedicated cloud VM
Administration	SSH and firewall rules

Full Walkthrough

The deployment notes and screenshots are in How to Install T-Pot Honeypot Framework on a Linux VM.

Next Iteration

I am expanding the documentation with a network diagram, sanitized event samples, an attack-trend summary, hardening notes, and an incident-report-style analysis of selected events.

Honeypots are intentionally exposed research systems. This lab used a dedicated environment and did not contain production credentials or business data.