Cowrie is an open-source honeypot solution designed to simulate a vulnerable SSH and Telnet service. It is primarily used to log brute force attacks and shell interaction performed by attackers. This article will guide you through the process of setting up Cowrie on a Linux system, providing practical examples and commands to get you started.

Prerequisites

Before you begin, ensure you have the following:

• A Linux server (Ubuntu/Debian-based systems are preferred for this guide)
• Root or sudo access to the server
• Basic knowledge of SSH and Linux command line

Step 1: Update Your System

First, ensure your system is up-to-date. Open a terminal and run:

sudo apt update && sudo apt upgrade -y

Step 2: Install Dependencies

Cowrie requires several dependencies. Install them using the following command:

sudo apt install -y git python3 python3-venv python3-dev libssl-dev libffi-dev build-essential

Step 3: Clone the Cowrie Repository

Navigate to your home directory and clone the Cowrie repository from GitHub:

cd ~
git clone https://github.com/cowrie/cowrie.git

Step 4: Set Up a Python Virtual Environment

Navigate into the Cowrie directory and create a Python virtual environment:

cd cowrie
python3 -m venv cowrie-env

Activate the virtual environment:

source cowrie-env/bin/activate

Step 5: Install Cowrie

With the virtual environment activated, install Cowrie's Python dependencies:

pip install -r requirements.txt

Step 6: Configure Cowrie

Copy the example configuration file to create your own configuration:

cp etc/cowrie.cfg.dist etc/cowrie.cfg

Edit etc/cowrie.cfg to customize your Cowrie setup. You can change the default SSH port, logging settings, and more.

Step 7: Start Cowrie

To start Cowrie, ensure your virtual environment is activated and run:

bin/cowrie start

Cowrie will now be running, simulating a vulnerable SSH service.

Step 8: Monitor Logs

Cowrie logs all interactions in the var/log/cowrie directory. You can monitor these logs to analyze attack patterns:

tail -f var/log/cowrie/cowrie.log

Step 9: Stop Cowrie

To stop Cowrie, use the following command:

bin/cowrie stop

Conclusion

By following these steps, you have successfully set up a Cowrie honeypot on your Linux system. This tool will help you gain insights into the types of attacks targeting your network and improve your security posture.