How to Setup “Cowrie” — An SSH Honeypot

David French
Oct 1, 2018 · 4 min read

Cowrie is a medium interaction SSH and Telnet honeypot, which can log brute force attacks and an attacker’s shell interaction. Cowrie is an open source project developed by Michel Oosterhof.

This post provides instructions on how to configure a Cowrie SSH honeypot on an Ubuntu 16.04 system. I recommend that you configure Cowrie on a cloud server instance that you can manage via the console connection.

Change the Port You’ll Use to Administer the Server

Cowrie will be listening for SSH connections on port 22. You’ll want to configure the SSH service to listen on a different port for you to connect to and administer the server.

Under # What ports, IPs and protocols we listen for, change the port number to 3393 or your preferred port number.

Write your changes and quit vi.

Restart the SSH service.

By running the command below, you can see that the server is now listening for connections on port 3393.

Install and Configure Cowrie

Download updated package lists.

Install Cowrie’s dependencies.

Add a new user named, cowrie.

Switch to the new user, cowrie

Navigate to the home directory of user, cowrie, and clone the cowrie git repository.

Create a new Python virtual environment for cowrie.

Activate the virtual environment.

The terminal will display (cowrie-env) before the username, cowrie.

Install pycrypto, Crypto and other requirements.

Generate a key for the cowrie instance.

Additional Cowrie Configuration

Make a copy of the config file for your new cowrie instance.

Set the hostname in the configuration file to a server name of your choice. E.g. fileserver4

Change the Port to listen for incoming SSH connections to port 22.

Write your changes and quit vi.

Enable authbind in cowrie’s file.

Change line 2 to read:

Start Cowrie

Execute the following commands to start Cowrie.

Verify cowrie is listening on port 22 by running the command below.

Execute the following command to stop Cowrie.

How to Stop and Start the SSH Service (Running on the Custom Port You Chose Earlier)

If your server is accessible via a console in your cloud provider’s management console, you may want to disable the SSH service on your server and enable it only when you need to establish a SSH connection to administer it.

This will prevent SSH brute force attacks against the real listening service.

Execute the following command to stop the SSH service.

Validate that the server is no longer listening on the custom SSH port. You should see that Cowrie is still listening on port 22.

Execute the following command to start the SSH service.

Test Connectivity to the Cowrie Honeypot

Connect to your server on port 22, enter any password and you will be authenticated successfully.

Execute some commands for Cowrie to log.

Review the Cowrie Log File

Connect to your server (not the Cowrie instance) and review the log file.

The attacker’s IP address will be shown in the red areas in the image below.

Threat Punter

Threat Hunting | Threat Detection | Digital Forensics