greyfield - Real-time cloud honeypot and threat observatory ca

项目说明

Greyfield

Greyfield is a defensi honeypot and public threat obser. It uses
Cowrie to record unsolicited SSH and Telnet
activity on an isolated Oracle Cloud Infrastructure instance, then publishes a
sanitized, e view of what reached the decoy.

Open the li Threat Obser →

Public research sensor: 137.23.33.116 — SSH on 22/tcp and Telnet on
23/tcp. These are isolated Cowrie deception services; they do not provide
access to the underlying host.

The public dashboard covers source infrastructure, credential pressure,
attacker-supplied commands, payload retrie, and MITRE ATT&CK
techniques supported by retained e. It ne raw Cowrie logs,
session identifiers, TTY recordings, captured files, operator addresses,
administrator access details, or cloud secrets.

What this project demonstrates

Architecture

Collection stays private on the is outbound-only, and every
field must pass the repository's schema and privacy checks before deployment.
The telemetry branch is deliberately orphaned from master; GitHub may show
it as ahead or behind because it is a rolling two-file data channel, not a code
branch intended for merging or pull requests.

The sensor is intentionally disco through this repository and the live
obser. Internet-wide indexes such as Shodan already crawl public services;
indexing confirms exposure but does not guarantee additional attacks or broader
ATT&CK co. Greyfield measures obser rather than manufacturing
traffic or inflating event counts.

See docs/ARCHITECTURE.md for the trust boundaries and
docs/DASHBOARD.md for the public-data contract.

Supported baseline

| Component | Supported configuration |
|---|---|
| Cloud host | OCI .E2.1.Micro, x86-64, 1 GB RAM |
| Operating system | Canonical-Ubuntu-22.04-2026.08.25-0 |
| Honeypot | Cowrie 3.0.13 |
| Administration | Windows 10/11 with OpenSSH |

Ubuntu 24.04 is intentionally outside the supported baseline because its ufw
package conflicts with the iptables-persistent dependency used by the current
redirect-persistence procedure.

Network model

| Public port | Host destination | Access |
|---|---|---|
| 22/tcp | Cowrie SSH on 2222 | Internet |
| 23/tcp | Cowrie Telnet on 2323 | Internet |
| 2223/tcp | Real OpenSSH server | Administrator IPv4 /32 only |

Real SSH must be from a second, independent terminal on port 2223
before public port 22 is handed to Cowrie. That gate is mandatory.

Staged deployment

1. Pro the OCI network and Ubuntu instance with the
OCI deployment guide.
2. Clone Greyfield to /opt/greyfield while real SSH still uses port 22.
3. Follow the numbered stages in docs/RUNBOOK.md.
4. Confirm every administrator-access, listener, firewall, persistence, and
logging gate before ad.
5. Configure telemetry publication separately with
docs/DASHBOARD.md.

The stages are intentionally not combined. Final acti occurs only after
administrator SSH and both Cowrie listeners have been pro.

E boundary

Greyfield may publish globally routable source IPs, approximate country/city/ASN
context, attempted credentials, inert command text, artifact URLs with query
material removed, SHA-256 hashes, and qualified provider obser.

Before aggregation, the exporter remo operator addresses and all
non-public sources. It redacts email-, token-, pri, and URL-query-like
patterns. The independently rejects forbidden fields, unexpected
files, stale snapshots, cross-record inconsistencies, and data outside the
publication ceilings.

Interpretation remains deliberately constrained:

Repository map

Run the same core checks enforced by CI before changing deployment behavior or
the public e contract:

The dashboard workflow additionally the latest telemetry snapshot and
ATT&CK Na layer before GitHub Pages receives an artifact.

Safety

Use Greyfield only on a dedicated disposable host. Do not place personal data,
production services, reusable credentials, unrelated SSH keys, raw logs,
captured malware, or cloud secrets in this repository. Cowrie may make outbound
requests while emulating attempted downloads; ne a captured sample.

License

Released under the MIT License. Copyright © 2026 Swaraj Singh.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Real-time cloud honeypot and threat observatory capturing internet attacks, analyzing adversary behavior, producing threat intelligence, and mapping activity to MITRE ATT&CK.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。