[5 Mins Docker] Deploy a free, simple and safe honeypot to detect the potential attackers - NETSEC


Learning, Sharing, Creating

Cybersecurity Memo

Saturday, June 29, 2024

[5 Mins Docker] Deploy a free, simple and safe honeypot to detect the potential attackers

HFish is a community free honeypot that focuses on enterprise security scenarios. It provides users with independently operable and practical functions from three scenarios: intranet loss detection, internet threat awareness, and threat intelligence production. It increases users' capabilities in the field of loss awareness and threat intelligence through a secure, agile, and reliable middle and low level interactive honeypot.

HFish has more than 40 honeypot environments, free cloud honeynet, highly customizable honeybait capability, one click deployment, cross platform multi architecture, domestic operating system and CPU support, extremely low performance requirements, email/syslog/webhook/enterprise WeChat/nail/fly book alarm and other features to help users reduce operation and maintenance costs and improve operational efficiency.



HFish is widely used to sense the horizontal movement of lost hosts in office intranet, production environment, cloud intranet and other environments, employee account leakage, scanning and detection behavior, private intelligence production and even internal drills and security awareness training. Various alarm output forms of HFish are combined with state, NDR, XDR or log platforms to greatly expand the detection vision.

HFish adopts B/S architecture, and the system consists of a management end and a node end. The management end is used to generate and manage the node end, and receive, analyze and display the data returned from the node end. The node end receives the control of the management end and is responsible for building the honeypot service.

System Requirements:


Docker Installation Pre-requisites

Free resources you might need to complete this docker project:

Pre-installed services:

  • Docker, 
    • apt update
    • apt install docker.io
    • apt install docker-compose
    • apt upgrade docker.io
    • mkdir /root/data/docker_data/<docker_name>
  • Docker-Compose (Using Ubuntu OS for the commands)
    • Docker-compose down
    • Optional command : use following command to backup your Docker data. You might need to change your folder name based on your docker configuraiton
      • cp -r /root/data/docker_data/<docker_name> /root/data/docker_data_backup/<docker_name>
    • docker-compose pull
    • docker-compose up -d
    • docker image prune
  • Portainer (Optional)
    • docker volume create portainer_data
    • docker run -d -p 9000:9000 --name portainer --restart always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest
  • Install some applications: apt install wget curl sudo vim git (Optional)
  • aapanel with Nginx (Optional)
  • Nginx Proxy Manager (Optional)
  • Install screen (Optional)
    • Install screen (Depends on the Linux Distribution if it came pre installed or not) : yum install screen
    • Initiate a Screen : screen or  screen -S <screen name> <command to execute>
    • Detach from the screen : "CTRL+A,D" not "CTRL+A+D"
    • List all the screen currently working : screen -ls
    • Reattach to a screen : screen  -r  <session number> or screen -r <screen name>
    • Kill specific screen: screen -X -S <screen name> quit
    • Kill all screens : pkill screen
  • Monitoring Usage
      • Docker stats
  • Remove Docker and Related folders
  • docker stop <Docker Name> # stop the docker but not remove anything. 
  • docker rm -f <Docker Name>  # remove speficic container, but will not delete mapped volumes
  • rm -rf /root/data/docker_data/<Docker Mapped Volumns>  # remove all mapped volumes

Docker Installation Steps


1 Pre-requisites verification

Docker version

2  Docker Run command :

docker run -itd --name hfish \
-v /usr/share/hfish:/usr/share/hfish \
--network host \
--privileged=true \

3 Docker Run command with auto-upgrade

docker run -d    \
 --name watchtower \
 --restart unless-stopped \
  -v /var/run/docker.sock:/var/run/docker.sock  \
  --label=com.centurylinklabs.watchtower.enable=false \
--privileged=true \
  containrrr/watchtower  \
  --cleanup  \
  hfish \
  --interval 3600

4 Log in

Make sure firewall opened port 4433 tcp. But if you have opened all ports to Internet for your Honeypot, you can ignore this 4433 port. 

Web Address:https://[server]:4433/web/ Username:admin Password:HFish2021




Threat Monitor

in 30 minutes, I got 11 attack and 538 times scanning. 

Node info:

After a couple of days, screen shows much more informaiton:

Linux / Windows Installation Commands

For Linux:  

For Windows: 

Web Address:https://[server]:4433/web/ Username:admin Password:HFish2021


HFish Honeypot Project- Easiest To Deploy in 5 Minutes(Docker) - 2020


Docker Hub: 

  • https://hub.docker.com/r/threatbook/hfish-server

  • https://github.com/hacklcx/HFish-English/
  • https://github.com/hacklcx/HFish
  • https://hfish.net/#/docs

  • https://a8dog.com/da-jian-yi-ge-hfish-mi-guan-jie-shou-quan-wang-gong-ji

No comments:

Post a Comment