Haydn Cowley

Write-ups

Building a honeypot on my home network

Eight fake services that nothing should ever touch. If anything does, I know about it straight away.

2 min readBy Haydn
Goal
Get an early warning if anything on my network starts poking around
Result
Every test hit logged
Tools
OpenCanary, systemd, UFW, Kali Linux

The idea

A honeypot is a trap: fake services that look real but that no legitimate device should ever use. I set up OpenCanary with an old-looking SSH server, Telnet, FTP, MySQL, Remote Desktop, VNC, Redis and a fake NAS login page. If anything connects, it's logged.

I kept it on my home network only. A honeypot on the internet would catch more, but it would mean opening ports and exposing my home IP, and a bug in the honeypot would put an attacker on the same Pi as everything else.

Locking the trap down

  • It runs as its own canary user with no login, not root.
  • systemd sandboxing: it can only write to its own log folder and can't gain privileges.
  • It's limited to 200 MB of memory.

What went wrong

It kept crashing: "no new privileges flag is set, which prevents sudo". OpenCanary's start script tries to use sudo, and my sandbox blocks that on purpose. Running the engine directly as the canary user fixed it, with no root needed at all.

The memory limit wasn't working: Raspberry Pi OS turns off the memory cgroup by default. Adding cgroup_enable=memory cgroup_memory=1 to the boot settings fixed it.

I nearly leaked my own email: while testing I typed my real email into the fake NAS login, and the live page would have shown it. Now the public page only shows common attacker usernames like root or admin, and never passwords or IP addresses.

Testing it

From my Kali Linux VM I connected to the fake SSH server and logged in to the fake NAS page. Both were logged straight away and appeared on the attack map (press A).

What I learned

  • On a healthy network a honeypot should be boring. Quiet is the good outcome.
  • Sandboxing a service can break it in surprising ways, and the fix is usually to give it less, not more.
  • Anything you display publicly needs filtering, even data from your own tests.

How I used AI: Claude wrote the honeypot config and the attack map. I installed it, fixed it with Claude's help and ran the tests from Kali. The full, unedited notes are in my build log.