首页 on 博客首页

cowrie

Mon, 20 Apr 2026 00:00:00 +0000

cowrie#

介绍#

git地址：https://github.com/cowrie/cowrie 文档地址：https://docs.cowrie.org/en/latest/

安装#

目录结构#

cowrie
├── bin
├── CHANGELOG.rst
├── CONTRIBUTING.rst
├── docker
├── docs
├── etc
├── fs
├── honeyfs
├── INSTALL.rst
├── LICENSE.rst
├── Makefile
├── MANIFEST.in
├── pyproject.toml
├── README.rst
├── requirements-output.txt
├── requirements.txt
├── share
├── src
└── var

安装部署#

apt-get install git python3-pip python3-venv libssl-dev libffi-dev build-essential libpython3-dev python3-minimal authbind
adduser --disabled-password cowrie
git clone http://github.com/cowrie/cowrie
python3 -m venv cowrie-env
source cowrie-env/bin/activate
cowrie start
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222

配置文件及字典文件#

配置文件#

# cowrie.cfg
[honeypot]
sensor_name= iZj6cgqnpiye12okkzx3fxZ
hostname = iZj6cgqnpiye12okkzx3fxZ
log_path = var/log/cowrie
download_path = ${honeypot:state_path}/downloads
data_path = src/cowrie/data
state_path = var/lib/cowrie
etc_path = etc
contents_path = /cowrie/honeyfs
txtcmds_path = txtcmds
ttylog = true
ttylog_path = ${honeypot:state_path}/tty
idle_timeout = 180
authentication_timeout = 120
backend = shell
logtype = rotating
timezone = Asia/Shanghai
auth_class = UserDB
[backend_pool]
pool_only = false
recycle_period = 1500
listen_endpoints = tcp:6415:interface=127.0.0.1
save_snapshots = false
snapshot_path = ${honeypot:state_path}/snapshots
config_files_path = ${honeypot:data_path}/pool_configs
network_config = default_network.xml
nw_filter_config = default_filter.xml
libvirt_uri = qemu:///system
guest_config = default_guest.xml
guest_privkey = ${honeypot:state_path}/ubuntu18.04-guest
guest_tag = ubuntu18.04
guest_ssh_port = 22
guest_telnet_port = 23
guest_image_path = /home/cowrie/cowrie-imgs/ubuntu18.04-minimal.qcow2
guest_hypervisor = kvm
guest_memory = 512
guest_qemu_machine = pc-q35-bionic
use_nat = true
nat_public_ip = 192.168.1.40
[proxy]
backend = pool
backend_ssh_host = localhost
backend_ssh_port = 2022
backend_telnet_host = localhost
backend_telnet_port = 2023
pool_max_vms = 5
pool_vm_unused_timeout = 600
pool_share_guests = true
pool = local
pool_host = 192.168.1.40
pool_port = 6415
backend_user = root
backend_pass = root
telnet_spoof_authentication = true
telnet_username_prompt_regex = (\n|^)ubuntu login: .*
telnet_password_prompt_regex = .*Password: .*
telnet_username_in_negotiation_regex = (.*\xff\xfa.*USER\x01)(.*?)(\xff.*)
log_raw = false
[llm]
[shell]
filesystem = /cowrie/share/cowrie/fs.pickle
processes = ${honeypot:data_path}/cmdoutput.json
arch = linux-x64-lsb
kernel_version = 6.8.0-90-generic
hardware_platform = x86_64
operating_system = GNU/Linux
ssh_version = OpenSSH_9.6p1, OpenSSL 3.0.11  19 Sep 2023
[ssh]
enabled = true
rsa_public_key = ${honeypot:state_path}/ssh_host_rsa_key.pub
rsa_private_key = ${honeypot:state_path}/ssh_host_rsa_key
ecdsa_public_key = ${honeypot:state_path}/ssh_host_ecdsa_key.pub
ecdsa_private_key = ${honeypot:state_path}/ssh_host_ecdsa_key
ed25519_public_key = ${honeypot:state_path}/ssh_host_ed25519_key.pub
ed25519_private_key = ${honeypot:state_path}/ssh_host_ed25519_key
public_key_auth = ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
version = SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.3
ciphers = aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,cast128-cbc
macs = hmac-sha2-512,hmac-sha2-384,hmac-sha2-256,hmac-sha1,hmac-md5
compression = zlib@openssh.com,zlib,none
listen_endpoints = tcp:2222:interface=0.0.0.0
sftp_enabled = false
forwarding = false
forward_redirect = false
forward_tunnel = false
auth_publickey_allow_any = false
auth_keyboard_interactive_enabled = false
[telnet]
enabled = true
listen_endpoints = tcp:2223:interface=0.0.0.0
[output_jsonlog]
enabled = true
logfile = ${honeypot:log_path}/cowrie.json
epoch_timestamp = false
[output_textlog]
enabled = true
logfile = ${honeypot:log_path}/audit.log
format = text
[output_mysql]
enabled = true
host = 127.0.0.1
database = cowrie
username = cowrie
password = cowrie
port = 3306
debug = false
.....

字典文件#

# etc/userdb.txt
root:x:!
admin:x:!
ubuntu:x:!
centos:x:!

tomcat:x:*
oracle:x:*
*:x:somepassword
*:x:*

虚拟操作系统#

honeyfs/etc/
├── group
├── host.conf
├── hostname
├── hosts
├── inittab
├── issue
├── issue.net
├── motd
├── passwd
├── resolv.conf
└── shadow

自定义虚拟操作系统#

source cowrie-env/bin/activate
#reatefs -l YOUR-DIR -d DEPTH -o custom.pickle
reatefs -l / -d 3 -o custom.pickle
#cowrie.cfg
[shell]
filesystem = custom.pickle

自定义操作系统内存#

# 代码文件src/cowrie/commands/free.py
修改honeyfs/proc/meminfo

自定义操作系统CPU#

修改 honeyfs/proc/cpuinfo

其它配置#

honeyfs/etc/
├── group
├── host.conf
├── hostname #主机名
├── hosts 
├── inittab
├── issue # 虚拟操作系统信息
├── issue.net
├── motd # 虚拟操作系统欢迎信息
├── passwd
├── resolv.conf
└── shadow

记录登录账户密码等#

su - cowrie
source cowrie/cowrie-env/bin/activate
pip install mysql-connector-python

# mysql
CREATE USER 'cowrie'@'localhost' IDENTIFIED BY 'PASSWORD HERE';
GRANT INSERT, SELECT, UPDATE ON cowrie.* TO 'cowrie'@'localhost';

cd ~/cowrie/docs/sql/
mysql -u cowrie -p
USE cowrie;
source mysql.sql;

# cowrie.cfg
[output_mysql]
host = localhost
database = cowrie
username = cowrie
password = PASSWORD HERE
port = 3306
debug = false
enabled = true

cd ~/cowrie/bin/
./cowrie restart

应对方式#

Fail2ban#

# filter.d/cowrie.conf
[Definition]
failregex = New connection: <HOST>:\d+

# jail.d
[cowrie]
enabled = true
filter = cowrie
logpath =  /cowrie/var/log/cowrie/audit.log
maxretry = 5
findtime = 600
bantime = 7d
backend = polling
action = iptables-allports

ssh#

修改ssh服务的端口
使用密钥
禁止使用root远程登录
安全组白名单机制

gitea

Mon, 20 Apr 2026 00:00:00 +0000

gitea#

官网地址#

https://docs.gitea.com/zh-cn/ Gitea是一个轻量级的DevOps平台软件。与GitLab类似。最初是从Gogs分支而来。

安装#

数据库准备#

CREATE DATABASE giteadb CHARACTER SET 'utf8mb4' COLLATE 'utf8mb4_bin';
GRANT ALL PRIVILEGES ON giteadb.* TO 'gitea';
FLUSH PRIVILEGES;

二进制安装#

下载页面：https://dl.gitea.com/gitea/

# 下载
wget -O gitea https://dl.gitea.com/gitea/1.26.1/gitea-1.26.1-linux-amd64
chmod +x gitea

# 创建工作路径
mkdir -p /var/lib/gitea/{custom,data,log}
chown -R git:git /var/lib/gitea/
chmod -R 750 /var/lib/gitea/
mkdir /etc/gitea
chown root:git /etc/gitea
chmod 770 /etc/gitea

# 配置文件
RUN_USER = gitea
WORK_PATH = /var/lib/gitea
APP_NAME = git
RUN_MODE = prod

[repository]
ROOT = /var/lib/gitea/repositories
DISABLE_HTTP_GIT = false

[server]
DOMAIN = gitea.notesync.cn
HTTP_ADDR = 0.0.0.0
HTTP_PORT = 3000
ROOT_URL = https://gitea.notesync.cn/
APP_DATA_PATH = /var/lib/gitea/data
SSH_DOMAIN = gitea.notesync.cn

DISABLE_REGISTRATION = true
SHOW_REGISTRATION_BUTTON = false

[log]
MODE = file
LEVEL = info
ROOT_PATH = /var/log/gitea/log

[database]
DB_TYPE = mysql
HOST = 127.0.0.1:3306
NAME = giteadb
USER = gitea
PASSWD = gitea
SSL_MODE = disable


[service]
REGISTER_EMAIL_CONFIRM = false
ENABLE_NOTIFY_MAIL = false
DISABLE_REGISTRATION = true
ALLOW_ONLY_EXTERNAL_REGISTRATION = false
ENABLE_CAPTCHA = false
REQUIRE_SIGNIN_VIEW = false
DEFAULT_KEEP_EMAIL_PRIVATE = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING = true
NO_REPLY_ADDRESS = noreply.gitea.notesync.cn

DEFAULT_PRIVATE = private
FORCE_PRIVATE = true
DEFAULT_PUSH_CREATE_PRIVATE = true

#/etc/systemd/system/gitea.service
[Unit]
Description=Gitea
After=syslog.target
After=network.target

[Service]
RestartSec=3s
Type=simple
User=gitea
Group=gitea
WorkingDirectory=/var/lib/gitea/

ExecStart=/var/lib/gitea/gitea web --config /etc/gitea/config/app.ini
Restart=always
Environment=USER=gitea GITEA_WORK_DIR=/var/lib/gitea

[Install]
WantedBy=multi-user.target

act-runner#

文档地址#

https://docs.gitea.com/zh-cn/usage/actions/overview

nginx内置变量

Sat, 18 Apr 2026 00:00:00 +0000

nginx内置变量#

获取内置变量#

 location /var {
        default_type text/plain;

        # binary_remote_addr:$binary_remote_addr
        return 200
        '
        host:$host
        hostname:$hostname
        uri:$uri
        arg_name:$arg_name
        args:$args
        body_bytes_sent:$body_bytes_sent
        bytes_sent:$bytes_sent
        connection:$connection
        connection_requests:$connection_requests
        connection_time:$connection_time
        content_length:$content_length
        content_type:$content_type
        cookie_name:$cookie_name
        document_root:$document_root
        document_uri:$document_uri
        http_name:$http_name
        https:$https
        is_args:$is_args
        limit_rate:$limit_rate
        msec:$msec
        nginx_version:$nginx_version
        pid:$pid
        pipe:$pipe
        proxy_protocol_addr:$proxy_protocol_addr
        proxy_protocol_port:$proxy_protocol_port
        proxy_protocol_server_addr:$proxy_protocol_server_addr
        proxy_protocol_server_port:$proxy_protocol_server_port
        query_string:$query_string
        realpath_root:$realpath_root
        remote_addr:$remote_addr
        remote_port:$remote_port
        remote_user:$remote_user
        request:$request
        request_body:$request_body
        request_body_file:$request_body_file
        request_completion:$request_completion
        request_filename:$request_filename
        request_id:$request_id
        request_length:$request_length
        request_method:$request_method
        request_time:$request_time
        request_uri:$request_uri
        scheme:$scheme
        sent_http_name:$sent_http_name
        sent_trailer_name:$sent_trailer_name
        server_addr:$server_addr
        server_name:$server_name
        server_port:$server_port
        server_protocol:$server_protocol
        status:$status
        tcpinfo_rtt:$tcpinfo_rtt
        tcpinfo_rttvar:$tcpinfo_rttvar
        tcpinfo_snd_cwnd:$tcpinfo_snd_cwnd
        tcpinfo_rcv_space:$tcpinfo_rcv_space
        time_iso8601:$time_iso8601
        time_local:$time_local
        ';
    }

hugo基本用法

Fri, 17 Apr 2026 14:08:25 +0800

hugo#

下载地址#

https://github.com/gohugoio/hugo/releases/

主题地址#

https://themes.gohugo.io

创建网站#

hugo new site blog
cd blog
git init
git submodule add https://github.com/theNewDynamic/gohugo-theme-ananke.git themes/ananke
echo "theme = 'ananke'" >> hugo.toml

添加内容#

cd blog
hugo new content/posts/my-first-post.md

正文内容

---
title: "我的第一篇文章"
date: 2022-11-20T09:03:20-08:00
draft: true
---
## 简介

这是 **粗体** 文本，这是 *斜体* 文本。

访问 [Hugo](https://gohugo.io) 网站！

配置网站#

baseURL = 'https://example.org/'
languageCode = 'en-us'
title = '我的新 Hugo 网站'
theme = 'ananke'

发布网站#

cd blog
hugo