Mike's Cybersecurity Path

Setting up a honeypot to capture and analyze malicious traffic is a valuable practice for anyone interested in cybersecurity. This guide walks you through deploying T-Pot—a robust honeypot solution—on an Azure Ubuntu VM from a Windows machine. We’ll also explore how to monitor attacks in real time via the T-Pot World Map.

Why Deploy a Honeypot?

A honeypot simulates a vulnerable target to lure cyber attackers, enabling you to observe and analyze attack patterns. In this guide, we’ll use T-Pot, an open-source platform that bundles multiple honeypots (such as Cowrie, Dionaea, and Honeytrap), providing an in-depth view of various attack methods.

Prerequisites:

• Windows machine for SSH access
• Azure account with VM creation permissions
• Basic knowledge of Linux and SSH
• Azure Ubuntu 20.04 LTS VM to host T-Pot

Step 1: Create the Ubuntu VM on Azure

1. Log into your Azure portal and navigate to Virtual Machines.
2. Click Create, and choose Ubuntu 20.04 LTS as the image.
3. Choose a size (minimum 2 vCPUs, 4 GB RAM) for your T-Pot deployment.
4. Ensure SSH (port 22) is allowed in the network settings.
5. After the VM is created, note the public IP address.

Step 2: SSH into Your Ubuntu VM from Windows

Use PowerShell or an SSH client (like Putty) on Windows to connect to the Ubuntu VM:

bashCopy codessh azureuser@<VM_public_IP>

Replace <VM_public_IP> with your actual VM’s public IP address.

Step 3: Install T-Pot on Your Ubuntu VM

Inside the Ubuntu VM, run the following command to install T-Pot:

bashCopy codeenv bash -c "$(curl -sL https://github.com/telekom-security/tpotce/raw/master/install.sh)"

Select the Hive edition for the complete T-Pot setup. After installation, the system will reboot automatically.

Step 4: Access the T-Pot Web Interface

Once the VM reboots, SSH back into your VM using the custom port for SSH (default: 64295):

bashCopy codessh azureuser@<VM_public_IP> -p 64295

To access the T-Pot web interface, open a browser and enter:

bashCopy codehttps://<VM_public_IP>:64297

Ignore any browser security warnings, as the certificate is self-signed.

Step 5: Visualize Attacks with the T-Pot World Map

After setting up, log in to the Kibana dashboard where you can visualize real-time attack data on the T-Pot World Map. This interactive map shows:

• Attack vectors
• Source locations of attacks
• Targeted protocols and services

A sample of the World Map might look like this, with live attacks displayed from around the world:

---

[Insert Image: T-Pot World Map with Real-Time Attacks]

---

Step 6: Analyzing Captured Attack Data

The T-Pot platform provides a rich set of tools for analyzing captured traffic, including:

• Top source IPs and geographic locations of attacks
• Breakdown of protocols and services under attack (SSH, HTTP, etc.)
• Real-time data on attack types and patterns, enabling deeper investigation into threat actors.

Benefits of Using T-Pot on Azure

• Cloud Flexibility: Easy deployment on Azure avoids the need for on-premise hardware.
• Comprehensive Insights: T-Pot consolidates multiple honeypots, offering insights into a variety of attack types.
• Learning Opportunity: It’s a great tool for hands-on cybersecurity training, providing real-world data on attacker behavior.

Conclusion

Deploying T-Pot on Azure offers a window into the constant barrage of cyberattacks in real time. This guide helps you set up a fully functional honeypot, analyze attack patterns, and strengthen your understanding of cyber threats. Whether you’re a seasoned professional or a cybersecurity beginner, this project will provide valuable insights into attacker tactics and vulnerabilities.