dockerfiles/cowrie/README.md

wonderfall/cowrie

What is this?

Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and the shell interaction performed by the attacker. Cowrie is based on Kippo.

Build-time variables

• MPFR_VERSION : GNU MPFR version.
• MPC_VERSION : GNU MPC version.
• GPG_ : fingerprints of signing keys.
• SHA_ : fingerprints of tarballs

Environment variables

• HOSTNAME : the hostname displayed in the honeypot.
• DL_LIMIT : the maximum size (in bytes!) of a stored downloaded file (0 = no limit).
• FACING_IP : your IP (you have to set it manually because cowrie fails to detect it when running in Docker).
• JSON_LOG : disables json logging if set to False.

Volumes

• /cowrie/dl : where downloads are stored.
• /cowrie/log : cowrie and tty sessions logs.
• /cowrie/custom : feel free to customize cowrie structure.

Docker compose (example)

cowrie:
  image: wonderfall/cowrie
  ports:
    - "2222:2222"
  volumes:
    - /mnt/cowrie/dl:/dl
    - /mnt/cowrie/log:/log
  environment:
    - HOSTNAME=foobar
    - DL_LIMIT=2048
    - FACING_IP=9.9.9.9
    - JSON_LOG=False
    - GID=1000
    - UID=1000