Deploy beside the real site

Your real website should look uninteresting to scanners. krain-sec parks a louder, juicier fake beside it — fake SSH, fake MySQL, fake Grafana, and a fake Aetheris SOC / admin console — giving commodity scanners and curious intruders believable dead ends to investigate.

Scanners probe whatever looks open, juicy, or misconfigured. When familiar ports present convincing decoys, opportunistic probes can spend their time and noise there instead of immediately reaching real admin services.

krain-sec is designed to consume scanner time with rabbit holes, decoy ports, planted secrets, tarpits, and dead ends while your real site on 80/443 stays boring. Customers reach the real site. Commodity scanners and curious intruders encounter the bait.

• Boxes keep getting hit by everything from script kiddies to sharper scanners. Full enterprise deception stacks are expensive and heavy to run. krain-sec is something small teams and solo ops can actually deploy: one container, low RAM, make prod, done.
• Only on servers you own. Not “hack back” — controlled deception for engaging opportunistic probes without touching the source.

Same VPS, two stories. Normal visitors never enter the bait. Attackers and scanners chase the shiny doors.

One path. They chase the decoy. Your real site stays boring.

1. 01

   They scan

   Find open bait ports like :8080

2. 02

   Hit Aetheris

   Looks like a real admin / SOC dashboard

3. 03

   WebRTC runs

   May reveal IP past some VPNs

4. 04

   They dig deeper

   Fake logins, files, SSH, MySQL, Grafana

5. 05

   Stuck in bait

   Rabbit holes · you see the activity

Choose one topology before changing ports or publishing lure URLs. Same-VPS deployment prioritizes immediate scanner discovery. A separate VPS prioritizes isolation.

• Not a real SSO portal, SIEM, or production auth stack.
• Not a replacement for patching, backups, TLS, or locking down the real app.
• Not an APT jail — optimized for noisy, high-volume, and curious adversaries.

When krain-sec shares the production VPS, move real SSH and MySQL elsewhere first. Put the pots on :22 and :3306 so scanners find decoys on the ports they always try. A separate honeypot VPS does not require production port changes.

Open ports attract network scanners automatically. Crawlers and hands-on attackers need discoverable trails: believable URLs, consistent identities, and clues that lead from one decoy to another. The objective is more time inside fake systems—not more traffic to production.

<!-- legacy operations console:
     https://console.example.com/internal/ -->

<script type="application/json" id="public-config">
  { "opsConsole": "https://console.example.com" }
</script>

<!-- robots.txt on the real site — keep product paths crawlable -->
# User-agent: *
# Allow: /
# Disallow: /internal/ops-console/
# Disallow: /backup/admin/

1. 01

   Choose where it runs

   Use the same VPS for immediate scanner diversion, or a separate VPS for stronger isolation.

2. 02

   Prepare the ports

   Same VPS: move real SSH and other conflicting services first. Separate VPS: production ports stay unchanged.

3. 03

   Clone & configure

   Copy .env.example to .env and set HONEYTOKEN_BASE_URL to the public bait hostname or IP-based URL.

4. 04

   Start the honeypot

   Run make prod. Confirm the decoy services are reachable from the internet.

5. 05

   Publish crawler lures on the real site

   Drop bait URLs in inert places crawlers scrape (comments, static config, data attrs) — not in nav, sitemaps, or pages Google/Bing should rank. Details in the Lures section above.

6. 06

   Keep search engines and SEO clean

   No cloaking redirects, no hidden SEO links, no honeypot as a normal sitemap page. Real site stays crawlable; decoy host stays separate.

Decoy surfaces and supporting gear. Full interactive tour on /features.

git clone https://github.com/h3ma209/krain-sec.git
cd krain-sec
cp .env.example .env          # edit HONEYTOKEN_BASE_URL when you go public
make prod                     # build + start the decoys

Hit the bait locally

• Console (Aetheris) → http://127.0.0.1:8080
• SSH → ssh admin@127.0.0.1
• MySQL → 127.0.0.1:3306
• Grafana → http://127.0.0.1:3000

Logs

Daily JSONL under ./logs — auth, HTTP, SSH, honeytokens, WebRTC, decoys. Retention default: 7 days. Passwords appear in auth-*.jsonl only — not stdout. Treat everything in there as hostile input.

• Real SSH not on port 22 before you publish bait SSH.
• No shared secrets or DB volumes between honeypot and real site.
• Leave Compose isolation on (internal network, caps, read-only).
• Still harden the real website.
• Treat all captured attacker input as hostile data.