krain-seckrain-sec

Safety

Deploy only on servers you own

Bait passwords are fake — never reuse them for real access. This gives commodity scanners decoys to investigate; it does not replace patching, backups, TLS, or locking down your real app.

Checklist

  1. 01Real SSH not on port 22 before you publish bait SSH.
  2. 02No shared secrets or DB volumes between honeypot and real site.
  3. 03Leave Compose isolation on (internal network, caps, read-only).
  4. 04Still harden the real website.
  5. 05Treat all captured attacker input as hostile data.

Isolation defaults

Compose uses an internal Docker network (no outbound to your DB/LAN), a read-only filesystem, dropped capabilities, and hard caps (256MB RAM / 0.5 CPU). Soft-fail: if SSH, MySQL, or Grafana cannot bind, the HTTP bait keeps running.

License

krain-sec is licensed under AGPL-3.0. Use only on infrastructure you control. Source: h3ma209/krain-sec.

← DocsHome