Honeypot Placement

#!/bin/bash
# deploy-tpot.sh
# Deploy T-Pot multi-honeypot platform on a dedicated VM
# T-Pot includes: Cowrie, Dionaea, Honeytrap, Conpot, and more
# Requires: Ubuntu 22.04+, 8GB RAM, 128GB disk minimum

set -euo pipefail

TPOT_VERSION="24.04"
TPOT_TYPE="STANDARD"  # STANDARD, HIVE, or SENSOR

echo "[*] Preparing system for T-Pot deployment..."

# Update and install prerequisites
apt-get update -qq
apt-get install -y -qq git curl

# Clone T-Pot installer
git clone https://github.com/telekom-security/tpotce /opt/tpot
cd /opt/tpot

echo "[*] Running T-Pot installer..."
echo "[*] Type: $TPOT_TYPE"

# Non-interactive install
export TPOT_OSTYPE="auto"
./install.sh --type="$TPOT_TYPE" --conf=/opt/tpot/iso/installer/tpot.conf

echo "[+] T-Pot installation complete."
echo "[*] Access the web interface at https://<host-ip>:64297"
echo "[*] SSH management port relocated to 64295"
echo ""
echo "[!] IMPORTANT: Configure your SIEM to ingest from:"
echo "    - Logstash output: port 64305"
echo "    - EWS (Early Warning System): port 64306"
echo ""
echo "[!] Ensure this host is placed on a deception subnet"
echo "    per the ShadowMatrix CDF architecture blueprint."

# modules/honeypot-placement/main.tf
# Deploy honeypots at strategic points along lateral movement paths

variable "placement_configs" {
  description = "Honeypot placement specifications"
  type = list(object({
    subnet_id      = string
    role_name      = string    # What the honeypot pretends to be
    services       = list(string)
    hostname       = string
  }))
  default = [
    {
      subnet_id = "subnet-web-tier"
      role_name = "web-server"
      services  = ["ssh", "http", "https"]
      hostname  = "prod-web-08"
    },
    {
      subnet_id = "subnet-db-tier"
      role_name = "database"
      services  = ["ssh", "postgresql", "mysql"]
      hostname  = "prod-db-04"
    },
    {
      subnet_id = "subnet-admin"
      role_name = "jump-host"
      services  = ["ssh", "rdp"]
      hostname  = "admin-jump-03"
    },
  ]
}

resource "aws_instance" "honeypot" {
  for_each = { for idx, cfg in var.placement_configs :
    cfg.role_name => cfg
  }

  ami                    = data.aws_ami.ubuntu.id
  instance_type          = "t3.small"
  subnet_id              = each.value.subnet_id
  vpc_security_group_ids = [aws_security_group.honeypot[each.key].id]

  tags = {
    Name = each.value.hostname
    Role = each.value.role_name
    # Internal tracking - not visible via instance metadata
  }

  user_data = templatefile("${path.module}/scripts/honeypot-init.sh", {
    hostname = each.value.hostname
    services = join(",", each.value.services)
    siem_host = var.siem_endpoint
  })
}

# Dynamic security groups based on the services each honeypot emulates
resource "aws_security_group" "honeypot" {
  for_each = { for idx, cfg in var.placement_configs :
    cfg.role_name => cfg
  }

  name   = "sg-honeypot-${each.key}"
  vpc_id = var.deception_vpc_id

  dynamic "ingress" {
    for_each = toset(each.value.services)
    content {
      from_port   = lookup(local.service_ports, ingress.value, 0)
      to_port     = lookup(local.service_ports, ingress.value, 0)
      protocol    = "tcp"
      cidr_blocks = [var.production_cidr]
      description = "Allow ${ingress.value} from production"
    }
  }
}

locals {
  service_ports = {
    ssh        = 22
    http       = 80
    https      = 443
    rdp        = 3389
    postgresql = 5432
    mysql      = 3306
    smb        = 445
    ftp        = 21
  }
}