Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on your system with privileges of www-data user.

Is it possible to have honeypot on commands run by the www-data user? For example, let's assume that apache2 or any other process run by www-data, never runs ls command to list directory (it would most likely use other API provided by the system, rather than start new process parse output etc). Is it possible to set-up a honeypot on such command? For example, log the commands in sys.log, or add an entry to a database with only INSERT permission?

The command should still run normally on other users (or specified) accounts, without triggering the log event.

If such honeypot is possible, how could one be set up? Is there any reasons why such honeypot is bad and should not be used?

  • Why would you want a honeypot once they have full control over the process and local control? Isn't it far too late?
    – schroeder
    Commented May 21, 2019 at 16:16
  • Well I was thinking of this a bit more as of "you been hacked" flag. In some cases compromised services / users can go for long time without being noticed by administrator, but adding such custom behaviour potentially could help finding it out sooner and reducing the impact
    – vakus
    Commented May 21, 2019 at 16:19
  • Then you don't want a honeypot. You want a tripwire. You want to be alerted when certain commands are run. That's a different problem.
    – schroeder
    Commented May 21, 2019 at 16:19
  • Are you also aware of things like: unix.stackexchange.com/questions/155139/…
    – schroeder
    Commented May 21, 2019 at 16:23
  • 1
    @S0AndS0 i never used any containers yet but dont feel that this is limiting factor, as i am willing to learn them
    – vakus
    Commented May 21, 2019 at 20:08

1 Answer 1


It sounds like you want to have a custom shell environment for this one user. Replace bash with a custom variant that only allows certain commands and logs the other commands.

Kippo/Cowrie would be a good model for you to look at for creating something like this and all the challenges and limitations, as well. Kippo/Cowrie is for faking ssh shells.

  • Some friends and I once wrote a program called "honeydoor". It is both a backdoor shell and a honeypot in one c program. If you log in as the 'doored' user, you get a bash shell. If you log in with one of programmed commonly used telnet password combos like 'root:toor', than you get the fake shell, which logs all commands. After a certain # of failed attempts it just spits urandom data at you (hopefully crashing the scanner) This is a pretty fun way to collect default logins and payloads, and is easier to set up than kippo: gist.github.com/darkerego/9771c474e73852986cacea3ee13f2096
    – Chev_603
    Commented May 21, 2019 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .