Nobody should knock. When someone does, you'll know.
EasyDecoy runs fake network services, a Telnet login and a web admin panel, that look real and lead nowhere. Nothing legitimate ever connects to them, so every connection, request and login attempt is worth a look. Each one is recorded as a JSON event and can be forwarded over syslog.
Two services, built to be found.
Each decoy answers like the real thing for long enough to be convincing, then refuses. Nothing a client sends is ever run or passed to the host: the decoys only imitate prompts and replies.
A login prompt that never lets anyone in
An Ubuntu-style banner and login: prompt that hides the password as it is typed, pauses like a real check, answers Login incorrect, and hangs up after three tries.
A sign-in page with nothing behind it
An appliance-style sign-in page on / and /login, a 404 everywhere else, and every sign-in refused. Each request is recorded with its path, Host and User-Agent.
Named the way your real machines are
A decoy called fileserver01 on a network of fs-ams-02s stands out. Set the banner, the hostname in the prompt, the web server's Server header and the sign-in page's title to match what an intruder expects to find.
High signal, by construction.
Intrusion detection usually means telling the attack apart from a flood of normal traffic. A decoy has no normal traffic, so whatever reaches it is the signal.
Alerts worth reading
Nobody has a reason to log in to a server that doesn't exist. A scan, a guessed password or a curious script is exactly what you wanted to hear about.
Passwords never stored
A login attempt keeps the username and the password's length. A colleague who types their real password into the wrong window doesn't end up in a log file.
Nothing is executed
The decoys are low-interaction: scripted prompts and replies, no shell and no real service behind them. There is nothing for an intruder to break out of.
Bounded under attack
Sessions are capped in number, idle time and length, and every read has a size limit. A flood of connections costs sockets for a moment, never memory.
Least privilege
The service runs as its own account with one capability, binding ports below 1024, inside a systemd sandbox that leaves it the log directory and nothing else to write to.
JSON lines and syslog
One JSON object per event, ready for jq, and a copy to any syslog collector, EasyLog included. A collector that is down never holds up the local record.
Decoys on your network, events on your desk.
Each decoy reports what happens to it to a single event writer, which appends one JSON line to the events file and hands a copy to the syslog sender. You read the file directly, or the collector it feeds.
One package. Live when you say so.
EasyDecoy is published as .deb and .rpm packages for x86_64 and arm64 on every GitHub release. Installing starts nothing: the decoys go live when you enable the service. The installation guide has the details.
easydecoy account and a default config./var/log/easydecoy, and on your syslog collector if you set one.Put one decoy on an unused address.
Give it a name that fits in, and wait. If your network is quiet, so is EasyDecoy. MIT licensed and developed in the open.