2026-09-28 19:44:37 +02:00
|
|
|
[Unit]
|
|
|
|
|
Description=NetScaler decoy HTTP and evidence collector
|
2026-10-04 06:16:31 +02:00
|
|
|
After=network-online.target
|
|
|
|
|
StartLimitIntervalSec=300
|
|
|
|
|
StartLimitBurst=10
|
2026-09-28 19:44:37 +02:00
|
|
|
[Service]
|
|
|
|
|
EnvironmentFile=/etc/decoy.env
|
|
|
|
|
# Simulation only: attacker commands are parsed, stored and answered, never executed.
|
|
|
|
|
# Real execution additionally requires --vm-config + --allow-real-execution and an isolated guest;
|
|
|
|
|
# never enable it on an internet-facing listener. All values come from /etc/decoy.env.
|
2026-10-04 06:16:31 +02:00
|
|
|
ExecStart=/usr/bin/python3 /opt/decoy/honeypot.py --simulation-only --bind=${HONEYPOT_BIND} --port=${HONEYPOT_PORT} --proxy-protocol-from=${HONEYPOT_PROXY_PROTOCOL_FROM} --hide-guest-files --trusted-forwarded-from=${HONEYPOT_TRUSTED_FORWARDED_FROM} --log-dir=${HONEYPOT_LOG_DIR} --evidence-mib=${HONEYPOT_EVIDENCE_MIB}
|
2026-09-28 19:44:37 +02:00
|
|
|
WorkingDirectory=/opt/decoy
|
|
|
|
|
UMask=0077
|
2026-10-04 06:16:31 +02:00
|
|
|
Restart=on-failure
|
|
|
|
|
RestartSec=5
|
|
|
|
|
RestartPreventExitStatus=78
|
2026-09-28 19:44:37 +02:00
|
|
|
NoNewPrivileges=true
|
|
|
|
|
PrivateTmp=true
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
ReadWritePaths=/var/lib/decoy
|
|
|
|
|
ProtectKernelTunables=true
|
|
|
|
|
ProtectKernelModules=true
|
|
|
|
|
ProtectControlGroups=true
|
|
|
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
|
|
|
MemoryMax=768M
|
|
|
|
|
TasksMax=128
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=multi-user.target
|
