CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

deploy/decoy.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=NetScaler decoy HTTP and evidence collector
+After=network-online.target decoy-network.service
+Requires=decoy-network.service
+[Service]
+EnvironmentFile=/etc/decoy.env
+# Simulation only: attacker commands are parsed, stored and answered, never executed.
+# Real execution additionally requires --vm-config + --allow-real-execution and an isolated guest;
+# never enable it on an internet-facing listener. All values come from /etc/decoy.env.
+ExecStart=/usr/bin/python3 /opt/decoy/honeypot.py --bind=${HONEYPOT_BIND} --port=${HONEYPOT_PORT} --proxy-protocol-from=${HONEYPOT_PROXY_PROTOCOL_FROM} --hide-guest-files --trusted-forwarded-from=${HONEYPOT_TRUSTED_FORWARDED_FROM} --fetch-payloads --log-dir=${HONEYPOT_LOG_DIR} --evidence-mib=${HONEYPOT_EVIDENCE_MIB}
+WorkingDirectory=/opt/decoy
+UMask=0077
+Restart=no
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/decoy
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+MemoryMax=768M
+TasksMax=128
+[Install]
+WantedBy=multi-user.target