shadowtrap/shadowtrap.service at main · rayketcham/shadowtrap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
[Unit]
Description=ShadowTrap Honeypot Service
Documentation=https://github.com/your-org/shadowtrap
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=shadowtrap
Group=shadowtrap
WorkingDirectory=/opt/honeypot
ExecStart=/usr/bin/python3 /opt/honeypot/honeypot.py
Restart=on-failure
RestartSec=10
TimeoutStopSec=30

# Security hardening
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/honeypot/data /opt/honeypot/logs
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes

# Allow binding to privileged ports without root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=shadowtrap

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target