Beelzebub Honeypot

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

Beelzebub is an open source, low-code honeypot and deception framework. It stands up low-interaction decoy services that look like real infrastructure - a fake SSH shell, a fake web server, a fake database - so that any connection to them is, by definition, suspicious. Every interaction is captured as a structured event and exposed as Prometheus metrics, giving you an early-warning tripwire for reconnaissance and intrusion attempts inside your network, all defined in simple YAML. This image delivers it fully installed and running under systemd, so a working deception layer is listening within minutes of launch.

Deception and Attack Capture

Out of the box the image runs three decoy services - an SSH decoy, an HTTP decoy and a database decoy - each defined by an editable YAML file you can extend or replace with your own decoys. When something connects, Beelzebub records the interaction as a structured event and increments its Prometheus counters, so you can scrape the activity into your SIEM, dashboards and alerting. Because nothing legitimate should ever touch a honeypot, every event is worth investigating. The decoys use static, built-in responses, so no external API key is needed; the optional AI-backed shell is disabled by default and is enabled only if you choose to supply your own key.

Two Separate Surfaces, Secure By Default

A honeypot's decoy services are meant to be inviting, and they run inside Beelzebub's own sandbox so they grant no real access to the host. This image keeps your real administrative SSH on its own standard port, entirely separate from the decoy SSH, so deploying the honeypot never interferes with how you manage the instance. What the image secures is the management surface: the Prometheus metrics endpoint is bound to the loopback interface and served through an nginx reverse proxy that is ready for your TLS certificate. An unauthenticated health endpoint is available for load balancer probes, while the metrics endpoint requires a password. There are no shared or default credentials - a unique password is generated on each instance's first boot and written to a root-only file. The shipped security group opens only the administrative SSH port and the metrics port; the decoy ports are closed until you deliberately open them, so a honeypot is never exposed without an explicit decision.

Hardened, Minimal Image

The Go binary is compiled from the pinned upstream release during image build, and the compiler and source tree are removed before the image is captured, so what ships is a single static binary with no build toolchain left behind. The daemon runs as a dedicated non-root user under a hardened systemd unit, and the operating system ships fully patched with unattended security updates enabled.

Ready To Use

Connect over SSH on the administrative port and the honeypot is already running. Read the welcome notes for your first-boot metrics password and the decoy port numbers, open the decoy ports to the networks you want to observe, scrape the metrics, and watch an interaction being logged. The paired deployment guide walks through retrieving the metrics password, scraping the metrics, watching a capture land in the event log, and adding your own decoy services.

cloudimg Support

24/7 technical support by email and chat. Help with decoy service configuration, the metrics endpoint and TLS, wiring the metrics into your monitoring, opening and placing the decoy ports safely, enabling the optional AI-backed shell with your own key, backups, and upgrade planning.

Use Cases

Running an internal tripwire that fires the moment something touches a service nothing legitimate should ever reach. Studying attacker behaviour with a research sensor. Placing a deception layer that slows and misdirects an intruder who has already gained a foothold.

This is a repackaged open source software product with additional charges for cloudimg support services. Beelzebub is distributed under the GNU General Public License v3.0. cloudimg is not affiliated with or endorsed by the Beelzebub project or its authors. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.