Build honey-pot environment to trap intruder from internet on CentOS 7 VM or security onion

 1. Download CentOS 7/  security onion( https://securityonionsolutions.com/software) form official ISO image  https://3ctipsmemo.blogspot.com/2021/04/centos-linux-7-and-8-isos-download-urls.html

and install it in Virtual Machine Apps(Virtualbox or VMware)

 

2. Setting firewall rules for allowing  all link in but denying all link out with firewalld

 

3. Setting a extremely complexity root password to avoid brute-force cracking

4. Opening general service ports to serve outside connection.

5. Monitoring /var/log/message/secure to verify malicious connection behavior such as root fraud is to try many times with ssh connection, dovecot users fraud is to try use smtp service...

6. If they try to hack service over six times, we can coordinate these malicious connections hostnames/source IPs/destination ports to insert firewall blacklist

reference

https://access.redhat.com/discussions/3238521

https://firewalld.org/documentation/man-pages/firewall-cmd.html

https://unix.stackexchange.com/questions/508696/firewalld-block-outgoing-connections-on-specific-port

https://serverfault.com/questions/618164/block-outgoing-connections-on-rhel7-centos7-with-firewalld

https://superuser.com/questions/1391650/how-can-i-configure-firewalld-to-block-all-outgoing-traffic-except-for-specific