{"id":1742,"date":"2025-10-23T09:35:12","date_gmt":"2025-10-23T06:35:12","guid":{"rendered":"https:\/\/zerontek.com\/zt\/?p=1742"},"modified":"2025-10-23T11:31:56","modified_gmt":"2025-10-23T08:31:56","slug":"deploying-conpot-in-a-linux-vm-vps-practical-guide","status":"publish","type":"post","link":"https:\/\/zerontek.com\/zt\/2025\/10\/23\/deploying-conpot-in-a-linux-vm-vps-practical-guide\/","title":{"rendered":"Deploying Conpot in a Linux VM \/ VPS \u2014 practical guide"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Why Conpot matters <\/h2>\n\n\n\n<p>Conpot is a low-interaction ICS\/SCADA honeypot that emulates common industrial services (Modbus, S7, SNMP, HTTP, EtherNet\/IP). It is useful for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>collecting reconnaissance traffic,<\/li>\n\n\n\n<li>validating SIEM\/IDS detection rules,<\/li>\n\n\n\n<li>training teams with real OT protocol interactions,<\/li>\n\n\n\n<li>demonstrating exposure to management.<\/li>\n<\/ul>\n\n\n\n<p>Run it on an isolated VM\/VPS so nothing production-facing shares its network.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conpot as a bounded computational system<\/h2>\n\n\n\n<p>Conpot is <strong>not<\/strong> a real industrial process \u2014 it\u2019s a <strong>computationally limited emulation<\/strong>. This limitation is crucial: it bounds the complexity of interactions.<\/p>\n\n\n\n<p>In real ICS, the state space is enormous \u2014 physical sensors, actuators, PLC logic, network events, timing, etc. Conpot reduces this to finite, predictable state transitions: Modbus read\/write, S7 communication, HTTP responses.<\/p>\n\n\n\n<p>Formally speaking, Conpot represents a <strong>decidable system<\/strong> \u2014 the number of possible states and transitions is finite and fully describable. This boundedness makes the \u201cattack problem\u201d tractable, while still retaining enough realism to study attacker strategies.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cA honeypot is an NP problem made P \u2014 it transforms an unbounded, complex environment into a controlled, solvable simulation.\u201d<\/p>\n<\/blockquote>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1) Prepare the VM \/ VPS<\/h2>\n\n\n\n<p>Update the system, install Docker and Nmap:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update &amp;&amp; sudo apt upgrade -y\nsudo apt install -y docker.io nmap ufw\nsudo systemctl enable --now docker\n<\/code><\/pre>\n\n\n\n<p>Firewall (example, adjust to your policy):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw default deny incoming\nsudo ufw default allow outgoing\nsudo ufw allow 22\/tcp      # SSH\nsudo ufw allow 80\/tcp      # HTTP (optional)\nsudo ufw allow 502\/tcp     # Modbus (if you expose it)\nsudo ufw allow 102\/tcp     # S7 (if you expose it)\nsudo ufw enable\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2) Pull and run Conpot (map host \u2192 container ports)<\/h2>\n\n\n\n<p>Conpot\u2019s default templates in the image often bind to container ports like <code>5020<\/code> and <code>10201<\/code>. Map the <strong>host standard ports<\/strong> to the container ports so external scanners and Nmap hit it correctly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker pull honeynet\/conpot:latest\n\nsudo docker run -it \\\n  -p 80:80 \\\n  -p 102:10201 \\\n  -p 502:5020 \\\n  -p 161:161\/udp \\\n  --name conpot_lab \\\n  --network bridge \\\n  honeynet\/conpot:latest \/bin\/sh\n<\/code><\/pre>\n\n\n\n<p>Inside the container start Conpot:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>~\/.local\/bin\/conpot -f --template default\n<\/code><\/pre>\n\n\n\n<p>You should see:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Modbus server started on: ('0.0.0.0', 5020)\nS7Comm server started on: ('0.0.0.0', 10201)\nHTTP server started on: ('0.0.0.0', 8800)\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3) Tail logs (host)<\/h2>\n\n\n\n<p>Watch activity in real time from the host:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker logs -f conpot_lab\n\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4) Nmap: quick port check<\/h2>\n\n\n\n<p>Verify the service is reachable:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nmap -sT -p 502,102 &lt;target-ip&gt;\n# example when testing locally on the VPS\nsudo nmap -sT -p 502,102 127.0.0.1\n<\/code><\/pre>\n\n\n\n<p>Expect <code>502\/tcp open<\/code> and <code>102\/tcp open<\/code> if port mapping and firewall are correct.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5) Nmap Modbus discovery<\/h2>\n\n\n\n<p>Use the NSE <code>modbus-discover<\/code> script to enumerate slave IDs and device identification strings:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># basic\nsudo nmap -sT -p 502 --script modbus-discover.nse &lt;target-ip&gt;\n\n# aggressive (more unit ID probing; noisy)\nsudo nmap -sT -p 502 --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' &lt;target-ip&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>What you get:<\/strong> Slave IDs, Slave ID data and any human-readable device strings \u2014 useful to learn which devices or scanners are probing you.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">6) Nmap S7 discovery<\/h2>\n\n\n\n<p>Probe Siemens S7 emulation with the NSE <code>s7-info<\/code> script:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nmap -sT -p 102 --script s7-info &lt;target-ip&gt;\n\n# or with version detection\nsudo nmap -sT -sV -p 102 --script s7-info &lt;target-ip&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>What you get:<\/strong> CPU\/device identification or fingerprints \u2014 with Conpot you\u2019ll usually see simulated or partial responses, but they still indicate probing activity.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7) Ensure NSE scripts are present<\/h2>\n\n\n\n<p>If a script is missing, update the Nmap script DB or add the script manually:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nmap --script-updatedb\nls \/usr\/share\/nmap\/scripts | grep -E 'modbus|s7'\n# if missing: download from Nmap repo into \/usr\/share\/nmap\/scripts then run --script-updatedb\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">8) Shodan: find Conpot instances<\/h2>\n\n\n\n<p>For research \/ threat-intel you can search Shodan for public Conpot instances using this filter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>product:\"Conpot\"\n<\/code><\/pre>\n\n\n\n<p>Use that filter in the Shodan search bar to find exposed honeypots (and study how others deploy Conpot). Don\u2019t abuse \u2014 use results for defensive research and responsible disclosure if you discover sensitive exposures.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Safety &amp; operational notes (short)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not deploy Conpot on the same network segment as production OT assets.<\/li>\n\n\n\n<li>Treat a public VPS as disposable \u2014 snapshot, monitor, rebuild regularly.<\/li>\n\n\n\n<li>Limit outbound connections and ship logs off the VPS to a secure SIEM or storage.<\/li>\n\n\n\n<li>Only scan networks and addresses you own or have permission to test.<\/li>\n\n\n\n<li>Container hardening: run with least privilege where possible (non-root user, drop capabilities, read-only filesystem) \u2014 test because the official image may require adjustments.<\/li>\n\n\n\n<li>Port mapping: map host ports to Conpot\u2019s internal ports (e.g., <code>-p 80:8800<\/code>, <code>-p 502:5020<\/code>, <code>-p 102:10201<\/code>) to ensure external scanners reach the services.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>Conpot is more than a trap \u2014 it\u2019s a <strong>computational model<\/strong>. By constraining state and transitions we make an intractable real-world problem analyzable. That\u2019s the defender\u2019s advantage: convert infinite-state complexity into a finite, decidable system and observe how attackers compute against it.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why Conpot matters Conpot is a low-interaction ICS\/SCADA honeypot that emulates common industrial services (Modbus, S7, SNMP, HTTP, EtherNet\/IP). It is useful for: Run it on an isolated VM\/VPS so nothing production-facing shares its network. Conpot as a bounded computational system Conpot is not a real industrial process \u2014 it\u2019s a computationally limited emulation. This [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1744,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[296,295,292,4,293,3,289,48,294,23,299],"tags":[297,7,298,13,6,12,47,20],"class_list":["post-1742","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-automata-theory","category-complexity-theory","category-conpot","category-cyber-security","category-honeypot","category-ics-security","category-modbus","category-ot-security","category-s7comm","category-shodan","category-theoretical-computer-science","tag-conpot","tag-cyber-security","tag-honeypot","tag-ics","tag-ics-security","tag-ot","tag-ot-security","tag-shodan"],"_links":{"self":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/comments?post=1742"}],"version-history":[{"count":4,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1742\/revisions"}],"predecessor-version":[{"id":1747,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/posts\/1742\/revisions\/1747"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media\/1744"}],"wp:attachment":[{"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/media?parent=1742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/categories?post=1742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerontek.com\/zt\/wp-json\/wp\/v2\/tags?post=1742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}