Skip to content
Kandaro
Start free trial

Decoy · Device

Linux server decoy

Once an intruder is inside, the first thing they look for is a server with a database on it. This decoy looks like exactly that: an Ubuntu 22.04 box called srv-db01 with SSH, an internal admin page, MySQL, Redis, MongoDB and a Git server.

Start free trialAll decoys

What it emulates

Poses as: Ubuntu database and web server.

Nobody on your team has a reason to touch it. So when something logs in, lists keys or tries to clone a repository, you know it is worth reading.

  • SSH 22

    Records every password, key and username tried, then refuses them. Only a password Kandaro planted opens a fake shell, where every command is recorded and answered with made-up output. Nothing runs.

  • HTTP 80

    An "Internal Admin Console" login page that records every username and password. Its documentation pages are an endless, slowly served wiki that keeps crawlers and AI agents busy.

  • HTTPS 443

    The same login page over HTTPS, with a certificate unique to this decoy.

  • MySQL 3306

    Speaks MySQL 8.0. Records the username and database, then asks the client for the password in plain text, records it and answers "Access denied".

  • Redis 6379

    Speaks Redis, with real Redis error messages. Records every password and every command. Requests to list keys get a slow, endless stream of made-up keys.

  • MongoDB 27017

    Speaks MongoDB 7.0. Records sign-in attempts and every query. Queries return generated documents with a cursor that never runs out: fake data, served slowly.

  • Git 9418

    Records which repository someone tries to clone or push, then answers "Repository not found". Never serves code.

  • SSH tarpit 2222

    A tarpit: it trickles out random lines forever and records how long it held the scanner.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

  • Port scans across the server
  • Password guessing on SSH, MySQL, Redis, MongoDB and the web login
  • Commands typed into the fake shell, including download attempts
  • Database queries and key listings, a sign of data theft
  • Attempts to clone source code from Git
  • Known web exploit payloads, such as SQL injection and path traversal

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

  • T1046Network Service Discovery
  • T1059Command and Scripting Interpreter
  • T1110Brute Force
  • T1190Exploit Public-Facing Application
  • T1552.001Unsecured Credentials: Credentials In Files
  • T1552.005Unsecured Credentials: Cloud Instance Metadata API

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

  • It runs nothing

    The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.

  • It connects to one place only

    Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.

  • Kandaro can only send it settings

    Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.

  • It holds no real secrets

    Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.

  • It cannot be used to attack others

    It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it in the server VLAN, next to your real databases and application servers, with a name that fits your naming scheme.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys · Lateral movement: what it looks like from inside a decoy

FAQ

Linux server decoy questions

Can an attacker actually log in?
No. Every real username and password is refused. Only a password Kandaro planted as bait opens a fake shell, and even there nothing runs: every command gets made-up output.
Does it hold any real data?
No. Every key, document and record it shows is generated. The data looks plausible so an intruder keeps going, but none of it is yours.
Is it safe to run on my network?
Yes. A decoy only answers connections with fake data. It runs nothing, forwards nothing and only connects out to the Kandaro API over HTTPS. It runs as an unprivileged, read-only container.

Related decoys

Pair it with these.

Put this decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trialView packages

Card required · cancel before day 14 and pay nothing