Azure SSH Honeypot

Fri, 16 Oct 2026 00:00:00 +0000

A small Azure VM that sits on the open internet and records who attacks it: brute-force logins, the commands attackers type, the malware they try to download, and probes against every other TCP port.

The goal is to deliberately invite attacks without becoming a risk to myself or anyone else. Most of the work went into the second half of that sentence.

The setup

 ┌──────────────── Azure NSG ────────────────┐
 Internet ─────────►│ 22222 from my IP ......... allow │
 │ 22222 from anyone else ... deny │
 │ any other TCP port ....... allow (bait) │
 └─────────────────────┬─────────────────────┘
 ▼
 vm-honeypot (Ubuntu 24.04, Standard_B1s)
 :22 ──Docker──► Cowrie :2222 fake SSH
 :23 ──Docker──► Cowrie :2223 fake Telnet
 :22222 ──────────► sshd real SSH (me)
 other ──────────► nothing → logged as SCAN

It’s built in three layers, each with one job:

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m alcodes, learning cloud security and programming in public.

Most of what I build lives on Azure, is deployed with Terraform, and runs in Docker. Then I try to break it. I write the tooling around it in Python and TypeScript.

What you’ll find here:

Cloud security: least-privilege IAM, network lockdown, honeypots, detection and logging.
Programming: CLIs, automation scripts, and the bugs I learned from.
Project write-ups: what I built, the security decisions behind it, and what I’d change.

Find me on GitHub.

Home on alcodes

Azure SSH Honeypot

The setup

About