Project Artillery is an open source project aimed at the detection of early warning indicators and attacks. The concept is that Artillery will spawn multiple ports on a system giving the attacker the idea that multiple ports are exposed. Additionally, Artillery actively monitors the filesystem for changes, brute force attacks, and other indicators of compromise. Artillery is a full suite for protection against attack on Linux and Windows based devices. It can be used as an early warning indicator of attackers on your network. Additionally, Artillery integrates into threat intelligence feeds which can notify when a previously seen attacker IP address has been identified. Artillery supports multiple configuration types, different versions of Linux, and can be deployed across multiple systems and events sent centrally.
Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems. It's relatively simple, run
./setup.pyand hit yes, this will install Artillery in
/var/artilleryand edit your
/etc/init.d/rc.localto start artillery on boot up.
- It sets up multiple common ports that are attacked. If someone
connects to these ports, it blacklists them forever (to remove
blacklisted ip's, remove them from
- It monitors what folders you specify, by default it checks
- It monitors the SSH logs and looks for brute force attempts.
- It will email you when attacks occur and let you know what the attack was.
Be sure to edit the
/var/artillery/configto turn on mail delivery, brute force attempt customizations, and what folders to monitor.
For those technical folks you can find all of the code in the following structure:
src/core.py- main central code reuse for things shared between each module
src/monitor.py- main monitoring module for changes to the filesystem
src/ssh_monitor.py- main monitoring module for SSH brute forcing
src/honeypot.py- main module for honeypot detection
src/harden.py- check for basic hardening to the OS
database/integrity.data- main database for maintaining sha512 hashes of filesystem
setup.py- copies files to
/etc/init.d/artilleryto ensure artillery starts per each reboot
Video Installation of Artillery