Every command

A reference dump of every command from the honeypot, domain/HTTPS, and SSH-hardening posts — no narrative, just the commands, grouped by post.

From: Building my first honeypot on AWS

sudo apt install -y git python3-venv python3-dev libssl-dev libffi-dev build-essential
sudo adduser --disabled-password --gecos "" cowrie

(Cowrie itself was cloned and installed inside a sudo su - cowrie session, so those exact clone/pip steps didn't survive in the ubuntu user's history — but the systemd unit that runs it did:)

sudo tee /etc/systemd/system/cowrie.service << 'EOF'
[Unit]
Description=Cowrie SSH/telnet Honeypot
After=network.target
[Service]
Type=forking
User=cowrie
Group=cowrie
WorkingDirectory=/home/cowrie/cowrie
Environment="PATH=/home/cowrie/cowrie/cowrie-env/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
ExecStart=/home/cowrie/cowrie/cowrie-env/bin/cowrie start
ExecStop=/home/cowrie/cowrie/cowrie-env/bin/cowrie stop
PIDFile=/home/cowrie/cowrie/var/run/cowrie.pid
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable cowrie
sudo systemctl start cowrie
sudo systemctl status cowrie.service

Quick log analysis, straight from the honeypot's own log file:

grep -c "New connection" var/log/cowrie/cowrie.log
grep -oP '(?<=,)[0-9]{1,3}(?:\.[0-9]{1,3}){3}(?=\])' var/log/cowrie/cowrie.log | sort | uniq -c | sort -rn | head -10

From: Getting a real domain and real HTTPS

sudo ss -tlnp | grep -E ':80|:443|:8080'
ps aux | grep -E 'nginx|apache2|php' | grep -v grep

Edited /etc/nginx/sites-enabled/default, changed server_name _; to the real domain, then:

sudo nginx -t
sudo systemctl reload nginx
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d mileshuynh.duckdns.org

From: My real SSH port was just as exposed as my fake one

sudo ss -tlnp | grep -E ':22|:2222'
sudo grep -i "^Port" /etc/ssh/sshd_config
sudo grep -iE "PasswordAuthentication|PermitRootLogin|PubkeyAuthentication" /etc/ssh/sshd_config
sudo apt install -y apache2-utils
sudo htpasswd -c /etc/nginx/.htpasswd admin
sudo nginx -t
sudo systemctl reload nginx
sudo systemctl status fail2ban
sudo fail2ban-client status

Plus one change made entirely in the AWS console: the EC2 security group's port 22 rule, source changed from 0.0.0.0/0 to my own IP.