AmberCell：运行真实服务的高交互蜜罐

／／ high-interaction honeypot · real services · zero emulation

AmberCell is a high-interaction honeypot: it runs full, real services — actual postfix, OpenLDAP, xrdp, kamailio — not emulated look-alikes. Attackers interact with genuine daemons on a genuine network stack, and every packet, credential, and payload is preserved, sealed in amber.

／ CELL BOOT SEQUENCE ／

utc —
the cells never sleep

high-interaction means the services are real — why that matters ↓

01 / WHAT IS A HONEYPOT — IN TWO DIALECTS

IN PLAIN TERMS

AmberCell is a decoy computer that looks like a real office network: mail servers, file shares, databases, even a remote-desktop login.

The difference from a movie prop: everything on it actually works. Attackers who break in get real software to interact with — and every move is recorded, like insects preserved in amber.

Nothing of yours is ever exposed, and the evidence leaves through a one-way letterbox.

FOR SECURITY PROFESSIONALS

• High-interaction by architecture: real OSS daemons in per-protocol cells — no fake shells, no scripted responses
• Single-host Docker Compose (Ubuntu 22.04 / Debian 12), host nftables ingress/egress
• Collector-owned netns capture: pcap + raw flows + JSONL events, append-only
• ATT&CK/Engage enrichment; bounded AI manager off the packet path with a deterministic critic
• Kill bars G1–G14 gate production exposure
• One-way dead drop — SIEM and analysts pull, they never touch the pot

meanwhile, in the web — an attacker who touches a cell is stuck in it:

no real data, no next hop, no way out. Every struggle is another frame of evidence, preserved.

02 / WHY HIGH-INTERACTION MATTERS

Honeypots are classed by how much of the service is real. AmberCell sits at the deep end — deliberately.

LOW-INTERACTION

Emulated protocol banners and handshakes only (honeyd-style). Cheap and safe, but an attacker fingerprinting the fake walks away in seconds — you learn almost nothing about what they intended to do.

MEDIUM-INTERACTION

Scripted emulation: fake shells and canned responses (cowrie-style). Better lures, still detectable — behaviour never quite matches a real system, and sophisticated tooling notices the seams.

HIGH-INTERACTION AMBERCELL

Full, real services. Attackers exploit, authenticate, upload and interact with genuine daemons on a real network stack — the deepest, most truthful evidence you can collect. AmberCell makes that safe to operate: every real daemon is sealed in its own cell with tight caps, seccomp and egress allowlists.

03 / 28 high-interaction protocol decoys

／ FLOWS — packets per second, live

04 / YOUR DECOY, YOUR WAY — READY OR HOMEMADE

whatever you plug in — curated, homemade, or remote — the evidence pipeline stays identical

Every protocol cell speaks the same contract. Run a curated real daemon, bring your own, or tunnel to the servers you already operate — the collectors and evidence never change.

WAY 1

CURATED REAL DAEMONS

70+ digest-pinned open-source servers ship as one-env-var swaps: AMBER_FTP_PROVIDER=proftpd, AMBER_SMTP_PROVIDER=exim, AMBER_LDAP_PROVIDER=glauth… Each keeps the same evidence schema, so switching never breaks your pipeline.

WAY 2

BRING YOUR OWN DOCKER

Already built the perfect lure? Point a cell at your image: AMBER_FTP_HI_IMAGE=registry…@sha256:… (prebuilt) or AMBER_FTP_PROVIDER_CONTEXT=/path/to/your/Dockerfile. Containment and capture wrap around whatever you bring.

WAY 3

TUNNEL TO YOUR OWN SERVER

Have real services already? Relay a cell to them at any address: AMBER_LDAP_PROVIDER=remote + AMBER_LDAP_REMOTE_ADDR=ldap.corp:389. It's an L4 relay — bytes untouched, evidence still captured at the cell front.

05 / HOW IT WORKS

STEP 1

DECOY

Real OSS daemons run in sealed cells behind nftables DNAT — a convincing, high-interaction network.

STEP 2

RECORD

Per-cell collectors own the netns: rotating pcap, raw flows, credentials, uploads — append-only.

STEP 3

EXAMINE

ATT&CK/Engage enrichment + bounded AI decisions; intelligence leaves via a one-way dead drop.

              ┌─────────────────────────── the sealed case ───────────────────────────┐
 internet ───▶│ nftables DNAT ──▶ ambernet (icc off) ──▶ 28 real-service cells           │
              │      │                     │                    │                        │
              │      ▼                     ▼                    ▼                        │
              │ egress allowlist      dns sinkhole      *-collector ──▶ /var/ambercell │
              │ (tcp 80/443 only,     (all lookups           │        pcap · flows · JSONL  │
              │  tcp/25 dropped)       logged)                ▼                            │
              │                                          dead drop ◀ one-way letterbox   │
              └──────────────────────────────────────────────────────────────────────────┘
                                                SIEM / analysts pull — never touch the pot

／ BEACON — the dead-drop publish cycle

06 / TUTORIALS — interactive, copy-ready, real

Every command is verified against the repo. Sessions run in an animated terminal — lines type themselves in, and every $ line copies on click.

~3 min
beginner

TUT·01

First flight — your first real honeypot

Clone, build amberctl, boot a real vsftpd cell, probe it, and watch your first evidence land. No public IP needed.

> open_session_

~2 min
beginner

TUT·02

Swap the decoy — providers & your own Docker

Switch vsftpd→proftpd with one variable, then bring a custom image. Evidence schema never changes; digests stay pinned.

> open_session_

~2 min
intermediate

TUT·03

Point a cell at YOUR server

Relay attackers into your existing LDAP/SNMP/SIP server at any address — the cell keeps capturing at the front.

> open_session_

~2 min
analyst

TUT·04

Take the intel — the dead drop

Publish an evidence bundle, verify it hash-by-hash, and pull it exactly like your SIEM would.

> open_session_

~4 min
operator

TUT·05

Deploy sensors — a remote fleet

Headless provisioning, systemd watchdog + publish timer, and a central launcher for many sensors.

> open_session_

07 / SAFETY — real services, hard limits

High-interaction means real risk if done naively. AmberCell's answer is layered containment — production exposure is gated by kill bars, and if any trips, you don't ship.

[✓] lab profile is the default [✓] no host orchestration, ever [✓] egress allowlist + dns sinkhole [✓] append-only evidence [✓] one-way dead drop

[✓] G1 no unexplained egress

[✓] G2 no lateral container reach

[✓] G3 no host/metadata access

[✓] G4 no docker.sock anywhere

[✓] G5 unknown traffic never dropped

[✓] G6 AI never mutates evidence

[✓] G8 traps can't orchestrate

[✓] G10 no outbound tcp/25

[✓] G13 no dns/memcached amplification

[✓] G14 relays can't widen egress

● AMBERCELL × CHN — you found one piece of the network

AmberCell runs perfectly as a standalone box — but it's part of Cyber Halluci Net (CHN), our security-research collective. The perfect complete free deception suite.

> try CHN at cyberhallucinet.org_

ready in ~30 seconds on a laptop — no public IP required for the lab.