Tripwires

Getting started

From a USB stick to a running honeypot in about 15 minutes.

What you need

  • A spare PC or mini server (2 CPU cores, 4 GB RAM, 40 GB disk is plenty)
  • A USB stick, 8 GB or larger
  • A wired network connection for the appliance
  • Your licence key (in your purchase email)

1. Write the USB stick

Download the ISO from your account page, then write it with balenaEtcher (Windows, macOS or Linux) — pick the ISO, pick the stick, click Flash.

Writing erases the USB stick completely. Make sure it holds nothing you need.

2. Boot the appliance from it

Plug the stick into the machine that will become your honeypot and turn it on. Most machines need a key held at power-on to pick a boot device — usuallyF12, F11 or Esc.

The installer erases the whole disk of the machine you install on. Use a machine with nothing on it you want to keep.

3. Answer the setup wizard

The installer runs on its own and reboots into a setup wizard that asks plain questions — no Linux knowledge needed. It covers:

  1. System check
  2. Time zone (so alert times read correctly)
  3. Admin password for the app
  4. Your licence key
  5. How you will reach it — Tailscale, WireGuard, or your local network
  6. iPhone push notifications
  7. Email backup alerts
  8. Which decoys to run
  9. Securing (containment)
  10. Starting everything
  11. Your connection details

The last screen shows the address, username and password to put into the app. You can see them again any time by running honeypot-info on the appliance, or re-run the whole wizard with honeypot-setup.

4. Connect the app

Install the app, sign in with the address and password from the last screen, and allow notifications. See Using the app.

5. Test it

The important step most people skip. From another computer, open the decoy's shared folder and open a file. Your phone should alert within seconds. If it does not, see Network setup — on a segmented network the decoy may need one firewall rule to be reachable.

A honeypot you have never tested is a honeypot you cannot trust. Do this once after install, and again any time you change your network.