turned an old laptop into a honeypot. Here's what happened. A few weeks ago, the Coda - my spare laptop…
turned an old laptop into a honeypot. Here's what happened.
A few weeks ago, the Coda - my spare laptop - got a second life.
Instead of gathering dust, it's now running Ubuntu 22.04 as a dedicated honeypot inside PhilSIEM, my home cybersecurity lab.
I installed OpenCanary to emulate SSH, FTP, HTTP, and Telnet services - fake doors that look real enough to attract attention.
Then I connected it to the rest of the lab remotely using Tailscale, so ! can monitor it from anywhere without exposing it directly to the internet.
The final touch? Telegram alerts piped straight to my phone and soon to come my smartwatch.
That moment when your wrist buzzes because something just probed a fake SSH port on a laptop in your spare room... that's when this stuff stops feeling like studying and starts feeling like real SOC work.
No enterprise budget. No corporate infrastructure. Just a retired laptop, some open source tools, and a lot of curiosity.
If you're breaking into cyber and wondering whether home lab projects actually matter - they do. This is the kind of build that teaches you how attackers think, how alerts fire, and how to tune out the noise.
Still reviewing the logs. More to come. 00
What does your home lab setup look like? Drop it in the comments
#CyberSecurity #SOC #Homelab #BreakingIntoCyber #PhilSIEM #OpenCanary #Tailscale #ThreatDetection
2 reactions · 1 comments
Topics: #tailscale, #opencanary, #philsiem, #cybersecurity, #soc, #homelab, #threatdetection, #breakingintocyber
Comments
Tyson M.: This is a great learning project, and there is a quieter lesson here that cyber people need to talk about more as we experiment with things like this. A honeypot is not just a toy system once it starts attracting real traffic in a corporate environment. You are operating something that may collect attacker behavior, IP addresses, payloads, credentials, malware samples, and potentially data that cr