Home › Docs ›Operations › Production Hardening

Production Hardening

Security hardening recommendations for production deployment

Hardening here has two goals that pull in opposite directions: make the honeypot look real enough to engage an adversary, and make sure a compromised honeypot cannot become a path into production or the SIEM. The pool credential split is the non-negotiable part.

Critical Isolate the pools Every pool database user must have a different password. The flat container network means network segmentation alone does not isolate pools. test_pool_isolation.sh

Critical Gate diagnostics Leave INTERNAL_TEST_SECRET unset in production, or require X-Internal-Test-Auth before emitting route and score headers. fail closed

Important Sign the session Set SESSION_SIGNING_KEY explicitly. An unset key is generated per process and breaks cookie verification across restarts. HMAC

Important Limit exposure Firewall the SIEM and admin surfaces, keep the edge as the only public entry point and restrict backend access to trusted proxies. least privilege

Network Hardening

Place honeypot behind a TLS-terminating reverse proxy with valid certificates.
Restrict inbound access to the honeypot backend to trusted proxies only.
Enable firewall rules limiting SIEM/Kibana access to authorized hosts.
Isolate the honeypot network segment from production backend networks.
Mind the layer's blast radius: the reverse-proxy layer gives each session a separate decoy backend that absorbs file-upload and RCE attacks, whereas the database layer swaps only the database — a foothold there reaches the shared eshop filesystem, so prefer the reverse-proxy layer on an exposed deployment.

Authentication & Access Control

Use strong, unique admin credentials for WordPress and SIEM interfaces.
Enable multi-factor authentication where supported.
Rotate API keys and credentials for Kibana/Elasticsearch.
Apply least-privilege access for dashboard operators and analysts.

Lua Pipeline Hardening

IP Whitelisting

_G.config.threat.ip_whitelist contains CIDR ranges or exact IPs that receive a negative reputation score (-20) and are never diverted to the honeypot. Should include: operator's admin IP, Tailscale tunnel range (100.64.0.0/10), university/lab network (10.0.0.0/8), loopback (127.0.0.1/32, ::1/128).

Session Cookie Security

The session cookie is named SERVERID (mimics HAProxy stickiness cookie). Signed with HMAC key (SESSION_SIGNING_KEY). When the key comes from env var, a bad signature is scored as tampering (+50). When unset, a random key is generated at startup.

Threat Decay Configuration

THREAT_DECAY_ENABLED=false turns decay OFF entirely — scores persist indefinitely.
DECAY_OFFENSE_SLOWDOWN (default 0.75): half-life multiplier is 1 + this × offenses (linear, not compounding).
PERMAFLAG_OFFENSES (default 5): at/above this many offenses, score stops decaying.
PERMAFLAG_SCORE (default 100): a single request scoring this also permaflags.

AbuseIPDB Configuration

ABUSEIPDB_API_KEY — when nil/placeholder, client disables itself.
ABUSEIPDB_CONFIDENCE_MINIMUM (default 90) — bulk feed confidence threshold.
ABUSEIPDB_DAILY_CHECK_LIMIT (default 1000) — free-tier daily cap.
ABUSEIPDB_BLACKLIST_ENABLED (default false) — bulk blacklist pull opt-in.
ABUSEIPDB_BLACKLIST_REFRESH_HOURS (default 24) — minimum age before fresh call.

Internal Test Secret

INTERNAL_TEST_SECRET gates the X-Route-Target / X-Risk-Score response headers. When set, headers only emitted for requests with matching X-Internal-Test-Auth header. When unset, headers never emitted (fail closed).

Device-Signature Key

The RSA private key that decrypts the consent-gated gdpr_token must live only on the proxy and never be shipped to the SIEM or logged — the privacy guarantee is that only the one-way signature ever leaves the server. Keep GDPR_TIMESTAMP_WINDOW tight to limit token replay, and treat the key like any other production secret.

Logging & Monitoring

Ship structured logs to the SIEM with appropriate retention.
Forward Suricata alerts to the SIEM in real time.
Enable audit logging for administrative actions.
Monitor _G.utils.log_security_event() output in Nginx error logs via Vector.

Runtime Hardening

Keep WordPress, plugins, and themes updated.
Disable XML-RPC amplification vectors where feasible.
Rate-limit login and REST API endpoints.
Monitor file upload directories for suspicious activity.
Regularly review threat_intel shared dict for poisoned entries.