Rich Gibbs
Practical, opinionated notes on Linux server security, AWS hygiene, and indie-founder operations from Rich Gibbs.
-
Six Cowrie Fixes, One Phantom, and an Edit in the Wrong Tree
One session spent deepening a hand-built Cowrie honeypot shell: six defects fixed, a command-failure list whose top entries needed no fix at all, a silent module-loader trap, and an edit that landed in the wrong copy of the source tree.
-
The Second Cowrie OOM Had a Different Cause, and the Cap Was Never the Ceiling
Session 19, 2026-08-28 into 2026-08-29. The honeypot started getting killed again two days after the last cap change — same symptom, different mechanism — and the live memory limits were coming from a drop-in override the unit file never mentioned. Swap went in this time; the ceiling stayed where it was.
-
Redtail's Payload Kit, and the Memory Cap That Kept Killing Cowrie
Session 18, 2026-08-26: a five-binary multi-architecture kit pushed in over SFTP, and a real outage caused by the systemd memory cap I set myself — plus the trap in systemctl edit that changes nothing and tells you nothing.
-
Filters Are Triage, Not Verdicts
Notes from one long honeypot session: two passes at the traffic filter, one upload I could finally call confirmed benign, and two sessions I nearly filed as sophisticated attackers.
-
Session 16: a pipe carries stdout, not stderr
Practice notes from session 16: the permission-denied lines that survived a pipe into grep were stderr walking around the pipe, not a bug in grep — plus the recursive content search I left unconfirmed.
-
The Month-Old Hardware Doc, and What I Left Out of It
A documentation-only pass that pulled the lab node's hardware doc a month forward: RAM settled by asking the machine, and two unsettled decisions deliberately left out.
-
The Most Active Session Was Mine
Notes from two days of log-analysis practice against a honeypot's real attacker traffic: why the top of my own most-active ranking was my test session, and the verify-the-number habit that came out of it.
-
systemd Kept Guessing Which PID to Track
Notes from moving a honeypot off Type=forking after a subtle failure where the service served real traffic while systemd reported it dead, and the three-way PID check that replaced a single status read.
-
Trust the Process List, Not the Success Message
Notes from one overnight honeypot build: a provider pivot, a port a service restart did not move, a stopped process that was still running, a decoy file that needs two halves, and three different kinds of nightly traffic.
-
RAM Wasn't Tight; the Switch Was the Next Step
A host-side memory readout said 2.7Gi free against 10Gi used, but both guests were using a fraction of their allocations — which points at KVM's static RAM reservation rather than real demand. Notes on that diagnosis, the balloon line missing from both configs, and why the next hardware purchase was an undeployed managed switch instead of more compute.