1

Security and Stealth

anti edited this page 2026-04-18 06:07:29 -04:00

Table of Contents

• Security and Stealth
• Authentication
• JWT
• Admin Credentials
• RBAC
• Stealth in Active Probes
• Network Architecture
• OS Fingerprint Spoofing
• Responsible Disclosure

Security and Stealth

DECNET sits on the attacker-facing edge of a network, so its own posture matters as much as the decoys it deploys.

Authentication

JWT

• Algorithm: HS256 (see decnet/web/auth.py).
• Secret: DECNET_JWT_SECRET — must be ≥ 32 characters. Anything shorter is rejected at startup with an explicit error referencing RFC 7518 §3.2 (see decnet/env.py).
• No fallback: the env var is required, not optional.

Admin Credentials

• DECNET_ADMIN_USER / DECNET_ADMIN_PASSWORD seed the initial admin on first boot (decnet/web/db/sqlmodel_repo.py).
• The combination admin/admin is rejected at startup. Deployments must pick a real password.
• Passwords are hashed with bcrypt — plaintext is never persisted.

RBAC

• All admin endpoints are gated server-side via require_admin / require_role("admin") dependencies (decnet/web/dependencies.py).
• Contributor rule (ANTI): the admin UI must be server-gated, never client-side only. A hidden button is not access control.

Stealth in Active Probes

Contributor rule (ANTI): active probes and health checks must never reveal DECNET's identity.

• No User-Agent: DECNET/....
• No banners, headers, or log lines that leak the framework name to a decoy or an external target.
• Probe traffic should be indistinguishable from ordinary tooling (curl, nmap, python-requests). If you're adding a probe and unsure, ask before merging.

Network Architecture

• Decoy network is attacker-facing by design.
• Logging / aggregation network (Logstash → ELK → SIEM) is isolated from the decoy network.
• A publicly accessible real server bridges the two; deckies never talk to the SIEM directly.

See the top-level README.md for the full diagram.

OS Fingerprint Spoofing

Deckies rotate service banners, TTLs, TCP options, and OS hints to look heterogeneous. Mutation is time-based and randomized per decky.

• Details: Mutation-and-Randomization

Responsible Disclosure

Found a security issue in DECNET itself (not a decoy)? Email:

• TODO: add security@ disclosure address

Please do not file public issues for exploitable bugs.

---

See also: Troubleshooting · Environment-Variables · Web-Dashboard

DECNET

• Home

User docs

• Quick-Start
• Installation
• Requirements-and-Python-Versions
• CLI-Reference
• INI-Config-Format
• Custom-Services
• Services-Catalog
• Service-Personas
• Archetypes
• Distro-Profiles
• OS-Fingerprint-Spoofing
• Networking-MACVLAN-IPVLAN
• Deployment-Modes
• SWARM-Mode
• MazeNET
• Remote-Updates
• Environment-Variables
• Teardown-and-State
• Database-Drivers
• Systemd-Setup
• Logging-and-Syslog
• Service-Bus
• Web-Dashboard
• REST-API-Reference
• Mutation-and-Randomization
• Troubleshooting

Developer docs

• Developer-Guide
• Design-Overview
• Writing-a-Service-Plugin
• UI-Things
• Module-Reference-Core
• Module-Reference-Web
• Module-Reference-Services
• Module-Reference-Workers
• PKI-and-mTLS
• Testing-and-CI
• Performance-Story
• Tracing-and-Profiling

Project meta

• Sponsors
• Support-the-Project
• Security-and-Stealth
• Roadmap-and-Known-Debt

DECNET — honeypot deception-network framework. Pre-1.0, active development — use with caution. See Sponsors to support the project. Contact: samuel@securejump.cl