Artillery can turn a Linux VPS into a low-interaction honeypot while also watching selected files and analyzing threats in real time. The practical setup is a disposable, segmented Ubuntu server with a separate administration path—not a production host. The commonly published installation dates from 5 December 2013, and the original repository now points to a moved project, so treat the commands below as a legacy procedure: verify the current BinaryDefense code, supported Ubuntu releases, Python requirements, installer behavior, and open issues before running them.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Artillery does
Artillery is an open-source defensive tool for Linux and Windows. Its Linux deployment combines three related functions:
As an Amazon Associate I earn from qualifying purchases.
- Low-interaction honeypot: decoy listeners answer on ports that scanners commonly probe, including SSH, MSSQL and RPC/SMB, making a Linux host appear more Windows-like.
- File-system monitoring: changes under directories you nominate can trigger alerts or investigation.
- Threat and connection analysis: the service watches activity on the host and can ban addresses that repeatedly fail authentication or otherwise match its defensive rules.
The project description states: “The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.” A honeypot is a detection and deception layer, not a replacement for patching, least privilege, backups, or a firewall.
Decide whether this legacy deployment fits
Use an isolated VPS
Choose a disposable instance or a separately segmented network. Do not install an unverified legacy security service on a server holding customer data, private keys, databases, or irreplaceable files. Give the VPS only the data and credentials required for the experiment, and keep administrative secrets off the monitored directories where possible.
#1 Best Overall
Keep an out-of-band recovery path
Before changing SSH, firewall, or listening-port settings, confirm that your provider’s web console, serial console, rescue environment, or equivalent recovery channel works. This is the path you will use if a rule blocks the network or the service binds a port you still need.
Separate administration from deception
The real SSH daemon and Artillery’s decoy listener cannot share one address and port. Decide which port is the management SSH endpoint and keep that port out of the decoy list. If your daemon currently uses port 22, either leave 22 out of PORTS or move SSH to another port using a tested two-session procedure. Never close the first working session until a second session has authenticated successfully.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Record the baseline
Write down the Ubuntu release, kernel, public and private addresses, current SSH port, firewall rules, Python version, and listening sockets. Capture this information before installation so a later change can be distinguished from Artillery’s behavior.
Check the project before copying old commands
The original project page says that Project Artillery has moved to https://github.com/BinaryDefense/artillery. The older repository remains useful for understanding the historical procedure, but it is not evidence that the 2013 installer still works on a current Ubuntu release.
Open the moved repository and check its installation documentation, supported distributions, Python version, dependency files, service definition, update mechanism, and recent issue history. Confirm whether the installer still expects setup.py, whether it writes to /var/artillery, and whether its service is compatible with your init system. If the repository does not document your Ubuntu release or the required runtime, test in a disposable clone first and pin the commit you tested. Do not enable unattended updates until you understand what code is fetched, how it is verified, and how to roll back.
The historical source is https://github.com/trustedsec/artillery/. Its commands and file paths are reproduced below as compatibility references, not as a guarantee of current support.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install the historical build procedure
After the compatibility check, use a fresh administrative shell and keep your recovery console available. The 2013 procedure is:
- Refresh package metadata:
sudo apt-get update - Install Git:
sudo apt-get install git - Clone the repository used by the historical tutorial:
sudo git clone https://github.com/trustedsec/artillery/ /artilleryIf the moved repository is the one you have validated, substitute its documented clone URL and branch instead of blindly using the old location.
- Enter the checkout:
cd /artillery - Run the installer:
sudo ./setup.pyThe old tutorial describes three yes/no prompts and recommends answering yes. Read every prompt on your version; an installer can request firewall changes, startup behavior, or update settings that differ from the historical wording.
Do not treat a successful return to the shell as proof that the service is safe. Confirm which files were created, which user owns them, which ports were opened, and whether the service definition matches your operating system.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDatabase-file workaround documented by the old tutorial
The historical procedure reports an error when /var/artillery/database/temp.database is missing. Its workaround creates the directory and empty file, then restarts the service:
sudo mkdir -p /var/artillery/database
sudo touch /var/artillery/database/temp.database
sudo service artillery restartUse this only if the version you installed expects that path. If a current checkout reports a different database location or schema, follow its own instructions instead of creating legacy files that the new code does not use.
Configure /var/artillery/config before exposing the VPS
The historical installer generates /var/artillery/config. Edit it before scanning the host from the internet. Make a dated backup of the original file so you can restore a known state.
| Setting | Purpose | Safe way to choose a value |
|---|---|---|
MONITOR_FOLDERS |
Directories whose file activity should be monitored. | Add only sensitive paths that matter to this test, such as /var/www, /etc, or /root. Start small so expected package and log activity does not overwhelm the signal. |
EXCLUDE |
Paths omitted from monitoring. | Exclude locations with constant, known churn or generated data. Document every exclusion because it is also a blind spot. |
WHITELIST_IP |
Addresses allowed to connect without being banned by defensive rules. | Include loopback and the fixed addresses used by administrators, monitoring systems, and authorized scanners before testing. |
PORTS |
Decoy ports that Artillery presents as open. | Choose a believable, minimal set that does not collide with real services or expose protocols you cannot monitor. |
AUTO_UPDATE |
Controls the historical automatic-update option. | The old article recommends AUTO_UPDATE=ON; review current update behavior and pin or stage updates before enabling this on an internet-facing host. |
ANTI_DOS_PORTS |
Ports covered by the anti-DoS feature. | The historical example is 80,443,8080,8180,10000. Use only ports you intentionally expose and test. |
ANTI_DOS |
Global switch for that protection. | The old configuration uses ANTI_DOS=ON and says HTTP/HTTPS protection is enabled by default. Disable only after understanding the effect of ANTI_DOS=OFF in your version. |
A conservative example
The historical article lists this decoy set:
PORTS=135,445,22,1433,3389,8080,21,5900,25,53,110,1723,1337,10000,5800,44443It is a deception choice, not a firewall policy. Remove ports that conflict with your real SSH, web, mail, DNS, or management services; add no port merely because it appears in the example. A smaller list that matches the story you want the host to tell is easier to validate and less likely to create accidental exposure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Build the firewall and SSH safety net
Apply restrictions at both layers available to you: the VPS provider’s security group or network firewall and the operating system firewall. Permit the actual management SSH port, the recovery services you require, and only the decoy ports you deliberately intend to expose. Deny everything else by default where your platform supports that policy.
UFW is an interface to iptables; the important ordering rule is to allow the required service before enabling the firewall. Use the same ordering in a provider firewall: add and verify the management rule first, then apply the broader policy. If the decoy list contains port 22 while SSH also listens on 22, resolve that collision before starting Artillery.
Open a second SSH session from an allowlisted administrator address. Leave both sessions active while you reload firewall rules, start the service, and run the first scan. If the second session fails, stop and use the provider console rather than closing the original session.
Start, inspect, and verify the service
The historical installation registers Artillery as a service and is intended to start it after reboot. Control it with:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #4
sudo service artillery start
sudo service artillery restartCheck that the process exists:
ps aux | grep artilleryThe old tutorial also suggests watching the process with top -p PID, replacing PID with the numeric process ID shown by your system. For socket-level confirmation, use:
ss -lntupCompare every listening socket with your intended design. Verify that the real SSH daemon remains reachable on its management port, that the decoy listeners correspond to the approved PORTS entries, and that no unexpected service appeared. A port shown as listening is not proof that the honeypot is receiving the traffic you expect; test from an external, authorized address.
Test without banning yourself
- Add the fixed administrator, monitoring, and scanner addresses to
WHITELIST_IPand reload the configuration if your version requires it. - From the authorized external scanner, connect only to the decoy ports you selected. Record banners, connection behavior, and timestamps without sending destructive payloads.
- Attempt one controlled failed SSH authentication from the test address if you need to confirm ban behavior. Do not use repeated guesses from an unallowlisted administrator address.
- Inspect Artillery’s logs and the system authentication logs to confirm which component made the decision.
- Remove the test exception only after you have a recovery path and have documented the expected result.
The source warns that an authorized user’s address can be banned after repeated failed SSH passwords. Allowlisting is therefore a prerequisite for testing, not an optional convenience.
Recover from a ban
If an address is banned, use a console or another allowlisted session to reach the host. The historical installation includes reset-bans.py in /var/artillery:
cd /var/artillery
sudo ./reset-bans.py 203.0.113.10203.0.113.10 is an example documentation address; replace it with the actual banned address. The published tutorial omits the separating space in its displayed command, so ensure your command has one between the script name and the IP address. Confirm that the ban is removed at the firewall layer as well as in Artillery’s own state, then correct the allowlist or test procedure that caused the lockout.
Validation checklist before leaving it online
- Confirm the moved repository, supported Ubuntu release, runtime, dependencies, and installer behavior.
- Verify the provider console or other out-of-band recovery channel.
- Establish a second SSH session before changing firewall or SSH settings.
- Run
ss -lntupand compare listening sockets with the intendedPORTSlist. - Verify that the real SSH daemon remains reachable on its management port.
- Test from an external, authorized scanner whose address is allowlisted.
- Inspect Artillery logs and ban behavior, then test the reset script using a controlled address.
- Record the exact Ubuntu release, repository commit, Python version, configuration, firewall rules, and test date.
Troubleshooting common failures
The installer fails immediately
Check the moved repository’s dependency and Python requirements first. A 2013 setup.py workflow may assume packages, interpreter behavior, or an init system no longer present. Capture the complete error, test in a disposable snapshot, and avoid mixing files from two repository versions.
The database path error returns
Confirm that your installed version actually references /var/artillery/database/temp.database. If it does, create the directory and file using the documented workaround, then restart the service. If it uses another path, follow that version’s migration or initialization instructions instead.
SSH stopped working
Keep the original session open, use the provider console, and inspect both firewall rules and listening sockets. Remove a colliding decoy port, restore the last known-good firewall policy, and add the administrator address to WHITELIST_IP before testing again.
Expected decoy ports are absent
Check the parsed configuration, service status, and ss -lntup output. A port can be absent because it conflicts with another daemon, was blocked upstream, or is not supported by the installed build. Resolve one cause at a time and retest from an authorized external address.
Monitoring produces too much noise
Narrow MONITOR_FOLDERS, add only well-understood high-churn paths to EXCLUDE, and document the resulting blind spots. Do not exclude a directory simply because it is noisy if it contains the evidence your investigation requires.
An update changes behavior
Disable unattended updating while you investigate, record the current commit and configuration, and compare the service definition and listening sockets with your baseline. Roll back to the tested snapshot if the update cannot be explained or reproduced.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Operational limits and security practices
Artillery’s decoys do not make an unpatched operating system safe. Keep Ubuntu security updates current, use least-privilege accounts, protect private keys, and restrict outbound traffic where practical. Treat every connection and file alert as evidence to preserve, not as proof that an attacker was fully contained.
Do not place production credentials, cloud metadata access, or unrestricted network routes on a honeypot. Segment it so a compromise cannot reach management networks. Forward logs to a separate system if you need durable evidence, and synchronize time so connection and file events can be correlated. Review disk usage because verbose logs and file-monitoring databases can fill a small VPS.
Is Artillery still maintained?
The evidence supports a cautious answer, not a current-maintenance claim. The original repository explicitly says the project moved to the BinaryDefense repository, but the 2013 tutorial does not establish which Ubuntu releases, Python versions, or security fixes are supported today. Before deployment, inspect the moved repository’s recent activity, release notes, dependency constraints, installer, and unresolved issues. If those checks do not cover your environment, treat Artillery as an experimental legacy tool and isolate it accordingly.
Bottom line for a safe deployment
Artillery is useful when you need a small deception layer combined with host-file monitoring, but the familiar installation is historical. Validate the moved code first, deploy only on an isolated VPS, keep a tested out-of-band path, separate real SSH from decoy ports, allowlist every administrator and scanner address, and verify sockets and bans from an external authorized test. The result should be a reproducible, documented experiment—not an assumption that old commands remain supported forever.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
