Hello I was wondering whether a a fresh install of Debian connected to the internet without further protection (iptable or whatever) is safe or equivalent to a honeypot. Do we have some people that demonstrated that a fresh linux install running naked on the internet for hours or days won't get compromised by itself for future use ?
Is a fresh install of linux equivalent to a honeypot?
security
It's not really a honey pot.  But you could treat it like one.But if you wanted to do that experiment, there might be a way to use tripwire to look for changes an intruder may have made to 'own' the system.Set it up,  leave it open and idle.  Then go back after your period is up and look for evidence.  (Take steps to make sure tripwire itself wasn't crippled.  Back up its initial database off the host.  use fresh copies of its executables to audit)If you were having security updates installed automatically, you'd have to exclude the changes that process made.But then there are the intruders that just visit without making changes.  You can look for logins in your log files.  You can probably even set up iptables to log connections to and from the test machine and check that for odd activity