Django Admin Honeypot is a fake Django admin login screen to log and notify admins of attempted unauthorized access. It creates a decoy admin interface that looks and feels like the real Django admin but actually traps potential attackers, logging their attempts and optionally sending notifications to the real administrators.

Pros

• Enhances security by diverting potential attackers away from the real admin interface
• Provides valuable insights into attempted unauthorized access
• Easy to set up and integrate with existing Django projects
• Customizable notification system for real-time alerts

Cons

• May give a false sense of security if relied upon too heavily
• Requires additional server resources to run the honeypot
• Could potentially confuse legitimate users if not implemented carefully
• Limited effectiveness against sophisticated attackers who may recognize the honeypot

Code Examples

1. Basic setup in urls.py:

from django.urls import path, include

urlpatterns = [
    path('admin/', include('admin_honeypot.urls', namespace='admin_honeypot')),
    path('secret-admin/', admin.site.urls),  # Your real admin URL
]

2. Customizing the admin template:

# settings.py
ADMIN_HONEYPOT_TEMPLATE = 'my_custom_admin_template.html'

3. Configuring email notifications:

# settings.py
ADMINS = [('John', 'john@example.com'), ('Jane', 'jane@example.com')]
EMAIL_HOST = 'smtp.example.com'
EMAIL_PORT = 587
EMAIL_USE_TLS = True
EMAIL_HOST_USER = 'your_email@example.com'
EMAIL_HOST_PASSWORD = 'your_password'

Getting Started

1. Install the package:

   pip install django-admin-honeypot
   

2. Add admin_honeypot to your INSTALLED_APPS in settings.py:

   INSTALLED_APPS = [
       ...
       'admin_honeypot',
       ...
   ]
   

3. Update your urls.py as shown in the code examples above.

4. Run migrations:

   python manage.py migrate
   

5. Start your Django server and navigate to /admin/ to see the honeypot in action.