I set up a DShield honeypot on an Ubuntu 26.04 LTS virtual machine running under VMware. After confirming the OS version, I created a dedicated dshield user, installed the necessary packages, and cloned the official DShield-ISC repository. I worked through the interactive installation script, successfully entered my DShield account email and API key, configured the network interface, trusted local networks, and firewall exceptions.
During the process I resolved several practical issues: missing git, password problems with the new user, awkward dialog box navigation, sudo authentication caching, and a forced reboot due to an active desktop session. After the initial install I updated the honeypot software and switched the VMware network adapter from NAT to Bridged mode so the sensor could receive real internet traffic.
The final status check confirmed that the API key was valid, the web honeypot was running, firewall rules were in place, and the sensor was correctly configured. While a “webserver not exposed” warning remains (typical until the router/firewall allows inbound traffic), the honeypot itself is fully installed, updated, and ready to begin collecting and submitting attack data to the SANS Internet Storm Center.