Setting Up a Honeypot On Linux For Security

Setting Up a Honeypot On Linux For Security - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Antivirus & Protection (https://sinister.ly/Forum-Antivirus-Protection)
+--- Thread: Setting Up a Honeypot On Linux For Security (/Thread-Setting-Up-a-Honeypot-On-Linux-For-Security)

Setting Up a Honeypot On Linux For Security - Ex094 - 06-13-2013

Intro

Hello HC!
Today the topic of my tutorial is Creating a Honeypot on Linux but before we continue we need to understand what the term "Honeypot" stands for:

Code:
In easy words, Honeypot is a fake system which is used to set a trap for intruders trying to gain unauthorized access to your system. A Honeypot is like a virtual program which tends to be a part of the computer and the network on which it is installed. A Honeypot detects scans, bruteforce attempts, nmap service scans, pings, telnet connections and more!

Usually Honeypot are of three types:

Code:
1) Pure Honeypot
2) High Interaction Honeypot
3) Low interaction Honeypot

For this tutorial we going to take a look at only Low Interaction Honeypot, this type of Honeypot deploys services that are frequent targets for hackers. This type of honeypot has code, and can be installed on a physical system, This honeypot is not complex either.

There are many Honeypot Programs but the one we are going to install is called "Artillery". It's developed by the same team who have made SET (Social Engineering Toolkit Cool

)

Installing Artillery

First of all open a Terminal and type the following command as root:

Code:
sudo git clone https://github.com/trustedsec/artillery/ artillery/

Then Navigate to the folder "artillery" by typing:

Code:
cd artillery

It has a setup.py script read y to be executed so type:

Code:
sudo python setup.py

Follow the on screen instructions from the CLI and complete the installation

Configuring Artillery

Artillery has a configuration file which lets you edit it's configurations easily, For that in the same terminal as before type:

Code:
sudo gedit config

Now the Text Editor will open your Config file, Make sure the following things are set correctly:

Code:
# DO YOU WANT TO TURN ON THE HONEYPOT
HONEYPOT=YES

# DO YOU WANT TO AUTOMATICALLY BAN ON THE HONEYPOT
HONEYPOT_BAN=YES

# PORTS TO SPAWN HONEYPOT FOR
PORTS="135,445,22,1433,3389,8080,21,5900,25,53,110,1723,1337,10000,5800,44443"

# DO YOU WANT TO MONITOR SSH BRUTE FORCE ATTEMPTS
SSH_BRUTE_MONITOR=ON

# HOW MANY ATTEMPTS BEFORE YOU BAN
SSH_BRUTE_ATTEMPTS=4

Once you have done editing, Type the following code in the same terminal:

Code:
sudo python restart_server.py

Operational Check

To see if Artillery is operating correctly, type the following netstat command in your terminal:

Code:
netstat -antp

You should see the following:

[Image: ZSYZaIZ.png]

What are these?

These are actually the dummy ports setup by artillery to see if someone connects to it, scans on them etc. If it detects suspicious activity it blocks the IP permanently.

Working Test

To test Artillery, From another PC. run the following command:

Code:
telnet your_artillery_pc_IP artillery_dummy_port

e.g:

Code:
telnet 192.168.0.120 445

Next time you connect, You'll get a connection error. I'll be posting some more testing stuff later

Congratulations, You’ve setup a small low-interaction Honeypot on your system Smile

Tutorial by Ex094

RE: Setting Up a Honeypot On Linux For Security - Snipa - 06-13-2013

Easy to follow

Very well explained Smile

Keep it up !

RE: Setting Up a Honeypot On Linux For Security - MrGeek - 06-13-2013

Nice explain bro Smile

I myself went into a honey pot ... a month ago when I tried to SQL inject a gov server Biggrin

RE: Setting Up a Honeypot On Linux For Security - The Real Slim Shady - 06-13-2013

Noob beware: setting up a honeypot can be fun, interesting, and a valuable experience... but a wrong configuration and the next thing you know you have provided a hacker with a platform to launch further attacks into your network, or someone elses. Not familiar with this specific software first hand, but as a general rule... focus and monitor your honeypot. dont leave it unattended for long periods!

RE: Setting Up a Honeypot On Linux For Security - diana32 - 06-13-2013

Well -what should i say - i install and run on my backtrack- i never here before about this and i give a thanks and a reputation point Biggrin

RE: Setting Up a Honeypot On Linux For Security - Ex094 - 06-13-2013

Thanks for all your replies, Glad you guys liked it Smile

RE: Setting Up a Honeypot On Linux For Security - RogueCoder - 06-14-2013

Thanks for another great read mate Smile

RE: Setting Up a Honeypot On Linux For Security - soh_cah_toa - 06-17-2013

I've been meaning to setup a honeypot for a while so I'm genuinely interested in this. I got Artillery up and running on a VM super quick and it does it's job well. Deploying this would actually make a nice weekend project.

I love the Hackers reference when exiting the program. Silly ReL1K...

RE: Setting Up a Honeypot On Linux For Security - 0wi5py - 03-30-2014

Very Nice :Smile:
Keep it up. :Smile: