Deploying Honetpots/Honeynets on Live networks

Question

Recently I have been looking into open source honeynet technology, mainly Honeyd and Potemkin.

Was wondering if anyone had experience working with them or similar technology and how you would start deploying these decoy servers. (Novice System Admin here).

Answer 1

I have experience with Capture HPC. This might not be exactly what you're looking for, since it is a fully active honey client solution made to browse URLs you provide it. Nonetheless, I might dispense some advice and pitfalls:

• Hardware. Some of these solutions are VMWare based. This means a revert operation is done after the machine is infected. This is HDD intensive operation, which would become really slow if the same HDD hosts two VMs that needs reverting at the same time.
• Isolate the servers as much as possible. If possible, have them on a different network than the organization LAN.
• Have a test environment. There are different configurations possible, and those might effect your performance/malicious-detection-efficiency/etc. . You'll need to experience those.
• Use unpatched guest OS. In order to detect malicious activity, you'll need a vulnerable version of the applications you're testing. I'd look for those at oldversion.com and FileHippo.
• Consider the fact these things require maintenance.

I guess there's more to it. Please elaborate the question if you want to know something more specific.

Answer 2

Make sure they're not accessible from internal networks if you can help it.

In my noobie days as a student, I accidentally logged into an infected honeypot machine, thinking it was the real deal, because nobody had told me different...

(although obviously this will not protect you from an internal attack)