A honeypot is a system with vulnerable services left publicly accessible for the purpose of collecting data about intrusions and attacks. It usually has some kind of safeguards to prevent the complete takeover of the system.

learn more… | top users | synonyms

0
votes
1answer
158 views

Beeswarm Honeypot Setup

I am working on a POC of Beeswarm and I'm running into an issue with connecting the drone. For the basic setup, I have the server working fine and I can access it via https://X.X.X.X:5000 (I get a ...
-2
votes
1answer
70 views

How to get rid of firewall blockage to ssh to my ec2 instance [closed]

I've made my ec2 instance on AWS and I worked on it at home like a charm and everything went fine (connection wise) Today I went to the library and when I tried to ssh into my ec2 using PuTTy as I ...
0
votes
2answers
66 views

Throw brute-forcers into a honeypot, but still allow real SSH logins?

So just for fun I opened up SSH to the world and a few bots have latched on to my server (unsuccessfully trying to log in by password). But of course this fills up the logs. I've attempted to use ...
2
votes
2answers
162 views

Rejecting traffic where ACCEPT header is empty on favicon.ico requests

As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty. I notice from my logs that a fair number of requests have been rejected due to ...
0
votes
0answers
512 views

Trouble directing traffic to Honeyd virtual hosts

I am trying to set up an experiment to observe some network behavior and as part of that experiment I am setting up a closed LAN that has virtual hosts created by Honeyd. I have honeyd running one ...
-2
votes
3answers
359 views

How to have sshd write passwords associated with login attempts in logs?

I would like to gather common login/password pairs. Currently, I have this in my system.log file: sshd[9117]: error: PAM: authentication error for root from localhost via ::1 How can I have the ...
-2
votes
2answers
73 views

giving no response of pinging from one but give response from other machine [closed]

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.141.148.253 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 14.1.0.0 ...
0
votes
1answer
387 views

Adding static route in Red Hat with machine in different subnet as default gateway

Destination Gateway Genmask Flags Metric Ref Use Iface 10.156.16.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0 168.254.0.0 0.0.0.0 255.255.0.0 ...
3
votes
1answer
287 views

Is there any useful/funny HTTP redirect for all those vulnerability probes? [closed]

I'm sure your HTTP logs, like mine, are full of 404 errors of various probes for common vulnerabilities and such: File does not exist: /www/XXXXXX.XX/data/email File does not exist: ...
2
votes
2answers
451 views

Has anyone ever tried to collect passwords and user logins from ssh-attacks?

I guess it should be easily possible to open the ssh port with a fake ssh server and collect passes (I guess they aren't plain anymore and became hashes) and corresponding logins, e.g. a honey-pot. ...
1
vote
1answer
248 views

better place to redirect spam than black hole?

I use throwaway email addresses of the form sitename@mydomain.com whenever I sign up to newsletters. When I get spam to them I unsubscribe from the newsletter and forward them to ":blackhole:". Is ...
0
votes
2answers
181 views

How can I get a hold of a large collection of varied I.P. addresses?

I want to get a low cost host (i.e. a cheap VPS Server) that has a lot of I.P. addresses pointed at it. This is for the purpose of running a honeypot server, the more I.P.s the more hits it will get. ...
3
votes
4answers
1k views

Providing DNS redirection to honeypot server for known bad domains

Currently running BIND on RHEL 5.4 and am looking for a more efficient manner of providing DNS redirection to a honeypot server for a large (30,000+) list of forbidden domains. Our current solution ...
0
votes
4answers
164 views

Temporarily banning IPs for accessing certain ports

One of my server logs showed there was an unauthorized access attempt on a daemon listening on a non-standard port. That led me to wonder how often people run port scanners to look for ...
5
votes
3answers
780 views

Setting up a Honeypot in an Enterprise Environment

I'm interested to see if anyone here who administers a large environment (200-500 Servers), and has a very large public customer base (100,000+), has set up (or has at least considered setting up) a ...
9
votes
10answers
2k views

Setting up a fake email address to trap spammers

I have heard it suggested that we set up a special email address, with it's only purpose being to be harvested. Then blacklisting every sender that targets this address. I'm wondering: if anyone ...