Questions tagged [honeypot]
A honeypot is a system with vulnerable services left publicly accessible for the purpose of collecting data about intrusions and attacks. It usually has some kind of safeguards to prevent the complete takeover of the system.
21
questions
0
votes
0
answers
48
views
Is creating a fake file that's not in use a viable honey pot?
We currently host upwards of 300 wordpress sites/installations, and I am experimenting with beefing up WordPress security through some homemade efforts.
As an IT guy, I watch logs .. All the time, ...
- 354
0
votes
2
answers
274
views
How to configure SELinux such that it will not block the execution of endlessh
I was prompted an execution error when I check on endlessh status, I believe SELinux is blocking that execution, how to let SELinux allow that execution?
[root@fedora endlessh]# systemctl status ...
- 1
1
vote
0
answers
64
views
HIDS: Need a trip wire for a honeypot, best approach?
We run a small VPS hosting company, each vps is based on a fixed 18.04 template.
We run a honeypot, a fallow server, to verify the template continues to be secure. We look at it probably once a month ...
- 31
1
vote
2
answers
201
views
Prevent using spam trap e-mail address on registration
I am running a website where the users register using their e-mail addresses and receive a confirmation code before they can log in. (After this every contact is opt-in.)
Every now and then some user ...
- 323
7
votes
1
answer
4k
views
How to forward FTP requests to another IP?
I have a VMware: 10.10.10.1, a linux in VMware (Guest): 10.10.10.128 and a honeypot on Guest: 10.10.10.15, and my Windows (Host): 192.168.1.11. I can send FTP requests directly from my Host to ...
- 83
0
votes
1
answer
68
views
Installed Kippo on a remote machine, cant get the root access back
This seems to be a foolish question, so I recently tried to install Kippo to my server (DigitalOcean).
I logged in to the server using PuTTY, configure the honeypot etc until it's working. Then the ...
- 425
0
votes
1
answer
362
views
Beeswarm Honeypot Setup
I am working on a POC of Beeswarm and I'm running into an issue with connecting the drone. For the basic setup, I have the server working fine and I can access it via https://X.X.X.X:5000 (I get a ...
- 1,393
-2
votes
1
answer
2k
views
How to get rid of firewall blockage to ssh to my ec2 instance [closed]
I've made my ec2 instance on AWS and I worked on it at home like a charm and everything went fine (connection wise)
Today I went to the library and when I tried to ssh into my ec2 using PuTTy as I ...
0
votes
2
answers
880
views
Throw brute-forcers into a honeypot, but still allow real SSH logins?
So just for fun I opened up SSH to the world and a few bots have latched on to my server (unsuccessfully trying to log in by password). But of course this fills up the logs.
I've attempted to use ...
- 221
2
votes
2
answers
1k
views
Rejecting traffic where ACCEPT header is empty on favicon.ico requests
As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty.
I notice from my logs that a fair number of requests have been rejected due to ...
- 409
1
vote
3
answers
4k
views
How to have sshd write passwords associated with login attempts in logs?
I would like to gather common login/password pairs.
Currently, I have this in my system.log file:
sshd[9117]: error: PAM: authentication error for root from localhost via ::1
How can I have the ...
- 201
-2
votes
2
answers
158
views
giving no response of pinging from one but give response from other machine [closed]
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.141.148.253 0.0.0.0 255.255.255.255 UH 0 0 0 eth0
14.1.0.0 10....
0
votes
1
answer
973
views
Adding static route in Red Hat with machine in different subnet as default gateway
Destination Gateway Genmask Flags Metric Ref Use Iface
10.156.16.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0
168.254.0.0 0.0.0.0 255.255.0.0 ...
3
votes
1
answer
518
views
Is there any useful/funny HTTP redirect for all those vulnerability probes? [closed]
I'm sure your HTTP logs, like mine, are full of 404 errors of various probes for common vulnerabilities and such:
File does not exist: /www/XXXXXX.XX/data/email
File does not exist: /www/XXXXXX.XX/...
- 5,846
2
votes
2
answers
1k
views
Has anyone ever tried to collect passwords and user logins from ssh-attacks?
I guess it should be easily possible to open the ssh port with a fake ssh server and collect passes (I guess they aren't plain anymore and became hashes) and corresponding logins, e.g. a honey-pot. ...
- 453
1
vote
1
answer
520
views
better place to redirect spam than black hole?
I use throwaway email addresses of the form [email protected] whenever I sign up to newsletters. When I get spam to them I unsubscribe from the newsletter and forward them to ":blackhole:". Is ...
- 301
0
votes
2
answers
242
views
How can I get a hold of a large collection of varied I.P. addresses?
I want to get a low cost host (i.e. a cheap VPS Server) that has a lot of I.P. addresses pointed at it. This is for the purpose of running a honeypot server, the more I.P.s the more hits it will get.
...
- 143
4
votes
4
answers
3k
views
Providing DNS redirection to honeypot server for known bad domains
Currently running BIND on RHEL 5.4 and am looking for a more efficient manner of providing DNS redirection to a honeypot server for a large (30,000+) list of forbidden domains.
Our current solution ...
- 493
0
votes
4
answers
318
views
Temporarily banning IPs for accessing certain ports
One of my server logs showed there was an unauthorized access attempt on a daemon listening on a non-standard port. That led me to wonder how often people run port scanners to look for vulnerabilities....
- 2,929
5
votes
3
answers
2k
views
Setting up a Honeypot in an Enterprise Environment
I'm interested to see if anyone here who administers a large environment (200-500 Servers), and has a very large public customer base (100,000+), has set up (or has at least considered setting up) a ...
- 4,163
10
votes
10
answers
5k
views
Setting up a fake email address to trap spammers
I have heard it suggested that we set up a special email address, with it's only purpose being to be harvested. Then blacklisting every sender that targets this address.
I'm wondering:
if anyone ...
- 23k