How To Install Honeyd On Debian Linux

Hello friends, I am very much new to linux environment and I have a final year project of emulating services on Honeyd. I don't know how to install honeyd on Centos.

For the security conscious, there is always room for another weapon against attackers. Firewalls, intrusion detection systems, packet sniffers — all are important pieces of the puzzle.

So too is, the 'honeypot daemon.' Honeyd simulates the existence of an array of server and client machines on your network, including typical traffic between them.

The phantom machines can be configured to mimic the signature and behavior of real operating systems, which will trick intruders into poking at them — and revealing themselves to your security staff. Current versions of Honeyd can imitate the appearance of more than 1,000 OSes and their variants, and the profiles used to mimic the targets are gleaned from the security scanner. That does not make them indistinguishable from reality, but it is as close as you can come; Nmap sets the gold standard for OS detection and fingerprinting. Honeyd's creators say they have tested the program with a phantom network of 65,536 virtual hosts running on a single machine.

You probably won't need that many unless you run a gigantic enterprise network, but it is nice to know the program has been thoroughly stress-tested. In practice, Honeyd trips up attackers in two ways. First, it slows them down by vastly increasing the amount of work they must do to correctly identify the real target machines on your network.

The Nmap scans and traffic logs will be much larger, and take much longer to sort through. Think of this as akin to the way medieval castles were built with multiple rings of walls, with the gates at different positions around the perimeter. The more you slow down the attacker, the better your chances of catching him or her through your other methods. Second, each of the Honeyd virtual servers is a 'honeypot' in the sense that it attracts real attacks even though it is not a real machine. No legitimate user on your network will ever need to probe a Honeyd virtual server, because they do not offer real services. Therefore any probes or connection attempts are automatic red flags. Obviously, a misconfigured program on another machine could generate false positives (as could an uninformed-but-curious new admin), but by and large the honey attracts ne'er-do-wells.

Installation and Configuration Researchers use Honeyd on Internet-facing networks to trap and catalog malware and viruses 'in the wild,' but for protecting your own home or office network, it runs just as well in a LAN environment. Most modern Linux distributions provide Honeyd packages through their package management system, but if you wish you can grab the source from the project's section. The most recent version is 1.5c, from 2007 (don't worry; the core functionality has not evolved much lately, but you might want to update the OS emulation capabilities by grabbing updated emulation scripts from the Honeyd ). Honeyd's configuration file resides at /etc/honeypot/honeyd.conf — although in practice you can have multiple config files as pass the one you want to run to honeyd at startup time.

The format is essentially plain text, with comment lines denoted with a hash character at the beginning. You may need to include a routing section at the beginning of the file, depending on the virtual 'network layout' you wish Honeyd to emulate.

One way or another, you will need to get the packets headed for your phantom honeypot IP addresses to the machine on which Honeyd is running. You can do this by adding specific routing rules to your router, so that traffic addressed to the specific IPs or IP range you are using for your honeypots is routed directly at your Honeyd machine, or you can use an external tool like. Either way, you use route entries in your honeyd.conf file to describe how the network should appear.

For example, the default config file comes with: route entry 10.0.0.1 route 10.0.0.1 link 10.2.0.0/24 route 10.0.0.1 add net 10. Free Download Game Untuk Notebook Asus 1215b. 3.0.0/16 10.3.0.1 latency 8ms bandwidth 10Mbps route 10.3.0.1 link 10.3.0.0/24 route 10.3.0.1 add net 10.3.1.0/24 10.3.1.1 latency 7ms loss 0.5 route 10.3.1.1 link 10.3.1.0/24 This defines a gateway at the IP address 10.0.0.1, and sets up links to three subnets: 10.2.0.0/24, 10.3.0.0/24 and 10.3.1.0/24. It also defines the connections between the subnets (the add net lines). As you can see, you can specify the bandwidth, latency, and packet loss over these phantom connections — remember, since the entire network is virtual, Honeyd can essentially control every aspect of it. With this framework in place, you will next need to define some virtual machine templates. Most configurations begin with a 'default' stanza that (as with firewall rules) establishes a baseline drop-unknown-packets behavior: create default set default default tcp action block set default default udp action block set default default icmp action block Templates can have any name you choose, so pick a descriptive one. After its create TEMPLATENAME line, use set to assign it an OS 'personality.' The list of emulatable personalities is found in /etc/honeypot/nmap.prints.