Using a Raspberry Pi as a network honeypot
Camouflage and Obfuscation
In the configuration files for Glastopf and Kippo, you will find predefined Apache or SSHd versions, which attackers already know. It makes sense to modify the products to fit in with your enterprise. For example, if all of your production servers run on IIS, you will not want Glastopf to send an Apache banner.
Configuring a successful honeypot is a question of psychology. The simulated services are intended to tickle the attacker's fancy and entice them to stick around for a while, but if the presentation is all too obvious, attackers will quickly turn to a more rewarding target.
Networks from the Air
Low-interaction honeypots are not good enough to stop more intelligent attackers from becoming suspicious. Honeypots always require a compromise between hardware investment, monitoring precision, and transparency. Because running a complete honeypot network does not make business sense, virtualization technology offers a helpful alternative. Advanced honeypots can simulate whole networks made up of different computers. Remember that a network made up of full-fledged virtual machines can be very useful to an attacker under certain circumstances. Once a virtual machine is compromised, an attacker can leverage it like any other zombie, employing it for DoS attacks and other nefarious activities.
The Honeyd honeypot tool [5], developed by Niels Provos, positions itself as a hybrid that simulates multiple computers without the overhead of a classical hypervisor stack. This approach reduces the computational power requirement, and users benefit from the fact that attackers cannot hijack emulated machines.
Because the product is only available for the desktop versions of Debian, you will need to compile it for other systems. To do so, change to the /usr/src
directory and run the commands shown in Listing 4.
Listing 4
Install Honeyd
From this point onward, you can launch the honeypot by typing the honeyd
command. The parameter it expects is the network interface to use; on a Raspberry Pi, you can launch the daemon by typing sudo honeyd -i eth0
.
Commissioning the Honeyd Network
Calling Honeyd directly launches honeypots with a set of not very useful default parameters. You will want to add a configuration file that contains additional information about the network topology you are simulating. The first example is the declaration of an admittedly fairly strange workstation, which you can implement using the following snippet:
create windows set windows personality "OpenBSD 4.0 (x86)" set windows uptime 1728650 set windows maxfds 35
The create
command defines a new host entry that is accessible via its alias. Defining the personality
tells Honeyd which operating system to simulate on the host. You will find the names of the individual operating systems in the nmap-os-db
file. Note that all the tutorials also refer to this file as nmap.prints
.
The tool simulates individual services using the files stored in the /scripts/
subdirectory, which describe the interaction between the server and client. Say you want to bind three different scripts to ports that are accessible via TCP; port 53 will simply be configured as an open UDP port:
add windows tcp port 80 "scripts/web.sh" add windows tcp port 22 "scripts/test.sh" add windows tcp port 23 "scripts/router-telnet.pl" add windows udp port 53 open
Finally, the file declares all unused ports as closed. Assign an IP address of 192.168.3.137 to the system, and you are ready for action:
set windows ethernet "dell" set windows default tcp action closed bind 192.168.3.137 windows
On the web, you will find many virtual networks if you search for Honeyd configuration. You can use these networks as a source of inspiration for your honeynet. Prebuilt configuration files are passed into the program using the -f
option; -p
lets you write to a different trace file, whereas -d
runs honeyd
in the foreground:
./honeyd -d -p nmap.prints -f config.sample
Honeyd only collects statistics if you call it with the -c
option. You can use the analysis scripts created by BruteForce Labs [6] to evaluate the results.
At this time, the honeypot is only accessible via the IP address assigned by the router. In the case of a virtual network, this configuration is not very useful because the attacker can only access the network via a single entry point. You can solve this problem by deploying a program called farpd:
sudo apt-get install farpd
Farpd will install on your single-board computer. After launching farpd with
sudo farpd -i interface
it manipulates the operating system protocol stack so that it fields any IP address requests via ARP from this point onward.
This behavior can cause problems in combination for VoIP systems, so farpd also supports a selective approach. The program can interpret restricting specifications such as 10.0.0.3, 10.0.0.0/16, and 10.0.0.5-10.0.0.15. Finally, the popular -d
option in Honeyd tells a program to work in the foreground.
« Previous 1 2 3 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Red Hat Adds New Deployment Option for Enterprise Linux Platforms
Red Hat has re-imagined enterprise Linux for an AI future with Image Mode.
-
OSJH and LPI Release 2024 Open Source Pros Job Survey Results
See what open source professionals look for in a new role.
-
Proton 9.0-1 Released to Improve Gaming with Steam
The latest release of Proton 9 adds several improvements and fixes an issue that has been problematic for Linux users.
-
So Long Neofetch and Thanks for the Info
Today is a day that every Linux user who enjoys bragging about their system(s) will mourn, as Neofetch has come to an end.
-
Ubuntu 24.04 Comes with a “Flaw"
If you're thinking you might want to upgrade from your current Ubuntu release to the latest, there's something you might want to consider before doing so.
-
Canonical Releases Ubuntu 24.04
After a brief pause because of the XZ vulnerability, Ubuntu 24.04 is now available for install.
-
Linux Servers Targeted by Akira Ransomware
A group of bad actors who have already extorted $42 million have their sights set on the Linux platform.
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.