andrewmichaelsmith / honeypot-setup-script Goto Github PK

dionaea bistreams folder not being created

I think this script should be replaced by a more simple script that calls out to some Docker containers (that should also be created as part of the work)

New project (with very beginnings) here: andrewmichaelsmith/manuka#1

I've broken kippo because I copy the cfg to /opt/kippo before doing the clone

Following error was reported by the script while attempting to start kippo

• Starting the process kippo Unhandled Error
  Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/twisted/application/app.py", line 642, in run
  runApp(config)
  File "/usr/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 23, in runApp
  _SomeApplicationRunner(config).run()
  File "/usr/lib/python2.7/dist-packages/twisted/application/app.py", line 376, in run
  self.application = self.createOrGetApplication()
  File "/usr/lib/python2.7/dist-packages/twisted/application/app.py", line 441, in createOrGetApplication
  application = getApplication(self.config, passphrase)
  --- ---
  File "/usr/lib/python2.7/dist-packages/twisted/application/app.py", line 452, in getApplication
  application = service.loadApplication(filename, style, passphrase)
  File "/usr/lib/python2.7/dist-packages/twisted/application/service.py", line 405, in loadApplication
  application = sob.loadValueFromFile(filename, 'application', passphrase)
  File "/usr/lib/python2.7/dist-packages/twisted/persisted/sob.py", line 203, in loadValueFromFile
  fileObj = open(filename, mode)
  exceptions.IOError: [Errno 2] No such file or directory: '/opt/kippo/kippo.tac'

Failed to load application: [Errno 2] No such file or directory: '/opt/kippo/kippo.tac'

p0f seems to start but then exits

example

--- p0f 2.0.8 resuming operations at <Tue Jan 15 22:10:41 2013> ---
[-] ERROR: Network is down.

e.g.

# You have the following interfaces, please choose one:

[0] lo (127.0.0.1)
[1] venet0 (127.0.0.1)
[2] venet0:0 (199.180.252.139)

# ..
#2

Seen by me and others in dionaea-errors.log

dionaea debug logging logs alot

should change levels in dionaea.conf

levels = "all" -> levels = "warning,error"

p0f should run under its own user

I have ports 22 and 445 forwarded respectively.
From a remote PC i can open shell to port 22 but 445 shows a filtered state. I'm not seeing logs on my dionea honeypot

Any workaround this issue?!

Added ppa:honeynet/nightly successfully but this does not contain dionaea package anymore.

Found this wiki: http://www.aldeid.com/wiki/Dionaea/Installation#Installation_of_Dionaea

This could serve as a temporary fix.

cheers

new kippo needs new config

Currently the script fails rather ungracefully if you don't have sudo installed or if you have sudo but don't have sudo powers.

# bash setup.bash
ERROR: Please install sudo before contniuing (apt-get install sudo)

#bash setup.bash
ERROR: You need to run this script under an account that has access to sudo

If you choose to run the honeypots on a virtual interface such as venet0:0 then dionaea will not run because it can't handle colons in the interface name.

If you strip it from the name then dionaea seems to handle it properly so that may be worth doing.

on ubuntu 14.04

There's a lot of apt-get noise that could hide errors.

Make this quieter.

If the box being configured has an extra NIC that is not plugged into the network, then that NIC won't have an IP address. When the python script that prompts the user for which interface to use, tries to enumerate all the interfaces (and their IP addresses), it will fail when it gets to that unplugged NIC. The installation script will continue without user interaction and fail at the end with a message about an invalid NIC. Workaround was possible by plugging all NICs (including unused ones) into a switch while the install script was running.

I get the error below after reboot. The directory is missing as well

An error has occurred: '[Errno 2] No such file or directory: '/var/run/kippo/kippo.pid''

• Starting the process kippo [fail]

Kippo has moved from googlecode to github: https://github.com/desaster/kippo

Dionaea package is now named dionaea-phibo.

Just an FYI, will try updating the script later and submitting a pull request.