Re: DNS Names for external services

On Fri, Apr 23, 2010 at 12:20:17PM -0700, [email protected] wrote:

>>> Likewise, if you don't run an FTP server (or CVS, or POP3, or...),
>>> setup DNS records for those pointing to your honeypot. Use it to
>>> respond in anyway you see fit for defense of your network (blocking
>>> the IP, etc).

>> What happens when one of your legit users says "I wonder if we have an
>> FTP server?" and tries ftp.$YOURCOMPANY.com just to see if it answers?

> if your server is locked down, nothing (other than an additional
> failed login)

Re-read above.  GP advocated setting up a honeypot on well-known names
that *blocks* the source IP.  The problem with this is that if
$legit_user of your company/organization says 'hey, I see
"ftp.$mycompany.com" resolves' and tries it, you will block
$legit_user's source IP.

- Morty