Re: DNS honeypots?

Cool, this is the kind of thing I was thinking of doing.  I was hoping
I wouldn't have to reinvent the wheel.

Thanks.

On Tue, Mar 2, 2010 at 3:49 PM, Jason Ross <[email protected]> wrote:
> On Tue, Mar 2, 2010 at 3:00 PM, Jason Lewis <[email protected]> wrot=
e:
>> Anyone have any pointers to dns honeypots or maybe just BIND
>> configurations that would allow logging of malicious queries without
>> actually executing them?
>>
>
>
> Below is how I've got BIND set up in Debian Linux for a similar purpose.
> It sends all the queries to a log file, and returns an A record (and MX)
> of whatever value you'd like (I used RFC1918 space for this example).
>
> Not sure it's perfect, but it works pretty well for my purposes.
>
> Cheers,
> --
> Jason
>
>
>
> root dir: /etc/bind
>
> =3D=3D=3D=3D=3D=3D=3D=3D
> named.conf
> =3D=3D=3D=3D=3D=3D=3D=3D
> include "/etc/bind/named.conf.options";
>
> zone "." IN {
> =A0 type master;
> =A0 file "/etc/bind/db.wildcard";
> };
>
>
> =3D=3D=3D=3D=3D=3D=3D=3D
> named.conf.options
> =3D=3D=3D=3D=3D=3D=3D=3D
> options {
> =A0 directory "/var/cache/bind";
> =A0 allow-transfer { none; };
> =A0 listen-on-v6 { any; };
> };
>
> logging {
> =A0 channel query_log {
> =A0 =A0 =A0severity info;
> =A0 =A0 =A0print-time yes;
> =A0 =A0 =A0file "query.log" versions 5 size 50M;
> =A0 };
> =A0 category queries {
> =A0 =A0 =A0query_log;
> =A0 };
> };
>
>
> =3D=3D=3D=3D=3D=3D=3D=3D
> db.wildcard
> =3D=3D=3D=3D=3D=3D=3D=3D
> $TTL =A0 604800
> @ =A0 IN =A0 SOA =A0 localhost. =A0root.localhost. (
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A02009102201 =A0; serial
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 604800 =A0; r=
efresh
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 86400 =A0=
; retry
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 2419200 =A0; expi=
re
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0604800) ; nega=
tive cache ttl
>
> @ =A0 =A0 =A0 =A0 =A0 =A0 =A0IN =A0 =A0 =A0 =A0 NS =A0 =A0 =A0 =A0localho=
st.
> * =A0 =A0 =A0 =A0 =A0 =A0 =A0IN =A0 =A0 =A0 =A0 =A0MX 10 =A0 mail.
> * =A0 =A0 =A0 =A0 =A0 =A0 =A0IN =A0 =A0 =A0 =A0 =A0 =A0A =A0 =A0 =A0 =A01=
92.168.3.101
>