Re: [sentinix-list] Webmin + Honeyd

Is it good to have the honeypot in the DMZ or should it be before the
firewall?





====================================
Marlon Richards
Communications Engineer
West Indies Alumina Company
Kirkvine Works
Jamaica
Tel#:    876-961-7434
Fax#:   876-961-7464
Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]



                                                                           
             Michel Blomgren                                               
             <[email protected]                                             
             org>                                                       To 
             Sent by:                  The SENTINIX Mailing List           
             sentinix-bounces@         <[email protected]>       
             elevenprospect.co                                          cc 
             m                                                             
                                                                   Subject 
                                       Re: [sentinix-list] Webmin + Honeyd 
             12/09/2003 09:56                                              
             AM                                                            
                                                                           
                                                                           
             Please respond to                                             
               The SENTINIX                                                
               Mailing List                                                
             <[email protected]                                             
               rospect.com>                                                
                                                                           
                                                                           




On Tuesday 09 December 2003 11:04, Hugo Teso Torío wrote:
> Hi,
>
> have been 3 days of holidays in spain and I have been busy with my "dear"
> computer, because It has been "death" for three days too. Interesting
> weekend...

oh, I know the feeling... :(

>
> The webmin implementation for sentinix continues by the correct way and
> also I have installed honeyd on my Sentinix box. Honeyd is an open source
> Honeypot for *NIX computers and I thought It woluld be the best choice
for
> includibg a Honeypot in Sentinix; the requirements for installing it are
> just three libraries:
>
> a.. libevent - an asynchronous event library.
> b.. libdnet - the [not so] dumb network library.
> c.. libpcap - a packet capture library.
>
> the first one comes with Sentinix but the other two must be included
> (Michel??) ;-)

libpcap is included in SENTINIX (under tcpdump).
Yes, I'll put 'em in the source tree. :)

> Please, can anybody take a look to the license It is
> released? I don't know if can include It in sentinix or there is any
legal
> problem, thanks.

libpcap, libevent and libdnet are put under the revised BSD license. Honeyd

has the original BSD license with the nasty advertising clause:

 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by Niels Provos.

...which we'll have to put somewhere in some obscure place, in tiny writing
in
the technical documentation (like Microsoft do with the IP stack).  If we
mention use of Honeyd on the front web page, I simply refuse to put the
acknowledgement there, since then I would feel obligated to put every other

software creator's name in there too, which would be a very long list no
one
would read anyway... better to reference and credit the entire project
directly instead, which the author would probably not object too either
(hopefully :).

>
> think in two or three weeks I will finish with webmin and honeyd,
depending
> on my computer's health

Great!

>
> Please take a look to the pdf about the do_brk bug for linux kernel; has
> been pached for higher kernels than the 2.4.22 and there is also a pach
in
> buqtraq, but It's an interesting paper to read.

Yes, I have read the iSEC report.  I even tested their little exploit code,

which, as expected, didn't work no matter how much I altered the code.
Anyway, 2.4.21 will still stay as openMosix kernel in the next release, but

with the do_brk() bug fixed.

             Michel
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix