Re: [sentinix-list] Webmin + Honeyd

I would say:  Don't trust your firewall(s)!

Placing a Honeypot and/or IDS in *both* the DMZ and the internal network is 
what I would recommend.  At the few companies I've been at, there has always 
been some kind of trust relationship between the DMZ and the internal 
network, for example, two NICs in each server, one frontend (belongs to the 
DMZ) and one backend (private IPs).  I guess this is the typical design of 
ISPs, but not a very good one if a server in the DMZ is rooted, then the 
attacker could proceed its attacks through eth1 (backend) and s/he would also 
know some of the private net's IP-range(s), a good starting point for 
cracking the internal net.  The internal net's firewall might even have 
softer rules (or no rules at all) for traffic coming from the DMZ backend.

Catching an attacker in the DMZ and *not* in the internal net must be bliss!  
:)

Then there's always the possibility of an attacker getting past the firewall 
(i.e. both the outside fw and the one protecting the internal net, if that's 
the network design). Some attacker finds some remote execution exploit on the 
other side of the firewall (e.g. through spoofing your backend IPs), 
auto-executing a client software that connects to a listening agent on the 
attacker's host, totally circumventing the firewall). Or, of course, 
man-in-the-middle spoofs, like the one described (perhaps made-up) by 
Shimomura of Mitnick's IP sequence number prediction attack (which, of 
course, is not possible with modern TCP stacks, e.g. RFC1948).

This is all very complex and hard to do!  ...but not impossible!

A Honeypot in the DMZ would possibly give the attacker too many "choices" of 
hosts and that would slow the attacker down. Deploying decoys like Honeypots 
is not real security, but getting alerts and logs of connections to the 
Honeypots are good warning signals that someone's doing something.

The IDS (Snort) should definitely sniff the entire DMZ (fontends and 
backends), but has to be configured to filter out the usual traffic, 
otherwise the alerts would pile up and real-world cracks would be hard to 
find in all that data.  An IDS should also be placed in the internal network.

Then again, me myself don't apply all the paranoia I speak.  I even run 
vulnerable versions of Sendmail and OpenSSL on sentinix.org's server, and I 
do have the frontend/backend network model here.  :-P

	Michel

On Thursday 11 December 2003 21:01, BWhittaker-i6UbuDaRlKRWk0Htik3J/[email protected] wrote:
> Keeping in mind that a honey pot can attract  I would not want it on the
> inside.
>
>
>
>
>
>
> Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
> Sent by: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> 12/11/2003 02:13 PM
> Please respond to The SENTINIX Mailing List
>
>         To:     The SENTINIX Mailing List <[email protected]>
>         cc:
>         Subject:        Re: [sentinix-list] Webmin + Honeyd
>
>
>
>
>
>
>
> Is it good to have the honeypot in the DMZ or should it be before the
> firewall?
>
>
>
>
>
> ====================================
> Marlon Richards
> Communications Engineer
> West Indies Alumina Company
> Kirkvine Works
> Jamaica
> Tel#:    876-961-7434
> Fax#:   876-961-7464
> Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
>
>
>
>
>              Michel Blomgren
>              <[email protected]
>              org>                                                       To
>
>              Sent by:                  The SENTINIX Mailing List
>              sentinix-bounces@         <[email protected]>
>              elevenprospect.co                                          cc
>
>              m
>                                                                    Subject
>
>                                        Re: [sentinix-list] Webmin + Honeyd
>
>              12/09/2003 09:56
>              AM
>
>
>              Please respond to
>                The SENTINIX
>                Mailing List
>              <[email protected]
>                rospect.com>
>
> On Tuesday 09 December 2003 11:04, Hugo Teso Torío wrote:
> > Hi,
> >
> > have been 3 days of holidays in spain and I have been busy with my
>
> "dear"
>
> > computer, because It has been "death" for three days too. Interesting
> > weekend...
>
> oh, I know the feeling... :(
>
> > The webmin implementation for sentinix continues by the correct way and
> > also I have installed honeyd on my Sentinix box. Honeyd is an open
>
> source
>
> > Honeypot for *NIX computers and I thought It woluld be the best choice
>
> for
>
> > includibg a Honeypot in Sentinix; the requirements for installing it are
> > just three libraries:
> >
> > a.. libevent - an asynchronous event library.
> > b.. libdnet - the [not so] dumb network library.
> > c.. libpcap - a packet capture library.
> >
> > the first one comes with Sentinix but the other two must be included
> > (Michel??) ;-)
>
> libpcap is included in SENTINIX (under tcpdump).
> Yes, I'll put 'em in the source tree. :)
>
> > Please, can anybody take a look to the license It is
> > released? I don't know if can include It in sentinix or there is any
>
> legal
>
> > problem, thanks.
>
> libpcap, libevent and libdnet are put under the revised BSD license.
> Honeyd
>
> has the original BSD license with the nasty advertising clause:
>
>  * 3. All advertising materials mentioning features or use of this
> software
>  *    must display the following acknowledgement:
>  *      This product includes software developed by Niels Provos.
>
> ...which we'll have to put somewhere in some obscure place, in tiny
> writing
> in
> the technical documentation (like Microsoft do with the IP stack).  If we
> mention use of Honeyd on the front web page, I simply refuse to put the
> acknowledgement there, since then I would feel obligated to put every
> other
>
> software creator's name in there too, which would be a very long list no
> one
> would read anyway... better to reference and credit the entire project
> directly instead, which the author would probably not object too either
> (hopefully :).
>
> > think in two or three weeks I will finish with webmin and honeyd,
>
> depending
>
> > on my computer's health
>
> Great!
>
> > Please take a look to the pdf about the do_brk bug for linux kernel; has
> > been pached for higher kernels than the 2.4.22 and there is also a pach
>
> in
>
> > buqtraq, but It's an interesting paper to read.
>
> Yes, I have read the iSEC report.  I even tested their little exploit
> code,
>
> which, as expected, didn't work no matter how much I altered the code.
> Anyway, 2.4.21 will still stay as openMosix kernel in the next release,
> but
>
> with the do_brk() bug fixed.
>
>              Michel
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
>
>
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix