Re: [sentinix-list] Webmin + Honeyd

Yes, the entire Cisco 4000-series should be able to do "port mirroring" or 
SPAN (as they call it), but I'm not a Cisco tech, I only know the basics.  
Depending on your network load, you can mirror all your VLANs to one port and 
just connect the SENTINIX box to that port on a separate, dedicated NIC.  I 
did this at a company over here, an ISP with a couple of hundred servers and, 
despite the 10/100mbs NIC and that the machine was a 2 x 400MHz it still did 
the job. It dropped 2% of the packets because the CPUs didn't quite cope with 
the load and a 100Mbs NIC was somewhat too slow.

Snort is a NIDS, Network IDS.   It is a sniffer, but it becomes an IDS because 
it can analyze packets in real-time.  Based on rules, it'll make it's 
decision whether to alert or not.

	Michel

On Friday 12 December 2003 13:42, Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected] wrote:
> I have a cisco 4006 layer 3 switch...that should be able to do port
> spanning..correct? In Sentinix, is Snort configured as just an IDS or a
> packet sniffer?
>
>
>
>
>
> ====================================
> Marlon Richards
> Communications Engineer
> West Indies Alumina Company
> Kirkvine Works
> Jamaica
> Tel#:    876-961-7434
> Fax#:   876-961-7464
> Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
>
>
>
>
>              Michel Blomgren
>              <[email protected]
>              org>                                                       To
>              Sent by:                  The SENTINIX Mailing List
>              sentinix-bounces@         <[email protected]>
>              elevenprospect.co                                          cc
>              m
>                                                                    Subject
>                                        Re: [sentinix-list] Webmin + Honeyd
>              12/11/2003 07:34
>              PM
>
>
>              Please respond to
>                The SENTINIX
>                Mailing List
>              <[email protected]
>                rospect.com>
>
>
>
>
>
>
> If you have a some Cisco stuff you could just SPAN everything to one RJ45
> port
> and attach a Snort box at the other end (on e.g. a 1Gb NIC).
>
>              Michel
>
> On Friday 12 December 2003 01:05, Michel Blomgren wrote:
> > I would say:  Don't trust your firewall(s)!
> >
> > Placing a Honeypot and/or IDS in *both* the DMZ and the internal network
>
> is
>
> > what I would recommend.  At the few companies I've been at, there has
> > always been some kind of trust relationship between the DMZ and the
> > internal network, for example, two NICs in each server, one frontend
> > (belongs to the DMZ) and one backend (private IPs).  I guess this is the
> > typical design of ISPs, but not a very good one if a server in the DMZ is
> > rooted, then the attacker could proceed its attacks through eth1
>
> (backend)
>
> > and s/he would also know some of the private net's IP-range(s), a good
> > starting point for cracking the internal net.  The internal net's
>
> firewall
>
> > might even have softer rules (or no rules at all) for traffic coming from
> > the DMZ backend.
> >
> > Catching an attacker in the DMZ and *not* in the internal net must be
> > bliss!
> >
> > :)
> >
> > Then there's always the possibility of an attacker getting past the
> > firewall (i.e. both the outside fw and the one protecting the internal
>
> net,
>
> > if that's the network design). Some attacker finds some remote execution
> > exploit on the other side of the firewall (e.g. through spoofing your
> > backend IPs), auto-executing a client software that connects to a
>
> listening
>
> > agent on the attacker's host, totally circumventing the firewall). Or, of
> > course, man-in-the-middle spoofs, like the one described (perhaps
>
> made-up)
>
> > by Shimomura of Mitnick's IP sequence number prediction attack (which, of
> > course, is not possible with modern TCP stacks, e.g. RFC1948).
> >
> > This is all very complex and hard to do!  ...but not impossible!
> >
> > A Honeypot in the DMZ would possibly give the attacker too many "choices"
> > of hosts and that would slow the attacker down. Deploying decoys like
> > Honeypots is not real security, but getting alerts and logs of
>
> connections
>
> > to the Honeypots are good warning signals that someone's doing something.
> >
> > The IDS (Snort) should definitely sniff the entire DMZ (fontends and
> > backends), but has to be configured to filter out the usual traffic,
> > otherwise the alerts would pile up and real-world cracks would be hard to
> > find in all that data.  An IDS should also be placed in the internal
> > network.
> >
> > Then again, me myself don't apply all the paranoia I speak.  I even run
> > vulnerable versions of Sendmail and OpenSSL on sentinix.org's server, and
>
> I
>
> > do have the frontend/backend network model here.  :-P
> >
> >            Michel
> >
> > On Thursday 11 December 2003 21:01, BWhittaker-i6UbuDaRlKRWk0Htik3J/[email protected] wrote:
> > > Keeping in mind that a honey pot can attract  I would not want it on
>
> the
>
> > > inside.
> > >
> > >
> > >
> > >
> > >
> > >
> > > Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
> > > Sent by: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> > > 12/11/2003 02:13 PM
> > > Please respond to The SENTINIX Mailing List
> > >
> > >         To:     The SENTINIX Mailing List <[email protected]>
> > >         cc:
> > >         Subject:        Re: [sentinix-list] Webmin + Honeyd
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > Is it good to have the honeypot in the DMZ or should it be before the
> > > firewall?
> > >
> > >
> > >
> > >
> > >
> > > ====================================
> > > Marlon Richards
> > > Communications Engineer
> > > West Indies Alumina Company
> > > Kirkvine Works
> > > Jamaica
> > > Tel#:    876-961-7434
> > > Fax#:   876-961-7464
> > > Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
> > >
> > >
> > >
> > >
> > >              Michel Blomgren
> > >              <[email protected]
> > >              org>
> > > To
> > >
> > >              Sent by:                  The SENTINIX Mailing List
> > >              sentinix-bounces@         <[email protected]>
> > >              elevenprospect.co
> > > cc
> > >
> > >              m
> > >
> > > Subject
> > >
> > >                                        Re: [sentinix-list] Webmin +
> > > Honeyd
> > >
> > >              12/09/2003 09:56
> > >              AM
> > >
> > >
> > >              Please respond to
> > >                The SENTINIX
> > >                Mailing List
> > >              <[email protected]
> > >                rospect.com>
> > >
> > > On Tuesday 09 December 2003 11:04, Hugo Teso Torío wrote:
> > > > Hi,
> > > >
> > > > have been 3 days of holidays in spain and I have been busy with my
> > >
> > > "dear"
> > >
> > > > computer, because It has been "death" for three days too. Interesting
> > > > weekend...
> > >
> > > oh, I know the feeling... :(
> > >
> > > > The webmin implementation for sentinix continues by the correct way
>
> and
>
> > > > also I have installed honeyd on my Sentinix box. Honeyd is an open
> > >
> > > source
> > >
> > > > Honeypot for *NIX computers and I thought It woluld be the best
>
> choice
>
> > > for
> > >
> > > > includibg a Honeypot in Sentinix; the requirements for installing it
> > > > are just three libraries:
> > > >
> > > > a.. libevent - an asynchronous event library.
> > > > b.. libdnet - the [not so] dumb network library.
> > > > c.. libpcap - a packet capture library.
> > > >
> > > > the first one comes with Sentinix but the other two must be included
> > > > (Michel??) ;-)
> > >
> > > libpcap is included in SENTINIX (under tcpdump).
> > > Yes, I'll put 'em in the source tree. :)
> > >
> > > > Please, can anybody take a look to the license It is
> > > > released? I don't know if can include It in sentinix or there is any
> > >
> > > legal
> > >
> > > > problem, thanks.
> > >
> > > libpcap, libevent and libdnet are put under the revised BSD license.
> > > Honeyd
> > >
> > > has the original BSD license with the nasty advertising clause:
> > >
> > >  * 3. All advertising materials mentioning features or use of this
> > > software
> > >  *    must display the following acknowledgement:
> > >  *      This product includes software developed by Niels Provos.
> > >
> > > ...which we'll have to put somewhere in some obscure place, in tiny
> > > writing
> > > in
> > > the technical documentation (like Microsoft do with the IP stack).  If
>
> we
>
> > > mention use of Honeyd on the front web page, I simply refuse to put the
> > > acknowledgement there, since then I would feel obligated to put every
> > > other
> > >
> > > software creator's name in there too, which would be a very long list
>
> no
>
> > > one
> > > would read anyway... better to reference and credit the entire project
> > > directly instead, which the author would probably not object too either
> > > (hopefully :).
> > >
> > > > think in two or three weeks I will finish with webmin and honeyd,
> > >
> > > depending
> > >
> > > > on my computer's health
> > >
> > > Great!
> > >
> > > > Please take a look to the pdf about the do_brk bug for linux kernel;
> > > > has been pached for higher kernels than the 2.4.22 and there is also
>
> a
>
> > > > pach
> > >
> > > in
> > >
> > > > buqtraq, but It's an interesting paper to read.
> > >
> > > Yes, I have read the iSEC report.  I even tested their little exploit
> > > code,
> > >
> > > which, as expected, didn't work no matter how much I altered the code.
> > > Anyway, 2.4.21 will still stay as openMosix kernel in the next release,
> > > but
> > >
> > > with the do_brk() bug fixed.
> > >
> > >              Michel
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> > >
> > >
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> > >
> > >
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix