RE: [sentinix-list] Webmin + Honeyd

Thanks allot.





====================================
Marlon Richards
Communications Engineer
West Indies Alumina Company
Kirkvine Works
Jamaica
Tel#:    876-961-7434
Fax#:   876-961-7464
Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]



                                                                           
             "OMalley, Bill"                                               
             <[email protected]                                             
             ellco.com>                                                 To 
             Sent by:                  "The SENTINIX Mailing List"         
             sentinix-bounces@         <[email protected]>       
             elevenprospect.co                                          cc 
             m                                                             
                                                                   Subject 
                                       RE: [sentinix-list] Webmin + Honeyd 
             12/12/2003 01:58                                              
             PM                                                            
                                                                           
                                                                           
             Please respond to                                             
               The SENTINIX                                                
               Mailing List                                                
             <[email protected]                                             
               rospect.com>                                                
                                                                           
                                                                           




The Mailing List service may have stripped the PDF.  Here are a couple of
links:

 If you have Cisco CCO:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_18a/command/m1.htm


 Link to PDF only:  http://www.lostlake.net/cisco/monitor.pdf

Regards,
Bill O'


-----Original Message-----
From: Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected] [mailto:[email protected]]
Sent: Friday, December 12, 2003 12:16 PM
To: The SENTINIX Mailing List
Subject: RE: [sentinix-list] Webmin + Honeyd







Thanks for the information. There was no PDF attatched to the email!





====================================
Marlon Richards
Communications Engineer
West Indies Alumina Company
Kirkvine Works
Jamaica
Tel#:    876-961-7434
Fax#:   876-961-7464
Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]



"OMalley, Bill"
<[email protected]
ellco.com>                                                 To
Sent by:                  "The SENTINIX Mailing List"
sentinix-bounces@         <[email protected]>
elevenprospect.co                                          cc
m
Subject                                        RE: [sentinix-list] Webmin +
Honeyd              12/12/2003 12:40
PM
Please respond to
The SENTINIX
Mailing List
<[email protected]
rospect.com>




You should use the "monitor session" command on the 4006 (e.g. monitor
session 1 filter vlan 100 - 304), see attached  PDF.

I monitor my PIX (firewall) interface, but you can monitor multiple vlans
if you desire.

Regards,
Bill O'Malley


-----Original Message-----
From: Michel Blomgren [mailto:[email protected]]
Sent: Friday, December 12, 2003 11:22 AM
To: The SENTINIX Mailing List
Subject: Re: [sentinix-list] Webmin + Honeyd


Yes, the entire Cisco 4000-series should be able to do "port mirroring" or
SPAN (as they call it), but I'm not a Cisco tech, I only know the basics.
Depending on your network load, you can mirror all your VLANs to one port
and
just connect the SENTINIX box to that port on a separate, dedicated NIC.  I
did this at a company over here, an ISP with a couple of hundred servers
and,
despite the 10/100mbs NIC and that the machine was a 2 x 400MHz it still
did
the job. It dropped 2% of the packets because the CPUs didn't quite cope
with
the load and a 100Mbs NIC was somewhat too slow.

Snort is a NIDS, Network IDS.   It is a sniffer, but it becomes an IDS
because
it can analyze packets in real-time.  Based on rules, it'll make it's
decision whether to alert or not.

             Michel

On Friday 12 December 2003 13:42, Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected] wrote:
> I have a cisco 4006 layer 3 switch...that should be able to do port
> spanning..correct? In Sentinix, is Snort configured as just an IDS or a
> packet sniffer?
>
>
>
>
>
> ====================================
> Marlon Richards
> Communications Engineer
> West Indies Alumina Company
> Kirkvine Works
> Jamaica
> Tel#:    876-961-7434
> Fax#:   876-961-7464
> Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
>
>
>
>
>              Michel Blomgren
>              <[email protected]
>              org>
To
>              Sent by:                  The SENTINIX Mailing List
>              sentinix-bounces@         <[email protected]>
>              elevenprospect.co
cc
>              m
>
Subject
>                                        Re: [sentinix-list] Webmin +
Honeyd
>              12/11/2003 07:34
>              PM
>
>
>              Please respond to
>                The SENTINIX
>                Mailing List
>              <[email protected]
>                rospect.com>
>
>
>
>
>
>
> If you have a some Cisco stuff you could just SPAN everything to one RJ45
> port
> and attach a Snort box at the other end (on e.g. a 1Gb NIC).
>
>              Michel
>
> On Friday 12 December 2003 01:05, Michel Blomgren wrote:
> > I would say:  Don't trust your firewall(s)!
> >
> > Placing a Honeypot and/or IDS in *both* the DMZ and the internal
network
>
> is
>
> > what I would recommend.  At the few companies I've been at, there has
> > always been some kind of trust relationship between the DMZ and the
> > internal network, for example, two NICs in each server, one frontend
> > (belongs to the DMZ) and one backend (private IPs).  I guess this is
the
> > typical design of ISPs, but not a very good one if a server in the DMZ
is
> > rooted, then the attacker could proceed its attacks through eth1
>
> (backend)
>
> > and s/he would also know some of the private net's IP-range(s), a good
> > starting point for cracking the internal net.  The internal net's
>
> firewall
>
> > might even have softer rules (or no rules at all) for traffic coming
from
> > the DMZ backend.
> >
> > Catching an attacker in the DMZ and *not* in the internal net must be
> > bliss!
> >
> > :)
> >
> > Then there's always the possibility of an attacker getting past the
> > firewall (i.e. both the outside fw and the one protecting the internal
>
> net,
>
> > if that's the network design). Some attacker finds some remote
execution
> > exploit on the other side of the firewall (e.g. through spoofing your
> > backend IPs), auto-executing a client software that connects to a
>
> listening
>
> > agent on the attacker's host, totally circumventing the firewall). Or,
of
> > course, man-in-the-middle spoofs, like the one described (perhaps
>
> made-up)
>
> > by Shimomura of Mitnick's IP sequence number prediction attack (which,
of
> > course, is not possible with modern TCP stacks, e.g. RFC1948).
> >
> > This is all very complex and hard to do!  ...but not impossible!
> >
> > A Honeypot in the DMZ would possibly give the attacker too many
"choices"
> > of hosts and that would slow the attacker down. Deploying decoys like
> > Honeypots is not real security, but getting alerts and logs of
>
> connections
>
> > to the Honeypots are good warning signals that someone's doing
something.
> >
> > The IDS (Snort) should definitely sniff the entire DMZ (fontends and
> > backends), but has to be configured to filter out the usual traffic,
> > otherwise the alerts would pile up and real-world cracks would be hard
to
> > find in all that data.  An IDS should also be placed in the internal
> > network.
> >
> > Then again, me myself don't apply all the paranoia I speak.  I even run
> > vulnerable versions of Sendmail and OpenSSL on sentinix.org's server,
and
>
> I
>
> > do have the frontend/backend network model here.  :-P
> >
> >            Michel
> >
> > On Thursday 11 December 2003 21:01, BWhittaker-i6UbuDaRlKRWk0Htik3J/[email protected] wrote:
> > > Keeping in mind that a honey pot can attract  I would not want it on
>
> the
>
> > > inside.
> > >
> > >
> > >
> > >
> > >
> > >
> > > Marlon.Richards-5I9FqcT3+DFWk0Htik3J/[email protected]
> > > Sent by: sentinix-bounces-y1CeFY8bYInMlQukkHbAVdBPR1lH4CV8@public.gmane.org
> > > 12/11/2003 02:13 PM
> > > Please respond to The SENTINIX Mailing List
> > >
> > >         To:     The SENTINIX Mailing List
<[email protected]>
> > >         cc:
> > >         Subject:        Re: [sentinix-list] Webmin + Honeyd
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > Is it good to have the honeypot in the DMZ or should it be before the
> > > firewall?
> > >
> > >
> > >
> > >
> > >
> > > ====================================
> > > Marlon Richards
> > > Communications Engineer
> > > West Indies Alumina Company
> > > Kirkvine Works
> > > Jamaica
> > > Tel#:    876-961-7434
> > > Fax#:   876-961-7464
> > > Email:  marlon.richards-Rzeo2xivIqhWk0Htik3J/[email protected]
> > >
> > >
> > >
> > >
> > >              Michel Blomgren
> > >              <[email protected]
> > >              org>
> > > To
> > >
> > >              Sent by:                  The SENTINIX Mailing List
> > >              sentinix-bounces@         <[email protected]>
> > >              elevenprospect.co
> > > cc
> > >
> > >              m
> > >
> > > Subject
> > >
> > >                                        Re: [sentinix-list] Webmin +
> > > Honeyd
> > >
> > >              12/09/2003 09:56
> > >              AM
> > >
> > >
> > >              Please respond to
> > >                The SENTINIX
> > >                Mailing List
> > >              <[email protected]
> > >                rospect.com>
> > >
> > > On Tuesday 09 December 2003 11:04, Hugo Teso Torío wrote:
> > > > Hi,
> > > >
> > > > have been 3 days of holidays in spain and I have been busy with my
> > >
> > > "dear"
> > >
> > > > computer, because It has been "death" for three days too.
Interesting
> > > > weekend...
> > >
> > > oh, I know the feeling... :(
> > >
> > > > The webmin implementation for sentinix continues by the correct way
>
> and
>
> > > > also I have installed honeyd on my Sentinix box. Honeyd is an open
> > >
> > > source
> > >
> > > > Honeypot for *NIX computers and I thought It woluld be the best
>
> choice
>
> > > for
> > >
> > > > includibg a Honeypot in Sentinix; the requirements for installing
it
> > > > are just three libraries:
> > > >
> > > > a.. libevent - an asynchronous event library.
> > > > b.. libdnet - the [not so] dumb network library.
> > > > c.. libpcap - a packet capture library.
> > > >
> > > > the first one comes with Sentinix but the other two must be
included
> > > > (Michel??) ;-)
> > >
> > > libpcap is included in SENTINIX (under tcpdump).
> > > Yes, I'll put 'em in the source tree. :)
> > >
> > > > Please, can anybody take a look to the license It is
> > > > released? I don't know if can include It in sentinix or there is
any
> > >
> > > legal
> > >
> > > > problem, thanks.
> > >
> > > libpcap, libevent and libdnet are put under the revised BSD license.
> > > Honeyd
> > >
> > > has the original BSD license with the nasty advertising clause:
> > >
> > >  * 3. All advertising materials mentioning features or use of this
> > > software
> > >  *    must display the following acknowledgement:
> > >  *      This product includes software developed by Niels Provos.
> > >
> > > ...which we'll have to put somewhere in some obscure place, in tiny
> > > writing
> > > in
> > > the technical documentation (like Microsoft do with the IP stack).
If
>
> we
>
> > > mention use of Honeyd on the front web page, I simply refuse to put
the
> > > acknowledgement there, since then I would feel obligated to put every
> > > other
> > >
> > > software creator's name in there too, which would be a very long list
>
> no
>
> > > one
> > > would read anyway... better to reference and credit the entire
project
> > > directly instead, which the author would probably not object too
either
> > > (hopefully :).
> > >
> > > > think in two or three weeks I will finish with webmin and honeyd,
> > >
> > > depending
> > >
> > > > on my computer's health
> > >
> > > Great!
> > >
> > > > Please take a look to the pdf about the do_brk bug for linux
kernel;
> > > > has been pached for higher kernels than the 2.4.22 and there is
also
>
> a
>
> > > > pach
> > >
> > > in
> > >
> > > > buqtraq, but It's an interesting paper to read.
> > >
> > > Yes, I have read the iSEC report.  I even tested their little exploit
> > > code,
> > >
> > > which, as expected, didn't work no matter how much I altered the
code.
> > > Anyway, 2.4.21 will still stay as openMosix kernel in the next
release,
> > > but
> > >
> > > with the do_brk() bug fixed.
> > >
> > >              Michel
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> > >
> > >
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> > >
> > >
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > SENTINIX mailing list
> > > [email protected]
> > > http://elevenprospect.com/mailman/listinfo/sentinix
> >
> > _______________________________________________
> > SENTINIX mailing list
> > [email protected]
> > http://elevenprospect.com/mailman/listinfo/sentinix
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
>
>
> _______________________________________________
> SENTINIX mailing list
> [email protected]
> http://elevenprospect.com/mailman/listinfo/sentinix
_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix




THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED
BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU
ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR
COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED
THIS COMMUNICATION IN ERROR, PLEASE  CONTACT  THE SENDER IMMEDIATELY AND
DELETE THE MESSAGE.  PLEASE NOTE THAT  ALTHOUGH WE WILL TAKE ALL
COMMERCIALLY REASONABLE EFFORTS
TO PREVENT VIRUSES FROM BEING TRANSMITTED FROM OUR
SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR AND PREVENT
ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix


_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix




THIS MESSAGE MAY CONTAIN INFORMATION THAT IS CONFIDENTIAL AND/OR PROTECTED
BY LAW. IF THE READER OF THIS MESSAGE IS NOT THE INTENDED RECIPIENT, YOU
ARE HEREBY NOTIFIED THAT ANY DISSEMINATION, DISTRIBUTION, COPYING OR
COMMUNICATION OF THIS MESSAGE IS STRICTLY PROHIBITED. IF YOU HAVE RECEIVED
THIS COMMUNICATION IN ERROR, PLEASE  CONTACT  THE SENDER IMMEDIATELY AND
DELETE THE MESSAGE.  PLEASE NOTE THAT  ALTHOUGH WE WILL TAKE ALL
COMMERCIALLY REASONABLE EFFORTS
TO PREVENT VIRUSES FROM BEING TRANSMITTED FROM OUR
SYSTEMS, IT IS THE RESPONSIBILITY OF THE RECIPIENT TO CHECK FOR AND PREVENT
ADVERSE ACTION BY VIRUSES ON ITS OWN SYSTEMS .

_______________________________________________
SENTINIX mailing list
[email protected]
http://elevenprospect.com/mailman/listinfo/sentinix