Using a Raspberry Pi as a network honeypot
Camouflage and Obfuscation
In the configuration files for Glastopf and Kippo, you will find predefined Apache or SSHd versions, which attackers already know. It makes sense to modify the products to fit in with your enterprise. For example, if all of your production servers run on IIS, you will not want Glastopf to send an Apache banner.
Configuring a successful honeypot is a question of psychology. The simulated services are intended to tickle the attacker's fancy and entice them to stick around for a while, but if the presentation is all too obvious, attackers will quickly turn to a more rewarding target.
Networks from the Air
Low-interaction honeypots are not good enough to stop more intelligent attackers from becoming suspicious. Honeypots always require a compromise between hardware investment, monitoring precision, and transparency. Because running a complete honeypot network does not make business sense, virtualization technology offers a helpful alternative. Advanced honeypots can simulate whole networks made up of different computers. Remember that a network made up of full-fledged virtual machines can be very useful to an attacker under certain circumstances. Once a virtual machine is compromised, an attacker can leverage it like any other zombie, employing it for DoS attacks and other nefarious activities.
The Honeyd honeypot tool [5], developed by Niels Provos, positions itself as a hybrid that simulates multiple computers without the overhead of a classical hypervisor stack. This approach reduces the computational power requirement, and users benefit from the fact that attackers cannot hijack emulated machines.
Because the product is only available for the desktop versions of Debian, you will need to compile it for other systems. To do so, change to the /usr/src
directory and run the commands shown in Listing 4.
Listing 4
Install Honeyd
From this point onward, you can launch the honeypot by typing the honeyd
command. The parameter it expects is the network interface to use; on a Raspberry Pi, you can launch the daemon by typing sudo honeyd -i eth0
.
Commissioning the Honeyd Network
Calling Honeyd directly launches honeypots with a set of not very useful default parameters. You will want to add a configuration file that contains additional information about the network topology you are simulating. The first example is the declaration of an admittedly fairly strange workstation, which you can implement using the following snippet:
create windows set windows personality "OpenBSD 4.0 (x86)" set windows uptime 1728650 set windows maxfds 35
The create
command defines a new host entry that is accessible via its alias. Defining the personality
tells Honeyd which operating system to simulate on the host. You will find the names of the individual operating systems in the nmap-os-db
file. Note that all the tutorials also refer to this file as nmap.prints
.
The tool simulates individual services using the files stored in the /scripts/
subdirectory, which describe the interaction between the server and client. Say you want to bind three different scripts to ports that are accessible via TCP; port 53 will simply be configured as an open UDP port:
add windows tcp port 80 "scripts/web.sh" add windows tcp port 22 "scripts/test.sh" add windows tcp port 23 "scripts/router-telnet.pl" add windows udp port 53 open
Finally, the file declares all unused ports as closed. Assign an IP address of 192.168.3.137 to the system, and you are ready for action:
set windows ethernet "dell" set windows default tcp action closed bind 192.168.3.137 windows
On the web, you will find many virtual networks if you search for Honeyd configuration. You can use these networks as a source of inspiration for your honeynet. Prebuilt configuration files are passed into the program using the -f
option; -p
lets you write to a different trace file, whereas -d
runs honeyd
in the foreground:
./honeyd -d -p nmap.prints -f config.sample
Honeyd only collects statistics if you call it with the -c
option. You can use the analysis scripts created by BruteForce Labs [6] to evaluate the results.
At this time, the honeypot is only accessible via the IP address assigned by the router. In the case of a virtual network, this configuration is not very useful because the attacker can only access the network via a single entry point. You can solve this problem by deploying a program called farpd:
sudo apt-get install farpd
Farpd will install on your single-board computer. After launching farpd with
sudo farpd -i interface
it manipulates the operating system protocol stack so that it fields any IP address requests via ARP from this point onward.
This behavior can cause problems in combination for VoIP systems, so farpd also supports a selective approach. The program can interpret restricting specifications such as 10.0.0.3, 10.0.0.0/16, and 10.0.0.5-10.0.0.15. Finally, the popular -d
option in Honeyd tells a program to work in the foreground.
« Previous 1 2 3 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
TUXEDO Computers Unveils Linux Laptop Featuring AMD Ryzen CPU
This latest release is the first laptop to include the new CPU from Ryzen and Linux preinstalled.
-
XZ Gets the All-Clear
The back door xz vulnerability has been officially reverted for Fedora 40 and versions 38 and 39 were never affected.
-
Canonical Collaborates with Qualcomm on New Venture
This new joint effort is geared toward bringing Ubuntu and Ubuntu Core to Qualcomm-powered devices.
-
Kodi 21.0 Open-Source Entertainment Hub Released
After a year of development, the award-winning Kodi cross-platform, media center software is now available with many new additions and improvements.
-
Linux Usage Increases in Two Key Areas
If market share is your thing, you'll be happy to know that Linux is on the rise in two areas that, if they keep climbing, could have serious meaning for Linux's future.
-
Vulnerability Discovered in xz Libraries
An urgent alert for Fedora 40 has been posted and users should pay attention.
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.