CentOS builds a virtual honeypot honeyed

It's a final homework for school, and I always forget to share it at the end.
Under centos, use the virtual honeypot built by honeyed. Honestly I don't think it's as simple as other honeypots I've found online.
Download the installation package, the installation package is here honeyed installation package

1. Install honeyd honeypot

  1. Install, gcc, g++ and then decompress the file. insert image description here
    Note: When installing arpd, the library function cannot be connected. If libdent does not install gcc, g++ has no way to ./configure. If some dependencies are not installed, install what is missing.
    And after installing Arpd, if the arpd command fails to use, it may be that the executable file of libdevent reports an error. At runtime, the program cannot find the dynamic library libevent-2.1.so.7, because the dynamic library stored in the default installation The path is under /usr/local/lib, not in the system's default search path

  2. Install honeyd, if an error is reported configure: error: need either libedit or libreadline; install one of them to install yum install -y readline readline-develinsert image description here

  3. ln -s /lib64/libc.so.6 /usr/lib/libc.so

  4. If
    /honeyd: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory appears, it means that you did not put the libdnet connection into usr/lib before, preferably in ./ Do this before configure

  5. sudo ln -s /usr/local/lib/libdnet.1 /usr/lib/libdnet.1

  6. After reinstallation, -v command to verifyinsert image description here

  7. Modify the file name to honeyd.confinsert image description here

  8. configuration file
    insert image description here

  9. Verify with IP address

 Arpd 192.168.145.131
honeyd -d -f /usr/local/share/honeyd/honeyd.conf 

insert image description here
insert image description here

  1. Use another virtual machine to ping to be able to ping to complete
    insert image description here
    the web service test

  2. Open arp continuous monitoring

  3. The test of the Web service shows that the permission is denied.
    The reason for this error is that honeyd is installed in the directory of a normal user, or installed in the directory of the root user, resulting in unauthorized access. So you need to copy the honeyd file or just its configuration file to other non-user directories for access. It should be noted that after copying, it is necessary to go back to the configuration file just now and modify the address of the configuration file.
    insert image description here

  4. Create a non-user directory and copy the files into it
    insert image description here

  5. And modify the configuration file to run successfully

  6. insert image description here

  7. Done, and some software-side scans should be pretty easy.

Guess you like

Origin blog.csdn.net/gy0797/article/details/128984474