
           ####   Honeyd Linux Kit  #####
          Last Modified: 19 December, 2003
                Based on Honeyd 0.7a


INTRO:
------
You are reading the documentation for the Honeyd Linux Kit.
The purpose of this kit is to give you all the tools you need
to quickly get your own Honeyd honeypot running on a Linux
i386 computer.  Honeyd is an OpenSource Honeypot written
by Niels Provos.  You can get full documentation and source
code for this honeypot at

   Honeyd Homepage
   http://www.honeyd.org

Before using this kit, it is assumed that you have already
read and understand the Honeyd documentation from the home
website.  To learn more on how to use and leverage a honeypot,
refer to the following documentation.

   Honeypots: Definitions and Values
   http://www.tracking-hackers.com/papers/honeypots.html

   Using Honeypots to Fight Worms
   http://www.securityfocus.com/infocus/1740
   http://www.honeyd.org/worms.php

   Using Honeypots to Fight Spam
   http://www.securityfocus.com/infocus/1747
   http://www.honeyd.org/spam.php

   Using Honeypots for Detection
   http://www.securityfocus.com/infocus/1690



RUNNING:
--------
To get Honeyd up and running should be relatively simple.
All you have to do is run both startup scripts.  Run 
the arpd script first for Arp spoofing (so you can get
traffic bound for non-existant systems).  Then run honeyd
startup script so you can interact with attackers.  Both
startup scripts and the honeyd.conf configuration file
assume you are on a 192.168.1.0/24 network.  You will have
to modify if you are on a different network (which is
most likely).  It is highly recommended you modify the
honeyd.conf configuration file so your honeypot does not
look like everyone elses on the Internet.  Also, you may 
want to consider running Snort on your honeypot so you 
can capture all of the network activity to and from your 
honeypot.

     ./start-arpd.sh
     ./start-honeyd.sh

By default, Honeyd looks for configuration files (and
scripts) in the directory /usr/local/share/honeyd.  This
toolkit is different.  Instead of using the standard
directory, this Toolkit uses everything locally.  In other
words, it should not matter where you install this toolkit,
the Toolkit Honeyd binary will look for all configuration
files and scripts that are local to this Toolkit.

NOTE: If you intend to have real attackers interact with
your honeypot, MAKE SURE you harden your Linux system so
it cannot be compromised!  It is also recommended you
chroot() or systrace() your Honeyd process and patch the
Linux kernel.  A great place to start is

     http://www.securityfocus.com 
     http://www.linuxsecurity.com
     http://www.grsecurity.org


FILES:
------
arpd                  Staticaly compiled 'arpd' binary, used
                      for Arp spoofing.
contrib               Directory with additional documentation debeloped
                      by the community.
honeyd                Statically compiled 'honeyd' binary.  Used 
                      for detecting and interacting with attackers.
honeyd.conf           Honeyd configuration file
honeyd.conf.simple    Simple Honeyd configuration file used for testing
honeyd.conf.bloat     Advanced Honeyd configuration file used for 
                      extensive virtual honeypot capabilities
honeyd.conf.networks  Advanced Honeyd configuration file used for
                      extensive networking capabilities.
nmap.prints           Nmap OS fingerprint database that comes with 
                      Honeyd src
nmap.prints.new       Nmap OS fingerprint database current (Nov, 03)
                      Honeyd 0.7a does not support the current database.
nmap.assoc            Associates specific fingerprints with general
                      operating systems.
pf.os                 Passive fingerprinting database
scripts               Scripts used by Honeyd to emulate services.
                      If you create any of your own scripts, let
                      us know!  <lance@honeynet.org>
start-arpd.sh         Script used to start arpd process.  
start-honeyd.sh       Script used to start honeyd process. 
xprobe2.conf          Xprobe2 OS fingerprint database that comes with 
                      Honeyd src
xprobe2.conf.new      Xprobe2 OS fingerprint database current (Nov,03).
                      Honeyd 0.7a does not support the current database.
README                You figure it out.



- Put together by Lance Spitzner <lance@honeynet.org>
  http://www.tracking-hackers.com/solutions/honeyd


NOTES:
------
This Toolkit is the result of the hard work, development,
and input of the security community.  Special thanks to

 - Thanks to Niels Provos <provos@citi.umich.edu> who is actively 
   developing and maintaining Honeyd.

 - Thanks to Laurent Oudot <oudot@rstack.org> for help, support,
   and concepts concerning honeypots. 

 - Thanks to Fabian Bieker <fb@dinoex.de> for extensive amount of 
   scripts.

 - Thanks to Roshen Chandran <roshen.chandran@paladion.net> for 
   honeyd.conf.networking.
