Changeset 1677

Show
Ignore:
Timestamp:
07/31/08 21:18:45 (2 months ago)
Author:
till
Message:

honeytrap
- 'bind_address' configuration option added for binding dynamic servers

to a specific IP address to make it possible to run several honeytrap
instances in parallel on a single machine

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeytrap/trunk/ChangeLog

    r1633 r1677  
    11Version 1.0.1 
     2- 'bind_address' configuration option added for binding dynamic servers 
     3  to a specific IP address to make it possible to run several honeytrap 
     4  instances in parallel on a single machine 
    25- Code cleanup: asprintf() 
    36- Error handling for failed malloc()'s where it was missing 

  • honeytrap/trunk/etc/honeytrap.conf.dist

    r1425 r1677  
    11/*  
    2  * honeytrap 1.0 configuration file template -- please adjust 
     2 * honeytrap 1.0.1 configuration file template -- please adjust 
    33 * (c) Tillmann Werner <tillmann.werner@gmx.de> 
    44 */ 
    55 
    6 /* log to this file */ 
     6// log to this file 
    77logfile         = "/opt/honeytrap/honeytrap.log" 
    88 
    9 /* PID file */ 
     9// store process ID in this file 
    1010pidfile         = "/var/run/honeytrap.pid" 
    1111 
    …… 
    1414response_dir    = "/opt/honeytrap/etc/honeytrap/responses" 
    1515 
    16 /* replace rfc1918 ip addresses with attacking ip address */ 
     16// replace rfc1918 IP addresses with attacking IP address 
    1717replace_private_ips = "no" 
    1818 
    19 /* default port mode -- valid values are "ignore", "normal" and "mirror" 
    20 portconf_default = "normal" 
    21  
    2219/* put network interface into promiscuous mode 
    23  * (only availabel when compiled with --with-pcap-mon) */ 
     20 * (only availabel when compiled with --with-stream-mon=pcap) */ 
    2421//promisc = "on" 
    2522 
    …… 
    3229read_limit = "20971520" 
    3330 
    34 /* include a file */ 
     31// include a file 
    3532//include = "ports.conf" 
    3633 
    …… 
    3936 
    4037/* where to look for plugins 
    41    need to be set before loading plugins */ 
     38   needs to be set before loading plugins */ 
    4239plugin_dir      = "/opt/honeytrap/etc/honeytrap/plugins" 
    4340 
    4441 
    45 /* include a plugin via plugin-[ModuleName] = "" */ 
     42// include a plugin via plugin-[ModuleName] = "" 
    4643 
    4744plugin-ftpDownload = "" 
    …… 
    5148 
    5249 
    53 /* store attacks on disk */ 
     50// store attacks on disk 
    5451plugin-SaveFile = { 
    5552        attacks_dir     = "/opt/honeytrap/attacks" 
    …… 
    5855 
    5956 
    60 /* scan downloaded samples with ClamAV engine */ 
     57// scan downloaded samples with ClamAV engine 
     58/* 
    6159plugin-ClamAV = { 
    6260        temp_dir        = "/tmp" 
    6361        clamdb_path     = "/var/lib/clamav" 
    6462} 
     63*/ 
    6564 
    6665 
    67 /* calculate locality sensitive hashes */ 
     66// calculate locality sensitive hashes 
     67/* 
    6868plugin-SpamSum = { 
    6969        md5sum_sigfile  = "/opt/honeytrap/md5sum.sigs" 
    7070        spamsum_sigfile = "/opt/honeytrap/spamsum.sigs" 
    7171} 
     72*/ 
    7273 
    7374 
    74 /* store attacks in PostgeSQL database */ 
     75// store attacks in PostgeSQL database 
    7576/* 
    7677plugin-SavePostgres = { 
    …… 
    8485 
    8586 
    86 /* invoke wget to download files via http */ 
     87// invoke an external program (f.e. wget) to download files via http 
    8788/* 
    8889plugin-httpDownload = { 
    …… 
    106107// explicit port configuration 
    107108portconf = { 
    108         /* ignore these ports */ 
     109        // ignore connection requests on these ports 
    109110        ignore = { 
    110111                protocol        = "tcp" 

  • honeytrap/trunk/src/honeytrap.h

    r1489 r1677  
    11/* honeytrap.h 
    2  * Copyright (C) 2005-2007 Tillmann Werner <tillmann.werner@gmx.de> 
     2 * Copyright (C) 2005-2008 Tillmann Werner <tillmann.werner@gmx.de> 
    33 * 
    44 * This file is free software; as a special exception the author gives 
    …… 
    105105// global variables regarding configuration 
    106106 
    107 char    *pidfile_name; 
    108 char    *logfile_name; 
    109 char    *dev; 
    110 char    *response_dir; 
    111 char    *plugin_dir; 
    112 u_char  daemonize; 
    113 u_char  promisc_mode; 
    114 u_char  replace_private_ips; 
    115 uid_t   u_id; 
    116 gid_t   g_id; 
    117 int32_t conn_timeout; 
    118 int32_t read_timeout; 
    119 int32_t m_read_timeout; 
    120 int32_t read_limit; 
     107char            *pidfile_name; 
     108char            *logfile_name; 
     109char            *dev; 
     110char            *response_dir; 
     111char            *plugin_dir; 
     112u_char          daemonize; 
     113u_char          promisc_mode; 
     114u_char          replace_private_ips; 
     115uid_t           u_id; 
     116gid_t           g_id; 
     117int32_t         conn_timeout; 
     118int32_t         read_timeout; 
     119int32_t         m_read_timeout; 
     120int32_t         read_limit; 
     121struct in_addr  bind_address; 
    121122 
    122123/* explicit port configurations */ 

  • honeytrap/trunk/src/readconf.c

    r1355 r1677  
    11/* readconf.c 
    2  * Copyright (C) 2006-2007 Tillmann Werner <tillmann.werner@gmx.de> 
     2 * Copyright (C) 2006-2008 Tillmann Werner <tillmann.werner@gmx.de> 
    33 * 
    44 * This file is free software; as a special exception the author gives 
    …… 
    5555        "plugin_dir", 
    5656        "read_limit", 
     57        "bind_address", 
    5758        "replace_private_ips", 
    5859#ifdef USE_PCAP_MON 
    …… 
    138139        config_tree             = NULL; 
    139140 
     141        bind_address.s_addr     = INADDR_ANY; 
     142 
    140143        /* build tree of allowed configuration keywords */ 
    141144        for (i=0; i<sizeof(config_keywords)/sizeof(char *); i++) { 
    …… 
    470473                else if (OPT_IS("response_dir")) OPT_SET("  Loading default responses from %s.\n", response_dir) 
    471474                else if (OPT_IS("plugin_dir")) OPT_SET("  Loading plugins from %s.\n", plugin_dir) 
     475                else if (OPT_IS("bind_address")) { 
     476                        if (inet_aton(value, &bind_address) == 0) { 
     477                                fprintf(stderr, "  Error - Unable to convert IP address: %s.\n", strerror(errno)); 
     478                                exit(EXIT_FAILURE); 
     479                        } 
     480                        DEBUG_FPRINTF(stdout, "  Binding dynamic servers to %s.\n", inet_ntoa(bind_address)); 
     481                } 
    472482                else if (OPT_IS("user")) { 
    473483                        if ((pwd_entry = getpwnam(value)) == NULL) { 
    …… 
    478488                        u_id = pwd_entry->pw_uid; 
    479489                        user = value; 
    480                         DEBUG_FPRINTF(stdout, "  Setting user to %s\n", user); 
     490                        DEBUG_FPRINTF(stdout, "  Setting user to %ss\n", user); 
    481491                } else if (OPT_IS("group")) { 
    482492                        if ((grp_entry = getgrnam(value)) == NULL) { 
    …… 
    487497                        g_id = grp_entry->gr_gid; 
    488498                        group = value; 
    489                         DEBUG_FPRINTF(stdout, "  Setting group to %s\n", group); 
     499                        DEBUG_FPRINTF(stdout, "  Setting group to %s.\n", group); 
    490500                } else if (OPT_IS("portconf")) { 
    491501                        if (process_conftree(node, node->first_leaf, process_confopt_portconf, NULL) == NULL) return(NULL); 

  • honeytrap/trunk/src/sock.c

    r1600 r1677  
    11/* sock.c 
    2  * Copyright (C) 2005-2007 Tillmann Werner <tillmann.werner@gmx.de> 
     2 * Copyright (C) 2005-2008 Tillmann Werner <tillmann.werner@gmx.de> 
    33 * 
    44 * This file is free software; as a special exception the author gives 
    …… 
    5858        bzero((char *) server_addr, sizeof(struct sockaddr_in)); 
    5959        server_addr->sin_family         = AF_INET; 
    60         server_addr->sin_addr.s_addr    = htonl(INADDR_ANY); 
     60        server_addr->sin_addr.s_addr    = bind_address.s_addr; 
    6161        server_addr->sin_port           = port; 
    6262        if ((bind(fd, (struct sockaddr *) server_addr, sizeof(struct sockaddr_in))) != 0) {