Recent Posts:

Archives:

Blogroll:

Get Email Updates:
Enter your email address:

Wednesday, 15 May 2013

Install Dionaea on Ubuntu 12.04 LTS:

Dionaea is a low interaction honeypot which offers the following services SMB, HTTP, FTP and TFTP. It's pretty easy to install (once you know how) but it helps to know a few quick tricks.

For alternative install instructions, see: dionaea.carnivore.it/#compiling

Add the Dionaea repositories:
:~$ sudo add-apt-repository ppa:honeynet/nightly
:~$ sudo apt-get update

Install Dionaea:
:~$ sudo apt-get install dionaea

After you've installed Dionaea, set up the directories:
:~$ sudo mkdir -p /var/dionaea/wwwroot
:~$ sudo mkdir -p /var/dionaea/binaries
:~$ sudo mkdir -p /var/dionaea/bitstreams
:~$ sudo mkdir -p /var/dionaea/log
:~$ sudo chown -R nobody:nogroup /var/dionaea/

Update the Config file with the new Directories:
:~$ sudo mv /etc/dionaea/dionaea.conf.dist /etc/dionaea/dionaea.conf
:~$ sudo sed -i 's/var\/dionaea\///g' /etc/dionaea/dionaea.conf
:~$ sudo sed -i 's/log\//\/var\/dionaea\/log\//g' /etc/dionaea/dionaea.conf

Before starting Dionaea, edit the Configuration which is located at /etc/dionaea/dionaea.conf. First I suggest that you reduce the amount of logging. Set the levels from all to warning,error:
logging = {
    default = {
      file = "/var/dionaea/log/dionaea.log"
      levels = "warning,error"
      domains = "*"
    }
 
    errors = {
       file = "/var/dionaea/log/dionaea-errors.log"
       levels = "warning,error"
       domains = "*"
   }
}

Next, edit the listen dection. Change the mode from getifaddrs (automatic) to manual, to ensure your install is reachable from the Internet:
listen =
{
   mode = "manual"
   addrs = { eth0 = ["::"] }
}

Finally, start Dionaea as Deamon:
:~$ sudo dionaea -c /etc/dionaea/dionaea.conf -w /var/dionaea -u nobody -g nogroup -D


0 Comments:

Post a Comment

Subscribe to Post Comments [Atom]

‹Home

‹Older