About:
Tiny Honeypot (thp) is a simple honey pot program based on iptables redirects and an xinetd listener. It listens on every TCP port not currently in use, logging all activity and providing some feedback to the attacker. The responders are entirely written in Perl, and provide just enough interaction to fool most automated attack tools, as well as quite a few humans, at least for a little while. With appropriate limits (default), thp can reside on production hosts with negligible impact on performance.

Author:
George Bakos [contact developer]

Rating:	reset 1 2 3 4 5 6 7 8 9 10
8.47/10.00 (1 vote)

Homepage:
http://www.alpinista.org/thp/
Tar/GZ:
http://www.alpinista.org/files/thp/thp-0.4.6.tar.gz
Changelog:
http://www.alpinista.org/files/thp/thp-0.4.6/CHANGELOG
Debian package:
http://packages.debian.org/tinyhoneypot

Trove categories: [change]

[Development Status]		4 - Beta
[Environment]		Console (Text Based)
[Intended Audience]		System Administrators
[License]		OSI Approved :: GNU General Public License (GPL)
[Operating System]		POSIX :: Linux
[Programming Language]		Perl
[Topic]		Security

Dependencies: [change]
iptables (required)
xinetd (recommended)
[download links]

 Branches

Branch	Version	Last release	License	URLs
Default	0.4.6	24-May-2003	GNU General Public License (GPL)

 Releases

Version	Focus	Date
0.4.6	Minor feature enhancements	24-May-2003 06:32
0.4.4	Minor feature enhancements	02-Aug-2002 20:36
0.4.3-2	Minor feature enhancements	23-Jul-2002 06:44
0.4.3-1	Minor bugfixes	16-Jul-2002 10:07
0.4.3	Initial freshmeat announcement	15-Jul-2002 08:59

 Comments

[»] The perfect IDS spice
by Bill Scherr IV - Aug 1st 2002 13:28:02

This package is perfect for those who are not intimately familiar with packet bits and c source code. The listener is just that, a listener. The responses are there to illicit a further degree of attacker activity without actually running the service. Attackers won't know what they're hitting until they've tipped their hands!

What does this do for you? If you want to understand more about network shenanigans, this will lay bare RPC and FTP attacks. It's in PERL, so if you want more services, grab an RFC and write it! A CAVEAT! If you're running a production network, think long and hard before putting this up! If you are not comfortable that your IDS is showing you everything, don't even think about it! Just say no!!!!

If you are still here, that means you know what xinetd and iptables do, can analyze their settings, and have them working. Open this in a test directory, and check out what it does first! You may have to manually add some rules, or adjust some services. Do it, and enjoy watching the script kiddies bounce off your walls.

--
Bill Scherr IV, GSEC, GCIA EWA / Information & Infrastructure Technologies Colchester, VT

[reply] [top]