Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.


I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this:

[Router] <----> [ IPS ] <-------> [ Honeypot ]

My problem is that most of the IPS rule sets out there are designed to drop/alert known malicious traffic.

My objective is to let all the traffic in, and have a drop by default policy for outgoing connections.

Over the drop by default policy, I would like specific rules to allow specific things such as SSH response, HTTP response, Wget , APT (for honeypot updates and so attackers can actually download and test malware on the honeypot).

The general idea is to let all attacks in, and block all malicious outbound traffic that may harm other servers. Sort of a positive security vs a negative security approach.

Does anyone know how I could start a set of rules that would best fit this scenario, or better still, recommend a better policy for my IPS?

share|improve this question
add comment

2 Answers

Alternatively, you can simply capture all traffic as pcap and run snort rules in offline mode for research/investigation.

share|improve this answer
add comment

due to the direction - nature of snort-sigs (src -> dst) you'll need 2 different installs, one protecting the incoming stream, one connecting the outgoing stream, if you want to snortify not only incoming, but also outgoing connections. even better, have for every direction one NIC.

2nd: suricata is an IDS and can be made an IPS, maybe you should try to understand the difference and what you need to do (or not) to make your IDS an IPS.

for blocking outgoing-stuff iptables would be more sufficient, just block (but log) anything out except port 22/80/443 and maybe irc-ports.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.