Let's consider the following scenario:
You have a web -facing server, which runs software e.g.
apache2 on separate Linux user
www-data. An attacker finds a vulnerability and gets a remote shell on your system with privileges of
Is it possible to have honeypot on commands run by the
www-data user? For example, let's assume that
apache2 or any other process run by
www-data, never runs
ls command to list directory (it would most likely use other API provided by the system, rather than start new process parse output etc). Is it possible to set-up a honeypot on such command? For example, log the commands in sys.log, or add an entry to a database with only
The command should still run normally on other users (or specified) accounts, without triggering the log event.
If such honeypot is possible, how could one be set up? Is there any reasons why such honeypot is bad and should not be used?