2

Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?.
The logs must be encrypted and sent in such a way that a potential attacker would not be able to sniff the communication.
I have tried sending my logs to a valid yet unused IP in my address space and then forward the logs to the private lan via a promisc interface and IPTables.
The problem with this solution is that it only works with UDP which is not encrypted and traffic to my logging server can still be sent and sniffed.
Can anyone propose a better method?
Someone told me to use a TAP device to send the information onto a separate bridge but I was unable to understand the logic.

2
  • You assume the attacker is on the server and can not track the ongoing logging and export process before it is packaged up via noting the services working and sockets open internally?
    – zedman9991
    Oct 2, 2013 at 20:02
  • rsyslog has been recompiled to run under another process name and uses a hidden config file. A dummy rsyslog process with default config, log dir and process name is enabled. I am trying to think up a way for the "hidden" rsyslog to send the logs Oct 2, 2013 at 20:06

2 Answers 2

4

If honeypot is a virtual machine, you could write the logs to the host - tricky, but I've done it.

I have also simply used a second nic on the honeypot connected to a management network. Assuming that your hackers cannot see that level of access in the OS, they would never see the communications, and you have a lot of power over the firewall and routing rules to add safety.

6
  • The honeypot is a PVM under Xen. Could you give more details as to how I might be able to pass the logs through the hypervisor to my logging server on a private lan? Cheers Oct 2, 2013 at 20:13
  • With PVs, you might not be able to write to hardware. But with PVHVM, you should be able to. I'm not that familiar with the details of Xen to advise on a tunnel through the hardware.
    – schroeder
    Oct 2, 2013 at 20:19
  • How did you do it with a HVM? As for the other solution, how would it be possible to hide a NIC on thee honeypot? Oct 2, 2013 at 20:26
  • It really depends on the honeypot you use. If the honeypot allows the 'visitor' access to the nics or if the 'visitor' breaks out of the honeypot, then you are out of luck no matter what. A second nic on a second network, tho, is automatically 'hidden'.
    – schroeder
    Oct 2, 2013 at 21:07
  • To write from a PV to a HVM, you access the HVM hardware (the disk) as a shared resource with the PV. You then set permissions on the file system to make sure the 'visitor' cannot modify or delete or escape the destination.
    – schroeder
    Oct 2, 2013 at 21:11
0

The Honeynet Project has released a kernel module to help you with that called Sebek, but the tool is a bit dated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .