Does anyone know of a secure and transparent method of sending logs from a honeypot server on a DMZ to a logging server in a private network?.
The logs must be encrypted and sent in such a way that a potential attacker would not be able to sniff the communication.
I have tried sending my logs to a valid yet unused IP in my address space and then forward the logs to the private lan via a promisc interface and IPTables.
The problem with this solution is that it only works with UDP which is not encrypted and traffic to my logging server can still be sent and sniffed.
Can anyone propose a better method?
Someone told me to use a TAP device to send the information onto a separate bridge but I was unable to understand the logic.

  • You assume the attacker is on the server and can not track the ongoing logging and export process before it is packaged up via noting the services working and sockets open internally?
    – zedman9991
    Oct 2 '13 at 20:02
  • rsyslog has been recompiled to run under another process name and uses a hidden config file. A dummy rsyslog process with default config, log dir and process name is enabled. I am trying to think up a way for the "hidden" rsyslog to send the logs Oct 2 '13 at 20:06

If honeypot is a virtual machine, you could write the logs to the host - tricky, but I've done it.

I have also simply used a second nic on the honeypot connected to a management network. Assuming that your hackers cannot see that level of access in the OS, they would never see the communications, and you have a lot of power over the firewall and routing rules to add safety.

  • The honeypot is a PVM under Xen. Could you give more details as to how I might be able to pass the logs through the hypervisor to my logging server on a private lan? Cheers Oct 2 '13 at 20:13
  • With PVs, you might not be able to write to hardware. But with PVHVM, you should be able to. I'm not that familiar with the details of Xen to advise on a tunnel through the hardware.
    – schroeder
    Oct 2 '13 at 20:19
  • How did you do it with a HVM? As for the other solution, how would it be possible to hide a NIC on thee honeypot? Oct 2 '13 at 20:26
  • It really depends on the honeypot you use. If the honeypot allows the 'visitor' access to the nics or if the 'visitor' breaks out of the honeypot, then you are out of luck no matter what. A second nic on a second network, tho, is automatically 'hidden'.
    – schroeder
    Oct 2 '13 at 21:07
  • To write from a PV to a HVM, you access the HVM hardware (the disk) as a shared resource with the PV. You then set permissions on the file system to make sure the 'visitor' cannot modify or delete or escape the destination.
    – schroeder
    Oct 2 '13 at 21:11

The Honeynet Project has released a kernel module to help you with that called Sebek, but the tool is a bit dated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.