[Honeywall] Fwd: help needed in configuration of honeywall

Matthew Tatalovic matthew.tatalovic at gmail.com
Tue Jul 8 14:54:32 EDT 2008


I have not deployed the Honeypots yet.  I have added an Ubuntu attacker VM
machhine though.  My host IP changes depending on where I am... so because I
work from home and school is there anyway of making this dynamic OR do I
have to change it everytime my host IP changes?

Thank you for the diagrams I have seen those and understand them for the
most part, what might help would be examples by adding possible IP
addressing schemas.

Is there any published attacker scripts for demonstration purposes or any
suggestions on attack patterns that would be good to show? (this is getting
a little ahead of myself as I do not have the system running but I thought I
would think ahead a bit)

On Thu, Jul 3, 2008 at 3:13 PM, Faiz Ahmad Shuja <faiz.shuja at gmail.com>
wrote:

> What's your host OS and the IP addressing on it? Can you access Honeywall
> from Host OS? Have you deployed any honeypots?
>
> You can view network diagrams at:
>
> http://www.honeynet.pk/honeywall/roo/honeywall2.jpg
>
> http://www.honeynet.pk/honeywall/roo/page2_files/vmware.jpg
>
>
> Paper: http://www.honeynet.pk/honeywall/roo/index.htm
>
> By the way, we will be upgrading this step-by-step guide to setup virtual
> honeynet, so any suggestions to improve the guide will be greatly
> appreciated.
>
>
> Regards,
> Faiz
>
>
>
>> *From: *"Matthew Tatalovic" <matthew.tatalovic at gmail.com>
>> *Date: *July 3, 2008 13:39:04 CDT
>> *To: *"Mailing list for users and developers of the Honeywall" <
>> honeywall at public.honeynet.org>
>> *Cc: *mohamed.rageb at gmail.com
>> *Subject: **Re: [Honeywall] Fwd: help needed in configuration of
>> honeywall*
>> *Reply-To: *Mailing list for users and developers of the Honeywall <
>> honeywall at public.honeynet.org>
>>
>> I am using VMware and have Ubuntu image running along side Honeywall and
>> in that I set the Ubuntu IP to 10.10.10.40  <http://10.10.10.66/>and run
>> a firefox browser to run the https://10.10.10.66 browser but it says it
>> cannot find the page.  When I ping it I get a destination unreachable.
>>
>> Ubuntu is on eth0 and has the same network mask as the management
>> interface.
>>
>> Where my Honeywall setup is:
>>
>> Eth0 bridged
>> Eth1 Host-only
>> Eth2 bridged
>>
>> And have pretty much followed,
>> http://www.philippinehoneynet.org/index.php?option=com_docman&task=doc_download&gid=16&Itemid=29
>>
>> A quick diagram of the ethernet cards OS computers and IPs would
>> definately be useful combining, honeywall, an attacker and 3 honey pot
>> setup.
>>
>> Thank you,
>>
>> Matthew.
>>
>>
>>
>> On Thu, Jul 3, 2008 at 2:24 PM, Peter Lovell <plovell at mac.com> wrote:
>>
>>> On Thu, Jul 3, 2008, Jamie Riden <jamie.riden at gmail.com> wrote:
>>>
>>> >Subject: help needed in configuration of honeywall
>>> >hello everyone, i decided to build and develop of hight interaction
>>> >honeypot as my graduation project, but I've  faced some problem
>>> >I've installed the honeywall CD and when the configuration process,
>>> >when it asked my for management interface IP address i entered the
>>> >following ip: 10.10.10.66
>>> >and the following network mask for the management interface is
>>> 255.255.255.0
>>> >default getway for 10.10.10.66(the management interface ip address) is
>>> >10.10.10.1
>>> >and the DNS domain for management interface is localhost.
>>> >the question is how can i access this management interface either
>>> >locally or remotely and how can i access the walleye web interface to
>>> >see the attacks report
>>> >please help me in these problems
>>> >if there are any illustration with image will be more helpful
>>> >thanks in advance
>>>
>>>
>>> Start a web browser and specify the address
>>> https://10.10.10.66
>>>
>>> For login, use account "roo" and password "honey". If I remember
>>> correctly, it forces you to change to a stronger password right away.
>>> This password is NOT the same as that for the "roo" account on the
>>> machine.
>>>
>>> Hopefully I've understood your question correctly, and this is the
>>> answer you need. If not, please ask again with any additional details
>>> you think are appropriate.
>>>
>>> Cheers.....Peter
>>>
>>> _______________________________________________
>>> Honeywall mailing list
>>> Honeywall at public.honeynet.org
>>> https://public.honeynet.org/mailman/listinfo/honeywall
>>>
>>
>> _______________________________________________
>> Honeywall mailing list
>> Honeywall at public.honeynet.org
>> https://public.honeynet.org/mailman/listinfo/honeywall
>>
>>
>>
>
> _______________________________________________
> Honeywall mailing list
> Honeywall at public.honeynet.org
> https://public.honeynet.org/mailman/listinfo/honeywall
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://public.honeynet.org/pipermail/honeywall/attachments/20080708/8eb91605/attachment-0001.html


More information about the Honeywall mailing list