Build a nepenthes honeypot On Debian

Nepenthes is a virtual honeypot platform running on Linux systems. It provides sufficient Simulation Technology for general Windows Services to fool most automatic attacks, it can automatically download malicious loads to collect malicious code samples.

First, you must install the Debian operating system. Because you do not need to use the graphic desktop X-Windows, we recommend that you use Debian-netinst for network installation. This installation image is only 160 MB. For detailed installation methods, refer to the numerous tutorials on the Internet. It is worth mentioning that when selecting the language in the first step of installation, it is best to select English rather than simplified Chinese. Otherwise, garbled characters will occur after the installation of the console, and a bunch of variables will be required, this is troublesome for new users who are not familiar with Linux.

After installing the system, adjust the network configuration (static IP addresses are used, and dynamic IP Address Allocation is selected by default during Debian installation ):

# nano /etc/network/interfaces

It looks like the following:

iface eth0 inet static

Address 192.168.0.240

netmask 255.255.255.0

network 192.168.0.0

broadcast 192.168.0.255

gateway 192.168.0.1

Then, adjust the DNS server configuration in the/etc/resolv. conf file.

Then restart the network:

# /etc/init.d/networking restart

# ifup eth0

Then update the source

# apt-get update

Delete exim4, which may affect the honeypot listening on port 25.

# apt-get remove exim4

Install nepenthes

# apt-get install nepenthes

After installation, modify the/etc/nepenthes. conf configuration and comment out unnecessary functions. Here are some basic lines:

 "submitfile.so"    "submit-file.conf"

 "submitnorman.so"    "submit-norman.conf"

 "logdownload.so"    "log-download.conf"

I also reserved an IRC record line.

 ”logirc.so”       “log-irc.conf”

Modify the above conf files in the/etc/nepenthes folder. The location where malicious code and logs are stored can be set in submit-file.conf and log-download.conf files,

Add your own email address in the submit-norman.conf, where you can set the IRC server address and channel used to record logs. Here I have installed an IRC server on the local machine

# apt-get install ircd-irc2

After installation, keep the default configuration and start the server.

# /etc/init.d/ircd-irc2 start

Then change the IRC server address and port in the log-irc.conf file to localhost and 6667 with the channel name # nepenthes, and keep the others by default.

Restart nepenthes.

# /etc/init.d/nepenthes restart

On the other machine, attach the IRC client M-IRC to the channel to view the real-time log information.