Create a honeypot

From kwang.cn
The first thing we need to do is to create an empty directory on the Web server. The name has nothing to do with the location. In this example, the author created a directory named Honeypot, which is located in the C: Inetpubwwwroot directory. Start the IIS management program and assign a Host header name to all sites so that each virtual server has a Host header name with an IP address.

Make sure that the virtual server cannot map with the IP address on port 80 without the Host header name, and that the server cannot have "all unallocated" IP address lookup. And ensure that the Host header information is correctly set and the user can still access all sites.

Then, create a new website pointing to the directory you just created. This honeypot website should specify all unassigned IP addresses and cannot configure Host header information. Although the website name is "honeypot", it does not affect access by hackers. Go to the attribute settings page of the new website, select the "Directory Security" tab, select "Integrated windows Authentication", deselect other authentication methods, and click "OK ".

Next, select the website tab, click "advanced", click "add" under "multi-site configuration", and add all IP addresses. If you receive an error message about IP address conflict, it does not matter. This indicates that you have not set a Host header name for this website. What you need to do is to clear the IP address from the list or configure a Host header name for this website.

Save all the changes and exit Internet Information Service.

In this way, when a malicious user accesses the website through an IP address, the user will be sent to an empty directory and receive a 403 error. Users who access the website through DNS domain names can access the website content with the Host header information.

This is not absolutely safe because hackers still try to access the website through the domain name, but most of the attacks are sent to the IP address. Using the header information of the host improves the performance of the Web server, because the WWW Service does not need to allocate a non-webpage internal pool for the website using an independent IP address.