Etusivu Tutki Apua
Rekisteröidy Kirjaudu sisään
Splunk
/
FredsHoneyPot
2
0
Haarauta 0
Tiedostot Esitykset 0 Vetopyynnöt 0 Wiki

Terraform to stand up a splunk server and a honeypot and just log all the things.

Puu: 7c48f871f6
Haarat Tunnisteet
FredsHoneyPot
ZIP TAR.GZ
Fred Damstra 7c48f871f6 Initial commit. 7 vuotta sitten
bin 7c48f871f6 Initial commit. 7 vuotta sitten
.gitignore 7c48f871f6 Initial commit. 7 vuotta sitten
AWS_AMI_MAPS.j 7c48f871f6 Initial commit. 7 vuotta sitten
Makefile 7c48f871f6 Initial commit. 7 vuotta sitten
README.md 7c48f871f6 Initial commit. 7 vuotta sitten
banner.txt 7c48f871f6 Initial commit. 7 vuotta sitten
honeypot.j 7c48f871f6 Initial commit. 7 vuotta sitten
network_acl.j 7c48f871f6 Initial commit. 7 vuotta sitten
provider.j 7c48f871f6 Initial commit. 7 vuotta sitten
security.j 7c48f871f6 Initial commit. 7 vuotta sitten
splunk_server.j 7c48f871f6 Initial commit. 7 vuotta sitten
variables.include 7c48f871f6 Initial commit. 7 vuotta sitten
variables.j 7c48f871f6 Initial commit. 7 vuotta sitten
vpcs_and_subnets.j 7c48f871f6 Initial commit. 7 vuotta sitten
z_nextsteps.j 7c48f871f6 Initial commit. 7 vuotta sitten

README.md

Splunk HoneyPot

Creates a public AWS instance with a public facing interface that listens on all ports. It logs any incoming data on those ports (using https://github.com/fdamstra/python_multithreaded_socket_logger).

Creates a second AWS instance with Splunk on it to share the data that was ingested.

!!! These should not be considered secure. !!!

A server with open ports is an attractive target to a lot of things. While I've taken precautions to try to minimize the risk, I suggest you keep any personal information off these servers. And while you should never reuse passwords, I suggest it's especially important here.

Design

There are two VPCs. The "untrusted" VPC contains the honeypot itself with two interfaces.

The first interface on the honeypot is a management interface. It has a public IP opened to the IPs specified in your configuration that allows only SSH.

The second interface is open to all IP addresses and protocols, but runs no real services. The only services on this interface are from the daemon.

Lastly, there is second instance for splunk itself. This instance resides in a separate VPC and allows SSH, HTTP, and HTTPS traffic.