Strona główna Odkrywaj Pomoc
Zarejestruj się Zaloguj się
Splunk
/
FredsHoneyPot
2
0
Forkuj 0
Pliki Problemy 0 Oczekujące zmiany 0 Wiki

Terraform to stand up a splunk server and a honeypot and just log all the things.

Drzewo: 7c48f871f6
Gałęzie Tagi
FredsHoneyPot
ZIP TAR.GZ
Fred Damstra 7c48f871f6 Initial commit. 7 lat temu
bin 7c48f871f6 Initial commit. 7 lat temu
.gitignore 7c48f871f6 Initial commit. 7 lat temu
AWS_AMI_MAPS.j 7c48f871f6 Initial commit. 7 lat temu
Makefile 7c48f871f6 Initial commit. 7 lat temu
README.md 7c48f871f6 Initial commit. 7 lat temu
banner.txt 7c48f871f6 Initial commit. 7 lat temu
honeypot.j 7c48f871f6 Initial commit. 7 lat temu
network_acl.j 7c48f871f6 Initial commit. 7 lat temu
provider.j 7c48f871f6 Initial commit. 7 lat temu
security.j 7c48f871f6 Initial commit. 7 lat temu
splunk_server.j 7c48f871f6 Initial commit. 7 lat temu
variables.include 7c48f871f6 Initial commit. 7 lat temu
variables.j 7c48f871f6 Initial commit. 7 lat temu
vpcs_and_subnets.j 7c48f871f6 Initial commit. 7 lat temu
z_nextsteps.j 7c48f871f6 Initial commit. 7 lat temu

README.md

Splunk HoneyPot

Creates a public AWS instance with a public facing interface that listens on all ports. It logs any incoming data on those ports (using https://github.com/fdamstra/python_multithreaded_socket_logger).

Creates a second AWS instance with Splunk on it to share the data that was ingested.

!!! These should not be considered secure. !!!

A server with open ports is an attractive target to a lot of things. While I've taken precautions to try to minimize the risk, I suggest you keep any personal information off these servers. And while you should never reuse passwords, I suggest it's especially important here.

Design

There are two VPCs. The "untrusted" VPC contains the honeypot itself with two interfaces.

The first interface on the honeypot is a management interface. It has a public IP opened to the IPs specified in your configuration that allows only SSH.

The second interface is open to all IP addresses and protocols, but runs no real services. The only services on this interface are from the daemon.

Lastly, there is second instance for splunk itself. This instance resides in a separate VPC and allows SSH, HTTP, and HTTPS traffic.