Dionaea Honeypot: Trials, Tribulations, Success, and Notes

A few months back I made a decision to increase my infosec skills and become more involved in the security community by building a honeypot. After doing a little research, and talking to a few people from the Shadowserver Foundation I found dionaea would be the best route to take. I decided to use Ubuntu server as the OS on a Dell Latitude C600. Unfortunately my first attempt was unsuccessful. After scouring the internet for more tutorials on setting up the system and coming up short, I decided to take another swing at it and take some notes for others who may attempt to set up there own honeypots.

Below are the notes I took that weren't covered in the guide provided on the dionaea website when building the server (after OS installation):

-autoconf - nothing installed (don't worry about this)

-Don't need to sudo to export

-had to install flex for libpcap to configure

-libpcap requires flex and yacc which you will need to download as byacc: sudo aptitude install flex

sudo aptitude install byacc

-don't install udns for Ubuntu, so don't need the flags on the dionaea configure/

-no back slash "\" in configure command

Don't forget to set the permissions on the /opt/dionaea directory, otherwise you won't get any logs.

Once I had everything installed, the question arose... "how to I run this thing?"

• Go to /opt/dionaea/bin type ./dionaea
• With encouragement from others I now do: ./dionaea -r /opt/dionaea -w /opt/dionaea -p /opt/dionaea/var/dionaea.pid -l all -L '*'

Finally honeypots are useless if you can't extract the data. Dionaea has an upgraded feature from Napenthes of using sqlite, unfortunately I was initially unable to use this feature so below is a command to get some of the data from the logs:

• alt: cat /opt/dionaea/var/log/dionaea.log | grep connected

I'm currently looking into writing a python script that will strip some further data from the logs and present it in graphical form. Stay tuned!

Special thanks to @commonism @ethicalhack3r and @sempersecurus for all their help and guidance.