honeypots .. any experience?

[Thorn]

Thanks guys , great tips - I will definitely take note of these and get to it soon..

But should I just create a drive on the server to make it appear like a shared public network station used for storage, or should I take it one step further and implement users with profiles and add those types to files on each user's profile folder?

I must admit I'm more tempted by creating a public drive and break it down into several folder like streaker suggests to make it simple .. however, should the public folder be shared in some sort so people will be able to browse them?

Directories that are set up for "public use" are usually made to be browsed by the users, so that would be normal, as would setting up different privileges for the users on a Win2003 server.

[lund99]

OK, so I created both a Public and a Profiles folder which both are readable - but the subfolders are locked so I'm one step closer to making this box look legit.

How about the Windows firewall settings in Win2003 server? Should I do something specific here to make the box look appealing to anyone? I have allowed incoming ICMP requests - but denied all outgoing...

Anything else I should think of?

[lund99]

BTW, by running my entire honeynet in VMWare I have used the following set-up for my honeywall:

ETH0 - bridged interface
ETH1 - Host only interface
ETH2 - NAT interface.

ETH0 and ETH1 are bridged and works like a switch, providing the other box I currently run in VMWare with connectivity to the internet.

ETH2 is set up as a NET'ed interface on a local VMWare subnet (192.168.101.0) for me to be able to access the Honeywalls' "Walleye" WEB GUI through the IP on that interface.

But I still don't have any internet connectivity on my honeywall :/ I would love to be able to download snort update rules etc.. but as of this moment, I can't work it out.

Any tips?