running background

[libin-math]

First of all, this is an awesome project and really simple to use. Thanks for it

Is it possible to run this honeypot in background like daemon, could be a real advantage.

[giga-a]

@libin-math thanks! I'm wondering if this helps --termination-strategy signal #11 if not, let me know..

[libin-math]

That was for termination, what I meant is to run the honeypot in background, so there is no need of running terminal. Also I am having an issue which some ip's are not listing as its showing 0.0.0.0. Am I missing anything?

{"action": "process", "dest_ip": "0.0.0.0", "dest_port": "443", "password": "test", "server": "https_server", "src_ip": "0.0.0.0", "src_port": "443", "status": "success", "timestamp": "2022-07-21T01:15:05.825023", "username": "test"}

the following is my config

  "http":{
     "port":80,
     "ip":"192.168.100.27",
     "username":"admin",
     "password":"admin",
     "log_file_name":"http.log",
     "max_bytes":10000,
     "backup_count":10,
     "options":["capture_commands","fix_get_client_ip"]
  },
  "https":{
     "port":443,
     "ip":"192.168.100.27",
     "username":"admin",
     "password":"admin",
     "log_file_name":"https.log",
     "max_bytes":10000,
     "backup_count":10,
     "options":["capture_commands","fix_get_client_ip"]
  },

SOLVED: I WAS PASSING MANY PARAMETERS IN THE CMD LINE.

My next question, how do we launch more than 1 honeypot in same terminal as I was using the command below causing the problem stated earlier

sudo -E python3 -m honeypots --setup smb,http,https --config /etc/honeypots/config.json

When I launched the same command with single --setup parameter like below, solved the above issue and the log is properly working

sudo -E python3 -m honeypots --setup smb --config /etc/honeypots/config.json

So my question, how do we properly launch more than 1 honeypot, to my question, how do we launch http,,https,smb only?

[giga-a]

@libin-math, I see; the syntax for launching more than one honeypot is http,https, smb etc.. a comma separates the honeypot. I'm not sure why you had issues with that, but could you please share your full JSON config file? And, tell me, what do you want the output? (DB, log files, or terminal)

[libin-math]

Yes it was sorted in my last testing, the issue was with generating logs as it was generating many log files with random names, but it was sorted when I reconfigured config.json.

Thanks for the reply, it meant a lot as I'm taking the logs generated from this honeypots to ELK server for visualizing through logstash nd it's quite successful.

[libin-math]

And I'm hoping to see the honeypot process being able to run in background rather than live on terminal.

Thanks once again! :)

[giga-a]

Okay, then let's make that successful! Let me check something and I will be back to you

[libin-math]

@giga-a I have found a workaround for the running background

sudo -E nohup python3 -m honeypots --setup http,mysql,https,smb,sip,ftp --config /etc/honeypots/config.json &

and killing program using

sudo kill $(ps ax | grep honeypots | awk '{print $1}')

nohup lets the python program run without terminating signal, & at the end will run the program in background.

Can you please check if it the above format affects the cleaning process when terminating?

[giga-a]

Great!

Can you please check if it the above format affects the cleaning process when terminating?

Yes, I suggest that you use --termination-strategy signal

sudo -E nohup python3 -m honeypots --setup http,mysql,https,smb,sip,ftp --config /etc/honeypots/config.json --termination-strategy signal &

And, for cleaning, send the SIGTERM to the main process (It will do the cleaning..)

sudo kill $(ps ax | grep "honeypots --setup" | awk '{print $1}')