JHoney honeypot

Stop the hackers before they can do real damage!

SourceForge.net Logo
 
Home
 
 
Requirements
 
 
Download
 
 
Installation
 
 
Getting started
 

Starting the webserver

Configuring and controlling JHoney is done using any webbrowser. First, start the HTTP server by executing the command jhserv start in a terminal. Open a webbrowser and browse to http://localhost:8333.
JHServ requires login. The default loginname is 'admin' and password 'admin'. To add a new user, open a terminal as root and run jhserv adduser uname pword. To remove a user, run jhserv removeuser uname pword.

Configuring the honeypot deamon

Before the deamon is started, you need to configure it. Read the help information under the Configuration menus to figure out what to do.

Starting the deamon

When you have finished configuring the scripts and config files, start the deamon by selecting the Deamon/Start menu alternative. You will be notified if the deamon started correctly or if something went wrong. Read the help for information about the status messages.

Test if everything works

You can try if the honeypot is working by using a webbased port scanner. You can find one at www.pcflank.com. Select Advanced port scanner and TCP connect. Scan the ports JHoney is simulating services at. You will be notified that the ports are open. Examine the attacks log in the JHoney webinterface. You will now see a www.pcflank.com entry. If you have enabled automatic blacklisting, try to use PCFlank's portscanner once more. If the blacklisting works, you will now be notified that the ports are stealthed. A PCFlank entry should also have been added to the attacks log file.