SMB lure and honeyd's subsystem virtualization citi.umich.edu USER_IN_DEF_WHITELIST autolearn=ham version=2.60

From: Sven Marcus <securifo_at_web.de>
Date: 28 Nov 2003 10:56:34 -0000

('binary' encoding is not supported, stored as-is) Hi,
does anybody have tried to build an SMB lure using samba and honeyd's subsystem virtualization yet?
I have tried using the following config [section], ending up with a problem:

create windows
set windows personality "Windows NT 4.0 Server SP5-SP6"
set windows default tcp action reset
set windows default udp action reset
#add windows subsystem "/etc/init.d/samba start" shared
add windows subsystem "/usr/sbin/nmbd -D" shared
add windows subsystem "/usr/sbin/smbd -D" shared

But nmbd fails (even if no samba program part is running) with the message
honeyd[6765]: Subsystem "/usr/sbin/nmbd -D" died

Any ideas what's going wrong?
Or any ideas or alternatives building an SMB lure using honeyd and samba (except proxying traffic to port 139 etc.)?

Thanks, Sven.
Received on Fri Nov 28 2003 - 09:16:39 PST