Call for Participation - WASC Distributed Open Proxy Honeypot Project

Happy New Year Everyone!

Seeing as this project is utilizing ModSecurity, the Core Rules and the ModSecurity Console, I thought that you all would be interested.  We are looking for people who would be willing to deploy a VMware honeypot sensor as part of our project.  We are looking for many diverse networks for deployment - home users, commercial, acedemic, ISP, etc...

 

Please review the updated webpages on the WASC website -

http://www.webappsec.org/projects/honeypots/

http://www.webappsec.org/projects/honeypots/faq.shtml

http://honeypots.sourceforge.net/WASC_Project_Proxy_Honeypot_Final.doc

I wanted to send out this announcement to this list prior to releasing it out to the general community on the webappsec mail-list.  I have updated the VMware honeypot host image so that it includes ModSecurity 2.0 and also uses the ModSecurity Core Rule Set for detection of attacks.  Since we are using ModSecurity, the Core Rules and the ModSecurity Console, I suggest that you review the documentation at the ModSecurity website ( http://www.modsecurity.org/projects/index.html) if you are unfamiliar with these applications.

If you would like to participate in this project, please contact me directly for Registration.  I will need the following information -

 

1) Your name

2) The email address you would like to use for WASC to contact you with any issues/updates

3) The internet accessible IP address that you plan to use for the honeypot

4 ) The Geo Location of your honeypot (Country/State/Province/City)

5) Network Block Owner.

 

With this information, I will then create a Sensor profile in the centralized logging host (running the ModSecurity Console).  Once your account is created, I will send you back an email with the following information -

 

1) The URL link to download the VMware honeypot image.

2) The root password for the image.

3) The username/password credentials that you will need to use with the ModSecurity logc program.  Without these credentials, you will not be able to submit your logs to the central host.

4) Steps for updating the image which include - setting the timezone info, verifying NTP is running, verifying DHCP worked, starting Apache, editing the logc.conf file, etc...

 

Thanks.

--
Ryan C. Barnett
Breach Security: Director of Application Security Training
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV_______________________________________________
mod-security-users mailing list
mod-security-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/mod-security-users