Re: Complete Honeynet

[<rewt () eghetto ca>]

First off, you should check www.honeynet.org page, if you haven't
already. You can setup honeypots with both of those OS's no problem. I
think linux is generally easier to get into for a full fledged (with
kernel modules and the hey hey) as there are generally more linux
hackers. Personally, I like OpenBSD though, as Theo is just -so- cuddly.

Other things to look into are snort, distributed syslog (including hiding
the 'real' syslog process on the honeypot itself, so evil crackers don't
make it disappear), tcpdump / ethereal and things like honeyd. Another
thing, but purely linux-specific is UML (user mode linux, check google for
a URL). It basically allows you to setup a finite amount of virtual linux
machines, and supports things like sharing the virtual kernels stack with
the real one, so while shellcode will run, it will only 'harm' the virtual
machine.

I hope that gives you some direction.

Peace

-mrOrange