Re: logging facility

[urbn () visi com]

What if someone compromised your honeypot, and then monitored any SSL traffic 
that was decrypted?  Common sense would tell me to keep these logs (the 
decrypted SSL traffic) on a separate system, but then why even have your 
honeypot decrypt it first. Better off just sending the encrypted packets to the 
system that will be logging it anyways.

Or am I missing something here?

Quoting KeyFocus <support () keyfocus net>:

> > How can encrypted traffic be decrypted with a honeypot?
> SSL is designed to prevent man in the middle attacks, which is why an IDS
> cannot examine the traffic.
>
> A honeypot is the end point of the SSL traffic so it decrypts it anyway.
> All
> thats needed is a means to log it.
>
> - Tom
> www.keyfocus.net