Distributed Nepenthes with PHARM

Just finished releasing version 1.0 of Nepenthes PHARM.

Nepenthes PHARM is a perfect companion to your Nepenthes honeypot installations to catch Malware in the wild. PHARM is an Open Source client/server and web portal package, which provides central reporting and analysis of your distributed Nepenthes based honeypots.

PHARM Clients are installed on along with your Nepenthes installs, PHARM clients listen for any changes in nepenthes log files (logged_submissions and nepenthes.log) and sends over the logged data and malware collected over to the server running the PHARM server.

PHARM server munges all the data collected from PHARM Clients and provides analysis/report of your honeypots through the PHARM Web portal. On the analytical part, Pharm actually queries Virus total's publicly available data to report back the detail of the malware collected.

PHARM is available for download at www.nepenthespharm.com . PHARM is developed and maintained by yours truly ME :) Parvinder S. Bhasin.

Perl and CPAN reconfigure

To reconfigure CPAN do the following:

perl -MCPAN -e shell

When inside the shell...type:

cpan> o conf init

That's it...you will get interactive question and answer to setup CPAN etc...cheers.

Another way to do this is ..just by executing cpan directly from shell.. as pointed out by chorny :) thx.
# cpan
cpan> o conf init

Again..there maybe more ways to do this...choose yours :)

OpenBSD tips and tricks - adding swap on the fly

******* Adding swap on fly *******

# dd if=/dev/zero of=/usr/swap0 bs=1024k count=64

This will create basically a 64MB file that we will use for adding some swap space.

set the proper permissions on (/usr/swap0)

# chmod 0600 /usr/swap0

Now to add the swap file on fly

# swapctl -a /usr/swap0

Check to make sure you are using swap by running top or:

# swapctl -l

You can then further add swap at boot time in /etc/rc.local by adding the swapctl command.

** Note there maybe some security implications with this ...so I won't advise you to do that for production system. This is for those times when you forgot to create proper swap partition and now one of you programs is causing segmentation faults etc cuz you are running out of physical memory. ** You've been cautioned, please use at your own risk.

Squid - WCCP and Cisco ASA setup

Setup squid first:

Then on the box (in this case LINUX) running squid do the following:

modprobe ip_gre
iptunnel add gre1 mode gre remote $ASA_ROUTER_IDENTIFIER local $SQUID_SERVER_IP dev eth0
ifconfig gre1 inet 1.2.3.4 netmask 255.255.255.0 up


Updated to reflect great comment from DanO'Reilly :)

The ASA_ROUTER_IDENTIFIER is first of all just identifier and its the highest ip that is on your ASA. Please use the highest IP on your ASA for the iptunnel command. You can get list of all the ips on your asa by doing "show ip".

Next....

Enable forwarding on squid server:


echo 1 > /proc/sys/net/ipv4/ip_forward


Disable reverse path filter.


echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/gre1/rp_filter



Add IPTABLES rule to redirect all the traffic coming on port 80 over to the squid listening port. i.e: 3128 in this case:


iptables -t nat -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j REDIRECT --to-port 3128


Now to configure squid.conf:

Make sure you compiled squid with transparency support (required for PF , IPFW etc). Do config --help | grep transp to see all the firewalls that need this option. For Cisco ASA etc, you don't need to have any transparent option.

anyways back to squid.conf add the following line:


http_port 3128 transparent


"transparent" is the key word here.

Now to configure WCCPv2 in squid.conf:


wccp2_router <$ASA_IP_ADDRESS>
wccp_version 4
wccp2_forwarding_method 1
wccp2_return_method 1




Enabling/configuring WCCPv2 on CISCO ASA(7.x/8.x):

I will go over two scenarios that I came across. First for testing I only wanted certain IPs to hit the squid box before opening it to the rest of the world. Additionaly I didn't want ALL THE PROTOCOLS to go through the proxy server. Only http (80) to go through squid: so here is what i created:

1. First created acl for the clients I wanted to allow access through squid for port 80

ASA# access-list proxyclients extended permit tcp host 192.168.100.202 any eq www

2. I added acl for my proxy servers too.

ASA# access-list proxyservers extended permit ip host 192.168.100.3 any

*** 192.168.100.3 - IP address of my squid box.

3. Now the wccp part:

ASA# wccp web-cache redirect-list proxyclients group-list proxyservers
ASA# wccp interface inside web-cache redirect in

4. Additionaly you can issue:

ASA# wccp web-cache


This should get you going :)

Now if you wanted to let EVERYONE in the world go through and go through proxy: I would remove all the ACLs and remove one wccp line:


ASA# no access-list proxyclients extended permit tcp host 192.168.100.202 any eq www
ASA# no access-list proxyservers extended permit ip host 192.168.100.3 any

This is tricky. You have to "no" the wccp interface command first so...


ASA# no wccp interface inside web-cache redirect in
ASA# no wccp web-cache redirect-list proxyclients group-list proxyservers

Now lets add the wccp interface command back


ASA# wccp web-cache
ASA# wccp interface inside web-cache redirect in


At this point all your traffic hitting the firewall would be redirected to the squid server.

** note about https transparency: packets are encrypted ..so by the time packets arrive at SQUID ..it cannot understand. So other words https transparency, I don't think its supported.

As superpaia pointed out in his comments:

important: "The only topology that the security appliance supports is when client and cache engine are behind the same interface of the security appliance and the cache engine can directly communicate with the client without going through the security appliance." from Cisco.