Ubuntu18.04下部署Honeyd蜜罐（完整过程）

Ubuntu18.04下部署Honeyd蜜罐

Honeyd概述

Honeyd是一个框架——把数千个虚拟蜜罐及对应的网络集成到一起。通常，我们配置Honeyd集成现有网络上未分配的IP地址。对于每一个IP地址，我们可以告诉Honeyd我们希望如何模拟计算机的行为。例如，我们可以建立一个虚拟的Web服务器服务器看似运行Linux和监听80端口。我们可以在另一个IP地址上建立一个带有类似Windows网络栈的虚拟蜜罐，它上面的所有TCP端口似乎都正在运行服务。这将使我们接收到蠕虫或者探测的初始TCP有效载荷。

依赖项准备

$ sudo apt-get install g++ gcc
$ sudo apt-get install flex
$ sudo apt-get install bison
$ sudo apt-get install libedit-dev

安装所需的函数库

honeyd1.5c和配套的安装包一共有6个。所有的安装包都放在下面的百度云链接中：https://pan.baidu.com/s/1nmsPBWIi45DhshOruhyPRA 密码：hani

（1）安装 libdnet-1.11

~/libdnet-1.11$ sudo ./configure
~/libdnet-1.11$ sudo make
~/libdnet-1.11$ sudo make install

（2）安装 libevent-1.4.14b-stable

~/libevent-1.4.14b-stable$ sudo ./configure
~/libevent-1.4.14b-stable$ sudo make
~/libevent-1.4.14b-stable$ sudo make install

（3）安装 libpcap-1.9.0

~/libpcap-1.9.0$ sudo ./configure
~/libpcap-1.9.0$ sudo make
~/libpcap-1.9.0$ sudo make install

（4）安装 zlib-1.2.11

~/zlib-1.2.11$ sudo ./configure
~/zlib-1.2.11$ sudo make
~/zlib-1.2.11$ sudo make install

（5）安装 ARPD

~/arpd$ sudo ./configure

当直接执行 $ sudo make 时会报错，错误如下所示：

~/arpd$ sudo make
arpd.c: In function ‘arpd_send’:
arpd.c:268:34: error: expected ‘)’ before string constant
   syslog(LOG_DEBUG, __FUNCTION__ ": who-has %s tell %s",
                                  ^~~~~~~~~~~~~~~~~~~~~~
arpd.c: In function ‘arpd_lookup’:
arpd.c:285:34: error: expected ‘)’ before string constant
   syslog(LOG_DEBUG, __FUNCTION__ ": %s at %s",
                                  ^~~~~~~~~~~~
arpd.c:294:34: error: expected ‘)’ before string constant
   syslog(LOG_DEBUG, __FUNCTION__ ": no entry for %s",
                                  ^~~~~~~~~~~~~~~~~~~
arpd.c:297:34: error: expected ‘)’ before string constant
   syslog(LOG_DEBUG, __FUNCTION__ ": %s at %s",
                                  ^~~~~~~~~~~~
arpd.c: In function ‘arpd_recv_cb’:
arpd.c:426:35: error: expected ‘)’ before string constant
    syslog(LOG_DEBUG, __FUNCTION__ ": %s at %s",
                                   ^~~~~~~~~~~~
Makefile:195: recipe for target 'arpd.o' failed
make: *** [arpd.o] Error 1

解决办法：
在 arpd.c 文件中添加：

#define __FUNCTION__ ""

重新执行$ sudo make 错误消失。

继续剩余操作：

~/arpd$ sudo make
~/arpd$ sudo make install

测试arpd

//成功安装arpd
~/arpd$ sudo arpd 123.123.123.123
arpd[28638]: listening on ens33: arp and (dst 123.123.123.123) and not ether src 00:0c:29:d2:22:ab

补充：安装arpd可能还会出现如下错误

# arpd 
./arpd/arpd: error while loading shared libraries: libevent-1.4.so.2: cannot open shared object file: No such file or  directory

可能的解决方法：

//输入该命令
$ sudo ldconfig

参考链接：
1.linux上启动Memcache报错：error while loading shared libraries: libevent-1.4.so.2
2.linux下安装honeyd蜜罐系统【原创】

安装Honeyd

执行 $ sudo ./configure
出现错误，错误如下：

~/honeyd-1.5c$ sudo ./configure
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking target system type... x86_64-unknown-linux-gnu
...
...
checking if underscores are needed for symbols... no
checking if we can access libc without dlopen... no
checking if we can access libc with libc.so... no
checking if we can access libc with /usr/lib/libc.so*... no
configure: error: Couldn't figure out how to access libc

解决方法：

//对于x86-64体系结构，输入该命令
~$ sudo ln -s /lib/x86_64-linux-gnu/libc.so.6 /usr/lib/libc.so

再次执行 $ sudo ./configure 错误消失。
继续剩下操作:

~/honeyd-1.5c$ sudo ./configure
~/honeyd-1.5c$ sudo make
~/honeyd-1.5c$ sudo make install
//安装完成

测试Honeyd，出现报错。

~/honeyd-1.5c$ sudo ./honeyd -V
./honeyd: error while loading shared libraries: libdnet.1: cannot open shared object file: No such file or directory

解决办法：

~$ sudo ln -s /usr/local/lib/libdnet.1 /usr/lib/libdnet.1

重新测试Honeyd

//安装成功！！
~/honeyd-1.5c$ sudo ./honeyd -V
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
Honeyd Version 1.5c

参考链接

十分感谢以下链接所提供的帮助，学到很多知识。

1. http://www.voidcn.com/article/p-fdysufqp-bry.html
2. http://www.voidcn.com/article/p-gzlkcwbx-ek.html
3. https://blog.51cto.com/297020555/538183
4. https://stackoverflow.com/questions/27267110/couldnt-figure-out-how-to-access-libc-on-installing-honeyd
5. https://blog.youkuaiyun.com/xumesang/article/details/51452974
6. https://www.imooc.com/article/266491
7. http://netsecurity.51cto.com/art/201101/242209_all.htm