My Live Test

MHN Dionaea ThreatMap

http://194.80.168.1:3000/

Set MHN for local rfc1918 addresses

#!/bin/bash

# LocalMHN to set MHN for rfc1918 private / local networks CEM 29/Oct/2014

cd /opt/mnemosyne/
git fetch origin
git stash
git merge origin/master
git stash pop

sed -i 's/ignore_rfc1918 = True/ignore_rfc1918 = False/g' mnemosyne.cfg

supervisorctl restart mnemosyne

supervisorctl status

====take two ===

#!/bin/bash

# LocalMHN to set MHN for rfc1918 private / local networks CEM 22/Sept/2014
# Also trap mac addresses in Dionaea for analysis

cd /opt/mnemosyne/
git fetch origin
git stash
git merge origin/master
git stash pop

sed -i 's/ignore_rfc1918 = True/ignore_rfc1918 = False/g' mnemosyne.cfg

sed -i 's/lookup_ethernet_addr = "no"/lookup_ethernet_addr = "yes"/g' /etc/dionaea/dionaea.conf


supervisorctl restart mnemosyne


sudo supervisorctl restart dionaea


supervisorctl status

Enable MHN Dionaea Sandbox submission

Regarding the sandbox submission, we don't have this enabled now. Do do so, you need to do a couple things.  

sudo gedit /etc/dionaea/dionaea.conf
.

1. find the line that looks like this (in the ihandlers section):
// "virustotal",
and uncomment it.

2. Find the section that looks like this:
virustotal = {
     apikey = "........." // grab it from your virustotal account at My account -> Inbox -> Public API
     file = "var/dionaea/vtcache.sqlite"
}
and fill in your API key.

2f226f10dfe3a6b2d==

f0102876b42070cd2==

7f86543ae28d79443==

bdd98eb539708

3 Save dionaea.conf and restart

sudo supervisorctl restart dionaea

--

Thanks 

Jason @ Threatstream

cd /opt/mhn

source env/bin/activate

sudo pip install --upgrade -r server/requirements.txt 

sudo supervisorctl status

MHN - Delete Old Records

You can delete the fake attacks from MHN by using the mongo DB command.  Here is how you would do it for IP 1.2.3.4:

mongo mnemosyne
> db.session.count({ source_ip:"1.2.3.4" })
> db.session.remove({ source_ip:"1.2.3.4" })

The first command will show you how many entries will be deleted.  The 2nd command will delete them.

Depending on the setup, mongo may store the results with "::ffff:" prepended to the IP. So you may need to do this too:

> db.session.count({ source_ip:"::ffff:1.2.3.4" })
> db.session.remove({ source_ip:"::ffff:1.2.3.4" })
To explore the "logs" you can also use mongo.  Here is an example:

> db.session.find({source_ip: "4.5.5.6"})

---
I had issues connecting mongo to mnemosyne

gedit /etc/mongod.conf

change to

bind_ip = 0.0.0.0 


Then

sudo rm /var/lib/mongodb/mongod.lock
sudo service mongodb restart

--

Thanks

Jason Trost from ThreatStream

http://stackoverflow.com/questions/24899849/connection-refused-to-mongodb-errno-111

Tweaking MHN

Edit

/opt/mhn/server/config.py

SERVER_BASE_URL = 'http://192.168.1.101'
HONEYMAP_URL = 'http://192.168.1.101:3000'





Restart
sudo supervisorctl restart mhn-uwsgi




--
Thanks

https://groups.google.com/forum/#!topic/modern-honey-network/8iFsMdHSHqE