So im making a research honeypot. The host is ubuntu 14.04. I want to store all of the logs from the honeypot ssh to the ubuntu host so the data is not lost. Does anyone know anything about this?

I researched and google mostly said to modify the rsyslog.conf file but how do i do that? and on which machine? Do i make the alterations on the honeypot rsyslog or the host's rsyslog??

Thank you so much


You can find the rsyslog.conf under the following path: /etc/rsyslog.conf

You can simply edit it with vi! At the moment I'm not sure what you want to do with the data! So if you want to forward the data to another Server then you have to edit the configuration of the client and the host! (You need a listener and a sender)...

If you need more help then I recommend you to join the Mailinglist of rsyslog: http://lists.adiscon.net/mailman/listinfo/rsyslog

Best regards, Tim Eifler

| improve this answer | |

On the honeypot, you would modify the rsyslog.conf to forward messages (all of them or just the ones that match a pattern) to the host.

The host needs to be running a syslog server (ie: listener) like syslog-ng or any of the myriad of options out there.

On the host's syslog configuration file, you will want to also write an action to take all the incoming messages from the honeypot (you can filter by IP address, hostname, etc) and write them to a separate file (possibly on a separate drive, cause it's going to add up fast).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.