Re: [tlug] Honeypots

[Christopher SEKIYA <wileyc@example.com>]

> The author says "if you have an insecure system it will be compromised"

...

> My Redhat 6.2 server Honeypot was compromised

... and we are surprised why?

If one deploys a machine with a direct (i.e., non-port-filtered) connection to the
outside world without first locking it down, it _will_ be compromised.  Especially if
it is a RedHat box -- more rootkits for RH flavours than any other UNIX.

I'm not convinced of the utility of a honeypot.  Reminds me of a bit that Robin
Williams did at the Met: "it won't stop 'em, but it sure as hell will amuse them for
awhile".


-- Chris "just try finding a rootkit for NetBSD/vax" Sekiya