Package: honeycheck
HoneyCheck - Detect Rogue DHCP Servers in your networkHoneycheck detects rogue DHCP servers and provides a modular and fully
configurable action environment in case they are found.Doc IndexSystem requirementsHoneycheck installatonConfiguring honeycheckRunning honeycheckExtending honeycheckDonations and SponsorshipsSystem requirementsapt-getinstall-ypython3virtualenvbridge-utilstcpdumpHoneycheck InstallationpipinstallhoneycheckConfiguring HoneycheckHoneycheck requires a configuration file as a parameter.The interfaces on which it will work must be indicated in the configuration
file.For each interface, you must define which control module will be executed when
a maliciousfail_testserver is detected or when it apparently stops being
detected pass_test.Control objects are highly customizable pieces of software. Each module
receives parameters that must be configured.The control objecthoneycheck.modules.script.Scriptallows the execution of
scripts and receives the script to execute as a parameter.Depending on the check, the parameter will be prefixed withfail_test,pass_testorfinal_exec.fail_test will be executed if a rogue DHCP server is detectedpass_test will be executed if a rogue DHCP seems to be removed from the networkpass_test can through false_negatives if the rogue_dhcp response are not detected
in a period of time.final_exec will be executed after each checkThe configuration file must be created before running honeycheck.Configuration sampleNote that honeycheck can work in multiple network interfaces at the same time.[wlp0s20f3] # Configuration for wlp0s20f3 network interface# Less than 30 seconds can give flapping false negativesdiscover_timeout=30# test syntax: module.ControlClassfail_test=honeycheck.modules.script.Scriptfail_test_script_path=scripts/zenity_fail.shpass_test=honeycheck.modules.script.Scriptpass_test_script_path=scripts/zenity_pass.shpass_test=honeycheck.modules.script.Scriptpass_test_script_path=/my/custom/script[eth0]discover_timeout=30fail_test=honeycheck.modules.script.Scriptfail_test_script_path=scripts/zenity_fail.shRunning HoneycheckOnce Honeycheck is configured it can be started runningpython3 -m honeycheck -c our_conf_file.cnfExtending HoneycheckYou can create your own modules to configure the behavior of honeycheck.To do this all you have to do is inherit from the BaseControl abstract class located inhoneycheck.modules.base_control.Example of a Custom Control Objectfromhoneycheck.modules.base_controlimportBaseControl,ControlConfigurationReqclassMyCustomControlObject(BaseControl):defapply_actions(self,dhcp_watcher,**kwargs):servers=dhcp_watcher.dhcp_serverswhitelist=dhcp_watcher.whitelist# Retrieve a param value from configurationscript_path=self._conf.get_req("script_path")# Do your stuff here...# Send an email, open an issue, publish a message to rabbitmq. whatever# you want.defget_conf_req(self)->ControlConfigurationReq:# Return a ControlConfigurationReq object with the required# configuration this control object needsreturnControlConfigurationReq(["script_path"])Once you have created your custom control object you will need to add it to
your system as a python package.After this you will be able to select it in the honeycheck configuration.fail_test = mycustom_module.MyCustomControlObjectDonations and SponsorshipsDonations from people/companiesIf this tool is useful to you, please consider making a donation to support my
work.Donations allow me to continue developing open source software to contribute
and grow our community.I wish some day I could focus only on creating quality open source with a
strong community
supporting my projects.You support me onhttps://ko-fi.com/elchicodepython.SponsorshipsIf your company uses this tool and would like it to have a specific feature,
your company can sponsor its development.To sponsor the development of a featurecontact
me.Product integration advertisingIf you want the integration of this tool with your solution to appear in this
Readme,contact me.