honeyclient.xml

Revision 510, 31.7 kB (checked in by kindlund, 2 years ago)
Minor config cleanup.
Property svn:keywords set to `Id "$file"`

Line
1	<?xml version="1.0" encoding="utf-8"?>
2	<!--
3	#######################################################################
4	HoneyClient Configuration File
5
6	This configuration file is used by the HoneyClient perl modules in
7	order to specify and use the following global configuration options.
8
9	For information about the syntax of this file format, please type
10	"perldoc XML::Simple".
11
12	CVS: $Id$
13
14	#######################################################################
15
16	Syntax Notes:
17
18	Note: During processing, if the HoneyClient expects a module-specific
19	variable to be present within this configuration file (e.g., "address")
20	but it is not listed or commented out, then the code will attempt
21	to look for the same variable within any of the module's parents.
22
23	For example, the code may expect:
24	<HoneyClient>
25	<Agent>
26	<Driver>
27	<address>localhost</address>
28	</Driver>
29	</Agent>
30	</HoneyClient>
31
32	But the following will work as well:
33	<HoneyClient>
34	<Agent>
35	<address>localhost</address>
36	</Agent>
37	</HoneyClient>
38
39	<HoneyClient>
40	<address>localhost</address>
41	</HoneyClient>
42
43	Keep in mind, though, that some variables should remain module-specific
44	(i.e., "port") in order to avoid collisions between modules.
45
46	-->
47	<HoneyClient>
48	<!-- Global Options -->
49	<!-- Note: This timeout should be long enough so that the Agent watchdog code will properly let the integrity checking code finish, before detecting a faulty timeout in processing. -->
50	<timeout description="Default timeout used for all communications between each module (in seconds)." default="900">
51	3600
52	</timeout>
53	<log_config description="The global Log4perl configuration file, used throughout all modules. This setting should not need to be changed." default="etc/honeyclient_log.conf">
54	etc/honeyclient_log.conf
55	</log_config>
56	<syslog_address description="The IP address of the syslog server that all logging messages will be sent to by both Agent and Manager processes over UDP port 514." default="10.0.0.1">
57	10.0.0.1
58	</syslog_address>
59	<!-- HoneyClient::Agent Options -->
60	<Agent>
61	<!-- TODO: Update this. -->
62	<address description="The IP or hostname that all Agent modules should use, when accepting SOAP requests." default="0.0.0.0">
63	0.0.0.0
64	</address>
65	<!-- TODO: Update this. -->
66	<!-- Note: This port should be unique and not already in use by other modules, services, or daemons running inside the VM. -->
67	<port description="The TCP port number that the SOAP server for all Agent modules will listen on for requests." default="9000">
68	9000
69	</port>
70	<!-- HoneyClient::Agent::Driver Options -->
71	<Driver>
72	<!-- TODO: Update this. -->
73	<timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60">
74	20
75	</timeout>
76	<Browser>
77	<!-- HoneyClient::Agent::Driver::IE Options -->
78	<!-- TODO: Update this. -->
79	<ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">
80	1
81	</ignore_links_timed_out>
82	<!-- TODO: Update this. -->
83	<process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
84	iexplore.exe
85	</process_name>
86	<max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
87	-1
88	</max_relative_links_to_visit>
89	<goodwords description="A comma-separated list of good words which will increase the score of links within a webpage." default="">
90	news,new,big,latest,main,update,sell,free,buy
91	</goodwords>
92	<badwords description="A comma-separated list of bad words which will decrease the score of links within a webpage." default="">
93	archive,privacy,legal,disclaim,about,contact,copyright,jobs,careers
94	</badwords>
95	<IE>
96	<!-- HoneyClient::Agent::Driver::IE Options -->
97	<!-- TODO: Update this. -->
98	<ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">
99	1
100	</ignore_links_timed_out>
101	<!-- TODO: Update this. -->
102	<process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
103	iexplore.exe
104	</process_name>
105	<max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
106	-1
107	</max_relative_links_to_visit>
108	</IE>
109	<FF>
110	<max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
111	5
112	</max_relative_links_to_visit>
113	<!-- http://gatekeeper-w.mitre.org:80 -->
114	<http_proxy description="Set to your HTTP Proxy if you have one, otherwise set to 'none'">
115	none
116	</http_proxy>
117	<ff_exec description="path to the firefox executable (default install path is C:\Program Files\Mozilla Firefox\firefox.exe)">
118	C:\Program Files\Mozilla Firefox\firefox.exe
119	</ff_exec>
120	</FF>
121	</Browser>
122	<EmailClient>
123	</EmailClient>
124	</Driver>
125	<perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1">
126	1
127	</perform_integrity_checks>
128	<!-- HoneyClient::Agent::Integrity Options -->
129	<Integrity>
130	<changes_found_file description="When an integrity check fails, all changes will be written to this file within the compromized honeyclient VM's filesystem." default="/tmp/changes.txt">
131	/tmp/changes.txt
132	</changes_found_file>
133	<!-- HoneyClient::Agent::Integrity::Filesystem Options -->
134	<Filesystem>
135	<directories_to_check description="List of base directories on the filesystem to recursively analyze. Use a regular slash (/) instead of a backslash (\) as a directory separator character.">
136	<name>C:/</name>
137	</directories_to_check>
138	<exclude_list description="List of regular expressions that match files/directories to exclude from analysis. These entries match files/directories that change normally during the course of driving the target application. As such, they are excluded from analysis in order to reduce false positives. Use a regular slash (/) instead of a backslash (\) as a directory separator character. Never prefix any entry with a carat (^) before the drive letter, such as '^C:/', and never add the regex suffix ($) to the end of an expression, such as 'C:/Temp$'. All comparisons are case-insensitive.">
139	<regex>C:/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader.*</regex>
140	<regex>C:/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles.*</regex>
141	<regex>C:/Documents and Settings/Administrator/Cookies.*</regex>
142	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Macromedia/Flash Player.*</regex>
143	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Microsoft/Windows Media.*</regex>
144	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex>
145	<regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex>
146	<regex>C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5.*</regex>
147	<regex>C:/Documents and Settings/Administrator/Local Settings/Temp</regex>
148	<regex>C:/Documents and Settings/Administrator/Recent.*</regex>
149	<regex>C:/Documents and Settings/Administrator/ntuser.dat.LOG</regex>
150	<regex>C:/Program Files/Mozilla Firefox/active-update.xml</regex>
151	<regex>C:/Program Files/Mozilla Firefox/updates</regex>
152	<regex>C:/WINDOWS/PCHEALTH/HELPCTR/DataColl.*</regex>
153	<regex>C:/WINDOWS/Prefetch.*</regex>
154	<regex>C:/WINDOWS/Debug/UserMode/userenv.log</regex>
155	<regex>C:/WINDOWS/SchedLgU.txt</regex>
156	<regex>C:/WINDOWS/SoftwareDistribution/DataStore.*</regex>
157	<regex>C:/WINDOWS/SoftwareDistribution/ReportingEvents.log</regex>
158	<regex>C:/WINDOWS/SoftwareDistribution/WuRedir.*</regex>
159	<regex>C:/WINDOWS/SYSTEM32</regex>
160	<regex>C:/WINDOWS/SYSTEM32/config/SecEvent.evt</regex>
161	<regex>C:/WINDOWS/SYSTEM32/config/SysEvent.evt</regex>
162	<regex>C:/WINDOWS/SYSTEM32/config/software</regex>
163	<regex>C:/WINDOWS/SYSTEM32/config/software.log</regex>
164	<regex>C:/WINDOWS/SYSTEM32/config/system.LOG</regex>
165	<regex>C:/WINDOWS/SYSTEM32/Macromed/Flash.*</regex>
166	<regex>C:/WINDOWS/SYSTEM32/perfc009.dat</regex>
167	<regex>C:/WINDOWS/SYSTEM32/perfd009.dat</regex>
168	<regex>C:/WINDOWS/SYSTEM32/perfh009.dat</regex>
169	<regex>C:/WINDOWS/SYSTEM32/perfi009.dat</regex>
170	<regex>C:/WINDOWS/SYSTEM32/PerfStringBackup.INI</regex>
171	<regex>C:/WINDOWS/SYSTEM32/wbem.*</regex>
172	<regex>C:/WINDOWS/WindowsUpdate.log</regex>
173	<!-- To exclude entries inside cygwin, use the following format. -->
174	<regex>/cygdrive/c/cygwin/tmp.*</regex>
175	<regex>/cygdrive/c/cygwin/home/Administrator/honeyclient.*</regex>
176	</exclude_list>
177	<!-- HoneyClient::Agent::Integrity::Filesystem::Test Options -->
178	<Test>
179	<!--
180	Note: you should never need to change any values
181	within this section of the configuration. All contents
182	are only used for unit testing.
183	-->
184	<monitor_dir description="The relative path to the test directory, that's used during unit testing." default="t/test_filesystem">
185	t/test_filesystem
186	</monitor_dir>
187	</Test>
188	</Filesystem>
189	<!-- HoneyClient::Agent::Integrity::Registry Options -->
190	<Registry>
191	<hives_to_check description="List of registry hives to analyze.">
192	<name>HKEY_LOCAL_MACHINE</name>
193	<name>HKEY_CLASSES_ROOT</name>
194	<name>HKEY_CURRENT_USER</name>
195	<name>HKEY_USERS</name>
196	<name>HKEY_CURRENT_CONFIG</name>
197	</hives_to_check>
198	<exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis. These entries match registry key directories that change normally during the course of driving the target application. As such, they are excluded from analysis in order to reduce false positives. As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character.">
199	<regex>^HKEY_CURRENT_USER\\SessionInformation.*$</regex>
200	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex>
201	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex>
202	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International$</regex>
203	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex>
204	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main$</regex>
205	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex>
206	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex>
207	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\MediaPlayer.*$</regex>
208	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia.*$</regex>
209	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex>
210	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex>
211	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume.*$</regex>
212	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex>
213	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex>
214	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex>
215	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex>
216	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex>
217	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex>
218	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex>
219	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex>
220	<regex>^HKEY_CURRENT_USER\\Volatile Environment$</regex>
221	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia$</regex>
222	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia\\FlashPlayer$</regex>
223	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\RNG$</regex>
224	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\PchSvc$</regex>
225	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\.*$</regex>
226	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM.*$</regex>
227	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\BITS$</regex>
228	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine\\Extension-List\\.*$</regex>
229	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\S.+\\Extension-List\\.*$</regex>
230	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\.*$</regex>
231	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update.*$</regex>
232	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Prefetcher$</regex>
233	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\WgaLogon\\Settings$</regex>
234	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\.+\\Parameters\\Tcpip.*$</regex>
235	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Dhcp\\Parameters.*$</regex>
236	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Eventlog\\Application\\ESENT.*$</regex>
237	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\SharedAccess\\Epoch.*$</regex>
238	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex>
239	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Parameters.*$</regex>
240	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Application\\ESENT.*$</regex>
241	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Epoch$</regex>
242	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex>
243	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.+\\Parameters\\Tcpip.*$</regex>
244	<regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex>
245	<regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex>
246	<regex>^HKEY_USERS\\.+\\UNICODE Program Groups.*$</regex>
247	<regex>^HKEY_USERS\\S.+\\SessionInformation$</regex>
248	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex>
249	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex>
250	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International$</regex>
251	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex>
252	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Main$</regex>
253	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex>
254	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex>
255	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer.*$</regex>
256	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Multimedia.*$</regex>
257	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex>
258	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex>
259	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume.*$</regex>
260	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex>
261	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex>
262	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex>
263	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex>
264	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex>
265	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex>
266	</exclude_list>
267	<!-- HoneyClient::Agent::Integrity::Registry::Test Options -->
268	<Test>
269	<!--
270	Note: you should never need to change any values
271	within this section of the configuration. All contents
272	are only used for unit testing.
273	-->
274	<before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg">
275	t/test_registry/before.reg
276	</before_registry_file>
277	<after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg">
278	t/test_registry/after.reg
279	</after_registry_file>
280	</Test>
281	<Parser>
282	<!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options -->
283	<Test>
284	<!--
285	Note: you should never need to change any values
286	within this section of the configuration. All contents
287	are only used for unit testing.
288	-->
289	<registry_file description="The relative path to a sample registry dump, that's used during unit testing." default="t/test_registry/dump.reg">
290	t/test_registry/dump.reg
291	</registry_file>
292	</Test>
293	</Parser>
294	</Registry>
295	</Integrity>
296	</Agent>
297	<!-- HoneyClient::DB Options -->
298	<DB>
299	<enable description="Enables database operations. 1 enables, 0 disables." default="0">
300	1
301	</enable>
302	<host description="The system providing the HoneyClient database. If the database is installed on the same host system as the Manager, then localhost should be used." default="127.0.0.1">
303	172.16.164.1
304	</host>
305	<dbname description="The name of the HoneyClient database." default="HoneyClient">
306	HoneyClient
307	</dbname>
308	<user description="The username to use, when connecting to the HoneyClient database.">
309	honeyclient_user
310	</user>
311	<pass description="The password to use, when connecting to the HoneyClient database.">
312	honeyclient_password
313	</pass>
314	<port description="The default TCP port number used to communicate with the database." default="3306">
315	3306
316	</port>
317	</DB>
318	<Manager>
319	<!-- TODO: Update this. -->
320	<manager_state description="Upon termination, the Manager will attempt to save a complete copy of its state into this file, if specified." default="">
321	Manager.dump
322	</manager_state>
323	<!-- TODO: Update this. -->
324	<address description="The IP or hostname that all Manager modules should use, when accepting SOAP requests." default="localhost">
325	localhost
326	</address>
327	<!-- TODO: Update this. -->
328	<!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. -->
329	<port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089">
330	8089
331	</port>
332	<vmnet_nat_router_address description="The IP address assigned to the VMware NAT interface (usually called vmnet8)." default="192.168.0.1">
333	192.168.0.1
334	</vmnet_nat_router_address>
335	<!-- TODO: Update this. -->
336	<conffile description="Logging options that can be applied to specify the layout of the logging messages.">
337	etc/honeyclient_log.conf
338	</conffile>
339	<!-- HoneyClient::Manager::FW Options -->
340	<FW>
341	<!-- TODO: Update this. -->
342	<address description="eth0 interface static IP">
343	192.168.0.128
344	</address>
345	<!-- TODO: Update this. -->
346	<port description="Default FW port number" default="8083">
347	8083
348	</port>
349	<!-- TODO: Update this. -->
350	<primaryDns description="Primary DNS IP Address">
351	128.29.154.150
352	</primaryDns>
353	<!-- TODO: Update this. -->
354	<secondaryDns description="Secondary DNS IP address">
355	128.29.40.1
356	</secondaryDns>
357	<!-- TODO: Update this. -->
358	<gsx_gateway description="IP address of GSX or VMware Server">
359	10.0.0.1/32
360	</gsx_gateway>
361	<!-- TODO: Update this. -->
362	<fwGateway description="Gateway IP address of the Firewall">
363	10.0.0.254/32
364	</fwGateway>
365	<!-- TODO: Update this. -->
366	<honeyclientnet description="CIDR notation for honeyclient netblock">
367	10.0.0.0/24
368	</honeyclientnet>
369	<!-- TODO: Update this. -->
370	<fwconfig description="Location of Firewall VM configuration file">
371	/vm/honeywall-test/honeywall.vmx
372	</fwconfig>
373	<!-- TODO: Update this. -->
374	<outputdir description="Output directory where logs will go on Firewall">
375	fw-output
376	</outputdir>
377	<!-- TODO: Update this. -->
378	<argus description="Argus binary location">
379	/usr/local/sbin/argus
380	</argus>
381	<!-- TODO: Update this. -->
382	<argusconfig description="Argus configuration file.">
383	/etc/argus.conf
384	</argusconfig>
385	<!-- TODO: Update this. -->
386	<argusoutput description="Argus logging directory">
387	/var/log/argus
388	</argusoutput>
389	<!-- TODO: Update this. -->
390	<arguspid description="Argus Process ID">
391	/var/run/argus.pid
392	</arguspid>
393	<!-- TODO: Update this. -->
394	<tcpdumplog description="Tcpdump log location directory">
395	/var/log/tcpdump
396	</tcpdumplog>
397	<!-- TODO: Update this. -->
398	<tcpdump description="Tcpdump binary">
399	/usr/sbin/tcpdump
400	</tcpdump>
401	<!-- TODO: Update this. -->
402	<dnspath description="DNS nameserver file">
403	/etc/resolv.conf
404	</dnspath>
405	<!-- TODO: Update this. -->
406	<dnsport description="DNS port number">
407	53
408	</dnsport>
409	<!-- TODO: Update this. -->
410	<LOCALHOST description="localhost address">
411	127.0.0.1
412	</LOCALHOST>
413	<!-- TODO: Update this. -->
414	<sshport description="SSH port number listening on">
415	22
416	</sshport>
417	<!-- TODO: Update this. -->
418	<debug description="Debug value (0 for no debugging, 1 for debugging output)">
419	0
420	</debug>
421	<!-- TODO: Update this. -->
422	<fwprocess description="Name of external SOAP listener.">
423	startFWListener.pl
424	</fwprocess>
425	<!-- TODO: Update this. -->
426	<config_file description="Location of config_file">
427	etc/honeyclient_log.conf
428	</config_file>
429	</FW>
430	<!-- HoneyClient::Manager::VM Options -->
431	<VM>
432	<!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. -->
433	<port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089">
434	8089
435	</port>
436	<datastore_path description="The absolute path to the parent directory, where all HoneyClient VM data is stored on the host server. It is assumed that individual VM data is stored in separate subdirectories within this parent directory." default="/vm">
437	/vm/clones
438	</datastore_path>
439	<snapshot_path description="The absolute path to the directory that contains all snapshot data, associated with every HoneyClient VM." default="/vm/snapshots">
440	/vm/snapshots
441	</snapshot_path>
442	<vmware_port description="The TCP port that VMware Server / GSX uses for console communication. By default, this TCP port is 902. Unless you've explicitly changes this port during the vmware-config.pl setup process, leave this setting as the default." default="902">
443	902
444	</vmware_port>
445	<bin_tar description="The absolute path to the 'tar' executable, accessible on the host filesystem." default="/bin/tar">
446	/bin/tar
447	</bin_tar>
448	<vm_id_length description="The length of each corresponding VM identifier (VMID). This value can be any integer between 1 and 32, inclusive. The VMID is a hexadecimal string that represents the VM's name. It is designed to be generated once per clone and remain for the life of the VM (regardless of where it runs). The VMID is used externally by HoneyClient::Manager and HoneyClient::Manager::FW. The HoneyClient::Manager::FW package uses IPTables and binds each rule to a specific VMID. However, IPTable's firewall rule labels can only be a maximum of 30 characters in length. Thus, 26 is specified here, to account for 'VMID-OUT' as a possible chain name." default="26">
449	26
450	</vm_id_length>
451	<dhcp_log description="The absolute path to the file that contains the DHCP logs, when a new VM gets a DHCP lease from the VMware Server / GSX server." default="/var/log/messages">
452	/var/log/messages
453	</dhcp_log>
454	<!-- HoneyClient::Manager::VM::Test Options -->
455	<Test>
456	<!--
457	Note: you should never need to change any values
458	within this section of the configuration. All contents
459	are only used for unit testing.
460	-->
461	<test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/test_vm/winXPPro.vmx">
462	t/test_vm/winXPPro.vmx
463	</test_vm_config>
464	</Test>
465	</VM>
466	</Manager>
467	<!-- HoneyClient::Util Options -->
468	<Util>
469	<!-- HoneyClient::Util::Config Options -->
470	<Config>
471	<!-- HoneyClient::Util::Config::Test Options -->
472	<Test>
473	<!--
474	Note: you should never need to change any values
475	within this section of the configuration. All contents
476	are only used for unit testing.
477	-->
478	<address description="The IP or hostname that this module should use, when performing unit tests." default="localhost" zing="foobar">localhost</address>
479	<zingers>foobar</zingers>
480	<Foo>
481	<Bar>
482	<address>baz</address>
483	</Bar>
484	</Foo>
485	<Yok>
486	<childA>12345678</childA>
487	<childA>ABCDEFGH</childA>
488	<childB>09876543</childB>
489	<childB>ZYXVTUWG</childB>
490	</Yok>
491	</Test>
492	</Config>
493	</Util>
494	</HoneyClient>

Note: See TracBrowser for help on using the browser.

root/honeyclient/tags/exp/DOWN1-mbriggs-db/etc/honeyclient.xml

Download in other formats: