honeyclient.xml

Revision 698, 32.3 kB (checked in by kindlund, 1 year ago)
Cleaned up browser-specific configuration options.
Property svn:keywords set to `Id "$file"`

Line
1	<?xml version="1.0" encoding="utf-8"?>
2	<!--
3	#######################################################################
4	HoneyClient Configuration File
5
6	This configuration file is used by the HoneyClient perl modules in
7	order to specify and use the following global configuration options.
8
9	For information about the syntax of this file format, please type
10	"perldoc XML::Simple".
11
12	CVS: $Id$
13
14	#######################################################################
15
16	Syntax Notes:
17
18	Note: During processing, if the HoneyClient expects a module-specific
19	variable to be present within this configuration file (e.g., "address")
20	but it is not listed or commented out, then the code will attempt
21	to look for the same variable within any of the module's parents.
22
23	For example, the code may expect:
24	<HoneyClient>
25	<Agent>
26	<Driver>
27	<address>localhost</address>
28	</Driver>
29	</Agent>
30	</HoneyClient>
31
32	But the following will work as well:
33	<HoneyClient>
34	<Agent>
35	<address>localhost</address>
36	</Agent>
37	</HoneyClient>
38
39	<HoneyClient>
40	<address>localhost</address>
41	</HoneyClient>
42
43	Keep in mind, though, that some variables should remain module-specific
44	(i.e., "port") in order to avoid collisions between modules.
45
46	-->
47	<HoneyClient>
48	<!-- Global Options -->
49	<!-- Note: This timeout should be long enough so that the Agent watchdog code will properly let the integrity checking code finish, before detecting a faulty timeout in processing. -->
50	<timeout description="Default timeout used for all communications between each module (in seconds)." default="900">
51	3600
52	</timeout>
53	<log_config description="The global Log4perl configuration file, used throughout all modules. This setting should not need to be changed." default="etc/honeyclient_log.conf">
54	etc/honeyclient_log.conf
55	</log_config>
56	<syslog_address description="The IP address of the syslog server that all logging messages will be sent to by both Agent and Manager processes over UDP port 514." default="10.0.0.1">
57	10.0.0.1
58	</syslog_address>
59	<!-- HoneyClient::Agent Options -->
60	<Agent>
61	<!-- TODO: Update this. -->
62	<address description="The IP or hostname that all Agent modules should use, when accepting SOAP requests." default="0.0.0.0">
63	0.0.0.0
64	</address>
65	<!-- TODO: Update this. -->
66	<!-- Note: This port should be unique and not already in use by other modules, services, or daemons running inside the VM. -->
67	<port description="The TCP port number that the SOAP server for all Agent modules will listen on for requests." default="9000">
68	9000
69	</port>
70	<!-- HoneyClient::Agent::Driver Options -->
71	<Driver>
72	<!-- TODO: Update this. -->
73	<timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60">
74	20
75	</timeout>
76	<ActiveContent>
77	<enable description="Enables active content parsing. 1 enables, 0 disables." default="1">
78	1
79	</enable>
80	<Flash>
81	<flasm_exec description="Path to the flasm executable." default="thirdparty/flasm/flasm.exe">
82	thirdparty/flasm/flasm.exe
83	</flasm_exec>
84	</Flash>
85	</ActiveContent>
86	<Browser>
87	<!-- HoneyClient::Agent::Driver::IE Options -->
88	<!-- TODO: Update this. -->
89	<ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">
90	1
91	</ignore_links_timed_out>
92	<!-- TODO: Update this. -->
93	<process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
94	iexplore.exe
95	</process_name>
96	<max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
97	-1
98	</max_relative_links_to_visit>
99	<positive_words description="If a link contains any number of these words, then its probability of being visited (its score) will increase.">
100	<word>news</word>
101	<word>new</word>
102	<word>big</word>
103	<word>latest</word>
104	<word>main</word>
105	<word>update</word>
106	<word>sell</word>
107	<word>free</word>
108	<word>buy</word>
109	<word>science</word>
110	</positive_words>
111	<negative_words description="If a link contains any number of these words, then its probability of being visited (its score) will decrease.">
112	<word>archive</word>
113	<word>privacy</word>
114	<word>legal</word>
115	<word>disclaim</word>
116	<word>about</word>
117	<word>contact</word>
118	<word>copyright</word>
119	<word>jobs</word>
120	<word>careers</word>
121	</negative_words>
122	<IE>
123	<!-- HoneyClient::Agent::Driver::Browser::IE Options -->
124	<!-- TODO: Update this. -->
125	<process_exec description="The absolute path to the Internet Explorer application process, as it sits in the VM filesystem." default="C:\Program Files\Internet Explorer\iexplore.exe">
126	C:\Program Files\Internet Explorer\iexplore.exe
127	</process_exec>
128	</IE>
129	<FF>
130	<!-- HoneyClient::Agent::Driver::Browser::FF Options -->
131	<process_exec description="The absolute path to the Mozilla Firefox application process, as it sits in the VM filesystem." default="C:\Program Files\Mozilla Firefox\firefox.exe">
132	C:\Program Files\Mozilla Firefox\firefox.exe
133	</process_exec>
134	</FF>
135	</Browser>
136	<EmailClient>
137	</EmailClient>
138	</Driver>
139	<perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1">
140	1
141	</perform_integrity_checks>
142	<!-- HoneyClient::Agent::Integrity Options -->
143	<Integrity>
144	<changes_found_file description="When an integrity check fails, all changes will be written to this file within the compromized honeyclient VM's filesystem." default="/tmp/changes.txt">
145	/tmp/changes.txt
146	</changes_found_file>
147	<!-- HoneyClient::Agent::Integrity::Filesystem Options -->
148	<Filesystem>
149	<directories_to_check description="List of base directories on the filesystem to recursively analyze. Use a regular slash (/) instead of a backslash (\) as a directory separator character.">
150	<name>C:/</name>
151	</directories_to_check>
152	<exclude_list description="List of regular expressions that match files/directories to exclude from analysis. These entries match files/directories that change normally during the course of driving the target application. As such, they are excluded from analysis in order to reduce false positives. Use a regular slash (/) instead of a backslash (\) as a directory separator character. Never prefix any entry with a carat (^) before the drive letter, such as '^C:/', and never add the regex suffix ($) to the end of an expression, such as 'C:/Temp$'. All comparisons are case-insensitive.">
153	<regex>C:/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader.*</regex>
154	<regex>C:/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles.*</regex>
155	<regex>C:/Documents and Settings/Administrator/Cookies.*</regex>
156	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Macromedia/Flash Player.*</regex>
157	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Microsoft/Windows Media.*</regex>
158	<regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex>
159	<regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex>
160	<regex>C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5.*</regex>
161	<regex>C:/Documents and Settings/Administrator/Local Settings/Temp</regex>
162	<regex>C:/Documents and Settings/Administrator/Recent.*</regex>
163	<regex>C:/Documents and Settings/Administrator/ntuser.dat.LOG</regex>
164	<regex>C:/Program Files/Mozilla Firefox/active-update.xml</regex>
165	<regex>C:/Program Files/Mozilla Firefox/updates</regex>
166	<regex>C:/WINDOWS/PCHEALTH/HELPCTR/DataColl.*</regex>
167	<regex>C:/WINDOWS/Prefetch.*</regex>
168	<regex>C:/WINDOWS/Debug/UserMode/userenv.log</regex>
169	<regex>C:/WINDOWS/SchedLgU.txt</regex>
170	<regex>C:/WINDOWS/SoftwareDistribution/DataStore.*</regex>
171	<regex>C:/WINDOWS/SoftwareDistribution/ReportingEvents.log</regex>
172	<regex>C:/WINDOWS/SoftwareDistribution/WuRedir.*</regex>
173	<regex>C:/WINDOWS/SYSTEM32</regex>
174	<regex>C:/WINDOWS/SYSTEM32/config/SecEvent.evt</regex>
175	<regex>C:/WINDOWS/SYSTEM32/config/SysEvent.evt</regex>
176	<regex>C:/WINDOWS/SYSTEM32/config/software</regex>
177	<regex>C:/WINDOWS/SYSTEM32/config/software.log</regex>
178	<regex>C:/WINDOWS/SYSTEM32/config/system.LOG</regex>
179	<regex>C:/WINDOWS/SYSTEM32/Macromed/Flash.*</regex>
180	<regex>C:/WINDOWS/SYSTEM32/perfc009.dat</regex>
181	<regex>C:/WINDOWS/SYSTEM32/perfd009.dat</regex>
182	<regex>C:/WINDOWS/SYSTEM32/perfh009.dat</regex>
183	<regex>C:/WINDOWS/SYSTEM32/perfi009.dat</regex>
184	<regex>C:/WINDOWS/SYSTEM32/PerfStringBackup.INI</regex>
185	<regex>C:/WINDOWS/SYSTEM32/wbem.*</regex>
186	<regex>C:/WINDOWS/WindowsUpdate.log</regex>
187	<regex>C:/WINDOWS/wmsetup.log</regex>
188	<!-- To exclude entries inside cygwin, use the following format. -->
189	<regex>/cygdrive/c/cygwin/tmp.*</regex>
190	<regex>/cygdrive/c/cygwin/home/Administrator/honeyclient.*</regex>
191	</exclude_list>
192	<!-- HoneyClient::Agent::Integrity::Filesystem::Test Options -->
193	<Test>
194	<!--
195	Note: you should never need to change any values
196	within this section of the configuration. All contents
197	are only used for unit testing.
198	-->
199	<monitor_dir description="The relative path to the test directory, that's used during unit testing." default="t/test_filesystem">
200	t/test_filesystem
201	</monitor_dir>
202	</Test>
203	</Filesystem>
204	<!-- HoneyClient::Agent::Integrity::Registry Options -->
205	<Registry>
206	<hives_to_check description="List of registry hives to analyze.">
207	<name>HKEY_LOCAL_MACHINE</name>
208	<name>HKEY_CLASSES_ROOT</name>
209	<name>HKEY_CURRENT_USER</name>
210	<name>HKEY_USERS</name>
211	<name>HKEY_CURRENT_CONFIG</name>
212	</hives_to_check>
213	<exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis. These entries match registry key directories that change normally during the course of driving the target application. As such, they are excluded from analysis in order to reduce false positives. As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character.">
214	<regex>^HKEY_CURRENT_USER\\SessionInformation.*$</regex>
215	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex>
216	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex>
217	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International$</regex>
218	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex>
219	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main$</regex>
220	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex>
221	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex>
222	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\MediaPlayer.*$</regex>
223	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia.*$</regex>
224	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex>
225	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex>
226	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2.*$</regex>
227	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex>
228	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex>
229	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex>
230	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex>
231	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex>
232	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex>
233	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex>
234	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex>
235	<regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Media\\WMSDK\\General.*$</regex>
236	<regex>^HKEY_CURRENT_USER\\Volatile Environment$</regex>
237	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia$</regex>
238	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia\\FlashPlayer$</regex>
239	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\RNG$</regex>
240	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Dfrg\\BootOptimizeFunction$</regex>
241	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Direct3D\\MostRecentApplication$</regex>
242	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\PchSvc$</regex>
243	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\.*$</regex>
244	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM.*$</regex>
245	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\BITS$</regex>
246	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine\\Extension-List\\.*$</regex>
247	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\S.+\\Extension-List\\.*$</regex>
248	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\.*$</regex>
249	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update.*$</regex>
250	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Prefetcher$</regex>
251	<regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\WgaLogon\\Settings$</regex>
252	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\.+\\Parameters\\Tcpip.*$</regex>
253	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Dhcp\\Parameters.*$</regex>
254	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Eventlog\\Application\\ESENT.*$</regex>
255	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\SharedAccess\\Epoch.*$</regex>
256	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex>
257	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Parameters.*$</regex>
258	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Application\\ESENT.*$</regex>
259	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Epoch$</regex>
260	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex>
261	<regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.+\\Parameters\\Tcpip.*$</regex>
262	<regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex>
263	<regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex>
264	<regex>^HKEY_USERS\\.+\\UNICODE Program Groups.*$</regex>
265	<regex>^HKEY_USERS\\S.+\\SessionInformation$</regex>
266	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex>
267	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex>
268	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International$</regex>
269	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex>
270	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Main$</regex>
271	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex>
272	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex>
273	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer.*$</regex>
274	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Multimedia.*$</regex>
275	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex>
276	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex>
277	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2.*$</regex>
278	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex>
279	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex>
280	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex>
281	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex>
282	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex>
283	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex>
284	<regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows Media\\WMSDK\\General.*$</regex>
285	</exclude_list>
286	<!-- HoneyClient::Agent::Integrity::Registry::Test Options -->
287	<Test>
288	<!--
289	Note: you should never need to change any values
290	within this section of the configuration. All contents
291	are only used for unit testing.
292	-->
293	<before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg">
294	t/test_registry/before.reg
295	</before_registry_file>
296	<after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg">
297	t/test_registry/after.reg
298	</after_registry_file>
299	</Test>
300	<Parser>
301	<!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options -->
302	<Test>
303	<!--
304	Note: you should never need to change any values
305	within this section of the configuration. All contents
306	are only used for unit testing.
307	-->
308	<registry_file description="The relative path to a sample registry dump, that's used during unit testing." default="t/test_registry/dump.reg">
309	t/test_registry/dump.reg
310	</registry_file>
311	</Test>
312	</Parser>
313	</Registry>
314	</Integrity>
315	</Agent>
316	<!-- HoneyClient::DB Options -->
317	<DB>
318	<enable description="Enables database operations. 1 enables, 0 disables." default="0">
319	1
320	</enable>
321	<host description="The system providing the HoneyClient database. If the database is installed on the same host system as the Manager, then localhost should be used." default="127.0.0.1">
322	172.16.164.1
323	</host>
324	<dbname description="The name of the HoneyClient database." default="HoneyClient">
325	HoneyClient
326	</dbname>
327	<user description="The username to use, when connecting to the HoneyClient database.">
328	honeyclient_user
329	</user>
330	<pass description="The password to use, when connecting to the HoneyClient database.">
331	honeyclient_password
332	</pass>
333	<port description="The default TCP port number used to communicate with the database." default="3306">
334	3306
335	</port>
336	</DB>
337	<Manager>
338	<!-- TODO: Update this. -->
339	<manager_state description="Upon termination, the Manager will attempt to save a complete copy of its state into this file, if specified." default="">
340	Manager.dump
341	</manager_state>
342	<!-- TODO: Update this. -->
343	<address description="The IP or hostname that all Manager modules should use, when accepting SOAP requests." default="localhost">
344	localhost
345	</address>
346	<!-- TODO: Update this. -->
347	<!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. -->
348	<port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089">
349	8089
350	</port>
351	<vmnet_nat_router_address description="The IP address assigned to the VMware NAT interface (usually called vmnet8)." default="192.168.0.1">
352	192.168.0.1
353	</vmnet_nat_router_address>
354	<!-- TODO: Update this. -->
355	<conffile description="Logging options that can be applied to specify the layout of the logging messages.">
356	etc/honeyclient_log.conf
357	</conffile>
358	<!-- HoneyClient::Manager::FW Options -->
359	<FW>
360	<!-- TODO: Update this. -->
361	<address description="eth0 interface static IP">
362	192.168.0.128
363	</address>
364	<!-- TODO: Update this. -->
365	<port description="Default FW port number" default="8083">
366	8083
367	</port>
368	<!-- TODO: Update this. -->
369	<primaryDns description="Primary DNS IP Address">
370	128.29.154.150
371	</primaryDns>
372	<!-- TODO: Update this. -->
373	<secondaryDns description="Secondary DNS IP address">
374	128.29.40.1
375	</secondaryDns>
376	<!-- TODO: Update this. -->
377	<gsx_gateway description="IP address of GSX or VMware Server">
378	10.0.0.1/32
379	</gsx_gateway>
380	<!-- TODO: Update this. -->
381	<fwGateway description="Gateway IP address of the Firewall">
382	10.0.0.254/32
383	</fwGateway>
384	<!-- TODO: Update this. -->
385	<honeyclientnet description="CIDR notation for honeyclient netblock">
386	10.0.0.0/24
387	</honeyclientnet>
388	<!-- TODO: Update this. -->
389	<fwconfig description="Location of Firewall VM configuration file">
390	/vm/honeywall-test/honeywall.vmx
391	</fwconfig>
392	<!-- TODO: Update this. -->
393	<outputdir description="Output directory where logs will go on Firewall">
394	fw-output
395	</outputdir>
396	<!-- TODO: Update this. -->
397	<argus description="Argus binary location">
398	/usr/local/sbin/argus
399	</argus>
400	<!-- TODO: Update this. -->
401	<argusconfig description="Argus configuration file.">
402	/etc/argus.conf
403	</argusconfig>
404	<!-- TODO: Update this. -->
405	<argusoutput description="Argus logging directory">
406	/var/log/argus
407	</argusoutput>
408	<!-- TODO: Update this. -->
409	<arguspid description="Argus Process ID">
410	/var/run/argus.pid
411	</arguspid>
412	<!-- TODO: Update this. -->
413	<tcpdumplog description="Tcpdump log location directory">
414	/var/log/tcpdump
415	</tcpdumplog>
416	<!-- TODO: Update this. -->
417	<tcpdump description="Tcpdump binary">
418	/usr/sbin/tcpdump
419	</tcpdump>
420	<!-- TODO: Update this. -->
421	<dnspath description="DNS nameserver file">
422	/etc/resolv.conf
423	</dnspath>
424	<!-- TODO: Update this. -->
425	<dnsport description="DNS port number">
426	53
427	</dnsport>
428	<!-- TODO: Update this. -->
429	<LOCALHOST description="localhost address">
430	127.0.0.1
431	</LOCALHOST>
432	<!-- TODO: Update this. -->
433	<sshport description="SSH port number listening on">
434	22
435	</sshport>
436	<!-- TODO: Update this. -->
437	<debug description="Debug value (0 for no debugging, 1 for debugging output)">
438	0
439	</debug>
440	<!-- TODO: Update this. -->
441	<fwprocess description="Name of external SOAP listener.">
442	startFWListener.pl
443	</fwprocess>
444	<!-- TODO: Update this. -->
445	<config_file description="Location of config_file">
446	etc/honeyclient_log.conf
447	</config_file>
448	</FW>
449	<!-- HoneyClient::Manager::VM Options -->
450	<VM>
451	<master_vm_config description="The full absolute path to the VM configuration file on the host system that will be used by all subsequent cloned VMs.">
452	/vm/master-vms/Agent.Master-20/winXPPro.cfg
453	</master_vm_config>
454	<port description="The TCP port number that the SOAP server of the VM daemon will listen on for requests. Note: This port should be unique and not already be used by other modules, services, or daemons running on the host system." default="8089">
455	8089
456	</port>
457	<datastore_path description="The absolute path to the parent directory, where all HoneyClient VM data is stored on the host server. It is assumed that individual VM data is stored in separate subdirectories within this parent directory." default="/vm">
458	/vm/clones
459	</datastore_path>
460	<snapshot_path description="The absolute path to the directory that contains all snapshot data, associated with every HoneyClient VM." default="/vm/snapshots">
461	/vm/snapshots
462	</snapshot_path>
463	<vmware_port description="The TCP port that VMware Server / GSX uses for console communication. By default, this TCP port is 902. Unless you've explicitly changes this port during the vmware-config.pl setup process, leave this setting as the default." default="902">
464	902
465	</vmware_port>
466	<bin_tar description="The absolute path to the 'tar' executable, accessible on the host filesystem." default="/bin/tar">
467	/bin/tar
468	</bin_tar>
469	<vm_id_length description="The length of each corresponding VM identifier (VMID). This value can be any integer between 1 and 32, inclusive. The VMID is a hexadecimal string that represents the VM's name. It is designed to be generated once per clone and remain for the life of the VM (regardless of where it runs). The VMID is used externally by HoneyClient::Manager and HoneyClient::Manager::FW. The HoneyClient::Manager::FW package uses IPTables and binds each rule to a specific VMID. However, IPTable's firewall rule labels can only be a maximum of 30 characters in length. Thus, 26 is specified here, to account for 'VMID-OUT' as a possible chain name." default="26">
470	26
471	</vm_id_length>
472	<dhcp_log description="The absolute path to the file that contains the DHCP logs, when a new VM gets a DHCP lease from the VMware Server / GSX server." default="/var/log/messages">
473	/var/log/messages
474	</dhcp_log>
475	<!-- HoneyClient::Manager::VM::Test Options -->
476	<Test>
477	<!--
478	Note: you should never need to change any values
479	within this section of the configuration. All contents
480	are only used for unit testing.
481	-->
482	<test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/test_vm/winXPPro.vmx">
483	t/test_vm/winXPPro.vmx
484	</test_vm_config>
485	</Test>
486	</VM>
487	</Manager>
488	<!-- HoneyClient::Util Options -->
489	<Util>
490	<!-- HoneyClient::Util::Config Options -->
491	<Config>
492	<!-- HoneyClient::Util::Config::Test Options -->
493	<Test>
494	<!--
495	Note: you should never need to change any values
496	within this section of the configuration. All contents
497	are only used for unit testing.
498	-->
499	<address description="The IP or hostname that this module should use, when performing unit tests." default="localhost" zing="foobar">localhost</address>
500	<zingers>foobar</zingers>
501	<Foo>
502	<Bar>
503	<address>baz</address>
504	</Bar>
505	</Foo>
506	<Yok>
507	<childA>12345678</childA>
508	<childA>ABCDEFGH</childA>
509	<childB>09876543</childB>
510	<childB>ZYXVTUWG</childB>
511	</Yok>
512	</Test>
513	</Config>
514	</Util>
515	</HoneyClient>

Note: See TracBrowser for help on using the browser.

root/honeyclient/tags/exp/PRE-kindlund-test/etc/honeyclient.xml

Download in other formats: