root/honeyclient/tags/exp/UP2-kindlund-filesystem/etc/honeyclient.xml

<?xml version="1.0" encoding="utf-8"?>
<!--
#######################################################################
HoneyClient Configuration File

This configuration file is used by the HoneyClient perl modules in
order to specify and use the following global configuration options.

For information about the syntax of this file format, please type
"perldoc XML::Simple".

CVS: $Id$

#######################################################################

Syntax Notes:

Note: During processing, if the HoneyClient expects a module-specific
variable to be present within this configuration file (e.g., "address")
but it is not listed or commented out, then the code will attempt
to look for the same variable within any of the module's parents.

For example, the code may expect:
<HoneyClient>
    <Agent>
        <Driver>
            <address>localhost</address>
        </Driver>
    </Agent>
</HoneyClient>

But the following will work as well:
<HoneyClient>
    <Agent>
        <address>localhost</address>
    </Agent>
</HoneyClient>

<HoneyClient>
    <address>localhost</address>
</HoneyClient>

Keep in mind, though, that some variables should remain module-specific
(i.e., "port") in order to avoid collisions between modules.

-->
<HoneyClient>
    <!-- Global Options -->
    <!-- Note: This timeout should be long enough so that the Agent watchdog code will properly let the integrity checking code finish, before detecting a faulty timeout in processing. -->
    <timeout description="Default timeout used for all communications between each module (in seconds)." default="900">
        3600
    </timeout>
    <log_config description="The global Log4perl configuration file, used throughout all modules.  This setting should not need to be changed." default="etc/honeyclient_log.conf">
        etc/honeyclient_log.conf
    </log_config>
    <!-- HoneyClient::Agent Options -->
    <Agent>
        <!-- TODO: Update this. -->
        <address description="The IP or hostname that all Agent modules should use, when accepting SOAP requests." default="0.0.0.0">
            0.0.0.0
        </address>
        <!-- TODO: Update this. -->
        <!-- Note: This port should be unique and not already in use by other modules, services, or daemons running inside the VM. -->
        <port description="The TCP port number that the SOAP server for all Agent modules will listen on for requests." default="9000">
            9000
        </port>
        <!-- HoneyClient::Agent::Driver Options -->
        <Driver>
            <!-- TODO: Update this. -->
            <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60">
                10 
            </timeout>
            <Browser>
                <!-- HoneyClient::Agent::Driver::IE Options -->
                <!-- TODO: Update this. -->
                <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">
                    1
                </ignore_links_timed_out>
                <!-- TODO: Update this. -->
                <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
                    iexplore.exe
                </process_name>
                <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website.  If negative, then the browser will exhaust all possible relative links found, before moving on.  This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
                    -1
                </max_relative_links_to_visit>
                <goodwords description="A comma-separated list of good words which will increase the score of links within a webpage." default="">
                    news,new,big,latest,main,update,sell,free,buy
                </goodwords>
                <badwords description="A comma-separated list of bad words which will decrease the score of links within a webpage." default="">
                    archive,privacy,legal,disclaim,about,contact,copyright,jobs,careers
                </badwords>
                <IE>
                    <!-- HoneyClient::Agent::Driver::IE Options -->
                    <!-- TODO: Update this. -->
                    <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">
                        1
                    </ignore_links_timed_out>
                    <!-- TODO: Update this. -->
                    <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">
                        iexplore.exe
                    </process_name>
                    <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website.  If negative, then the browser will exhaust all possible relative links found, before moving on.  This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
                        -1
                    </max_relative_links_to_visit>
                </IE>
                <FF>
                    <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website.  If negative, then the browser will exhaust all possible relative links found, before moving on.  This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">
                        5
                    </max_relative_links_to_visit>
                    <!-- http://gatekeeper-w.mitre.org:80 -->
                    <http_proxy description="Set to your HTTP Proxy if you have one, otherwise set to 'none'">
                        none
                    </http_proxy>
                    <ff_exec description="path to the firefox executable (default install path is C:\Program Files\Mozilla Firefox\firefox.exe)">
                        C:\Program Files\Mozilla Firefox\firefox.exe
                    </ff_exec>
                </FF>
            </Browser>
            <EmailClient>
            </EmailClient>
        </Driver>
        <perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1">
            1
        </perform_integrity_checks>
        <!-- HoneyClient::Agent::Integrity Options -->
        <Integrity>
            <!-- Files which are read in only. -->
            <!-- TODO: Update this. -->
            <file_checklist description="The file containing the list of files and directories to check during filesystem checking." default="none">
                etc/file_checklist.txt
            </file_checklist>
            <!-- TODO: Update this. -->
            <file_exclude description="The file containing the list of files or directories to exclude if found in subdirectories during filesystem checking." default="none">
                ../../../etc/file_exclude.txt
            </file_exclude>
            <!-- Files which are written out only. -->
            <!-- TODO: Update this. -->
            <clean_file description="File to store hashes for files selected during baseline process.">
                /tmp/cleanfile.txt
            </clean_file>
            <!-- TODO: Update this. -->
            <change_file description="File to write any found changes to.">
                /tmp/changes.txt
            </change_file>
            <!-- Files to read and write. -->
            <!-- TODO: Update this. -->
            <test_dir description="If you're testing integrity checks, this is the directory that you can specify to minimize testing time. Only the files in this directory will be part of the integrity check.">
                ../t/testintegrity
            </test_dir>
            <Registry>
                <!-- HoneyClient::Agent::Integrity::Registry::Test Options -->
                <Test>
                    <!--
                        Note: you should *never* need to change *any* values
                        within this section of the configuration.  All contents
                        are *only* used for unit testing.
                    -->
                    <before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg">
                        t/test_registry/before.reg
                    </before_registry_file>
                    <after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg">
                        t/test_registry/after.reg
                    </after_registry_file>
                </Test>
                <Parser>
                    <!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options -->
                    <Test>
                        <!--
                            Note: you should *never* need to change *any* values
                            within this section of the configuration.  All contents
                            are *only* used for unit testing.
                        -->
                        <registry_file description="The relative path to a sample registry dump, that's used during unit testing." default="t/test_registry/dump.reg">
                            t/test_registry/dump.reg
                        </registry_file>
                    </Test>
                </Parser>
            </Registry>
        </Integrity>
    </Agent>
    <Manager>
        <!-- TODO: Update this. -->
        <manager_state description="Upon termination, the Manager will attempt to save a complete copy of its state into this file, if specified." default="">
            Manager.dump
        </manager_state>
        <!-- TODO: Update this. -->
        <address description="The IP or hostname that all Manager modules should use, when accepting SOAP requests." default="localhost">
            localhost
        </address>
        <!-- TODO: Update this. -->
        <!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. -->
        <port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089">
            8089
        </port>
        <vmnet_nat_router_address description="The IP address assigned to the VMware NAT interface (usually called vmnet8)." default="192.168.0.1">
            192.168.0.1
        </vmnet_nat_router_address>
        <!-- TODO: Update this. -->
        <conffile description="Logging options that can be applied to specify the layout of the logging messages.">
            etc/honeyclient_log.conf
        </conffile>
        <!-- HoneyClient::Manager::FW Options -->
        <FW>
            <!-- TODO: Update this. -->
            <address description="eth0 interface static IP">
                192.168.0.128
            </address>
            <!-- TODO: Update this. -->
            <port description="Default FW port number" default="8083">
                8083
            </port>
            <!-- TODO: Update this. -->
            <primaryDns description="Primary DNS IP Address">
                128.29.154.150
            </primaryDns>
            <!-- TODO: Update this. -->
            <secondaryDns description="Secondary DNS IP address">
                128.29.40.1
            </secondaryDns>
            <!-- TODO: Update this. -->
            <gsx_gateway description="IP address of GSX or VMware Server">
                10.0.0.1/32
            </gsx_gateway>
            <!-- TODO: Update this. -->
            <fwGateway description="Gateway IP address of the Firewall">
                10.0.0.254/32
            </fwGateway>
            <!-- TODO: Update this. -->
            <honeyclientnet description="CIDR notation for honeyclient netblock">
                10.0.0.0/24
            </honeyclientnet>
            <!-- TODO: Update this. -->
            <fwconfig description="Location of Firewall VM configuration file">
                /vm/honeywall-test/honeywall.vmx
            </fwconfig>
            <!-- TODO: Update this. -->
            <outputdir description="Output directory where logs will go on Firewall">
                fw-output
            </outputdir>
            <!-- TODO: Update this. -->
            <argus description="Argus binary location">
                /usr/local/sbin/argus
            </argus>
            <!-- TODO: Update this. -->
            <argusconfig description="Argus configuration file.">
                /etc/argus.conf
            </argusconfig>
            <!-- TODO: Update this. -->
            <argusoutput description="Argus logging directory">
                /var/log/argus
            </argusoutput>
            <!-- TODO: Update this. -->
            <arguspid description="Argus Process ID">
                /var/run/argus.pid
            </arguspid>
            <!-- TODO: Update this. -->
            <tcpdumplog description="Tcpdump log location directory">
                /var/log/tcpdump
            </tcpdumplog>
            <!-- TODO: Update this. -->
            <tcpdump description="Tcpdump binary">
                /usr/sbin/tcpdump
            </tcpdump>
            <!-- TODO: Update this. -->
            <dnspath description="DNS nameserver file">
                /etc/resolv.conf
            </dnspath>
            <!-- TODO: Update this. -->
            <dnsport description="DNS port number">
                53
            </dnsport>
            <!-- TODO: Update this. -->
            <LOCALHOST description="localhost address">
                127.0.0.1
            </LOCALHOST>
            <!-- TODO: Update this. -->
            <sshport description="SSH port number listening on">
                22
            </sshport>
            <!-- TODO: Update this. -->
            <debug description="Debug value (0 for no debugging, 1 for debugging output)">
                0
            </debug>
            <!-- TODO: Update this. -->
            <fwprocess description="Name of external SOAP listener.">
                startFWListener.pl 
            </fwprocess>
            <!-- TODO: Update this. -->
            <config_file description="Location of config_file">
                etc/honeyclient_log.conf
            </config_file>
        </FW>
        <!-- HoneyClient::Manager::DB Options -->
        <DB>
            <!-- TODO: Update this. -->
            <address description="eth0 interface static IP">
                192.168.0.128
            </address>
            <!-- TODO: Update this. -->
            <port description="Default FW port number" default="8083">
                8089
            </port>
        </DB>
        <!-- HoneyClient::Manager::VM Options -->
        <VM>
            <!-- TODO: Update this. -->
            <!-- Note: This port should be unique and not already in use by other modules, services, or daemons running on the host system. -->
            <port description="The TCP port number that the SOAP server for all Manager modules will listen on for requests." default="8089">
                8089
            </port>
            <!-- TODO: Update this. -->
            <datastore_path description="The absolute path to the parent directory, where all HoneyClient VM data is stored on the host server.  It is assumed that individual VM data is stored in separate subdirectories within this parent directory." default="/vm">
                /vm
            </datastore_path>
            <!-- TODO: Update this. -->
            <snapshot_path description="The absolute path to the directory that contains all snapshot data, associated with every HoneyClient VM." default="/vm/snapshots">
                /vm/snapshots
            </snapshot_path>
            <!-- TODO: Update this. -->
            <vmware_port description="The TCP port that VMware Server / GSX uses for console communication.  By default, this TCP port is 902.  Unless you've explicitly changes this port during the vmware-config.pl setup process, leave this setting as the default." default="902">
                902
            </vmware_port>
            <!-- TODO: Update this. -->
            <bin_tar description="The absolute path to the 'tar' executable, accessible on the host filesystem." default="/bin/tar">
                /bin/tar
            </bin_tar>
            <!-- TODO: Update this. -->
            <vm_id_length description="The length of each corresponding VM identifier (VMID).  This value can be any integer between 1 and 32, inclusive.  The VMID is a hexadecimal string that represents the VM's name.  It is designed to be generated once per clone and remain for the life of the VM (regardless of where it runs).  The VMID is used externally by HoneyClient::Manager and HoneyClient::Manager::FW.  The HoneyClient::Manager::FW package uses IPTables and binds each rule to a specific VMID.  However, IPTable's firewall rule labels can only be a maximum of 30 characters in length.  Thus, 26 is specified here, to account for 'VMID-OUT' as a possible chain name." default="26">
                26
            </vm_id_length>
            <!-- TODO: Update this. -->
            <dhcp_log description="The absolute path to the file that contains the DHCP logs, when a new VM gets a DHCP lease from the VMware Server / GSX server." default="/var/log/messages">
                /var/log/messages
            </dhcp_log>
            <!-- HoneyClient::Manager::VM::Test Options -->
            <Test>
                <!--
                    Note: you should *never* need to change *any* values
                    within this section of the configuration.  All contents
                    are *only* used for unit testing.
                -->
                <test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/testVM/winXPPro.vmx">
                    t/testVM/winXPPro.vmx
                </test_vm_config>
            </Test>
        </VM>
    </Manager>
    <!-- HoneyClient::Util Options -->
    <Util>
        <!-- HoneyClient::Util::Config Options -->
        <Config>
            <!-- HoneyClient::Util::Config::Test Options -->
            <Test>
                <!--
                    Note: you should *never* need to change *any* values
                    within this section of the configuration.  All contents
                    are *only* used for unit testing.
                -->
                <address description="The IP or hostname that this module should use, when performing unit tests." default="localhost" zing="foobar">localhost</address>
                <zingers>foobar</zingers>
                <Foo>
                    <Bar>
                        <address>baz</address>
                    </Bar>
                </Foo>
                <Yok>
                    <childA>12345678</childA>
                    <childA>ABCDEFGH</childA>
                    <childB>09876543</childB>
                    <childB>ZYXVTUWG</childB>
                </Yok>
            </Test>
        </Config>
    </Util>
</HoneyClient>