Changeset 1182

Show
Ignore:
Timestamp:
02/04/08 16:09:48 (7 months ago)
Author:
xkovah
Message:

more appropriate defaults for the config + removed some firewall and integrity check cruft options

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeyclient/branches/exp/xkovah-simpler_install/etc/honeyclient.xml

    r1106 r1182  
    5252    </timeout> 
    5353    <log_config description="The global Log4perl configuration file, used throughout all modules.  This setting should not need to be changed." default="etc/honeyclient_log.conf"> 
    54         etc/honeyclient_log.conf 
     54        /etc/honeyclient_log.conf 
    5555    </log_config> 
    5656    <syslog_address description="The IP address of the syslog server that all logging messages will be sent to by both Agent and Manager processes over UDP port 514." default="10.0.0.1"> 
    …… 
    160160                /tmp/realtime-changes.txt 
    161161            </realtime_changes_file> 
    162             <!-- HoneyClient::Agent::Integrity::Filesystem Options --> 
    163             <Filesystem> 
    164                 <directories_to_check description="List of base directories on the filesystem to recursively analyze.  Use a regular slash (/) instead of a backslash (\) as a directory separator character."> 
    165                     <name>C:/</name> 
    166                 </directories_to_check> 
    167                 <exclude_list description="List of regular expressions that match files/directories to exclude from analysis.  These entries match files/directories that change normally during the course of driving the target application.  As such, they are excluded from analysis in order to reduce false positives.  Use a regular slash (/) instead of a backslash (\) as a directory separator character.  Never prefix any entry with a carat (^) before the drive letter, such as '^C:/', and never add the regex suffix ($) to the end of an expression, such as 'C:/Temp$'.  All comparisons are case-insensitive."> 
    168                     <regex>C:/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader.*</regex> 
    169                     <regex>C:/Documents and Settings/Administrator/Application Data/Mozilla/Firefox/Profiles.*</regex> 
    170                     <regex>C:/Documents and Settings/Administrator/Cookies.*</regex> 
    171                     <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Macromedia/Flash Player.*</regex> 
    172                     <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Microsoft/Windows Media.*</regex> 
    173                     <regex>C:/Documents and Settings/Administrator/Local Settings/Application Data/Mozilla/Firefox/Profiles.*</regex> 
    174                     <regex>C:/Documents and Settings/Administrator/Local Settings/History/History.IE5.*</regex> 
    175                     <regex>C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5.*</regex> 
    176                     <regex>C:/Documents and Settings/Administrator/Local Settings/Temp</regex> 
    177                     <regex>C:/Documents and Settings/Administrator/Recent.*</regex> 
    178                     <regex>C:/Documents and Settings/Administrator/ntuser.dat.LOG</regex> 
    179                     <regex>C:/Program Files/Mozilla Firefox/active-update.xml</regex> 
    180                     <regex>C:/Program Files/Mozilla Firefox/updates</regex> 
    181                     <regex>C:/WINDOWS/PCHEALTH/HELPCTR/DataColl.*</regex> 
    182                     <regex>C:/WINDOWS/Prefetch.*</regex> 
    183                     <regex>C:/WINDOWS/Debug/UserMode/userenv.log</regex> 
    184                     <regex>C:/WINDOWS/SchedLgU.txt</regex> 
    185                     <regex>C:/WINDOWS/SoftwareDistribution/DataStore.*</regex> 
    186                     <regex>C:/WINDOWS/SoftwareDistribution/ReportingEvents.log</regex> 
    187                     <regex>C:/WINDOWS/SoftwareDistribution/WuRedir.*</regex> 
    188                     <regex>C:/WINDOWS/SYSTEM32</regex> 
    189                     <regex>C:/WINDOWS/SYSTEM32/config/SecEvent.evt</regex> 
    190                     <regex>C:/WINDOWS/SYSTEM32/config/SysEvent.evt</regex> 
    191                     <regex>C:/WINDOWS/SYSTEM32/config/software</regex> 
    192                     <regex>C:/WINDOWS/SYSTEM32/config/software.log</regex> 
    193                     <regex>C:/WINDOWS/SYSTEM32/config/system.LOG</regex> 
    194                     <regex>C:/WINDOWS/SYSTEM32/Macromed/Flash.*</regex> 
    195                     <regex>C:/WINDOWS/SYSTEM32/perfc009.dat</regex> 
    196                     <regex>C:/WINDOWS/SYSTEM32/perfd009.dat</regex> 
    197                     <regex>C:/WINDOWS/SYSTEM32/perfh009.dat</regex> 
    198                     <regex>C:/WINDOWS/SYSTEM32/perfi009.dat</regex> 
    199                     <regex>C:/WINDOWS/SYSTEM32/PerfStringBackup.INI</regex> 
    200                     <regex>C:/WINDOWS/SYSTEM32/wbem.*</regex> 
    201                     <regex>C:/WINDOWS/WindowsUpdate.log</regex> 
    202                     <regex>C:/WINDOWS/wmsetup.log</regex> 
    203                     <!-- To exclude entries inside cygwin, use the following format. --> 
    204                     <regex>/cygdrive/c/cygwin/tmp.*</regex> 
    205                     <regex>/cygdrive/c/cygwin/home/Administrator/honeyclient.*</regex> 
    206                 </exclude_list> 
    207                 <!-- HoneyClient::Agent::Integrity::Filesystem::Test Options --> 
    208                 <Test> 
    209                     <!-- 
    210                         Note: you should *never* need to change *any* values 
    211                         within this section of the configuration.  All contents 
    212                         are *only* used for unit testing. 
    213                     --> 
    214                     <monitor_dir description="The relative path to the test directory, that's used during unit testing." default="t/test_filesystem"> 
    215                         t/test_filesystem 
    216                     </monitor_dir> 
    217                 </Test> 
    218             </Filesystem> 
    219             <!-- HoneyClient::Agent::Integrity::Registry Options --> 
    220             <Registry> 
    221                 <hives_to_check description="List of registry hives to analyze."> 
    222                     <name>HKEY_LOCAL_MACHINE</name> 
    223                     <name>HKEY_CLASSES_ROOT</name> 
    224                     <name>HKEY_CURRENT_USER</name> 
    225                     <name>HKEY_USERS</name> 
    226                     <name>HKEY_CURRENT_CONFIG</name> 
    227                 </hives_to_check> 
    228                 <exclude_list description="List of perl regular expressions, each matching one or more registry key directory names to exclude from analysis.  These entries match registry key directories that change normally during the course of driving the target application.  As such, they are excluded from analysis in order to reduce false positives.  As in normal regular expressions, each backslash (\) must be escaped (\\) and each regex must not end with any backslash character."> 
    229                     <regex>^HKEY_CURRENT_USER\\SessionInformation.*$</regex> 
    230                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex> 
    231                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 
    232                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International$</regex> 
    233                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex> 
    234                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main$</regex> 
    235                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
    236                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
    237                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\MediaPlayer.*$</regex> 
    238                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Multimedia.*$</regex> 
    239                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
    240                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
    241                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2.*$</regex> 
    242                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex> 
    243                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex> 
    244                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex> 
    245                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex> 
    246                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex> 
    247                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex> 
    248                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex> 
    249                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex> 
    250                     <regex>^HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Media\\WMSDK\\General.*$</regex> 
    251                     <regex>^HKEY_CURRENT_USER\\Volatile Environment$</regex> 
    252                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia$</regex> 
    253                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Macromedia\\FlashPlayer$</regex> 
    254                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\RNG$</regex> 
    255                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Dfrg\\BootOptimizeFunction$</regex> 
    256                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Direct3D\\MostRecentApplication$</regex> 
    257                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PCHealth\\PchSvc$</regex> 
    258                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\.*$</regex> 
    259                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM.*$</regex> 
    260                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\BITS$</regex> 
    261                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine\\Extension-List\\.*$</regex> 
    262                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\S.+\\Extension-List\\.*$</regex> 
    263                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\.*$</regex> 
    264                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update.*$</regex> 
    265                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Prefetcher$</regex> 
    266                     <regex>^HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\WgaLogon\\Settings$</regex> 
    267                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\.+\\Parameters\\Tcpip.*$</regex> 
    268                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Dhcp\\Parameters.*$</regex> 
    269                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Eventlog\\Application\\ESENT.*$</regex> 
    270                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\SharedAccess\\Epoch.*$</regex> 
    271                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet.+\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex> 
    272                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dhcp\\Parameters.*$</regex> 
    273                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\Application\\ESENT.*$</regex> 
    274                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Epoch$</regex> 
    275                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\.*$</regex> 
    276                     <regex>^HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.+\\Parameters\\Tcpip.*$</regex> 
    277                     <regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\.+\\Count.*$</regex> 
    278                     <regex>^HKEY_USERS\\.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\BagMRU.*$</regex> 
    279                     <regex>^HKEY_USERS\\.+\\UNICODE Program Groups.*$</regex> 
    280                     <regex>^HKEY_USERS\\S.+\\SessionInformation$</regex> 
    281                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\ActiveMovie\\devenum.*$</regex> 
    282                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\IntelliForms$</regex> 
    283                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International$</regex> 
    284                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\International\\CpMRU$</regex> 
    285                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Main$</regex> 
    286                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing.*$</regex> 
    287                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Internet Explorer\\TypedURLs$</regex> 
    288                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\MediaPlayer.*$</regex> 
    289                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Multimedia.*$</regex> 
    290                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\Links.*$</regex> 
    291                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Start Menu2\\Programs.*$</regex> 
    292                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2.*$</regex> 
    293                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU.*$</regex> 
    294                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Ext\\Stats\\.*$</regex> 
    295                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections.*$</regex> 
    296                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.*$</regex> 
    297                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\DUIBags\\ShellFolders\\.*$</regex> 
    298                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache.*$</regex> 
    299                     <regex>^HKEY_USERS\\S.+\\Software\\Microsoft\\Windows Media\\WMSDK\\General.*$</regex> 
    300                 </exclude_list> 
    301                 <!-- HoneyClient::Agent::Integrity::Registry::Test Options --> 
    302                 <Test> 
    303                     <!-- 
    304                         Note: you should *never* need to change *any* values 
    305                         within this section of the configuration.  All contents 
    306                         are *only* used for unit testing. 
    307                     --> 
    308                     <before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg"> 
    309                         t/test_registry/before.reg 
    310                     </before_registry_file> 
    311                     <after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg"> 
    312                         t/test_registry/after.reg 
    313                     </after_registry_file> 
    314                 </Test> 
    315                 <Parser> 
    316                     <!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options --> 
    317                     <Test> 
    318                         <!-- 
    319                             Note: you should *never* need to change *any* values 
    320                             within this section of the configuration.  All contents 
    321                             are *only* used for unit testing. 
    322                         --> 
    323                         <registry_file description="The relative path to a sample registry dump, that's used during unit testing." default="t/test_registry/dump.reg"> 
    324                             t/test_registry/dump.reg 
    325                         </registry_file> 
    326                     </Test> 
    327                 </Parser> 
    328             </Registry> 
    329162        </Integrity> 
    330163    </Agent> 
    …… 
    372205        <!-- TODO: Update this. --> 
    373206        <conffile description="Logging options that can be applied to specify the layout of the logging messages."> 
    374             etc/honeyclient_log.conf 
     207            /etc/honeyclient_log.conf 
    375208        </conffile> 
    376209        <max_agent_error_count description="When the Agent is running, this value is the maximum number of SOAP communication errors the Manager will ignore (e.g., timeouts) before the Manager suspends the corresponding VM and clones a new Agent.  These errors mainly occur when the Manager loses connectivity to the Agent for some reason (i.e., software/OS crashing inside the VM).  Otherwise, the Manager would loop forever trying to reconnect with the faulty VM.  This value should never be set to 0 and should always be positive." default="3"> 
    …… 
    409242            <!-- TODO: Update this. --> 
    410243            <fwconfig description="Location of Firewall VM configuration file"> 
    411                 /vm/honeywall-test/honeywall.vmx 
     244                /vm/firewall-3/honeywall.vmx 
    412245            </fwconfig> 
    413246            <!-- TODO: Update this. --> 
    …… 
    416249            </outputdir> 
    417250            <!-- TODO: Update this. --> 
    418             <argus description="Argus binary location"> 
    419                 /usr/local/sbin/argus 
    420             </argus> 
    421             <!-- TODO: Update this. --> 
    422             <argusconfig description="Argus configuration file."> 
    423                 /etc/argus.conf 
    424             </argusconfig> 
    425             <!-- TODO: Update this. --> 
    426             <argusoutput description="Argus logging directory"> 
    427                 /var/log/argus 
    428             </argusoutput> 
    429             <!-- TODO: Update this. --> 
    430             <arguspid description="Argus Process ID"> 
    431                 /var/run/argus.pid 
    432             </arguspid> 
    433             <!-- TODO: Update this. --> 
    434             <tcpdumplog description="Tcpdump log location directory"> 
    435                 /var/log/tcpdump 
    436             </tcpdumplog> 
    437             <!-- TODO: Update this. --> 
    438             <tcpdump description="Tcpdump binary"> 
    439                 /usr/sbin/tcpdump 
    440             </tcpdump> 
    441             <!-- TODO: Update this. --> 
    442251            <dnspath description="DNS nameserver file"> 
    443252                /etc/resolv.conf 
    …… 
    465274            <!-- TODO: Update this. --> 
    466275            <config_file description="Location of config_file"> 
    467                 etc/honeyclient_log.conf 
     276                /etc/honeyclient_log.conf 
    468277            </config_file> 
    469278        </FW> 
    …… 
    471280        <VM> 
    472281            <master_vm_config description="The full absolute path to the VM configuration file on the host system that will be used by all subsequent cloned VMs."> 
    473                 /vm/master-vms/Agent.Master-28/winXPPro.cfg 
     282                /vm/master/master.vmx 
    474283            </master_vm_config> 
    475284            <port description="The TCP port number that the SOAP server of the VM daemon will listen on for requests.  Note: This port should be unique and not already be used by other modules, services, or daemons running on the host system." default="8089">