sinkhole.conf.example

# Additional includes
# 
# Used to include additional configuration files.
# If executable is true the "name" is executed and
# STDOUT is captured to include in the configuration.

# Include an additional configuration file called logging.conf.
#include
#{
#	name = "logging.conf";
#	executable = false;
#}

# Include sinkhole.conf on ssh://config@mysite.tld
#include
#{
#	name = "/usr/bin/ssh config@mysite.tld cat sinkhole.conf";
#	executable = true;
#}

# General configuration
sinkhole
{
	# An optional directory to chroot to once the Sinkhole has started, after
	# the configuration has been loaded and all modules have been loaded.
	# If you do chroot, be wary of paths later on in the config.
	#chroot = "/home/adam/sh/";

	# An optional user to setuid to after the Sinkhole has started.
	# Useful for binding to privileged ports (httpd, ftpd, dns) but not run as root.
	#runuser = "sinkhole";

	# An optional group to setguid to after the Sinkhole has started.
	# Useful for binding to privileged ports (httpd, ftpd, dns) but not run as root.
	#rungroup = "sinkhole";
}

# Flatfile logging module.
#
# Uncomment to enable flatfile logging.
#module { name = "logging/flatfile.so"; }

# Flatfile configuration
# There may be multiple flatfile blocks.
flatfile
{
	# The name of this logging method, used to configure log blocks below
	name = "flatfile/main";

	# The destination logfile to log to.
	# This string is formatted with strftime, see man strftime
	directory = "%Y/%B/%d.log";

	# How long to keep logfiles before cleaning them, use 0 to keep all logs forever.
	keeplogs = 31;
}

# MQueue logging module.
#
# Uncomment to enable muqueue logging.
#module { name = "logging/mqueue.so"; }

# MQueue configuration (required if the MQueue logging module is loaded).
# Note that you may have multiple mqueue blocks.
mqueue
{
	# The name of this object, used to configure log blocks below
	name = "mqueue/main";
	# The path to the mqueue object
	path = "/sinkhole";
}

# MySQL logging module.
# 
# Uncomment to enable logging to MySQL.
#module { name = "logging/mysql.so"; }

# MySQL configuration (required if the MySQL logging module is loaded).
# Note that you may have multiple mysql blocks.
mysql
{
	# The name of this connection, used to configure log blocks below
	name = "mysql/main";
	# The address of the MySQL server
	server = "192.168.1.2";
	# The port of the MySQL server
	port = 3306;
	# Database to log to.
	database = "sinkhole";
	# Username
	username = "sinkhole";
	# Password
	password = "";
}

# Logging configuration.
log
{
	# The name of the log block, used later in the service blocks.
	name = "logging/main";
	# The names of the targets messages matching this log block should go to, seperated by spaces.
	targets = "flatfile/main mqueue/main mysql/main";

	# The targets for p0f to log.
	# Valid values are: CONNECT
	p0f = "*";

	# The targets for dns to log.
	# Valid values are: REQUEST RESOLVE
	dns = "*";

	# The targets for ftp to log.
	# Valid values are: AUTH AUTH_FAIL APPE DELE MKD RETR
	ftp = "*";

	# The targets for http to log.
	# Valid values are: REQUEST HOST TIMEOUT USERAGENT
	http = "*";

	# The targets from the irc protocol to log. Wildcards are accepted.
	# Valid values are: CONNECT QUIT JOIN PART PASS
	irc = "*";
}

# P0f support
#
# Uncomment to enable P0f. P0f requires pcap.h and the pcap development libraries.
#
# P0f is a passive OS fingerprinting tool that allows you to gather data,
# particularly operating system and version, of connecting clients.
#module { name = "logging/p0f.so"; }

# P0f block used to configured p0f. You may only have one p0f block.
p0f
{
	# Required for the log block
	name = "p0f";
	# The socket P0f is configured to listen on.
	# For this to work, P0f MUST be running and listening on the below socket for queries!
	# To do this, run sudo ./p0f -Q /var/run/p0f.sock -u `whoami`
	socket = "/var/run/p0f.sock";
	# Logging method for p0f to use
	log = "logging/main";
}

# DNS protocol module
#
# Uncomment to enable DNS protocol support.
#module { name = "protocol/dns.so"; }

# DNS resolver. The DNS module optionally allows you to resolve the IP addresses of
# clients connecting to any service provided by the sinkhole.
#
# Because the dns module is not a real nameserver you must give the IP of a nameserver
# to resolve connecting clients hosts with.
resolver
{
	# IP of a real nameserver
	nameserver = "8.8.8.8";
	# Port of the namserver
	port = 53;
	# Set to true if this is an IPv6 nameserver
	ipv6 = false;
	# How long to wait before DNS queries are considered timed out.
	timeout = 5;

	# Set to true to resolve the IPs of clients connecting to the sinkhole.
	resolve_clients = true;
}
# A server for the client resolver.
dns
{
	name = "dns/resolver";
	log = "logging/main";
}

# DNS configuration, represents a single DNS server.
# Note that you may have multiple dns blocks.
dns
{
	# The name of this server, used for logging purposes
	name = "dns/main";
	# Desired logging method (configured above)
	log = "logging/main";

	# Addresses to listen on, multiple listen blocks are allowed.
	listen { addr = "192.168.1.2"; port = 53; ipv6 = false; }

	# Represents a class of users
	# Connections that do not match any classes will be immediatly terminated.
	class
	{
		# The IP of the users allowed to use this block, multiple source blocks are allowed.
		source { addr = "127.0.0.0/8"; }

		# A DNS zone we should return replies for.
		zone
		{
			name = "example.com";

			# The SOA record. One must exist for each zone.
			soa
			{
				mname = "example.com";
				rname = "admin.example.com";
				serial = 2010070100;
				refresh = 86000;
				retry = 7200;
				expire = 3600000;
				minimum = 600;
			}

			# A DNS record. Remember to append "." to the end of any
			# absolute names. "@" is short for the name of this zone.
			# A ttl field is also allowed, if ommited defaults to the
			# SOA's ttl record.
			#
			# Valid class types are: A, AAAA, CNAME, PTR, and NS.
			record { name = "@"; class = "A"; host = "127.0.0.1"; }
		}
	}
}

# FTP protocol module
#
# Uncomment to enable FTP protocol support.
#module { name = "protocol/ftp.so"; }

# FTP configuration, represents a single FTP server.
# Note that you may have multiple ftp blocks.
ftp
{
	# The name of this server, used for logging purposes
	name = "ftp/main";
	# The welcome banner to use
	banner = "Welcome.";
	# Desired logging method (configured above)
	log = "logging/main";

	# Addresses to listen on, multiple listen blocks are allowed.
	# Note that IPv6 isn't supported at this time.
	listen { addr = "192.168.1.2"; port = 21; }

	# Represents a class or group of users.
	# Connections that do not match any classes will be immediatly terminated.
	class
	{
		# The name of the class
		name = "all";
		# The IP of the users allowed to use this block, multiple source blocks are allowed.
		source { addr = "127.0.0.0/8"; }

		# Users allowed to login to the FTP server and their root directories
		# Omit password for any/no password, used for anonymous
		user { name = "adam"; password = "qwerty"; root = "/home/adam/"; access = "all"; }
		user { name = "anonymous"; root = "/home/anonymous"; access = "readonly"; }
	}

	# Access class for all commands.
	access
	{
		# Name of the class
		name = "all";
		# Space separated list of allowed commands, wildcards accepted.
		commands = "*";
	}

	# Access class that does not allow modifying the files on the server.
	access
	{
		# Name of the class
		name = "readonly";
		# Space separated list of allowed commands, wildcards accepted.
		# Note that ~ negates a command.
		commands = "~APPE ~DELE ~MKD ~RMD ~RNFR ~RNTO *";
	}
}

# HTTP protocol module
#
# Uncomment to enable HTTP protocol support.
#module { name = "protocol/http.so"; }

# HTTP configuration, represents a single HTTP server.
# Note that you may have multiple http blocks.
http
{
	# The name of this server, used for logging purposes
	name = "http/main";
	# How long before connections should be timed out
	timeout = 30;
	# Addresses to listen on, multiple listen blocks are allowed.
	listen { addr = "192.168.1.2"; port = 80; ipv6 = false; }
	# Desired logging method (configured above)
	log = "logging/main";
	
	# Represents a class or group of users.
	class
	{
		# The IP of the users allowed to use this block, multiple source blocks are allowed.
		source { addr = "127.0.0.0/8"; }
		# The action that should be taken by users matching this class.
		action = "403-deny";
	}

	# For the rest of the users.
	# Users that match no class at all (eg, if this block were removed) will
	# have their connection immediately terminated.
	class
	{
		source { addr = "0.0.0.0/0"; }
		action = "404-unknown";
	}

	# Represents an action which defines how the webserver replies to different users.
	action
	{
		# The name of the action, used in http:class blocks.
		name = "403-deny";
		# The server name and version to send replies from. It may be a good idea to pretend to be some other
		# HTTP software such as Apache.
		server-name = "honeynet-sinkhole/1.0";
		
		# Represents a vhost, which can allow multiple different sites to be under the same action block.
		# You may have multiple vhost blocks.
		vhost
		{
			# This vhost block is used for accessing example.com.
			# example.com will use these settings instead of the default below.
			name = "example.com";
			# The root for this domain. When a file is requested it is searched for in this directory.
			root = "/var/www/sinkhole/example.com/";
		}

		# The default action for this block is to serve the 403.html file.
		# It is also possible to use root here instead to specify a directory.
		serve = "403.html";
	}

	action
	{
		name = "404-unknown";
		server-name = "honeynet-sinkhole/1.0";
		serve = "404.html";
	}
}

# IRC protocol module
#
# Uncomment to enable IRC protocol support.
#module { name = "protocol/irc.so"; }

# IRC configuration, represents a single IRC server.
# Note that you may have multiple irc blocks.
irc
{
	# The name of this server, used for logging purposes.
	name = "irc/main";
	# The server name
	server-name = "irc.honeynet.org";
	# The network name
	network-name = "IRC";
	# The server description
	desc = "irc";
	# Addresses to listen on, multiple listen blocks are allowed.
	listen { addr = "192.168.1.2"; port = 6665; ipv6 = false; }
	# Desired logging method (configured above)
	log = "logging/main";
}