MITM Configurations

[Patiience]

sudo forever -l /home/student/personalLogs/"personalContainer$date.log" -a start /home/student/MITM/mitm.js -n $2 -i $personalContainerIP -p 6901 --auto-access --auto-access-fixed 1 --debug --mitm-ip $hostIP

Run the above command, or something similar to run MITM in the background.

• Double check port forwarding is configured to allow for SSH traffic to go through MITM port.
• Create multiple instances based on the honeypot configuration
• Configure file paths based on the honeypot configuration
• And kill the MITM instance when deleting the container, in order to allow for new logging, in the next randomization

[Patiience]

Updated Code:

sudo forever -l ~/$DIRECTORY_NAME/"$CONTAINER_NAME.log -> $(date)" -a start --uid "mitm_id_$CONTAINER_NAME" ~/MITM/mitm.js -n $CONTAINER_NAME -i $CONTAINER_IP -p $MITM_PORT --auto-access --auto-access-fixed 1 --debug --mitm-ip $HOST_IP

sudo forever stop "mitm_id_$CONTAINER_NAME"

Note: sudo forever stop is using the --uid option to stop the forever process

Some more to consider:

• Need to determine the actual values for all the variables, particularly $DIRECTORY_NAME, as that will stay consistent based on the honeypot configuration
• What should our auto-access number be?
• Do we need the --mitm-ip option, could be unnecessary
• For the --uid option, we can either use CONTAINER_NAME or just the EXTERNAL_IP address
• MOST IMPORTANTLY, remember to copy the above code for each honeypot configuration, and configure as needed

Possible code needed for Deployment (Installing ACES MITM Server):

git clone https://github.com/UMD-ACES/MITM
cd ./MITM
sudo ./install.sh

Where MITM is installed needs to match the path for the 'start' argument in the sudo forever command.

Make sure containers have open-ssh server installed.

For installation of forever:

• sudo npm install -g forever

[Patiience]

Wiki Page: https://github.com/UMD-ACES/MITM/wiki/Running-in-the-Background

[AaronGorbaty]

Daniel the goat no Kizzy cap