search

shiva-spampot / shiva

Spam Honeypot with Intelligent Virtual Analyzer
MIT License
132 stars 37 forks source link

Shiva is not starting for me #21

Closed bmfmancini closed 7 years ago

bmfmancini commented 8 years ago

Hello I am having some issues with starting shiva

I have run the install script without issues and created the db also without issues however when launching the virtual env i am receiving some python errors

I am running a clean install of debian 8

see below

(shivaReceiver)root@shiva:/home/sean/shiva-installer/shiva/shivaReceiver/receiver# lamson start (shivaReceiver)root@shiva:/home/sean/shiva-installer/shiva/shivaReceiver/receiver# cd logs/ (shivaReceiver)root@shiva:/home/sean/shiva-installer/shiva/shivaReceiver/receiver/logs# head lamson.log 2016-10-15 09:07:29,268 - root - ERROR - Traceback (most recent call last): File "/home/sean/shiva-installer/shiva/shivaReceiver/local/lib/python2.7/site-packages/lamson/smtpd.py", line 397, in init self.bind(localaddr) File "/usr/lib/python2.7/asyncore.py", line 342, in bind return self.socket.bind(addr) File "/usr/lib/python2.7/socket.py", line 224, in meth return getattr(self._sock,name)(*args) error: [Errno 99] Cannot assign requested address

I am thinking the socket error must be an issue in shiva.conf but I dont see anything wrong here is my conf

[global]

Path for Receiver to dump mails and Analyzer to retrieve spams from

queuepath : /home/sean/shiva-installer/shiva/queue/

[receiver]

Host to listen on for incoming spams. It could be NATed or Public IP

listenhost : 192.168.1.172

Port for running SMTP receiver (integer value only)

listenport : 25

Name of the sensor

sensorname : shiva

Boolean value to enable/disable SMTP Authentication. (True/False)

authenabled : False

Username(s) for SMTP AUTH. Combination of user1:pass1, user2:pass2 .... userN:passN would work

e.g. smtpuser : user1,user2,user3,userN (no space, just comma separated)

smtpuser : user,admin,root

Password(s) for SMTP AUTH

e.g. smtppasswd : pass1,pass2,pass3,passN (no space, just comma separated)

smtppasswd : password,123,admin

[analyzer]

Enable/disable relaying of spams. Beware! Do not disable relaying and do not relay too much

relay : True

Number of times an individual spam is to be relayed (integer)

individualcounter : 30

Number of total spams to be relayed in a specific time (integer value only)

globalcounter : 120

The port on which exim is listening (integer value only)

relayport : 2500

Host on which exim is listening

relayhost : 127.0.0.1

Path where distorted spam(s), which could not be analyzed, would be dumped

undeliverable_path : /home/sean/shiva-installer/shiva/distorted/

Duration (in minutes) to be passed to shivascheduler (integer value only)

schedulertime : 120

Path where raw spam samples would be dumped

rawspampath : /home/sean/shiva-installer/shiva/rawspams/

Path to dump attachments

attachpath : /home/sean/shiva-installer/shiva/attachments/

Path to dump inline attachments

inlinepath : /home/sean/shiva-installer/shiva/attachments/inlines/

[database]

Store data in local databases (True/False)

localdb : True

MySQL host to connect

host : 127.0.0.1

MySQL username

user : uname

MySQL password

password : pwd

[hpfeeds]

Boolean value to enable/disable hpfeeds (True/False)

enabled : True

Hpfeeds host

host : hpfriends.honeycloud.net

Hpfeeds port (integer value only)

port : 20000

Ident for hpfeeds

ident : wN7TesWe

Secret key for hpfeeds

secret : 8koAbA4P0PMhnW9Q

Path where raw spam samples published on hpfeeds would be dumped

hpfeedspam : /home/sean/shiva-installer/shiva/rawspams/hpfeedspam/

Path where attachments published on hpfeeds would be dumped

hpfeedattach : /home/sean/shiva-installer/shiva/attachments/hpfeedattach/

[notification]

Boolean value to enable/disable notification email to developer/maintainer (True/False)

enabled : True

sender email-id (any mail-id shall work; even the bogus ones)

sender : my.spamp0t@anydomain.com

recipient email-id (suggested to be of developer / maintainer)

recipient : b0nd.g4h@gmail.com

b0nd commented 8 years ago

Hi,

Try changing port to 2525 and run again (listenport : 25)

Cheers!

On Sun, Oct 16, 2016 at 2:27 AM, bmfmancini notifications@github.com wrote:

Hello I am having some issues with starting shiva

I have run the install script without issues and created the db also without issues however when launching the virtual env i am receiving some python errors

I am running a clean install of debian 8

see below

(shivaReceiver)root@shiva:/home/sean/shiva-installer/shiva/shivaReceiver/receiver# lamson start (shivaReceiver)root@shiva:/home/sean/shiva-installer/shiva/shivaReceiver/receiver# cd logs/ (shivaReceiver)root@shiva:/home/sean/shiva-installer/ shiva/shivaReceiver/receiver/logs# head lamson.log 2016-10-15 09:07:29,268 - root - ERROR - Traceback (most recent call last): File "/home/sean/shiva-installer/shiva/shivaReceiver/local/lib/ python2.7/site-packages/lamson/smtpd.py", line 397, in init self.bind(localaddr) File "/usr/lib/python2.7/asyncore.py", line 342, in bind return self.socket.bind(addr) File "/usr/lib/python2.7/socket.py", line 224, in meth return getattr(self._sock,name)(*args) error: [Errno 99] Cannot assign requested address

I am thinking the socket error must be an issue in shiva.conf but I dont see anything wrong here is my conf

[global] Path for Receiver to dump mails and Analyzer to retrieve spams from

queuepath : /home/sean/shiva-installer/shiva/queue/

[receiver] Host to listen on for incoming spams. It could be NATed or Public IP

listenhost : 192.168.1.172 Port for running SMTP receiver (integer value only)

listenport : 25 Name of the sensor

sensorname : shiva Boolean value to enable/disable SMTP Authentication. (True/False)

authenabled : False Username(s) for SMTP AUTH. Combination of user1:pass1, user2:pass2 .... userN:passN would work e.g. smtpuser : user1,user2,user3,userN (no space, just comma separated)

smtpuser : user,admin,root Password(s) for SMTP AUTH e.g. smtppasswd : pass1,pass2,pass3,passN (no space, just comma separated)

smtppasswd : password,123,admin

[analyzer] Enable/disable relaying of spams. Beware! Do not disable relaying and do not relay too much

relay : True Number of times an individual spam is to be relayed (integer)

individualcounter : 30 Number of total spams to be relayed in a specific time (integer value only)

globalcounter : 120 The port on which exim is listening (integer value only)

relayport : 2500 Host on which exim is listening

relayhost : 127.0.0.1 Path where distorted spam(s), which could not be analyzed, would be dumped

undeliverable_path : /home/sean/shiva-installer/shiva/distorted/ Duration (in minutes) to be passed to shivascheduler (integer value only)

schedulertime : 120 Path where raw spam samples would be dumped

rawspampath : /home/sean/shiva-installer/shiva/rawspams/ Path to dump attachments

attachpath : /home/sean/shiva-installer/shiva/attachments/ Path to dump inline attachments

inlinepath : /home/sean/shiva-installer/shiva/attachments/inlines/

[database] Store data in local databases (True/False)

localdb : True MySQL host to connect

host : 127.0.0.1 MySQL username

user : uname MySQL password

password : pwd

[hpfeeds] Boolean value to enable/disable hpfeeds (True/False)

enabled : True Hpfeeds host

host : hpfriends.honeycloud.net Hpfeeds port (integer value only)

port : 20000 Ident for hpfeeds

ident : wN7TesWe Secret key for hpfeeds

secret : 8koAbA4P0PMhnW9Q Path where raw spam samples published on hpfeeds would be dumped

hpfeedspam : /home/sean/shiva-installer/shiva/rawspams/hpfeedspam/ Path where attachments published on hpfeeds would be dumped

hpfeedattach : /home/sean/shiva-installer/shiva/attachments/hpfeedattach/

[notification] Boolean value to enable/disable notification email to developer/maintainer (True/False)

enabled : True sender email-id (any mail-id shall work; even the bogus ones)

sender : my.spamp0t@anydomain.com recipient email-id (suggested to be of developer / maintainer)

recipient : b0nd.g4h@gmail.com

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/shiva-spampot/shiva/issues/21, or mute the thread https://github.com/notifications/unsubscribe-auth/AD-hlV_9kvH8DX-7WYGunbo_8-XvTxTbks5q0NTVgaJpZM4KXtOH .

Sumit Sharma Info Security Researcher

agaglia commented 7 years ago

Hi. I have the same problem. I've changed the port number, the ip, but anything chance. Any idea? Thanks

b0nd commented 7 years ago

Hi,

Please dump latest logs from log file (shivaReceiver/receiver/logs# head lamson.log )

Cheers!

On Mon, Jan 23, 2017 at 7:57 PM, agaglia notifications@github.com wrote:

Hi. I have the same problem. I've changed the port number, the ip, but anything chance. Any idea? Thanks

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/shiva-spampot/shiva/issues/21#issuecomment-274501226, or mute the thread https://github.com/notifications/unsubscribe-auth/AD-hlcJE_rfi6gr9_sI42nmL4ul1IpiPks5rVLjBgaJpZM4KXtOH .

-- Sumit Sharma Info Security Researcher

agaglia commented 7 years ago

Hi. I solved. I deleted the smtp.pid in the "run/" path in the analyzer and in the receiver virtualenv and it's started. With "ps -el | grep -i lamson" I have two pid locked as manual says. Cheers!!!