What is a honeypot?
A honeypot is a security resource who’s value lies in being probed, attacked, or compromised. Unlike firewalls or IDS sensors, honeypots are something you want the bad guys to interact with. To learn more about what honeypots are all about, you may want to start with the paper Honeypots: Definitions and Values. You can also learn about all the different OpenSource and Commercial honeypots at Honeypot Solutions.
A Honeypot is a hardened host that masquerades as a vulnerable host for the purposes of observing crackers, and learning how they operate. The Honeypot host should be inviting enough to attract an attacker, but not so inviting as to arouse suspicion, and should extensively log attacker activities. Be sure you know what you’re doing before getting into this. Compromised boxes are most often used to launch attacks against other boxes. If you don’t configure your system to be difficult to launch an attack from, and keep it under constant surveillance, you could very well end up contributing to the problem. A Honeypot is a serious project, and should be treated as such.
