Message Board

Installing Honey Pots

unable to contact server

Author: C.Rivas (27 Apr 06 12:15am)

Hi.
I get the subject message when I tried to install Honey Pots. I have a mini cPanel account at hostultra and was wondering if that might be what was causing the error. I has PHP 4.4.1 and uses Apache 1.3.34 (Unix) and FreeBSD operating system. I run geeklog on my site, so the PHP is working well and I'm not sure what the trouble is. Any help would be appreciated.
Thank you.

Re: unable to contact server

Author: M.Prince (1 May 06 6:30pm)

The most common reasaon for getting the "cannot contact the server" error is that out-bound connections HTTP are blocked from your machine. This is typical of free web hosts and we haven't found any good ways around it other than contacting the web host and begging them to open an outbound port.

The best test to see if out-bound connections are blocked on your server is to try running something that makes an out-bound HTTP connection like the Lynx command line web browser. If that fails then you might want to talk to whoever is providing your hosting and see if they can open out a route out.

Out-bound connections are necessary because your script has to contact the Project Honey Pot mothership in order to get a unique address to hand out to the spam harvesting spiders that visit it. Unfortunately, there's no real way to implement the scripts on your site without out-bound connections. We're working on a quick-n-easy installation process that will allow you to piggyback off other people's scripts, but that's probably still some time off before we have it online. When we do, we'll make an announcement on the site.

Good luck!
Matthew.

Re: unable to contact server

Author: E.Rasanen (26 Apr 07 2:49am)

Hi,

I'm having same problem with my installed honeypot. I'm an admin of our network and I know that I haven't allowed our servers to open outgoing http sessions to anywhere exept to those IP's I have allowed.

To solve this issue, could you provide a list of IP's where this script tries to open connections? I would be happy to open these addresses in our firewalls, but opening outgoing http to whole world is definite no-no-no-not-in-this-life thing for me.

We are also an hosting provider (not free) and try to guess how many hack attempts we see each month when our customer is running outdated phpbb (just one example) which allows attacker to download rootkit from external server and run it? Blocking outgoing connections is one extra tool for security.