Message Board

Installing Honey Pots

trouble with the install

Author: C.Wyatt (3 Nov 04 1:53am)

When I run the script from my server I get this message:
A validation error occured. If this problem persists, you will need to generate a new script.
Well, it persists, and I did generate a new script and I get the same results. Any help would be much appreciated. Thanks

Re: trouble with the install

Author: L.Holloway (3 Nov 04 6:01am)

Strange. It looks the problem is on your end; it seems that:

$_SERVER["SERVER_ADDR"]
$_SERVER["REQUEST_URI"]

Return NULL instead of the expected values -- and of course our end doesn't like that very much. Do you know why this might be happening?

I sent you an email with a debug script that you can install and maybe help shine light on the problem.

Re: trouble with the install

Author: L.Holloway (5 Nov 04 5:08pm)

The good news is that I managed to write some code that will guess
where your script is located. Since your pot was not reporting how it
was accessed, this should fix the problem.

The bad news is that you will have to generate and download a new
script:

http://www.projecthoneypot.org/manage_honey_pots.php
(Click on the domain of the troubled honey pot; then click
'Download New Script' [on the left] on the next page)

Let us know if your script still bombs. Thanks!

Re: trouble with the install

Author: C.Wyatt (18 Nov 04 9:43pm)

I think I sent you an email back, I can't remember, anywho, now the script says Potential Abuse Detected.

Re: trouble with the install

Author: L.Holloway (19 Nov 04 11:58pm)

Sorry bout that. I checked my inbox, but coudn't find your reply.

Anyhow, it looks like the orginal problem is fixed. This time the error is the result of your honey pot reporting a script hash that conflicts with the one we expect. There are three things that could cause this: 1) the scripts contents were modified 2) the script is old 3) for some reason your environment isn't hashing properly

If you redownload the new script from our site and upload it over the existing file that should fix the problem problems 1 and 2.

Problem 3 is a little more interesting. We use the following php functions to determine the hash:
implode()
md5()
file()
basename()

Do you have any permission settings that would prevent file() from accessing files/folders in your web directories?

Re: trouble with the install

Author: D.Jackson (20 Nov 04 10:20am)

I too am recieving the 'Potential Abuse Detected' after signing up just now & installing the script.

My host is running windows (2000)? & IIS. Could that be a problem?

I run pmWiki, a PHP wiki site without too many problems

The URI is http://glossopian.co.uk/pub/disagreeablealterna.php

I tried it in FireFox .10.1 & IE 6 on XP SP2 if that helps

Dave J

Re: trouble with the install

Author: A.Webb (20 Nov 04 11:00am)

I'm getting the same issue. I have a PHP site and haven't modified the file at all, however, I get the 'potential abuse detected' message. I have redownloaded the script 2 times and made sure that chmod 755 was set.

Re: trouble with the install

Author: C.Wyatt (20 Nov 04 4:10pm)

I redownloaded the script and it still didn't work. I don't use PHP extensively on my site, but I haven't run into any problems. I don't know what could be causing it. I am on a Windows server, so I don't really think that permissions are my problem.

Re: trouble with the install

Author: L.Holloway (20 Nov 04 7:00pm)

Wyatt / Jackson:
Your pots work great when we turn off the Hash Match checking on our end. I suspect that one of functions we used to fetch the contents for hashing injects some odd characters. I rewrote how the hash works to not use file() or basename(). Hopefully that will work for you two.

Webb:
Your pot should now be working. For some reason your pot was reporting:
php.cgi as the script's name ($_SERVER["SCRIPT_NAME"]) when your pot (gnats.php) was accessed. Are you using some intermediate script that handles page requests?

Fortunately, $_SERVER["REQUEST_URI"] reports the correct page and we are able to pull that instead.

Post Edited (23 Nov 04 3:40am)

Re: trouble with the install

Author: C.Wyatt (30 Nov 04 12:12am)

Ok, works fine for me now.

Post Edited (30 Nov 04 12:04am)

Re: trouble with the install

Author: C.Wyatt2 (6 Jan 05 3:07pm)

That's funny. I'm another Cwyatt, I guess with the same problem. Wow, that's a weird Twighlight Zone kind of thing.

Anyway, I'm trying to install here:

http://blackntan.clarku.edu/~cwyatt/honeypot/honeypot.php

Thanks for any suggestions.

-Chuck

Re: trouble with the install

Author: L.Holloway (15 Jan 05 4:01am)

Twighlight Zone indeed. Problem has been fixed and your pot looks like its healthy now. (A good ending for this particular twilight zone episode.) A faulty regex didn't like the '~', but it does now. Thanks for reporting the issue, and welcome to the Project.

Post Edited (18 Jan 05 11:36pm)