Artillery detecting incoming from 127.0.0.1 filling log space.

[Paladin-z]

I posted this on the wrong artillery git on 26 Feb so it's outdated and the log in question is gone. Posting it here for information only in case it happens again.

When looking at /var/log/user.log I see repititions of

Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 123
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 123
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 808

Filling the log space and making the system unresponsive, Debian Buster with Swizzin installed. It created a 36GB log file.

[oldkingcone]

if you look at This line there is a whitelist. I am quite positive that somewhere in the configuration files you can set this information.

[Paladin-z]

Probably so oldkingcone, however a program writing/causing 36gb of alerts to a system log and causing the entire system to fail indicates an issue with the way the program handles logging. If someone caused enough alerts to be logged they could take down any server running Artillery.

The alerts indicate the I.P. as 127.0.0.1 which would imply a local program was scanning those 2 ports, which isn't something I was running. So theres the possibility that the I.P. address is logged incorrectly, unless there was an unknown local program running scanning those local ports.

[oldkingcone]

agreed, thats a ton of space lost. Give me a couple of days, i may not work on the project, but i might be able to give you a small work around.

[Paladin-z]

Thanks but I've already made changes to the way my system handles log files so it's unlikely to be such a problem (he says hopefully) for me again.