Classnotes | UNIX03 | RecentChanges | Preferences thp is written in Perl. As we have seen before, many Perl scripts use configuration files that are written in Perl. thp is no exception.
thp.conf
thp.conf is thp's main configuration file. Here is an overview of that file:
# Interface to listen on
$intf = "eth0";
# Session timeout - wouldja believe that some systems
# just don't cleanup stale sockets?
$timeout = "300"; # seconds
These first two are fairly self-explanitory.
# Hostname to use in responses:
$hostname = "localhost.localdomain";
# ip address to state for incoming connections, ie: ftp data channel
# NOTE: if commented out, thp will try to determine it from the
# interface specified above. This will fail if thp user (nobody, by default)
# doesn't have permission to read /proc/net/dev
#$thpaddr = "127.0.0.1";
# Domain name to use in responses:
$domain = "localdomain";
Again, these are fairly self-explanitory. The one note here is, if you are running virtual domains, you will have to take that into account here.
# location of thp scripts, libs, etc.
$thpdir = "/usr/local/thp";
# Directory for all logging. Should be mode 0700 nobody:nobody
$logdir = "/var/log/hpot";
/usr/local/thp is the default installation directory for thp, but you can specify any alternative here. Ownership should be whatever you have thp set up as.
# Specific name for the master logfile.
$logfile = "$logdir/captures";
# Log format - "single" or "multi". Single line format is easier
# to parse, but does not make any entry into the capture log
# until the session is complete.
# Multiline gives you separate "start" & "end" lines, but is a
# pain in the toches to do anything with.
$logtype = "single";
# Program to run to generate the shell MOTD. I like fortune.
#$greetbin = "/usr/games/fortune";
$greetbin = "/bin/false";
# The home directory of the virtual root user
$homedir = "/root";
# If a shell prompt is to be returned, here ye go.
# NOTE: this may be changed later as the intruder changes
#working directory.
$prompt = "[root\@$hostname root]# ";
# ftp server version choices (edit them if you like)
<snip>
# Should we allow ftp data connections?
# 0 = no
# 1 = yes
$allowftpdata = "1";
# the http vendor is emulated via selecting the appropriate
#directory of responses
#$httpdvend = "Microsoft-IIS";
$httpdvend = "Apache";
