Install DionaeaFR web frontend to Dionaea honeypot on Ubuntu

Dionaea and DionaeaFR

Dionaea is a low-interaction honeypot. It is one of the honeypots that can be deployed through the Modern Honey Network. Next to the MHN dashboard I also wanted some specific data on the Dionaea honeypot. That is where DionaeaFR kicks in.

The installation is described in detail on the github page and on

I had to add some extra packages and settings on a Ubuntu 12.04.4 LTS system. Below is the full installation path.

Install Dionaea

I assume you have Dionaea installed, either according to the Dionaea installation guide or via the deploy script of MHN.

Install DionaeaFR

apt-get install python-pip python-netaddr
apt-get install build-essential
apt-get install python-dev
apt-get install git
pip install Django
pip install pygeoip
pip install django-pagination
pip install django-tables2
pip install django-compressor
pip install django-htmlmin
pip install django-filter
cd /opt/
wget -O
mv django-tables2-simplefilter-master/ django-tables2-simplefilter/
cd django-tables2-simplefilter/
python install
cd /opt/
git clone
cd pysubnettree/
python install
cd /opt/
tar xzvf node-v0.8.16.tar.gz
cd node-v0.8.16
make install
npm install -g less
cd /opt/
wget -O
mv DionaeaFR-master/ DionaeaFR
cd /opt/
gunzip GeoLiteCity.dat.gz
gunzip GeoIP.dat.gz
mv GeoIP.dat DionaeaFR/DionaeaFR/static
mv GeoLiteCity.dat DionaeaFR/DionaeaFR/static

My Dionaea setup is done via MHN and I had to change this in /opt/DionaeaFR/DionaeaFR/

'NAME': '/var/dionaea/logsql.sqlite', # Or path to database file if using sqlite3.
STATIC_ROOT = '/opt/DionaeaFR/DionaeaFR/static/static2/'

Start the DionaeaFR webserver

You can start the DionaeaFR webserver with

cd /opt/DionaeaFR/
python collectstatic #type yes when asked
python runserver


The default logging of Dionaea (configured via MHN) has limited logging to a textfile. Even if logging to sqlite is enabled having a text log file is useful to grep for patterns (IPs, …). The log file location is set via file and the details of events is set with levels.

logging = {
	default = {
    	file = "/var/dionaea/log/dionaea.log"
        levels = "warning,error,message,info"
        domains = "*"

This log setting will generate large log files so you’ll have to rotate them regularly. Put this file in /etc/logrotate.d/dionaea. Notice that the postrotate script calls supervisorctl because that’s how Dionaea is monitored when installed via MHN.

/var/dionaea/log/*.log {
        rotate 28
        create 660 root root
                supervisorctl restart dionaea

Update 20141118

Additionally you’ll need these packages for a fully functional dionaeaFR.

sudo apt-get install python-pip python-netaddr
sudo apt-get install unzip sqlite    

If you get an error concerning mimetype when starting dionaeaFR then you’ll have to edit the file This is the full error

Internal Server Error: /graphs/timeline/
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/django/core/handlers/", line 111, in get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/opt/DionaeaFR/Web/views/", line 275, in timeline
  File "/usr/local/lib/python2.7/dist-packages/django/http/", line 318, in __init__
    super(HttpResponse, self).__init__(*args, **kwargs)
TypeError: __init__() got an unexpected keyword argument 'mimetype'

Open the file Web/views/ and replace every occurence of mimetype (mimetype=”application/json”) with content_type. In VI:


20141130 – Python module promise missing

It is possible that you get an error message for the python module promise.

Error: Cannot find module 'promise'
    at Function.Module._resolveFilename (module.js:338:15)

You were probably already alerted of this issue when you installed npm install -g less

npm install -g less

npm http GET
npm http 304
npm WARN engine less@2.1.1: wanted: {"node":">=0.10.0"} (current: {"node":"v0.8.16","npm":"1.1.69"})


npm WARN optional dep failed, continuing mkdirp@^0.5.0
npm WARN optional dep failed, continuing mime@^1.2.11


npm WARN optional dep failed, continuing request@^2.48.0
npm WARN optional dep failed, continuing graceful-fs@^3.0.4
npm WARN optional dep failed, continuing source-map@^0.1.x
npm WARN optional dep failed, continuing promise@^6.0.1
/usr/local/bin/lessc -> /usr/local/lib/node_modules/less/bin/lessc
less@2.1.1 /usr/local/lib/node_modules/less

To solve this you’ll have to upgrade node.js. Download the latest node.js source from, extract, compile and install.

make install

and then reinstall less.

npm install -g less

13 thoughts on “Install DionaeaFR web frontend to Dionaea honeypot on Ubuntu

  1. Hi there! Cool blog post 🙂 I’m happy that my guide helped.
    I have a question, how do you find MHN so far? It’s the next thing on my list.
    Keep up the good work,

    • Koen on said:

      Hi Ion! Thanks! MHN looks promising but it’s missing some features to drill down on events and export events easily. I find the deploy scripts the most useful part, the other parts still need some work.

  2. xpcsyf on said:

    Hi,i got a error when i install pysubnettree,it shows that:
    c++: error: unrecognized command line option ‘-fstack-protector-strong’
    error: command ‘c++’ failed with exit status 1

    Are that ever happened in your installlation

  3. David Jobes on said:

    I am getting errors about db file not found

    File “/usr/local/lib/python2.7/dist-packages/django/db/backends/”, line 122, in connect
    self.connection = self.get_new_connection(conn_params)
    File “/usr/local/lib/python2.7/dist-packages/django/db/backends/sqlite3/”, line 374, in get_new_connection
    conn = Database.connect(**conn_params)
    django.db.utils.OperationalError: unable to open database file

    hwo do you gen the db file or where can i find it

  4. David Jobes on said:

    I have just loaded this onto a new machine, but now all it show it shows is Connections and IP’s, it is not showing any of the malware analyzied or known, no downloads or urls. is this a problem with dionaea or dionaeafr

  5. Hi,
    Thank You very much for this details post.
    However is it possible to run DionaeaFR to catch more than 1 Dionaea Honeypot sqlite logs?

    If lets say I’m running 2 or 3 seperated Dionaeas honeypots.

  6. eRDe on said:

    Hi ..
    Thank you very much for this post
    I get some error, I can’t gunzip file geolitecity and geolitecountry. this error is “not in gzip format”. can you help me?

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.