Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-01 12:32:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

tweaking ntp and logstash

Browse source 
remove ntp and replace with timesyncd (client only)

adjust logstash config
This commit is contained in:
t3chn0m4g3 2022-03-30 20:32:24 +00:00
parent 9705538dba
commit 572d540ead
4 changed files with 4 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docker/elk/logstash/Dockerfile
View file

@ -36,12 +36,12 @@ RUN apt-get update -y && \
chmod u+x /usr/bin/entrypoint.sh && \
mkdir -p /etc/logstash/conf.d /usr/share/logstash/config && \
cp logstash.conf /etc/logstash/conf.d/ && \
cp logstash.yml /etc/logstash/conf.d/ && \
cp http_input.conf /etc/logstash/conf.d/ && \
cp http_output.conf /etc/logstash/conf.d/ && \
cp pipelines.yml /usr/share/logstash/config/pipelines.yml && \
cp pipelines_sensor.yml /usr/share/logstash/config/pipelines_sensor.yml && \
cp tpot-template.json /etc/logstash/ && \
rm /etc/logstash/pipelines.yml && \
#
# Setup user, groups and configs
groupmod -g 2000 logstash && \

17
iso/installer/install.sh
View file

@ -798,23 +798,6 @@ echo "$mySYSTEMDFIX" | tee /etc/systemd/network/99-default.link
fuBANNER "Add cronjobs"
echo "$myCRONJOBS" | tee -a /etc/crontab
### For some honeypots to work we need to ensure ntp.service is not listening
echo "### Ensure ntp.service is not listening to avoid potential port conflict with ddospot."
myNTP_IF_DISABLE="interface ignore wildcard
interface ignore 127.0.0.1
interface ignore ::1"
if [ "$(cat /etc/ntp.conf | grep "interface ignore wildcard" | wc -l)" != "1" ];
then
echo "### Found active ntp listeners and updating config."
echo "$myNTP_IF_DISABLE" | tee -a /etc/ntp.conf
echo "### Restarting ntp.service for changes to take effect."
systemctl stop ntp.service
systemctl start ntp.service
else
echo "### Found no active ntp listeners."
fi
# Let's create some files and folders
fuBANNER "Files & folders"
mkdir -vp /data/adbhoney/{downloads,log} \

2
packages.txt
View file

@ -41,7 +41,6 @@ multitail
net-tools
neovim
npm
ntp
openssh-server
openssl
pass
@ -52,6 +51,7 @@ sshpass
psmisc
pv
python3-pip
systemd-timesyncd
toilet
unattended-upgrades
unzip

26
update.sh
View file

@ -239,8 +239,8 @@ echo "### Installing apt-fast"
local myPACKAGES=$(cat /opt/tpot/packages.txt)
echo
echo "### Removing and holding back problematic packages ..."
apt-fast -y purge cockpit-pcp elasticsearch-curator exim4-base glances mailutils pcp
apt-mark hold exim4-base mailutils pcp cockpit-pcp
apt-fast -y purge cockpit-pcp elasticsearch-curator exim4-base glances mailutils ntp pcp
apt-mark hold exim4-base mailutils ntp pcp cockpit-pcp
hash -r
echo
echo "### Now upgrading packages ..."
@ -308,28 +308,6 @@ mkdir -vp /data/adbhoney/{downloads,log} \
/data/tanner/{log,files} \
/home/tsec/.ssh/
### For some honeypots to work we need to ensure ntp.service is not listening
echo
echo "### Ensure ntp.service is not listening to avoid potential port conflict with ddospot."
myNTP_IF_DISABLE="interface ignore wildcard
interface ignore 127.0.0.1
interface ignore ::1"
if [ "$(cat /etc/ntp.conf | grep "interface ignore wildcard" | wc -l)" != "1" ];
then
echo
echo "### Found active ntp listeners and updating config."
echo "$myNTP_IF_DISABLE" | tee -a /etc/ntp.conf
echo
echo "### Restarting ntp.service for changes to take effect."
systemctl stop ntp.service
systemctl start ntp.service
else
echo
echo "### Found no active ntp listeners."
fi
### Let's take care of some files and permissions
chmod 770 -R /data
chown tpot:tpot -R /data