tweaking, hardening

docker/vnclowpot/Dockerfile

@@ -1,8 +1,4 @@
 FROM alpine
-MAINTAINER MO
-
-# Include dist
-#ADD dist/ /root/dist/
 
 # Setup apk
 RUN apk -U add bash \
@@ -11,7 +7,10 @@ RUN apk -U add bash \
                go \
                procps && \
 
-# Setup vnclowpot
+# Setup go, vnclowpot
+    export GOPATH=/opt/go/ && \
+    mkdir -p /opt/go/ && \
+    cd /opt && \
     go get github.com/magisterquis/vnclowpot && \
     go install github.com/magisterquis/vnclowpot && \
 
@@ -22,8 +21,10 @@ RUN apk -U add bash \
 
 # Clean up
     apk del build-base \
-            git && \
+            git \
+            go && \
     rm -rf /var/cache/apk/*
 
 # Run supervisor upon container start
-CMD /root/go/bin/vnclowpot -j >> /var/log/vnclowpot/vnclowpot.log
+USER vnclowpot:vnclowpot
+CMD /opt/go/bin/vnclowpot -j >> /var/log/vnclowpot/vnclowpot.log

docker/vnclowpot/README.md

@@ -1,4 +1,4 @@
-[![](https://images.microbadger.com/badges/version/dtagdevsec/vnclowpot:1710.svg)](https://microbadger.com/images/dtagdevsec/vnclowpot:1710 "Get your own version badge on microbadger.com") [![](https://images.microbadger.com/badges/image/dtagdevsec/vnclowpot:1710.svg)](https://microbadger.com/images/dtagdevsec/vnclowpot:1710 "Get your own image badge on microbadger.com")
+[![](https://images.microbadger.com/badges/version/dtagdevsec/vnclowpot:1804.svg)](https://microbadger.com/images/dtagdevsec/vnclowpot:1804 "Get your own version badge on microbadger.com") [![](https://images.microbadger.com/badges/image/dtagdevsec/vnclowpot:1804.svg)](https://microbadger.com/images/dtagdevsec/vnclowpot:1804 "Get your own image badge on microbadger.com")
 
 # vnclowpot
 

docker/vnclowpot/docker-compose.yml

@@ -1,4 +1,4 @@
-version: '2.1'
+version: '2.2'
 
 networks:
   vnclowpot_local:
@@ -7,12 +7,14 @@ services:
 
 # vnclowpot service
   vnclowpot:
+    build: .
     container_name: vnclowpot
     restart: always
     networks:
      - vnclowpot_local
     ports:
      - "5900:5900"
-    image: "dtagdevsec/vnclowpot:1710"
+    image: "dtagdevsec/vnclowpot:1804"
+    read_only: true
     volumes:
      - /data/vnclowpot/log:/var/log/vnclowpot

docker/wetty/Dockerfile

@@ -1,23 +1,32 @@
 FROM alpine
-MAINTAINER MO
 
 # Setup env and apt
 RUN apk -U upgrade && \
-    apk add bash build-base git nodejs nodejs-npm openssh-client python procps && \
+    apk add bash \
+            build-base \
+            git \
+            nodejs \
+            nodejs-npm \
+            openssh-client \
+            python \
+            procps && \
 
 # Setup user
     addgroup -g 2000 wetty && \
     adduser -S -s /bin/bash -u 2000 -D -g 2000 wetty && \
 
 # Get and install packages
-    mkdir -p /app/ && \
-    cd /app/ && \
+    mkdir -p /opt/ && \
+    cd /opt/ && \
     npm install https://github.com/t3chn0m4g3/wetty && \
 
 # Clean up
-    apk del build-base git nodejs-npm python
+    apk del --purge build-base \
+                    git \
+                    nodejs-npm \
+                    python
 
 # Start elasticsearch-head
-WORKDIR /app
-USER wetty
-CMD /usr/bin/node /app/node_modules/wetty/app.js -p 64300 --host 127.0.0.1 --sshhost 127.0.0.1 --sshport 64295 --sshuser $MY_SSHUSER
+WORKDIR /opt
+USER wetty:wetty
+CMD /usr/bin/node /opt/node_modules/wetty/app.js -p 64300 --host 127.0.0.1 --sshhost 127.0.0.1 --sshport 64295 --sshuser $MY_SSHUSER

docker/wetty/docker-compose.yml

@@ -6,9 +6,11 @@ services:
 
 # Wetty service
   wetty:
+    build: .
     container_name: wetty
     restart: always
     network_mode: "host"
     env_file:
      - /opt/tpot/etc/compose/wetty_environment
-    image: "dtagdevsec/wetty:1710"
+    image: "dtagdevsec/wetty:1804"
+    read_only: true

etc/compose/collect.yml

@@ -219,6 +219,5 @@ services:
     network_mode: "host"
     env_file:
      - /opt/tpot/etc/compose/wetty_environment
-    ports:
-     - "64300:64300"
-    image: "dtagdevsec/wetty:1710"
+    image: "dtagdevsec/wetty:1804"
+    read_only: true

etc/compose/tpot.yml

@@ -314,7 +314,7 @@ services:
     volumes:
      - /data/p0f/log:/var/log/p0f
 
-# Vnclowpot service
+# vnclowpot service
   vnclowpot:
     container_name: vnclowpot
     restart: always
@@ -322,7 +322,8 @@ services:
      - vnclowpot_local
     ports:
      - "5900:5900"
-    image: "dtagdevsec/vnclowpot:1710"
+    image: "dtagdevsec/vnclowpot:1804"
+    read_only: true
     volumes:
      - /data/vnclowpot/log:/var/log/vnclowpot
 
@@ -333,6 +334,5 @@ services:
     network_mode: "host"
     env_file:
      - /opt/tpot/etc/compose/wetty_environment
-    ports:
-     - "64300:64300"
-    image: "dtagdevsec/wetty:1710"
+    image: "dtagdevsec/wetty:1804"
+    read_only: true