mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-10-13 11:59:14 +00:00
Logos look and feel
This commit is contained in:
pedro
parent
d6a1dbc40a
commit
90bb45354e
9 changed files with 29 additions and 29 deletions
6
.env
6
.env
|
|
@ -44,7 +44,7 @@ TPOT_PERSISTENCE=on
|
|||
# <1-999>: Set the number of T-Pot restart cycles for logrotate.
|
||||
# Be mindful of this setting as the logs will use up a lot of available disk space.
|
||||
# In case the setting is invalid, T-Pot will default to 30 cycles.
|
||||
# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/telekom-security/tpotce/?tab=readme-ov-file#log-persistence)
|
||||
# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/pedro-gallego/tpotce/?tab=readme-ov-file#log-persistence)
|
||||
# as this setting only accounts for the honeypot logs in the ~/tpotce/data folder.
|
||||
TPOT_PERSISTENCE_CYCLES=30
|
||||
|
||||
|
|
@ -59,7 +59,7 @@ TPOT_PERSISTENCE_CYCLES=30
|
|||
# Create credentials with 'htpasswd ~/tpotce/data/nginx/conf/lswebpasswd <username>'
|
||||
# 4. On SENSOR: Provide username / password from (3) for TPOT_HIVE_USER as base64 encoded string:
|
||||
# "echo -n 'username:password' | base64 -w0"
|
||||
# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/telekom-security/tpotmobile)
|
||||
# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/pedro-gallego/tpotmobile)
|
||||
TPOT_TYPE=HIVE
|
||||
|
||||
# T-Pot Hive User (only relevant for SENSOR deployment)
|
||||
|
|
@ -74,7 +74,7 @@ TPOT_HIVE_USER=
|
|||
# contains a sAN for the HIVE IP. In scenario where the HIVE needs to be accessed via Internet, maybe with
|
||||
# a different NAT address, a new certificate needs to be generated before deployment that includes all the
|
||||
# IPs and FQDNs as sANs for logstash successfully establishing a connection to the HIVE for transmitting
|
||||
# logs. Details here: https://github.com/telekom-security/tpotce?tab=readme-ov-file#distributed-deployment
|
||||
# logs. Details here: https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#distributed-deployment
|
||||
# none: This setting will disable the ssl verification check of logstash and should only be used in a testing
|
||||
# environment where IPs often change. It is not recommended for a production environment where trust between
|
||||
# HIVE and SENSOR is only established through a self signed certificate.
|
||||
|
|
|
|||
|
|
@ -10,10 +10,10 @@ assignees: ''
|
|||
# Successfully raise an issue
|
||||
Before you post your issue make sure it has not been answered yet and provide **⚠️ BASIC SUPPORT INFORMATION** (as requested below) if you come to the conclusion it is a new issue.
|
||||
|
||||
- 🔍 Use the [search function](https://github.com/telekom-security/tpotce/issues?utf8=%E2%9C%93&q=) first
|
||||
- 🧐 Check our [Config Examples & Tutorials](https://github.com/telekom-security/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/telekom-security/tpotce/discussions) in general.
|
||||
- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md).
|
||||
- ⚙️ The [Troubleshoot Section](https://github.com/telekom-security/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own.
|
||||
- 🔍 Use the [search function](https://github.com/pedro-gallego/tpotce/issues?utf8=%E2%9C%93&q=) first
|
||||
- 🧐 Check our [Config Examples & Tutorials](https://github.com/pedro-gallego/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/pedro-gallego/tpotce/discussions) in general.
|
||||
- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md).
|
||||
- ⚙️ The [Troubleshoot Section](https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own.
|
||||
- **⚠️ Provide [BASIC SUPPORT INFORMATION](#-basic-support-information-commands-are-expected-to-run-as-root) or similar detailed information with regard to your issue or we will close the issue or convert it into a discussion without further interaction from the maintainers**.<br>
|
||||
|
||||
# ⚠️ Basic support information (commands are expected to run as `root`)
|
||||
|
|
|
|||
|
|
@ -10,10 +10,10 @@ assignees: ''
|
|||
# Successfully raise an issue
|
||||
Before you post your issue make sure it has not been answered yet and provide **⚠️ BASIC SUPPORT INFORMATION** (as requested below) if you come to the conclusion it is a new issue.
|
||||
|
||||
- 🔍 Use the [search function](https://github.com/telekom-security/tpotce/issues?utf8=%E2%9C%93&q=) first
|
||||
- 🧐 Check our [Config Examples & Tutorials](https://github.com/telekom-security/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/telekom-security/tpotce/discussions) in general.
|
||||
- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md).
|
||||
- ⚙️ The [Troubleshoot Section](https://github.com/telekom-security/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own.
|
||||
- 🔍 Use the [search function](https://github.com/pedro-gallego/tpotce/issues?utf8=%E2%9C%93&q=) first
|
||||
- 🧐 Check our [Config Examples & Tutorials](https://github.com/pedro-gallego/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/pedro-gallego/tpotce/discussions) in general.
|
||||
- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md).
|
||||
- ⚙️ The [Troubleshoot Section](https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own.
|
||||
- **⚠️ Provide [BASIC SUPPORT INFORMATION](#-basic-support-information-commands-are-expected-to-run-as-root) or similar detailed information with regard to your issue or we will close the issue or convert it into a discussion without further interaction from the maintainers**.<br>
|
||||
|
||||
# ⚠️ Basic support information (commands are expected to run as `root`)
|
||||
|
|
|
|||
|
|
@ -13,16 +13,16 @@ authors:
|
|||
city: Bonn
|
||||
country: DE
|
||||
post-code: '53113'
|
||||
website: 'https://github.com/telekom-security'
|
||||
website: 'https://github.com/pedro-gallego'
|
||||
- given-names: Marco
|
||||
family-names: Ochse
|
||||
affiliation: Deutsche Telekom Security GmbH
|
||||
identifiers:
|
||||
- type: url
|
||||
value: >-
|
||||
https://github.com/telekom-security/tpotce/releases/tag/24.04.1
|
||||
https://github.com/pedro-gallego/tpotce/releases/tag/24.04.1
|
||||
description: T-Pot Release 24.04.1
|
||||
repository-code: 'https://github.com/telekom-security/tpotce'
|
||||
repository-code: 'https://github.com/pedro-gallego/tpotce'
|
||||
abstract: >-
|
||||
T-Pot is the all in one, optionally distributed, multiarch
|
||||
(amd64, arm64) honeypot plattform, supporting 20+
|
||||
|
|
|
|||
18
README.md
18
README.md
|
|
@ -98,7 +98,7 @@ env bash -c "$(curl -sL https://github.com/pedro-gallego/tpotce/raw/master/insta
|
|||
|
||||
# Disclaimer
|
||||
- You install and run T-Pot within your responsibility. Choose your deployment wisely as a system compromise can never be ruled out.
|
||||
- For fast help research the [Issues](https://github.com/telekom-security/tpotce/issues) and [Discussions](https://github.com/telekom-security/tpotce/discussions).
|
||||
- For fast help research the [Issues](https://github.com/pedro-gallego/tpotce/issues) and [Discussions](https://github.com/pedro-gallego/tpotce/discussions).
|
||||
- The software is designed and offered with best effort in mind. As a community and open source project it uses lots of other open source software and may contain bugs and issues. Report responsibly.
|
||||
- Honeypots - by design - should not host any sensitive data. Make sure you don't add any.
|
||||
- By default, your data is submitted to [Sicherheitstacho](https://www.sicherheitstacho.eu/start/main). You can disable this in the config (`~/tpotce/docker-compose.yml`) by [removing](#community-data-submission) the `ewsposter` section. But in this case sharing really is caring!
|
||||
|
|
@ -161,7 +161,7 @@ Alongside the following tools:
|
|||
|
||||
The source code and configuration files are fully stored in the T-Pot GitHub repository. The docker images are built and preconfigured for the T-Pot environment.
|
||||
|
||||
The individual Dockerfiles and configurations are located in the [docker folder](https://github.com/telekom-security/tpotce/tree/master/docker).
|
||||
The individual Dockerfiles and configurations are located in the [docker folder](https://github.com/pedro-gallego/tpotce/tree/master/docker).
|
||||
<br><br>
|
||||
|
||||
## Services
|
||||
|
|
@ -243,7 +243,7 @@ T-Pot is tested on and known to run on ...
|
|||
* Telekom OTC using the post install method
|
||||
... others may work, but remain untested.
|
||||
|
||||
Some users report working installations on other clouds and hosters, i.e. Azure and GCP. Hardware requirements may be different. If you are unsure you should research [issues](https://github.com/telekom-security/tpotce/issues) and [discussions](https://github.com/telekom-security/tpotce/discussions) and run some functional tests. With T-Pot 24.04.0 and forward we made sure to remove settings that were known to interfere with cloud based installations.
|
||||
Some users report working installations on other clouds and hosters, i.e. Azure and GCP. Hardware requirements may be different. If you are unsure you should research [issues](https://github.com/pedro-gallego/tpotce/issues) and [discussions](https://github.com/pedro-gallego/tpotce/discussions) and run some functional tests. With T-Pot 24.04.0 and forward we made sure to remove settings that were known to interfere with cloud based installations.
|
||||
<br><br>
|
||||
|
||||
## Required Ports
|
||||
|
|
@ -341,7 +341,7 @@ Once you are familiar with how things work you should choose a network you suspe
|
|||
|
||||
<br><br>
|
||||
## Get and install T-Pot
|
||||
1. Clone the GitHub repository: `$ git clone https://github.com/telekom-security/tpotce` or follow the [TL;DR](#tldr) and skip this section.
|
||||
1. Clone the GitHub repository: `$ git clone https://github.com/pedro-gallego/tpotce` or follow the [TL;DR](#tldr) and skip this section.
|
||||
2. Change into the **tpotce/** folder: `$ cd tpotce`
|
||||
3. Run the installer as non-root: `$ ./install.sh`:
|
||||
* ⚠️ ***Depending on your Linux distribution of choice the installer will:***
|
||||
|
|
@ -356,7 +356,7 @@ Once you are familiar with how things work you should choose a network you suspe
|
|||
* Add `dps` and `dpsw` aliases (`grc docker ps -a`, `watch -c "grc --colour=on docker ps -a`)
|
||||
* Add `la`, `ll` and `ls` aliases (for `exa`, a improved `ls` command)
|
||||
* Add `mi` (for `micro`, a great alternative to `vi` and / or `nano`)
|
||||
* Display open ports on the host (compare with T-Pot [required](https://github.com/telekom-security/tpotce#required-ports) ports)
|
||||
* Display open ports on the host (compare with T-Pot [required](https://github.com/pedro-gallego/tpotce#required-ports) ports)
|
||||
* Add and enable `tpot.service` to `/etc/systemd/system` so T-Pot can automatically start and stop
|
||||
4. Follow the installer instructions, you will have to enter your user (`sudo` or `root`) password at least once
|
||||
5. Check the installer messages for errors and open ports that might cause port conflicts
|
||||
|
|
@ -367,7 +367,7 @@ Once you are familiar with how things work you should choose a network you suspe
|
|||
Sometimes it is just nice if you can spin up a T-Pot instance on macOS or Windows, i.e. for development, testing or just the fun of it. As Docker Desktop is rather limited not all honeypot types or T-Pot features are supported. Also remember, by default the macOS and Windows firewall are blocking access from remote, so testing is limited to the host. For production it is recommended to run T-Pot on [Linux](#choose-your-distro).<br>
|
||||
To get things up and running just follow these steps:
|
||||
1. Install Docker Desktop for [macOS](https://docs.docker.com/desktop/install/mac-install/) or [Windows](https://docs.docker.com/desktop/install/windows-install/).
|
||||
2. Clone the GitHub repository: `git clone https://github.com/telekom-security/tpotce` (in Windows make sure the code is checked out with `LF` instead of `CRLF`!)
|
||||
2. Clone the GitHub repository: `git clone https://github.com/pedro-gallego/tpotce` (in Windows make sure the code is checked out with `LF` instead of `CRLF`!)
|
||||
3. Go to: `cd ~/tpotce`
|
||||
4. Copy `cp compose/mac_win.yml ./docker-compose.yml`
|
||||
5. Create a `WEB_USER` by running `~/tpotce/genuser.sh` (macOS) or `~/tpotce/genuserwin.ps1` (Windows)
|
||||
|
|
@ -424,7 +424,7 @@ There is not much to do except to login and check via `dps` if all services and
|
|||
## Distributed Deployment
|
||||
### Planning and Certificates
|
||||
The distributed deployment involves planning as **T-Pot Init** will only create a self-signed certificate for the IP of the **Hive** host which usually is suitable for simple setups. Since **logstash** will check for a valid certificate upon connection, a distributed setup involving **Hive** to be reachable on multiple IPs (i.e. RFC 1918 and public NAT IP) and maybe even a domain name will result in a connection error where the certificate cannot be validated as such a setup needs a certificate with a common name and SANs (Subject Alternative Name).<br>
|
||||
Before deploying any sensors make sure you have planned out domain names and IPs properly to avoid issues with the certificate. For more details see [issue #1543](https://github.com/telekom-security/tpotce/issues/1543).<br>
|
||||
Before deploying any sensors make sure you have planned out domain names and IPs properly to avoid issues with the certificate. For more details see [issue #1543](https://github.com/pedro-gallego/tpotce/issues/1543).<br>
|
||||
Adjust the example to your IP / domain setup and follow the commands to change the certificate of **Hive**:
|
||||
|
||||
```
|
||||
|
|
@ -775,13 +775,13 @@ If you are a security researcher and want to responsibly report an issue please
|
|||
<br><br>
|
||||
|
||||
## Issues
|
||||
Please report issues (errors) on our [GitHub Issues](https://github.com/telekom-security/tpotce/issues), but [troubleshoot](#troubleshooting) first. Issues not providing information to address the error will be closed or converted into [discussions](#discussions).
|
||||
Please report issues (errors) on our [GitHub Issues](https://github.com/pedro-gallego/tpotce/issues), but [troubleshoot](#troubleshooting) first. Issues not providing information to address the error will be closed or converted into [discussions](#discussions).
|
||||
|
||||
Use the search function first, it is possible a similar issue has been addressed or discussed already, with the solution just a search away.
|
||||
<br><br>
|
||||
|
||||
## Discussions
|
||||
General questions, ideas, show & tell, etc. can be addressed on our [GitHub Discussions](https://github.com/telekom-security/tpotce/discussions).
|
||||
General questions, ideas, show & tell, etc. can be addressed on our [GitHub Discussions](https://github.com/pedro-gallego/tpotce/discussions).
|
||||
|
||||
Use the search function, it is possible a similar discussion has been opened already, with an answer just a search away.
|
||||
<br><br>
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ TPOT_PERSISTENCE=on
|
|||
# <1-999>: Set the number of T-Pot restart cycles for logrotate.
|
||||
# Be mindful of this setting as the logs will use up a lot of available disk space.
|
||||
# In case the setting is invalid, T-Pot will default to 30 cycles.
|
||||
# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/telekom-security/tpotce/?tab=readme-ov-file#log-persistence)
|
||||
# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/pedro-gallego/tpotce/?tab=readme-ov-file#log-persistence)
|
||||
# as this setting only accounts for the honeypot logs in the ~/tpotce/data folder.
|
||||
TPOT_PERSISTENCE_CYCLES=30
|
||||
|
||||
|
|
@ -59,7 +59,7 @@ TPOT_PERSISTENCE_CYCLES=30
|
|||
# Create credentials with 'htpasswd ~/tpotce/data/nginx/conf/lswebpasswd <username>'
|
||||
# 4. On SENSOR: Provide username / password from (3) for TPOT_HIVE_USER as base64 encoded string:
|
||||
# "echo -n 'username:password' | base64 -w0"
|
||||
# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/telekom-security/tpotmobile)
|
||||
# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/pedro-gallego/tpotmobile)
|
||||
TPOT_TYPE=HIVE
|
||||
|
||||
# T-Pot Hive User (only relevant for SENSOR deployment)
|
||||
|
|
@ -74,7 +74,7 @@ TPOT_HIVE_USER=
|
|||
# contains a sAN for the HIVE IP. In scenario where the HIVE needs to be accessed via Internet, maybe with
|
||||
# a different NAT address, a new certificate needs to be generated before deployment that includes all the
|
||||
# IPs and FQDNs as sANs for logstash successfully establishing a connection to the HIVE for transmitting
|
||||
# logs. Details here: https://github.com/telekom-security/tpotce?tab=readme-ov-file#distributed-deployment
|
||||
# logs. Details here: https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#distributed-deployment
|
||||
# none: This setting will disable the ssl verification check of logstash and should only be used in a testing
|
||||
# environment where IPs often change. It is not recommended for a production environment where trust between
|
||||
# HIVE and SENSOR is only established through a self signed certificate.
|
||||
|
|
|
|||
|
|
@ -192,7 +192,7 @@ fi
|
|||
if [ ! -f installer/install/tpot.yml ] && [ ! -f tpot.yml ];
|
||||
then
|
||||
echo "### Now downloading T-Pot Ansible Installation Playbook ... "
|
||||
wget -qO tpot.yml https://raw.githubusercontent.com/telekom-security/tpotce/master/installer/install/tpot.yml
|
||||
wget -qO tpot.yml https://raw.githubusercontent.com/pedro-gallego/tpotce/master/installer/install/tpot.yml
|
||||
myANSIBLE_TPOT_PLAYBOOK="tpot.yml"
|
||||
echo
|
||||
else
|
||||
|
|
|
|||
|
|
@ -735,7 +735,7 @@
|
|||
|
||||
- name: Clone / Update T-Pot repository (All)
|
||||
git:
|
||||
repo: 'https://github.com/telekom-security/tpotce'
|
||||
repo: 'https://github.com/pedro-gallego/tpotce'
|
||||
dest: '/home/{{ ansible_user_id }}/tpotce/'
|
||||
version: master
|
||||
clone: yes
|
||||
|
|
|
|||
|
|
@ -174,7 +174,7 @@ function fuUPDATER () {
|
|||
echo "### We stored the previous version as backup in $myARCHIVE."
|
||||
echo "### Some updates may need an import of the latest Kibana objects as well."
|
||||
echo "### Download the latest objects here if they recently changed:"
|
||||
echo "### https://raw.githubusercontent.com/telekom-security/tpotce/master/etc/objects/kibana_export.ndjson.zip"
|
||||
echo "### https://raw.githubusercontent.com/pedro-gallego/tpotce/master/etc/objects/kibana_export.ndjson.zip"
|
||||
echo "### Export and import the objects easily through the Kibana WebUI:"
|
||||
echo "### Go to Kibana > Management > Saved Objects > Export / Import"
|
||||
echo
|
||||
|
|
|
|||
Loading…
Reference in a new issue