diff --git a/.env b/.env index fd39580d..b16530b5 100644 --- a/.env +++ b/.env @@ -44,7 +44,7 @@ TPOT_PERSISTENCE=on # <1-999>: Set the number of T-Pot restart cycles for logrotate. # Be mindful of this setting as the logs will use up a lot of available disk space. # In case the setting is invalid, T-Pot will default to 30 cycles. -# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/telekom-security/tpotce/?tab=readme-ov-file#log-persistence) +# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/pedro-gallego/tpotce/?tab=readme-ov-file#log-persistence) # as this setting only accounts for the honeypot logs in the ~/tpotce/data folder. TPOT_PERSISTENCE_CYCLES=30 @@ -59,7 +59,7 @@ TPOT_PERSISTENCE_CYCLES=30 # Create credentials with 'htpasswd ~/tpotce/data/nginx/conf/lswebpasswd ' # 4. On SENSOR: Provide username / password from (3) for TPOT_HIVE_USER as base64 encoded string: # "echo -n 'username:password' | base64 -w0" -# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/telekom-security/tpotmobile) +# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/pedro-gallego/tpotmobile) TPOT_TYPE=HIVE # T-Pot Hive User (only relevant for SENSOR deployment) @@ -74,7 +74,7 @@ TPOT_HIVE_USER= # contains a sAN for the HIVE IP. In scenario where the HIVE needs to be accessed via Internet, maybe with # a different NAT address, a new certificate needs to be generated before deployment that includes all the # IPs and FQDNs as sANs for logstash successfully establishing a connection to the HIVE for transmitting -# logs. Details here: https://github.com/telekom-security/tpotce?tab=readme-ov-file#distributed-deployment +# logs. Details here: https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#distributed-deployment # none: This setting will disable the ssl verification check of logstash and should only be used in a testing # environment where IPs often change. It is not recommended for a production environment where trust between # HIVE and SENSOR is only established through a self signed certificate. diff --git a/.github/ISSUE_TEMPLATE/bug-report-for-t-pot.md b/.github/ISSUE_TEMPLATE/bug-report-for-t-pot.md index 4e120f93..42d66a8e 100644 --- a/.github/ISSUE_TEMPLATE/bug-report-for-t-pot.md +++ b/.github/ISSUE_TEMPLATE/bug-report-for-t-pot.md @@ -10,10 +10,10 @@ assignees: '' # Successfully raise an issue Before you post your issue make sure it has not been answered yet and provide **⚠️ BASIC SUPPORT INFORMATION** (as requested below) if you come to the conclusion it is a new issue. -- 🔍 Use the [search function](https://github.com/telekom-security/tpotce/issues?utf8=%E2%9C%93&q=) first -- 🧐 Check our [Config Examples & Tutorials](https://github.com/telekom-security/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/telekom-security/tpotce/discussions) in general. -- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md). -- ⚙️ The [Troubleshoot Section](https://github.com/telekom-security/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own. +- 🔍 Use the [search function](https://github.com/pedro-gallego/tpotce/issues?utf8=%E2%9C%93&q=) first +- 🧐 Check our [Config Examples & Tutorials](https://github.com/pedro-gallego/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/pedro-gallego/tpotce/discussions) in general. +- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md). +- ⚙️ The [Troubleshoot Section](https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own. - **⚠️ Provide [BASIC SUPPORT INFORMATION](#-basic-support-information-commands-are-expected-to-run-as-root) or similar detailed information with regard to your issue or we will close the issue or convert it into a discussion without further interaction from the maintainers**.
# ⚠️ Basic support information (commands are expected to run as `root`) diff --git a/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md b/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md index fb65f588..ceac5583 100644 --- a/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md +++ b/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md @@ -10,10 +10,10 @@ assignees: '' # Successfully raise an issue Before you post your issue make sure it has not been answered yet and provide **⚠️ BASIC SUPPORT INFORMATION** (as requested below) if you come to the conclusion it is a new issue. -- 🔍 Use the [search function](https://github.com/telekom-security/tpotce/issues?utf8=%E2%9C%93&q=) first -- 🧐 Check our [Config Examples & Tutorials](https://github.com/telekom-security/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/telekom-security/tpotce/discussions) in general. -- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md). -- ⚙️ The [Troubleshoot Section](https://github.com/telekom-security/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/telekom-security/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own. +- 🔍 Use the [search function](https://github.com/pedro-gallego/tpotce/issues?utf8=%E2%9C%93&q=) first +- 🧐 Check our [Config Examples & Tutorials](https://github.com/pedro-gallego/tpotce/discussions/categories/config-examples-tutorials) and the [discussions](https://github.com/pedro-gallego/tpotce/discussions) in general. +- 📚 Consult the documentation of 💻 your Linux OS, 🐳 [Docker](https://docs.docker.com/), the 🦌 [Elastic stack](https://www.elastic.co/guide/index.html) and the 🍯 [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md). +- ⚙️ The [Troubleshoot Section](https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#troubleshooting) of the [T-Pot Readme](https://github.com/pedro-gallego/tpotce/blob/master/README.md) is a good starting point to collect a good set of information for the issue and / or to fix things on your own. - **⚠️ Provide [BASIC SUPPORT INFORMATION](#-basic-support-information-commands-are-expected-to-run-as-root) or similar detailed information with regard to your issue or we will close the issue or convert it into a discussion without further interaction from the maintainers**.
# ⚠️ Basic support information (commands are expected to run as `root`) diff --git a/CITATION.cff b/CITATION.cff index 3d6d8ccb..8571a644 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -13,16 +13,16 @@ authors: city: Bonn country: DE post-code: '53113' - website: 'https://github.com/telekom-security' + website: 'https://github.com/pedro-gallego' - given-names: Marco family-names: Ochse affiliation: Deutsche Telekom Security GmbH identifiers: - type: url value: >- - https://github.com/telekom-security/tpotce/releases/tag/24.04.1 + https://github.com/pedro-gallego/tpotce/releases/tag/24.04.1 description: T-Pot Release 24.04.1 -repository-code: 'https://github.com/telekom-security/tpotce' +repository-code: 'https://github.com/pedro-gallego/tpotce' abstract: >- T-Pot is the all in one, optionally distributed, multiarch (amd64, arm64) honeypot plattform, supporting 20+ diff --git a/README.md b/README.md index 7d2d4c80..6bd22e55 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ env bash -c "$(curl -sL https://github.com/pedro-gallego/tpotce/raw/master/insta # Disclaimer - You install and run T-Pot within your responsibility. Choose your deployment wisely as a system compromise can never be ruled out. -- For fast help research the [Issues](https://github.com/telekom-security/tpotce/issues) and [Discussions](https://github.com/telekom-security/tpotce/discussions). +- For fast help research the [Issues](https://github.com/pedro-gallego/tpotce/issues) and [Discussions](https://github.com/pedro-gallego/tpotce/discussions). - The software is designed and offered with best effort in mind. As a community and open source project it uses lots of other open source software and may contain bugs and issues. Report responsibly. - Honeypots - by design - should not host any sensitive data. Make sure you don't add any. - By default, your data is submitted to [Sicherheitstacho](https://www.sicherheitstacho.eu/start/main). You can disable this in the config (`~/tpotce/docker-compose.yml`) by [removing](#community-data-submission) the `ewsposter` section. But in this case sharing really is caring! @@ -161,7 +161,7 @@ Alongside the following tools: The source code and configuration files are fully stored in the T-Pot GitHub repository. The docker images are built and preconfigured for the T-Pot environment. -The individual Dockerfiles and configurations are located in the [docker folder](https://github.com/telekom-security/tpotce/tree/master/docker). +The individual Dockerfiles and configurations are located in the [docker folder](https://github.com/pedro-gallego/tpotce/tree/master/docker).

## Services @@ -243,7 +243,7 @@ T-Pot is tested on and known to run on ... * Telekom OTC using the post install method ... others may work, but remain untested. -Some users report working installations on other clouds and hosters, i.e. Azure and GCP. Hardware requirements may be different. If you are unsure you should research [issues](https://github.com/telekom-security/tpotce/issues) and [discussions](https://github.com/telekom-security/tpotce/discussions) and run some functional tests. With T-Pot 24.04.0 and forward we made sure to remove settings that were known to interfere with cloud based installations. +Some users report working installations on other clouds and hosters, i.e. Azure and GCP. Hardware requirements may be different. If you are unsure you should research [issues](https://github.com/pedro-gallego/tpotce/issues) and [discussions](https://github.com/pedro-gallego/tpotce/discussions) and run some functional tests. With T-Pot 24.04.0 and forward we made sure to remove settings that were known to interfere with cloud based installations.

## Required Ports @@ -341,7 +341,7 @@ Once you are familiar with how things work you should choose a network you suspe

## Get and install T-Pot -1. Clone the GitHub repository: `$ git clone https://github.com/telekom-security/tpotce` or follow the [TL;DR](#tldr) and skip this section. +1. Clone the GitHub repository: `$ git clone https://github.com/pedro-gallego/tpotce` or follow the [TL;DR](#tldr) and skip this section. 2. Change into the **tpotce/** folder: `$ cd tpotce` 3. Run the installer as non-root: `$ ./install.sh`: * ⚠️ ***Depending on your Linux distribution of choice the installer will:*** @@ -356,7 +356,7 @@ Once you are familiar with how things work you should choose a network you suspe * Add `dps` and `dpsw` aliases (`grc docker ps -a`, `watch -c "grc --colour=on docker ps -a`) * Add `la`, `ll` and `ls` aliases (for `exa`, a improved `ls` command) * Add `mi` (for `micro`, a great alternative to `vi` and / or `nano`) - * Display open ports on the host (compare with T-Pot [required](https://github.com/telekom-security/tpotce#required-ports) ports) + * Display open ports on the host (compare with T-Pot [required](https://github.com/pedro-gallego/tpotce#required-ports) ports) * Add and enable `tpot.service` to `/etc/systemd/system` so T-Pot can automatically start and stop 4. Follow the installer instructions, you will have to enter your user (`sudo` or `root`) password at least once 5. Check the installer messages for errors and open ports that might cause port conflicts @@ -367,7 +367,7 @@ Once you are familiar with how things work you should choose a network you suspe Sometimes it is just nice if you can spin up a T-Pot instance on macOS or Windows, i.e. for development, testing or just the fun of it. As Docker Desktop is rather limited not all honeypot types or T-Pot features are supported. Also remember, by default the macOS and Windows firewall are blocking access from remote, so testing is limited to the host. For production it is recommended to run T-Pot on [Linux](#choose-your-distro).
To get things up and running just follow these steps: 1. Install Docker Desktop for [macOS](https://docs.docker.com/desktop/install/mac-install/) or [Windows](https://docs.docker.com/desktop/install/windows-install/). -2. Clone the GitHub repository: `git clone https://github.com/telekom-security/tpotce` (in Windows make sure the code is checked out with `LF` instead of `CRLF`!) +2. Clone the GitHub repository: `git clone https://github.com/pedro-gallego/tpotce` (in Windows make sure the code is checked out with `LF` instead of `CRLF`!) 3. Go to: `cd ~/tpotce` 4. Copy `cp compose/mac_win.yml ./docker-compose.yml` 5. Create a `WEB_USER` by running `~/tpotce/genuser.sh` (macOS) or `~/tpotce/genuserwin.ps1` (Windows) @@ -424,7 +424,7 @@ There is not much to do except to login and check via `dps` if all services and ## Distributed Deployment ### Planning and Certificates The distributed deployment involves planning as **T-Pot Init** will only create a self-signed certificate for the IP of the **Hive** host which usually is suitable for simple setups. Since **logstash** will check for a valid certificate upon connection, a distributed setup involving **Hive** to be reachable on multiple IPs (i.e. RFC 1918 and public NAT IP) and maybe even a domain name will result in a connection error where the certificate cannot be validated as such a setup needs a certificate with a common name and SANs (Subject Alternative Name).
-Before deploying any sensors make sure you have planned out domain names and IPs properly to avoid issues with the certificate. For more details see [issue #1543](https://github.com/telekom-security/tpotce/issues/1543).
+Before deploying any sensors make sure you have planned out domain names and IPs properly to avoid issues with the certificate. For more details see [issue #1543](https://github.com/pedro-gallego/tpotce/issues/1543).
Adjust the example to your IP / domain setup and follow the commands to change the certificate of **Hive**: ``` @@ -775,13 +775,13 @@ If you are a security researcher and want to responsibly report an issue please

## Issues -Please report issues (errors) on our [GitHub Issues](https://github.com/telekom-security/tpotce/issues), but [troubleshoot](#troubleshooting) first. Issues not providing information to address the error will be closed or converted into [discussions](#discussions). +Please report issues (errors) on our [GitHub Issues](https://github.com/pedro-gallego/tpotce/issues), but [troubleshoot](#troubleshooting) first. Issues not providing information to address the error will be closed or converted into [discussions](#discussions). Use the search function first, it is possible a similar issue has been addressed or discussed already, with the solution just a search away.

## Discussions -General questions, ideas, show & tell, etc. can be addressed on our [GitHub Discussions](https://github.com/telekom-security/tpotce/discussions). +General questions, ideas, show & tell, etc. can be addressed on our [GitHub Discussions](https://github.com/pedro-gallego/tpotce/discussions). Use the search function, it is possible a similar discussion has been opened already, with an answer just a search away.

diff --git a/env.example b/env.example index fd39580d..b16530b5 100644 --- a/env.example +++ b/env.example @@ -44,7 +44,7 @@ TPOT_PERSISTENCE=on # <1-999>: Set the number of T-Pot restart cycles for logrotate. # Be mindful of this setting as the logs will use up a lot of available disk space. # In case the setting is invalid, T-Pot will default to 30 cycles. -# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/telekom-security/tpotce/?tab=readme-ov-file#log-persistence) +# Remember to adjust the Elastic Search Lifecycle Policy (https://github.com/pedro-gallego/tpotce/?tab=readme-ov-file#log-persistence) # as this setting only accounts for the honeypot logs in the ~/tpotce/data folder. TPOT_PERSISTENCE_CYCLES=30 @@ -59,7 +59,7 @@ TPOT_PERSISTENCE_CYCLES=30 # Create credentials with 'htpasswd ~/tpotce/data/nginx/conf/lswebpasswd ' # 4. On SENSOR: Provide username / password from (3) for TPOT_HIVE_USER as base64 encoded string: # "echo -n 'username:password' | base64 -w0" -# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/telekom-security/tpotmobile) +# MOBILE: This will set the correct type for T-Pot Mobile (https://github.com/pedro-gallego/tpotmobile) TPOT_TYPE=HIVE # T-Pot Hive User (only relevant for SENSOR deployment) @@ -74,7 +74,7 @@ TPOT_HIVE_USER= # contains a sAN for the HIVE IP. In scenario where the HIVE needs to be accessed via Internet, maybe with # a different NAT address, a new certificate needs to be generated before deployment that includes all the # IPs and FQDNs as sANs for logstash successfully establishing a connection to the HIVE for transmitting -# logs. Details here: https://github.com/telekom-security/tpotce?tab=readme-ov-file#distributed-deployment +# logs. Details here: https://github.com/pedro-gallego/tpotce?tab=readme-ov-file#distributed-deployment # none: This setting will disable the ssl verification check of logstash and should only be used in a testing # environment where IPs often change. It is not recommended for a production environment where trust between # HIVE and SENSOR is only established through a self signed certificate. diff --git a/install.sh b/install.sh index 08479c12..c1287eff 100755 --- a/install.sh +++ b/install.sh @@ -192,7 +192,7 @@ fi if [ ! -f installer/install/tpot.yml ] && [ ! -f tpot.yml ]; then echo "### Now downloading T-Pot Ansible Installation Playbook ... " - wget -qO tpot.yml https://raw.githubusercontent.com/telekom-security/tpotce/master/installer/install/tpot.yml + wget -qO tpot.yml https://raw.githubusercontent.com/pedro-gallego/tpotce/master/installer/install/tpot.yml myANSIBLE_TPOT_PLAYBOOK="tpot.yml" echo else diff --git a/installer/install/tpot.yml b/installer/install/tpot.yml index b6fb16e8..d0cf0cfd 100644 --- a/installer/install/tpot.yml +++ b/installer/install/tpot.yml @@ -735,7 +735,7 @@ - name: Clone / Update T-Pot repository (All) git: - repo: 'https://github.com/telekom-security/tpotce' + repo: 'https://github.com/pedro-gallego/tpotce' dest: '/home/{{ ansible_user_id }}/tpotce/' version: master clone: yes diff --git a/update.sh b/update.sh index f8fa4304..25f3ea22 100755 --- a/update.sh +++ b/update.sh @@ -174,7 +174,7 @@ function fuUPDATER () { echo "### We stored the previous version as backup in $myARCHIVE." echo "### Some updates may need an import of the latest Kibana objects as well." echo "### Download the latest objects here if they recently changed:" - echo "### https://raw.githubusercontent.com/telekom-security/tpotce/master/etc/objects/kibana_export.ndjson.zip" + echo "### https://raw.githubusercontent.com/pedro-gallego/tpotce/master/etc/objects/kibana_export.ndjson.zip" echo "### Export and import the objects easily through the Kibana WebUI:" echo "### Go to Kibana > Management > Saved Objects > Export / Import" echo