From 658b71d6d8d0fcb2420e3cb7b1b2b2b06bae756e Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Tue, 25 Jun 2019 16:33:56 +0100 Subject: [PATCH 1/6] Add terraform configuration --- cloud/terraform/.gitignore | 2 + cloud/terraform/README.md | 131 +++++++++++++++++++++++++++++++ cloud/terraform/cloud-init.yaml | 25 ++++++ cloud/terraform/ec2/main.tf | 59 ++++++++++++++ cloud/terraform/ec2/outputs.tf | 12 +++ cloud/terraform/ec2/variables.tf | 53 +++++++++++++ cloud/terraform/ec2/versions.tf | 3 + cloud/terraform/tpot.conf | 5 ++ 8 files changed, 290 insertions(+) create mode 100644 cloud/terraform/.gitignore create mode 100644 cloud/terraform/README.md create mode 100644 cloud/terraform/cloud-init.yaml create mode 100644 cloud/terraform/ec2/main.tf create mode 100644 cloud/terraform/ec2/outputs.tf create mode 100644 cloud/terraform/ec2/variables.tf create mode 100644 cloud/terraform/ec2/versions.tf create mode 100644 cloud/terraform/tpot.conf diff --git a/cloud/terraform/.gitignore b/cloud/terraform/.gitignore new file mode 100644 index 00000000..bcb28067 --- /dev/null +++ b/cloud/terraform/.gitignore @@ -0,0 +1,2 @@ +**/.terraform +**/terraform.* diff --git a/cloud/terraform/README.md b/cloud/terraform/README.md new file mode 100644 index 00000000..e17cd5d4 --- /dev/null +++ b/cloud/terraform/README.md @@ -0,0 +1,131 @@ +# T-Pot Terraform + +This [Terraform](https://www.terraform.io/) configuration can be used to provision a T-Pot instance in AWS in addition to all of the necessary pre-requisites. Specifically, the following resources will be created: + +* EC2 instance: + * t3.large (2 vCPU, 8 GiB RAM) + * 128GB disk + * [Debian Stretch](https://wiki.debian.org/Cloud/AmazonEC2Image/Stretch) (The T-Pot installation script will then upgrade this to Debian Sid) +* AWS Security Group: + * TCP/UDP ports <= 64000 open to the Internet + * TCP ports 64294, 64295 and 64297 open to a chosen administrative IP + +[Cloud-init](https://cloudinit.readthedocs.io/en/latest/) is used to bootstrap the instance and install T-Pot on startup. Additional provisioning using Ansible etc. is not required. + +The following resources are NOT automatically created and need to be specified in the configuration below: + +* VPC +* Subnet + +## Pre-Requisites + +* [Terraform](https://www.terraform.io/) 0.12 +* AWS Account + * Existing VPC. VPC ID should be specified in configuration below + * Existing subnet. Subnet ID should be specified in configuration below +* AWS Authentication credentials should be [set using environment variables](https://www.terraform.io/docs/providers/aws/index.html#environment-variables) + +## Required Configuration Changes + +### Terraform Variables + +In `ec2/variables.tf`, change the following variables to correspond to your existing EC2 infrastructure: + +* `admin_ip` - source IP address(es) that you will use to administer the system. Connections to TCP ports 64294, 64295 and 64297 will be allowed from this IP only. Multiple IPs or CIDR blocks can be specified in the format: `["127.0.0.1/32", "192.168.0.0/24"]` +* `ec2_vpc_id` +* `ec2_subnet_id` +* `ec2_region` + +### Admin Credentials + +In `tpot.conf`, change the following variables: + +``` +myCONF_WEB_USER='webuser' +myCONF_WEB_PW='w3b$ecret' +``` + +This will be used to configure credentials for the T-Pot Kibana interface. Refer to [Options](https://github.com/dtag-dev-sec/tpotce#options) for more information. + +## Initialising + +The [`terraform init`](https://www.terraform.io/docs/commands/init.html) command is used to initialize a working directory containing Terraform configuration files. + +``` +$ cd ec2 +$ terraform init + +Initializing the backend... + +Initializing provider plugins... +- Checking for available provider plugins... +- Downloading plugin for provider "aws" (terraform-providers/aws) 2.16.0... + +The following providers do not have any version constraints in configuration, +so the latest version was installed. + +To prevent automatic upgrades to new major versions that may contain breaking +changes, it is recommended to add version = "..." constraints to the +corresponding provider blocks in configuration, with the constraint strings +suggested below. + +* provider.aws: version = "~> 2.16" + +Terraform has been successfully initialized! + +You may now begin working with Terraform. Try running "terraform plan" to see +any changes that are required for your infrastructure. All Terraform commands +should now work. + +If you ever set or change modules or backend configuration for Terraform, +rerun this command to reinitialize your working directory. If you forget, other +commands will detect it and remind you to do so if necessary. +``` + +## Applying the Configuration + +The [`terraform apply`](https://www.terraform.io/docs/commands/apply.html) command is used to apply the changes required to reach the desired state of the configuration, or the pre-determined set of actions generated by a [`terraform plan`](https://www.terraform.io/docs/commands/plan.html) execution plan. + +``` +$ terraform apply + +An execution plan has been generated and is shown below. +Resource actions are indicated with the following symbols: + + create + +Terraform will perform the following actions: + + # aws_instance.tpot will be created + ... + + # aws_security_group.tpot will be created + ... + +Plan: 2 to add, 0 to change, 0 to destroy. + +Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: +``` + +This will perform the following actions: + +1. Create EC2 security group +2. Start a Debian EC2 instance +3. Update all packages and reboot if necessary +4. Install T-Pot and required dependencies +5. Reboot + +## Connecting to the Instance + +### SSH + +Prior to the final reboot, you will temporarily be able to SSH to port 22 as per standard. Following the reboot, port 22 is used for the honeypot. The *real* SSH server is listening on port **64295** + +### Browser + +https://www.example.com:64297/ + +Replace with the FQDN of your EC2 instance. Refer to the [T-POT documentation](https://github.com/dtag-dev-sec/tpotce#ssh-and-web-access) for further details. diff --git a/cloud/terraform/cloud-init.yaml b/cloud/terraform/cloud-init.yaml new file mode 100644 index 00000000..612f15d3 --- /dev/null +++ b/cloud/terraform/cloud-init.yaml @@ -0,0 +1,25 @@ +#cloud-config +timezone: UTC + +package_update: true +package_upgrade: true +package_reboot_if_required: true + +packages: + - git + +runcmd: + - git clone https://github.com/dtag-dev-sec/tpotce /root/tpot + - /root/tpot/iso/installer/install.sh --type=auto --conf=/root/tpot.conf + - rm /root/tpot.conf + - /sbin/shutdown -r +5 + +# The contents of tpot.conf will be base64 encoded and appended to this file +# via the terraform configuration in main.tf +# +# Make sure there are no trailing new lines after "permissions" below +write_files: + - encoding: b64 + owner: root:root + path: /root/tpot.conf + permissions: '0600' diff --git a/cloud/terraform/ec2/main.tf b/cloud/terraform/ec2/main.tf new file mode 100644 index 00000000..f62481f3 --- /dev/null +++ b/cloud/terraform/ec2/main.tf @@ -0,0 +1,59 @@ +provider "aws" { + region = var.ec2_region +} + +resource "aws_security_group" "tpot" { + name = "T-Pot" + description = "T-Pot Honeypot" + vpc_id = var.ec2_vpc_id + ingress { + from_port = 0 + to_port = 64000 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + ingress { + from_port = 64294 + to_port = 64294 + protocol = "tcp" + cidr_blocks = var.admin_ip + } + ingress { + from_port = 64295 + to_port = 64295 + protocol = "tcp" + cidr_blocks = var.admin_ip + } + ingress { + from_port = 64297 + to_port = 64297 + protocol = "tcp" + cidr_blocks = var.admin_ip + } + egress { + from_port = 0 + to_port = 0 + protocol = "-1" + cidr_blocks = ["0.0.0.0/0"] + } + tags = { + Name = "T-Pot" + } +} + +resource "aws_instance" "tpot" { + ami = var.ec2_ami[var.ec2_region] + instance_type = var.ec2_instance_type + key_name = var.ec2_ssh_key_name + subnet_id = var.ec2_subnet_id + tags = { + Name = "T-Pot Honeypot" + } + root_block_device { + volume_type = "gp2" + volume_size = 128 + delete_on_termination = true + } + user_data = "${file("../cloud-init.yaml")} content: ${base64encode(file("../tpot.conf"))}" + vpc_security_group_ids = [aws_security_group.tpot.id] +} diff --git a/cloud/terraform/ec2/outputs.tf b/cloud/terraform/ec2/outputs.tf new file mode 100644 index 00000000..753a893b --- /dev/null +++ b/cloud/terraform/ec2/outputs.tf @@ -0,0 +1,12 @@ +output "Admin_UI" { + value = "https://${aws_instance.tpot.public_dns}:64294/" +} + +output "SSH_Access" { + value = "ssh -i {private_key_file} -p 64295 admin@${aws_instance.tpot.public_dns}" +} + +output "Web_UI" { + value = "https://${aws_instance.tpot.public_dns}:64297/" +} + diff --git a/cloud/terraform/ec2/variables.tf b/cloud/terraform/ec2/variables.tf new file mode 100644 index 00000000..12e47731 --- /dev/null +++ b/cloud/terraform/ec2/variables.tf @@ -0,0 +1,53 @@ +variable "admin_ip" { + default = ["127.0.0.1/32"] + description = "admin IP addresses in CIDR format" +} + +variable "ec2_vpc_id" { + description = "ID of AWS VPC" + default = "vpc-XXX" +} + +variable "ec2_subnet_id" { + description = "ID of AWS VPC subnet" + default = "subnet-YYY" +} + +variable "ec2_region" { + description = "AWS region to launch servers" + default = "eu-west-1" +} + +variable "ec2_ssh_key_name" { + default = "default" +} + +# https://aws.amazon.com/ec2/instance-types/ +# t3.large = 2 vCPU, 8 GiB RAM +variable "ec2_instance_type" { + default = "t3.large" +} + +# Refer to https://wiki.debian.org/Cloud/AmazonEC2Image/Stretch +variable "ec2_ami" { + type = map(string) + default = { + "ap-northeast-1" = "ami-09fbcd30452841cb9" + "ap-northeast-2" = "ami-08363ccce96df1fff" + "ap-south-1" = "ami-0dc98cbb0d0e49162" + "ap-southeast-1" = "ami-0555b1a5444087dd4" + "ap-southeast-2" = "ami-029c54f988446691a" + "ca-central-1" = "ami-04413a263a7d94982" + "eu-central-1" = "ami-01fb3b7bab31acac5" + "eu-north-1" = "ami-050f04ca573daa1fb" + "eu-west-1" = "ami-0968f6a31fc6cffc0" + "eu-west-2" = "ami-0faa9c9b5399088fd" + "eu-west-3" = "ami-0cd23820af84edc85" + "sa-east-1" = "ami-030580e61468e54bd" + "us-east-1" = "ami-0357081a1383dc76b" + "us-east-2" = "ami-09c10a66337c79669" + "us-west-1" = "ami-0adbaf2e0ce044437" + "us-west-2" = "ami-05a3ef6744aa96514" + } +} + diff --git a/cloud/terraform/ec2/versions.tf b/cloud/terraform/ec2/versions.tf new file mode 100644 index 00000000..d9b6f790 --- /dev/null +++ b/cloud/terraform/ec2/versions.tf @@ -0,0 +1,3 @@ +terraform { + required_version = ">= 0.12" +} diff --git a/cloud/terraform/tpot.conf b/cloud/terraform/tpot.conf new file mode 100644 index 00000000..030f3afd --- /dev/null +++ b/cloud/terraform/tpot.conf @@ -0,0 +1,5 @@ +# tpot configuration file +# myCONF_TPOT_FLAVOR=[STANDARD, SENSOR, INDUSTRIAL, COLLECTOR, NEXTGEN, LEGACY] +myCONF_TPOT_FLAVOR='STANDARD' +myCONF_WEB_USER='webuser' +myCONF_WEB_PW='w3b$ecret' From 4d8149846b01d1718451257bb00aae4efd70c303 Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Tue, 25 Jun 2019 16:42:04 +0100 Subject: [PATCH 2/6] Fix tcp access in security group --- cloud/terraform/ec2/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloud/terraform/ec2/main.tf b/cloud/terraform/ec2/main.tf index f62481f3..468c0238 100644 --- a/cloud/terraform/ec2/main.tf +++ b/cloud/terraform/ec2/main.tf @@ -9,7 +9,7 @@ resource "aws_security_group" "tpot" { ingress { from_port = 0 to_port = 64000 - protocol = "-1" + protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } ingress { From a5236d518fbf93e3b8ea9cb4026c2a092dffe898 Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Tue, 25 Jun 2019 16:42:54 +0100 Subject: [PATCH 3/6] Add udp access to security group --- cloud/terraform/ec2/main.tf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/cloud/terraform/ec2/main.tf b/cloud/terraform/ec2/main.tf index 468c0238..2115718a 100644 --- a/cloud/terraform/ec2/main.tf +++ b/cloud/terraform/ec2/main.tf @@ -12,6 +12,12 @@ resource "aws_security_group" "tpot" { protocol = "tcp" cidr_blocks = ["0.0.0.0/0"] } + ingress { + from_port = 0 + to_port = 64000 + protocol = "udp" + cidr_blocks = ["0.0.0.0/0"] + } ingress { from_port = 64294 to_port = 64294 From cca0a065c769899def46392240530d55cdb489ec Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Wed, 26 Jun 2019 14:15:14 +0100 Subject: [PATCH 4/6] Update README.md to include Terraform --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index 83846c0d..3667574c 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,7 @@ Furthermore we use the following tools - [Post Install Auto](#postinstallauto) - [Cloud Deployments](#cloud) - [Ansible Deployment on Open Telekom Cloud](#ansible-otc) + - [Terraform](#terraform) - [First Run](#firstrun) - [System Placement](#placement) - [Updates](#updates) @@ -335,6 +336,15 @@ The [`deploy_ansible_otc_t-pot.sh`](cloud/open-telekom-cloud/deploy_ansible_otc_ It first creates a new Elastic Cloud Server via the Open Telekom Cloud API and then invokes the Ansible Playbooks to install and configure T-Pot. You can have a look at the script and easily adapt it for other cloud providers. + +### Terraform Configuration + +You can find [Terraform](https://www.terraform.io/) configuration in the [`cloud/terraform`](cloud/terraform) folder. + +This can be used to launch a virtual machine, bootstrap any dependencies and install T-Pot in a single step. + +Configuration for Amazon Web Services (AWS) is currently included and this can easily be extended to support other [Terraform providers](https://www.terraform.io/docs/providers/index.html). + ## First Run The installation requires very little interaction, only a locale and keyboard setting have to be answered for the basic linux installation. The system will reboot and please maintain the active internet connection. The T-Pot installer will start and ask you for an installation type, password for the **tsec** user and credentials for a **web user**. Everything else will be configured automatically. All docker images and other componenents will be downloaded. Depending on your network connection and the chosen installation type, the installation may take some time. During our tests (250Mbit down, 40Mbit up), the installation was usually finished within a 15-30 minute timeframe. From 0c1257b863da1508bf955c051296c14836628a18 Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Wed, 26 Jun 2019 14:19:04 +0100 Subject: [PATCH 5/6] Rename ec2 to aws --- cloud/terraform/README.md | 4 ++-- cloud/terraform/{ec2 => aws}/main.tf | 0 cloud/terraform/{ec2 => aws}/outputs.tf | 0 cloud/terraform/{ec2 => aws}/variables.tf | 0 cloud/terraform/{ec2 => aws}/versions.tf | 0 5 files changed, 2 insertions(+), 2 deletions(-) rename cloud/terraform/{ec2 => aws}/main.tf (100%) rename cloud/terraform/{ec2 => aws}/outputs.tf (100%) rename cloud/terraform/{ec2 => aws}/variables.tf (100%) rename cloud/terraform/{ec2 => aws}/versions.tf (100%) diff --git a/cloud/terraform/README.md b/cloud/terraform/README.md index e17cd5d4..65896523 100644 --- a/cloud/terraform/README.md +++ b/cloud/terraform/README.md @@ -29,7 +29,7 @@ The following resources are NOT automatically created and need to be specified i ### Terraform Variables -In `ec2/variables.tf`, change the following variables to correspond to your existing EC2 infrastructure: +In `aws/variables.tf`, change the following variables to correspond to your existing EC2 infrastructure: * `admin_ip` - source IP address(es) that you will use to administer the system. Connections to TCP ports 64294, 64295 and 64297 will be allowed from this IP only. Multiple IPs or CIDR blocks can be specified in the format: `["127.0.0.1/32", "192.168.0.0/24"]` * `ec2_vpc_id` @@ -52,7 +52,7 @@ This will be used to configure credentials for the T-Pot Kibana interface. Refer The [`terraform init`](https://www.terraform.io/docs/commands/init.html) command is used to initialize a working directory containing Terraform configuration files. ``` -$ cd ec2 +$ cd aws $ terraform init Initializing the backend... diff --git a/cloud/terraform/ec2/main.tf b/cloud/terraform/aws/main.tf similarity index 100% rename from cloud/terraform/ec2/main.tf rename to cloud/terraform/aws/main.tf diff --git a/cloud/terraform/ec2/outputs.tf b/cloud/terraform/aws/outputs.tf similarity index 100% rename from cloud/terraform/ec2/outputs.tf rename to cloud/terraform/aws/outputs.tf diff --git a/cloud/terraform/ec2/variables.tf b/cloud/terraform/aws/variables.tf similarity index 100% rename from cloud/terraform/ec2/variables.tf rename to cloud/terraform/aws/variables.tf diff --git a/cloud/terraform/ec2/versions.tf b/cloud/terraform/aws/versions.tf similarity index 100% rename from cloud/terraform/ec2/versions.tf rename to cloud/terraform/aws/versions.tf From 9db5c92f4d478b68cd2709a8fceb10abe80046e4 Mon Sep 17 00:00:00 2001 From: Prateep Bandharangshi Date: Wed, 26 Jun 2019 14:38:29 +0100 Subject: [PATCH 6/6] Removed LEGACY installation option --- cloud/terraform/tpot.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloud/terraform/tpot.conf b/cloud/terraform/tpot.conf index 030f3afd..f2f3e6a0 100644 --- a/cloud/terraform/tpot.conf +++ b/cloud/terraform/tpot.conf @@ -1,5 +1,5 @@ # tpot configuration file -# myCONF_TPOT_FLAVOR=[STANDARD, SENSOR, INDUSTRIAL, COLLECTOR, NEXTGEN, LEGACY] +# myCONF_TPOT_FLAVOR=[STANDARD, SENSOR, INDUSTRIAL, COLLECTOR, NEXTGEN] myCONF_TPOT_FLAVOR='STANDARD' myCONF_WEB_USER='webuser' myCONF_WEB_PW='w3b$ecret'