mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-01 04:22:11 +00:00
continue working on readme
This commit is contained in:
Marco Ochse
GitHub
parent
0c8ea5576f
commit
972e5f5085
1 changed files with 95 additions and 85 deletions
180
README.md
180
README.md
|
|
@ -110,21 +110,24 @@ Seeing is believing :bowtie:
|
|||
- A low interaction RDP honeypot
|
||||
* [vnclowpot](https://github.com/magisterquis/vnclowpot)
|
||||
- A low interaction VNC honeypot
|
||||
- **Persistence** is now enabled by default and will keep honeypot logs and tools data in `/data/` and its sub-folders by default for 30 days. You may change that behavior in `/etc/tpot/logrotate/logrotate.conf`. ELK data however will be kept for 90 days by default. You may change that behavior in `/etc/tpot/curator/actions.yml`. Scripts will be triggered through `/etc/crontab`.
|
||||
- **Updates**
|
||||
- **Docker** was updated to the latest **1.12.6** release within Ubuntu 16.04.x LTS
|
||||
- **ELK** was updated to the latest **Kibana 5.5.2**, **Elasticsearch 5.5.2** and **Logstash 5.5.2** releases.
|
||||
- **Suricata** was updated to the latest **4.0.0** version including the latest **Emerging Threats** community ruleset.
|
||||
|
||||
- **Dashboards Makeover**
|
||||
- We now have **150 Visualizations** pre-configured and compiled to 14 individual **Kibana Dashboards** for every honeypot. Monitor all *honeypot events* locally on your T-Pot installation. Aside from *honeypot events* you can also view *Suricata NSM, Syslog and NGINX* events for a quick overview of local host events.
|
||||
- We now have **160+ Visualizations** pre-configured and compiled to 14 individual **Kibana Dashboards** for every honeypot. Monitor all *honeypot events* locally on your T-Pot installation. Aside from *honeypot events* you can also view *Suricata NSM, Syslog and NGINX* events for a quick overview of local host events.
|
||||
- View available IP reputation of any source IP address
|
||||
- View available CVE ID for events
|
||||
- More **Smart links** are now included.
|
||||
|
||||
<a name="concept"></a>
|
||||
# Technical Concept
|
||||
|
||||
T-Pot is based on the network installer of Ubuntu Server 16.04 LTS.
|
||||
The honeypot daemons as well as other support components being used have been paravirtualized using [docker](http://docker.io).
|
||||
This allows us to run multiple honeypot daemons on the same network interface without problems and thus making the entire system very low maintenance. <br>The encapsulation of the honeypot daemons in docker provides a good isolation of the runtime environments and easy update mechanisms.
|
||||
T-Pot is based on the network installer of Ubuntu Server 16.04.x LTS.
|
||||
The honeypot daemons as well as other support components being used have been containerized using [docker](http://docker.io).
|
||||
This allows us to run multiple honeypot daemons on the same network interface while maintaining a small footprint and constrain each honeypot within its own environment.
|
||||
|
||||
In T-Pot we combine the dockerized honeypots
|
||||
[conpot](http://conpot.org/),
|
||||
|
|
@ -132,27 +135,34 @@ In T-Pot we combine the dockerized honeypots
|
|||
[dionaea](https://github.com/DinoTools/dionaea),
|
||||
[elasticpot](https://github.com/schmalle/ElasticPot),
|
||||
[emobility](https://github.com/dtag-dev-sec/emobility),
|
||||
[glastopf](http://glastopf.org/) and
|
||||
[honeytrap](https://github.com/armedpot/honeytrap/) with
|
||||
[suricata](http://suricata-ids.org/) a Network Security Monitoring engine and the
|
||||
[ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot. Events will be correlated by our own data submission tool [ewsposter](https://github.com/dtag-dev-sec/ews) which also supports Honeynet project hpfeeds honeypot data sharing.
|
||||
[glastopf](http://glastopf.org/),
|
||||
[honeytrap](https://github.com/armedpot/honeytrap/),
|
||||
[mailoney](https://github.com/awhitehatter/mailoney),
|
||||
[rdpy](https://github.com/citronneur/rdpy) and
|
||||
[vnclowpot](https://github.com/magisterquis/vnclowpot) with
|
||||
[ELK stack](https://www.elastic.co/videos) to beautifully visualize all the events captured by T-Pot,
|
||||
[Elasticsearch Head](https://mobz.github.io/elasticsearch-head/) a web front end for browsing and interacting with an Elastic Search cluster,
|
||||
[Netdata](http://my-netdata.io/) for real-time performance monitoring,
|
||||
[Portainer](http://portainer.io/) a web based UI for docker,
|
||||
[Spiderfoot](https://github.com/smicallef/spiderfoot) a open source intelligence automation tool,
|
||||
[Suricata](http://suricata-ids.org/) a Network Security Monitoring engine and
|
||||
[Wetty](https://github.com/krishnasrinivas/wetty) a web based SSH client.
|
||||
|
||||
|
||||
|
||||
All data in docker is volatile. Once a docker container crashes, all data produced within its environment is gone and a fresh instance is restarted. Hence, for some data that needs to be persistent, i.e. config files, we have a persistent storage **`/data/`** on the host in order to make it available and persistent across container or system restarts.<br>
|
||||
Important log data is now also stored outside the container in `/data/<container-name>` allowing easy access to logs from within the host and. The **systemd** scripts have been adjusted to support storing data on the host either volatile (*default*) or persistent (adjust individual systemd scripts in `/etc/systemd/system` or use a global setting in `/usr/bin/clear.sh`).
|
||||
While data within docker containers is volatile we do now ensure a default 30 day persistence of all relevant honeypot and tool data in the well known `/data` folder and sub-folders. The persistence configuration may be adjusted in `/etc/tpot/logrotate/logrotate.conf`. Once a docker container crashes, all other data produced within its environment is erased and a fresh instance is started from the corresponding docker image.<br>
|
||||
|
||||
Basically, what happens when the system is booted up is the following:
|
||||
|
||||
- start host system
|
||||
- start all the necessary services (i.e. docker-engine, reverse proxy, etc.)
|
||||
- start all docker containers (honeypots, nms, elk)
|
||||
- start all docker containers via docker-compose (honeypots, nms, elk)
|
||||
|
||||
Within the T-Pot project, we provide all the tools and documentation necessary to build your own honeypot system and contribute to our [community data view](http://sicherheitstacho.eu/?peers=communityPeers), a separate channel on our [Sicherheitstacho](http://sicherheitstacho.eu) that is powered by T-Pot community data.
|
||||
|
||||
The source code and configuration files are stored in individual GitHub repositories, which are linked below. The docker images are tailored to be run in this environment. If you want to run the docker images separately, make sure you study the upstart scripts, as they provide an insight on how we configured them.
|
||||
The source code and configuration files are stored in individual GitHub repositories, which are linked below. The docker images are pre-configured for the T-Pot environment. If you want to run the docker images separately, make sure you study the docker-compose configuration (`/etc/tpot/tpot.yml`) and the T-Pot systemd script (`/etc/systemd/system/tpot.service`), as they provide a good starting point for implementing changes.
|
||||
|
||||
The individual docker configurations etc. we used can be found here:
|
||||
The individual docker configurations are located in the following GitHub repositories:
|
||||
|
||||
- [conpot](https://github.com/dtag-dev-sec/conpot)
|
||||
- [cowrie](https://github.com/dtag-dev-sec/cowrie)
|
||||
|
|
@ -160,63 +170,65 @@ The individual docker configurations etc. we used can be found here:
|
|||
- [elasticpot](https://github.com/dtag-dev-sec/elasticpot)
|
||||
- [elk-stack](https://github.com/dtag-dev-sec/elk)
|
||||
- [emobility](https://github.com/dtag-dev-sec/emobility)
|
||||
- [ewsposter](https://github.com/dtag-dev-sec/ews)
|
||||
- [glastopf](https://github.com/dtag-dev-sec/glastopf)
|
||||
- [honeytrap](https://github.com/dtag-dev-sec/honeytrap)
|
||||
- [mailoney](https://github.com/dtag-dev-sec/mailoney)
|
||||
- [netdata](https://github.com/dtag-dev-sec/netdata)
|
||||
- [portainer](https://github.com/dtag-dev-sec/ui-for-docker)
|
||||
- [suricata](https://github.com/dtag-dev-sec/suricata)
|
||||
- [rdpy](https://github.com/dtag-dev-sec/rdpy)
|
||||
- [spiderfoot](https://github.com/dtag-dev-sec/spiderfoot)
|
||||
- [suricata & p0f](https://github.com/dtag-dev-sec/suricata)
|
||||
- [vnclowpot](https://github.com/dtag-dev-sec/vnclowpot)
|
||||
|
||||
<a name="requirements"></a>
|
||||
# System Requirements
|
||||
Depending on your installation type, whether you install on [real hardware](#hardware) or in a [virtual machine](#vm), make sure your designated T-Pot system meets the following requirements:
|
||||
|
||||
##### T-Pot Installation (Cowrie, Dionaea, ElasticPot, Glastopf, Honeytrap, ELK, Suricata+P0f & Tools)
|
||||
##### T-Pot Installation (Cowrie, Dionaea, ElasticPot, Glastopf, Honeytrap, Mailoney, Rdpy, Vnclowpot, ELK, Suricata+P0f & Tools)
|
||||
When installing the T-Pot ISO image, make sure the target system (physical/virtual) meets the following minimum requirements:
|
||||
|
||||
- 4 GB RAM (6-8 GB recommended)
|
||||
- 64 GB disk (128 GB SSD recommended)
|
||||
- 64 GB SSD (128 GB SSD recommended)
|
||||
- Network via DHCP
|
||||
- A working internet connection
|
||||
- A working, non-proxied, internet connection
|
||||
|
||||
##### Sensor Installation (Cowrie, Dionaea, ElasticPot, Glastopf, Honeytrap)
|
||||
When installing the T-Pot ISO image, make sure the target system (physical/virtual) meets the following minimum requirements:
|
||||
|
||||
- 3 GB RAM (4-6 GB recommended)
|
||||
- 64 GB disk (64 GB SSD recommended)
|
||||
- 64 GB SSD (64 GB SSD recommended)
|
||||
- Network via DHCP
|
||||
- A working internet connection
|
||||
- A working, non-proxied, internet connection
|
||||
|
||||
##### Industrial Installation (ConPot, eMobility, ELK, Suricata+P0f & Tools)
|
||||
When installing the T-Pot ISO image, make sure the target system (physical/virtual) meets the following minimum requirements:
|
||||
|
||||
- 4 GB RAM (8 GB recommended)
|
||||
- 64 GB disk (128 GB SSD recommended)
|
||||
- 64 GB SSD (128 GB SSD recommended)
|
||||
- Network via DHCP
|
||||
- A working internet connection
|
||||
- A working, non-proxied, internet connection
|
||||
|
||||
##### Everything Installation (Everything, all of the above)
|
||||
When installing the T-Pot ISO image, make sure the target system (physical/virtual) meets the following minimum requirements:
|
||||
|
||||
- 8 GB RAM
|
||||
- 128 GB disk or larger (128 GB SSD or larger recommended)
|
||||
- 8+ GB RAM
|
||||
- 128+ GB SSD
|
||||
- Network via DHCP
|
||||
- A working internet connection
|
||||
- A working, non-proxied, internet connection
|
||||
|
||||
<a name="installation"></a>
|
||||
# Installation
|
||||
The installation of T-Pot is straight forward. Please be advised that you should have an internet connection up and running as all all the docker images for the chosen installation type need to be pulled from docker hub.
|
||||
The installation of T-Pot is straight forward and heavily depends on a working, transparent and non-proxied up and running internet connection. Otherwise the installation **will fail!**
|
||||
|
||||
Firstly, decide if you want to download our prebuilt installation ISO image [tpot.iso](http://community-honeypot.de/tpot.iso) ***or*** [create it yourself](#createiso).
|
||||
Firstly, decide if you want to download our prebuilt installation ISO image from [GitHub](https://github.com/dtag-dev-sec/tpotce/releases) ***or*** [create it yourself](#createiso).
|
||||
|
||||
Secondly, decide where you want to let the system run: [real hardware](#hardware) or in a [virtual machine](#vm)?
|
||||
|
||||
<a name="prebuilt"></a>
|
||||
## Prebuilt ISO Image
|
||||
We provide an installation ISO image for download (~50MB), which is created using the same [tool](https://github.com/dtag-dev-sec/tpotce) you can use yourself in order to create your own image. It will basically just save you some time downloading components and creating the ISO image.
|
||||
You can download the prebuilt installation image [here](http://community-honeypot.de/tpot.iso) and jump to the [installation](#vm) section. The ISO image is hosted by our friends from [Strato](http://www.strato.de) / [Cronon](http://www.cronon.de).
|
||||
|
||||
sha256sum tpot.iso
|
||||
df6b1db24d0dcc421125dc973fbb2d17aa91cd9ff94607dde9d1b09a92bcbaf0 tpot.iso
|
||||
You can download the prebuilt installation image from [GitHub](https://github.com/dtag-dev-sec/tpotce/releases) and jump to the [installation](#vm) section.
|
||||
|
||||
<a name="createiso"></a>
|
||||
## Create your own ISO Image
|
||||
|
|
@ -231,15 +243,15 @@ For transparency reasons and to give you the ability to customize your install,
|
|||
**How to create the ISO image:**
|
||||
|
||||
1. Clone the repository and enter it.
|
||||
|
||||
git clone https://github.com/dtag-dev-sec/tpotce.git
|
||||
cd tpotce
|
||||
|
||||
```
|
||||
git clone https://github.com/dtag-dev-sec/tpotce
|
||||
cd tpotce
|
||||
```
|
||||
2. Invoke the script that builds the ISO image.
|
||||
The script will download and install dependencies necessary to build the image on the invoking machine. It will further download the ubuntu network installer image (~50MB) which T-Pot is based on.
|
||||
|
||||
sudo ./makeiso.sh
|
||||
|
||||
```
|
||||
sudo ./makeiso.sh
|
||||
```
|
||||
After a successful build, you will find the ISO image `tpot.iso` along with a SHA256 checksum `tpot.sha256`in your directory.
|
||||
|
||||
<a name="vm"></a>
|
||||
|
|
@ -250,9 +262,9 @@ We successfully tested T-Pot with [VirtualBox](https://www.virtualbox.org) and [
|
|||
|
||||
It is important to make sure you meet the [system requirements](#requirements) and assign a virtual harddisk >=64 GB, >=4 GB RAM and bridged networking to T-Pot.
|
||||
|
||||
You need to enable promiscuous mode for the network interface for suricata to work properly. Make sure you enable it during configuration.
|
||||
You need to enable promiscuous mode for the network interface for suricata and p0f to work properly. Make sure you enable it during configuration.
|
||||
|
||||
If you want to use a wifi card as primary NIC for T-Pot, please remind that not all network interface drivers support all wireless cards. E.g. in VirtualBox, you then have to choose the *"MT SERVER"* model of the NIC.
|
||||
If you want to use a wifi card as primary NIC for T-Pot, please be aware of the fact that not all network interface drivers support all wireless cards. E.g. in VirtualBox, you then have to choose the *"MT SERVER"* model of the NIC.
|
||||
|
||||
Lastly, mount the `tpot.iso` ISO to the VM and continue with the installation.<br>
|
||||
|
||||
|
|
@ -270,9 +282,9 @@ Whereas most CD burning tools allow you to burn from ISO images, the procedure t
|
|||
|
||||
<a name="firstrun"></a>
|
||||
## First Run
|
||||
The installation requires very little interaction, only some locales and keyboard settings have to be answered. Everything else will be configured automatically. The system will reboot two times. Make sure it can access the internet as it needs to download the updates and the dockerized honeypot components. Depending on your network connection and the chosen installation type, the installation may take some time. During our tests (50Mbit down, 10Mbit up), the installation is usually finished within <=30 minutes.
|
||||
The installation requires very little interaction, only a locale and keyboard setting has to be answered for the basic linux installation. The system will reboot and please maintain an active internet connection. The T-Pot installer will start and ask you for an installation type, password for the **tsec** user and credentials for a **web user**. Everything else will be configured automatically. All docker images and other componenents will be downloaded. Depending on your network connection and the chosen installation type, the installation may take some time. During our tests (50Mbit down, 10Mbit up), the installation is usually finished within a 30 minute timeframe.
|
||||
|
||||
Once the installation is finished, the system will automatically reboot and you will be presented with the T-Pot login screen. The user credentials for the first login are:
|
||||
Once the installation is finished, the system will automatically reboot and you will be presented with the T-Pot login screen. On the console you may login with the **tsec** user:
|
||||
|
||||
- user: **tsec**
|
||||
- pass: **password you chose during the installation**
|
||||
|
|
@ -287,21 +299,9 @@ You can also login from your browser: ``https://<your.ip>:64297``
|
|||
|
||||
<a name="placement"></a>
|
||||
# System Placement
|
||||
Make sure your system is reachable through the internet. Otherwise it will not capture any attacks, other than the ones from your hostile internal network! We recommend you put it in an unfiltered zone, where all TCP and UDP traffic is forwarded to T-Pot's network interface.
|
||||
|
||||
If you are behind a NAT gateway (e.g. home router), here is a list of ports that should be forwarded to T-Pot.
|
||||
|
||||
| Honeypot|Transport|Forwarded ports|
|
||||
|---|---|---|
|
||||
| conpot | TCP | 1025, 50100 |
|
||||
| cowrie | TCP | 22, 23 |
|
||||
| dionaea | TCP | 21, 42, 135, 443, 445, 1433, 1723, 1883, 1900, 3306, 5060, 5061, 8081, 11211 |
|
||||
| dionaea | UDP | 69, 5060 |
|
||||
| elasticpot | TCP | 9200 |
|
||||
| emobility | TCP | 8080 |
|
||||
| glastopf | TCP | 80 |
|
||||
| honeytrap | TCP | 25, 110, 139, 3389, 4444, 4899, 5900, 21000 |
|
||||
Make sure your system is reachable through the internet. Otherwise it will not capture any attacks, other than the ones from your internal network! We recommend you put it in an unfiltered zone, where all TCP and UDP traffic is forwarded to T-Pot's network interface.
|
||||
|
||||
A list of all relevant ports is available as part of the [Technical Concept](#concept)
|
||||
<br>
|
||||
|
||||
Basically, you can forward as many TCP ports as you want, as honeytrap dynamically binds any TCP port that is not covered by the other honeypot daemons.
|
||||
|
|
@ -309,8 +309,7 @@ Basically, you can forward as many TCP ports as you want, as honeytrap dynamical
|
|||
In case you need external SSH access, forward TCP port 64295 to T-Pot, see below.
|
||||
In case you need external web access, forward TCP port 64297 to T-Pot, see below.
|
||||
|
||||
T-Pot requires outgoing http and https connections for updates (ubuntu, docker) and attack submission (ewsposter, hpfeeds).
|
||||
|
||||
T-Pot requires outgoing git, http, https connections for updates (Ubuntu, Docker, GitHub, PyPi) and attack submission (ewsposter, hpfeeds). Ports and availability may vary based on your geographical location.
|
||||
|
||||
<a name="options"></a>
|
||||
# Options
|
||||
|
|
@ -329,7 +328,7 @@ If you do not have a SSH client at hand and still want to access the machine via
|
|||
|
||||
and choose **WebSSH** from the navigation bar. You will be prompted to allow access for this connection and enter the password for the user **tsec**.
|
||||
|
||||
|
||||
|
||||
|
||||
<a name="kibana"></a>
|
||||
## Kibana Dashboard
|
||||
|
|
@ -338,47 +337,60 @@ Just open a web browser and access and connect to `https://<your.ip>:64297`, ent
|
|||
- user: **user you chose during the installation**
|
||||
- pass: **password you chose during the installation**
|
||||
|
||||
and the **Kibana dashboard** will automagically load. The Kibana dashboard can be customized to fit your needs. By default, we haven't added any filtering, because the filters depend on your setup. E.g. you might want to filter out your incoming administrative ssh connections and connections to update servers.
|
||||
and **Kibana** will automagically load. The Kibana dashboard can be customized to fit your needs. By default, we haven't added any filtering, because the filters depend on your setup. E.g. you might want to filter out your incoming administrative ssh connections and connections to update servers.
|
||||
|
||||
|
||||
|
||||
|
||||
<a name="tools"></a>
|
||||
## Tools
|
||||
We included some web based management tools to improve and ease up on your daily tasks.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<a name="maintenance"></a>
|
||||
## Maintenance
|
||||
As mentioned before, the system was designed to be low maintenance. Basically, there is nothing you have to do but let it run. If one of the dockerized daemon fails, it will restart. If this fails, the regarding upstart job will be restarted.
|
||||
As mentioned before, the system was designed to be low maintenance. Basically, there is nothing you have to do but let it run.
|
||||
|
||||
If you run into any problems, a reboot may fix it. ;)
|
||||
If you run into any problems, a reboot may fix it :bowtie:
|
||||
|
||||
If new versions of the components involved appear, we will test them and build new docker images. Those new docker images will be pushed to docker hub and downloaded to T-Pot and activated accordingly.
|
||||
|
||||
<a name="submission"></a>
|
||||
## Community Data Submission
|
||||
We provide T-Pot in order to make it accessible to all parties interested in honeypot deployment. By default, the data captured is submitted to a community backend. This community backend uses the data to feed a [community data view](http://sicherheitstacho.eu/?peers=communityPeers), a separate channel on our own [Sicherheitstacho](http://sicherheitstacho.eu), which is powered by our own set of honeypots.
|
||||
You may opt out the submission to our community server by disabling it in the `[EWS]`-section of the config file `/data/ews/conf/ews.cfg`.
|
||||
|
||||
Further we support [hpfeeds](https://github.com/rep/hpfeeds). It is disabled by default since you need to supply a channel you want to post to and enter your user credentials. To enable hpfeeds, edit the config file `/data/ews/conf/ews.cfg`, section `[HPFEED]` and set it to true.
|
||||
You may opt out the submission to our community server by removing the `# Ewsposter service` from `/etc/tpot/tpot.yml`:
|
||||
1. Stop T-Pot services: `systemctl stop tpot`
|
||||
2. Remove Ewsposter service: `vi /etc/tpot/tpot.yml`
|
||||
3. Remove the following lines, save and exit vi (`:x!`):<br>
|
||||
```
|
||||
# Ewsposter service
|
||||
ewsposter:
|
||||
container_name: ewsposter
|
||||
restart: always
|
||||
networks:
|
||||
- ewsposter_local
|
||||
image: "dtagdevsec/ewsposter:1710"
|
||||
volumes:
|
||||
- /data:/data
|
||||
- /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
|
||||
```
|
||||
4. Start T-Pot services: `systemctl start tpot`
|
||||
|
||||
Data is submitted in a structured ews-format, a XML stucture. Hence, you can parse out the information that is relevant to you.
|
||||
|
||||
We encourage you not to disable the data submission as it is the main purpose of the community approach - as you all know **sharing is caring** 😍
|
||||
|
||||
The *`/data/ews/conf/ews.cfg`* file contains many configuration parameters required for the system to run. You can - if you want - add an email address, that will be included with your submissions, in order to be able to identify your requests later. Further you can add a proxy.
|
||||
Please do not change anything other than those settings and only if you absolutely need to. Otherwise, the system may not work as expected.
|
||||
|
||||
<a name="roadmap"></a>
|
||||
# Roadmap
|
||||
As with every development there is always room for improvements ...
|
||||
|
||||
- Bump ELK-stack to 5.0
|
||||
- Move from Glastopf to SNARE
|
||||
- Documentation 😎
|
||||
- Bump ELK-stack to 6.x
|
||||
- Introduce new honeypots
|
||||
- Include automatic updates
|
||||
|
||||
Some features may be provided with updated docker images, others may require some hands on from your side.
|
||||
|
||||
|
|
@ -391,10 +403,6 @@ You are always invited to participate in development on our [GitHub](https://git
|
|||
- You install and you run within your responsibility. Choose your deployment wisely as a system compromise can never be ruled out.
|
||||
- Honeypots should - by design - not host any sensitive data. Make sure you don't add any.
|
||||
- By default, your data is submitted to the community dashboard. You can disable this in the config. But hey, wouldn't it be better to contribute to the community?
|
||||
- By default, hpfeeds submission is disabled. You can enable it in the config section for hpfeeds. This is due to the nature of hpfeeds. We do not want to spam any channel, so you can choose where to post your data and who to share it with.
|
||||
- Malware submission is enabled by default but malware is currently not processed on the submission backend. This may be added later, but can also be disabled in the `ews.cfg` config file.
|
||||
- The system restarts the docker containers every night to avoid clutter and reduce disk consumption. *All data in the container is then reset.* The data displayed in kibana is kept for <=90 days.
|
||||
|
||||
|
||||
<a name="faq"></a>
|
||||
# FAQ
|
||||
|
|
@ -409,7 +417,7 @@ For general feedback you can write to cert @ telekom.de.
|
|||
|
||||
<a name="licenses"></a>
|
||||
# Licenses
|
||||
The software that T-Pot is built on, uses the following licenses.
|
||||
The software that T-Pot is built on uses the following licenses.
|
||||
<br>GPLv2: [conpot (by Lukas Rist)](https://github.com/mushorg/conpot/blob/master/LICENSE.txt), [dionaea](https://github.com/DinoTools/dionaea/blob/master/LICENSE), [honeytrap (by Tillmann Werner)](https://github.com/armedpot/honeytrap/blob/master/LICENSE), [suricata](http://suricata-ids.org/about/open-source/)
|
||||
<br>GPLv3: [elasticpot (by Markus Schmall)](https://github.com/schmalle/ElasticPot), [emobility (by Mohamad Sbeiti)](https://github.com/dtag-dev-sec/emobility/blob/master/LICENSE), [ewsposter (by Markus Schroer)](https://github.com/dtag-dev-sec/ews/), [glastopf (by Lukas Rist)](https://github.com/glastopf/glastopf/blob/master/GPL), [netdata](https://github.com/firehol/netdata/blob/master/LICENSE.md)
|
||||
<br>Apache 2 License: [elasticsearch](https://github.com/elasticsearch/elasticsearch/blob/master/LICENSE.txt), [logstash](https://github.com/elasticsearch/logstash/blob/master/LICENSE), [kibana](https://github.com/elasticsearch/kibana/blob/master/LICENSE.md), [docker] (https://github.com/docker/docker/blob/master/LICENSE), [elasticsearch-head](https://github.com/mobz/elasticsearch-head/blob/master/LICENCE)
|
||||
|
|
@ -422,7 +430,7 @@ The software that T-Pot is built on, uses the following licenses.
|
|||
# Credits
|
||||
Without open source and the fruitful development community we are proud to be a part of T-Pot would not have been possible. Our thanks are extended but not limited to the following people and organizations:
|
||||
|
||||
###The developers and development communities of
|
||||
### The developers and development communities of
|
||||
|
||||
* [conpot](https://github.com/mushorg/conpot/graphs/contributors)
|
||||
* [cowrie](https://github.com/micheloosterhof/cowrie/graphs/contributors)
|
||||
|
|
@ -434,19 +442,21 @@ Without open source and the fruitful development community we are proud to be a
|
|||
* [emobility](https://github.com/dtag-dev-sec/emobility/graphs/contributors)
|
||||
* [ewsposter](https://github.com/armedpot/ewsposter/graphs/contributors)
|
||||
* [glastopf](https://github.com/mushorg/glastopf/graphs/contributors)
|
||||
* [heatmap](https://github.com/stormpython/heatmap/graphs/contributors)
|
||||
* [honeytrap](https://github.com/armedpot/honeytrap/graphs/contributors)
|
||||
* [kibana](https://github.com/elastic/kibana/graphs/contributors)
|
||||
* [logstash](https://github.com/elastic/logstash/graphs/contributors)
|
||||
* [mailoney](https://github.com/awhitehatter/mailoney)
|
||||
* [netdata](https://github.com/firehol/netdata/graphs/contributors)
|
||||
* [p0f](http://lcamtuf.coredump.cx/p0f3/)
|
||||
* [portainer](https://github.com/portainer/portainer/graphs/contributors)
|
||||
* [rdpy](https://github.com/citronneur/rdpy)
|
||||
* [spiderfoot](https://github.com/smicallef/spiderfoot)
|
||||
* [suricata](https://github.com/inliniac/suricata/graphs/contributors)
|
||||
* [tagcloud](https://github.com/stormpython/tagcloud/graphs/contributors)
|
||||
* [ubuntu](http://www.ubuntu.com/)
|
||||
* [vnclowpot](https://github.com/magisterquis/vnclowpot)
|
||||
* [wetty](https://github.com/krishnasrinivas/wetty/graphs/contributors)
|
||||
|
||||
###The following companies and organizations
|
||||
### The following companies and organizations
|
||||
* [cannonical](http://www.canonical.com/)
|
||||
* [docker](https://www.docker.com/)
|
||||
* [elastic.io](https://www.elastic.co/)
|
||||
|
|
@ -458,9 +468,9 @@ Without open source and the fruitful development community we are proud to be a
|
|||
|
||||
<a name="staytuned"></a>
|
||||
# Stay tuned ...
|
||||
We will be releasing a new version of T-Pot about every 6 months.
|
||||
We will be releasing a new version of T-Pot about every 6-12 months.
|
||||
|
||||
<a name="funfact"></a>
|
||||
# Fun Fact
|
||||
|
||||
Coffee just does not cut it anymore which is why we needed a different caffeine source and consumed *107* bottles of [Club Mate](https://de.wikipedia.org/wiki/Club-Mate) during the development of T-Pot 16.10 😇
|
||||
Coffee just does not cut it anymore which is why we needed a different caffeine source and consumed *215* bottles of [Club Mate](https://de.wikipedia.org/wiki/Club-Mate) during the development of T-Pot 17.10 😇
|
||||
|
|
|
|||
Loading…
Reference in a new issue