diff --git a/.env b/.env index 2f748aca..6f8e8619 100644 --- a/.env +++ b/.env @@ -14,6 +14,18 @@ WEB_USER='change:me' # DISABLED: This is the default and no stealth efforts are in place. TPOT_BLACKHOLE=DISABLED +# T-Pot AttackMap Text Output +# ENABLED: This is the default and the docker container map_data will print events to the console. +# DISABLED: Printing events to the console is disabled. +TPOT_ATTACKMAP_TEXT=ENABLED + +# T-Pot AttackMap Text Output Timezone +# UTC: (T-Pot default) This is usually the best option. +# Continent/City: In Linux you can check our timezone with `readlink` /etc/localtime or +# see the full list here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Examples: America/New_York, Asia/Taipei, Australia/Melbourne, Europe/Athens, Europe/Berlin +TPOT_ATTACKMAP_TEXT_TIMEZONE=UTC + ################################################################################### # NEVER MAKE CHANGES TO THIS SECTION UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!!! # ################################################################################### diff --git a/compose/mac_win.yml b/compose/mac_win.yml index d187971e..4a76ee63 100644 --- a/compose/mac_win.yml +++ b/compose/mac_win.yml @@ -1,3 +1,4 @@ +# T-Pot: MAC_WIN version: '3.9' networks: @@ -26,11 +27,11 @@ networks: services: -############################################# +######################################## #### DEV -############################################## -#### T-Pot Light Init - Never delete this! -############################################## +######################################## +#### T-Pot Init - Never delete this! +######################################## # T-Pot Init Service tpotinit: @@ -227,7 +228,7 @@ services: ports: - "22:22" - "23:23" - image: ${TPOT_REPO}/cowrie:${TPOT_VERSION} + image: ${TPOT_REPO}/cowrie:${TPOT_VERSION} pull_policy: ${TPOT_PULL_POLICY} read_only: true volumes: @@ -615,7 +616,7 @@ services: ################## -#### Tools +#### Tools ################## #### ELK @@ -725,6 +726,8 @@ services: - nginx_local environment: - MAP_COMMAND=DataServer_v2.py + - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT} + - TZ=${TPOT_ATTACKMAP_TEXT_TIMEZONE} stop_signal: SIGKILL tty: true image: ${TPOT_REPO}/map:${TPOT_VERSION} diff --git a/compose/raspberry_showcase.yml b/compose/raspberry_showcase.yml new file mode 100644 index 00000000..63180712 --- /dev/null +++ b/compose/raspberry_showcase.yml @@ -0,0 +1,702 @@ +# T-Pot: RASPBERRY_SHOWCASE +# Note: This docker compose file has been adjusted to limit the number of tools, services and honeypots to run +# T-Pot on a Raspberry Pi 4 (8GB of RAM, SSD) with an enabled desktop environment. +# The standard docker compose file should work mostly fine (depending on traffic) if you do not enable a +# desktop environment such as LXDE and meet the minimum requirements of 8GB and a SSD. +version: '3.9' + +networks: + adbhoney_local: + ciscoasa_local: + citrixhoneypot_local: + conpot_local_IEC104: + conpot_local_guardian_ast: + conpot_local_ipmi: + conpot_local_kamstrup_382: + cowrie_local: + dicompot_local: + dionaea_local: + elasticpot_local: + heralding_local: + ipphoney_local: + mailoney_local: + medpot_local: + redishoneypot_local: + sentrypeer_local: + tanner_local: + spiderfoot_local: + ewsposter_local: + +services: + +######################################### +#### DEV +######################################### +#### T-Pot Init - Never delete this! +######################################### + +# T-Pot Init Service + tpotinit: + container_name: tpotinit + env_file: + - .env + restart: always + tmpfs: + - /tmp/etc:uid=2000,gid=2000 + - /tmp/:uid=2000,gid=2000 + network_mode: "host" + cap_add: + - NET_ADMIN + image: ${TPOT_REPO}/tpotinit:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + volumes: + - ${TPOT_DOCKER_COMPOSE}:/tmp/tpot/docker-compose.yml:ro + - ${TPOT_DATA_PATH}/blackhole:/etc/blackhole + - ${TPOT_DATA_PATH}:/data + + +################## +#### Honeypots +################## + +# Adbhoney service + adbhoney: + container_name: adbhoney + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - adbhoney_local + ports: + - "5555:5555" + image: ${TPOT_REPO}/adbhoney:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/adbhoney/log:/opt/adbhoney/log + - ${TPOT_DATA_PATH}/adbhoney/downloads:/opt/adbhoney/dl + +# Ciscoasa service + ciscoasa: + container_name: ciscoasa + restart: always + depends_on: + logstash: + condition: service_healthy + tmpfs: + - /tmp/ciscoasa:uid=2000,gid=2000 + networks: + - ciscoasa_local + ports: + - "5000:5000/udp" + - "8443:8443" + image: ${TPOT_REPO}/ciscoasa:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/ciscoasa/log:/var/log/ciscoasa + +# CitrixHoneypot service + citrixhoneypot: + container_name: citrixhoneypot + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - citrixhoneypot_local + ports: + - "443:443" + image: ${TPOT_REPO}/citrixhoneypot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/citrixhoneypot/logs:/opt/citrixhoneypot/logs + +# Conpot IEC104 service + conpot_IEC104: + container_name: conpot_iec104 + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - CONPOT_CONFIG=/etc/conpot/conpot.cfg + - CONPOT_JSON_LOG=/var/log/conpot/conpot_IEC104.json + - CONPOT_LOG=/var/log/conpot/conpot_IEC104.log + - CONPOT_TEMPLATE=IEC104 + - CONPOT_TMP=/tmp/conpot + tmpfs: + - /tmp/conpot:uid=2000,gid=2000 + networks: + - conpot_local_IEC104 + ports: + - "161:161/udp" + - "2404:2404" + image: ${TPOT_REPO}/conpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/conpot/log:/var/log/conpot + +# Conpot guardian_ast service + conpot_guardian_ast: + container_name: conpot_guardian_ast + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - CONPOT_CONFIG=/etc/conpot/conpot.cfg + - CONPOT_JSON_LOG=/var/log/conpot/conpot_guardian_ast.json + - CONPOT_LOG=/var/log/conpot/conpot_guardian_ast.log + - CONPOT_TEMPLATE=guardian_ast + - CONPOT_TMP=/tmp/conpot + tmpfs: + - /tmp/conpot:uid=2000,gid=2000 + networks: + - conpot_local_guardian_ast + ports: + - "10001:10001" + image: ${TPOT_REPO}/conpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/conpot/log:/var/log/conpot + +# Conpot ipmi + conpot_ipmi: + container_name: conpot_ipmi + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - CONPOT_CONFIG=/etc/conpot/conpot.cfg + - CONPOT_JSON_LOG=/var/log/conpot/conpot_ipmi.json + - CONPOT_LOG=/var/log/conpot/conpot_ipmi.log + - CONPOT_TEMPLATE=ipmi + - CONPOT_TMP=/tmp/conpot + tmpfs: + - /tmp/conpot:uid=2000,gid=2000 + networks: + - conpot_local_ipmi + ports: + - "623:623/udp" + image: ${TPOT_REPO}/conpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/conpot/log:/var/log/conpot + +# Conpot kamstrup_382 + conpot_kamstrup_382: + container_name: conpot_kamstrup_382 + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - CONPOT_CONFIG=/etc/conpot/conpot.cfg + - CONPOT_JSON_LOG=/var/log/conpot/conpot_kamstrup_382.json + - CONPOT_LOG=/var/log/conpot/conpot_kamstrup_382.log + - CONPOT_TEMPLATE=kamstrup_382 + - CONPOT_TMP=/tmp/conpot + tmpfs: + - /tmp/conpot:uid=2000,gid=2000 + networks: + - conpot_local_kamstrup_382 + ports: + - "1025:1025" + - "50100:50100" + image: ${TPOT_REPO}/conpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/conpot/log:/var/log/conpot + +# Cowrie service + cowrie: + container_name: cowrie + restart: always + depends_on: + logstash: + condition: service_healthy + tmpfs: + - /tmp/cowrie:uid=2000,gid=2000 + - /tmp/cowrie/data:uid=2000,gid=2000 + networks: + - cowrie_local + ports: + - "22:22" + - "23:23" + image: ${TPOT_REPO}/cowrie:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/cowrie/downloads:/home/cowrie/cowrie/dl + - ${TPOT_DATA_PATH}/cowrie/keys:/home/cowrie/cowrie/etc + - ${TPOT_DATA_PATH}/cowrie/log:/home/cowrie/cowrie/log + - ${TPOT_DATA_PATH}/cowrie/log/tty:/home/cowrie/cowrie/log/tty + +# Dicompot service +# Get the Horos Client for testing: https://horosproject.org/ +# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/ +# Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images + dicompot: + container_name: dicompot + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - dicompot_local + ports: + - "11112:11112" + image: ${TPOT_REPO}/dicompot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/dicompot/log:/var/log/dicompot +# - ${TPOT_DATA_PATH}/dicompot/images:/opt/dicompot/images + +# Dionaea service + dionaea: + container_name: dionaea + stdin_open: true + tty: true + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - dionaea_local + ports: + - "20:20" + - "21:21" + - "42:42" + - "69:69/udp" + - "81:81" + - "135:135" + # - "443:443" + - "445:445" + - "1433:1433" + - "1723:1723" + - "1883:1883" + - "3306:3306" + # - "5060:5060" + # - "5060:5060/udp" + # - "5061:5061" + - "27017:27017" + image: ${TPOT_REPO}/dionaea:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp + - ${TPOT_DATA_PATH}/dionaea/roots/tftp:/opt/dionaea/var/dionaea/roots/tftp + - ${TPOT_DATA_PATH}/dionaea/roots/www:/opt/dionaea/var/dionaea/roots/www + - ${TPOT_DATA_PATH}/dionaea/roots/upnp:/opt/dionaea/var/dionaea/roots/upnp + - ${TPOT_DATA_PATH}/dionaea:/opt/dionaea/var/dionaea + - ${TPOT_DATA_PATH}/dionaea/binaries:/opt/dionaea/var/dionaea/binaries + - ${TPOT_DATA_PATH}/dionaea/log:/opt/dionaea/var/log + - ${TPOT_DATA_PATH}/dionaea/rtp:/opt/dionaea/var/dionaea/rtp + +# ElasticPot service + elasticpot: + container_name: elasticpot + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - elasticpot_local + ports: + - "9200:9200" + image: ${TPOT_REPO}/elasticpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log + +# Heralding service + heralding: + container_name: heralding + restart: always + depends_on: + logstash: + condition: service_healthy + tmpfs: + - /tmp/heralding:uid=2000,gid=2000 + networks: + - heralding_local + ports: + # - "21:21" + # - "22:22" + # - "23:23" + # - "25:25" + # - "80:80" + - "110:110" + - "143:143" + # - "443:443" + - "465:465" + - "993:993" + - "995:995" + # - "3306:3306" + # - "3389:3389" + - "1080:1080" + - "5432:5432" + - "5900:5900" + image: ${TPOT_REPO}/heralding:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/heralding/log:/var/log/heralding + +# Honeytrap service + honeytrap: + container_name: honeytrap + restart: always + depends_on: + logstash: + condition: service_healthy + tmpfs: + - /tmp/honeytrap:uid=2000,gid=2000 + network_mode: "host" + cap_add: + - NET_ADMIN + image: ${TPOT_REPO}/honeytrap:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/honeytrap/attacks:/opt/honeytrap/var/attacks + - ${TPOT_DATA_PATH}/honeytrap/downloads:/opt/honeytrap/var/downloads + - ${TPOT_DATA_PATH}/honeytrap/log:/opt/honeytrap/var/log + +# Ipphoney service + ipphoney: + container_name: ipphoney + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - ipphoney_local + ports: + - "631:631" + image: ${TPOT_REPO}/ipphoney:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/ipphoney/log:/opt/ipphoney/log + +# Mailoney service + mailoney: + container_name: mailoney + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - HPFEEDS_SERVER= + - HPFEEDS_IDENT=user + - HPFEEDS_SECRET=pass + - HPFEEDS_PORT=20000 + - HPFEEDS_CHANNELPREFIX=prefix + networks: + - mailoney_local + ports: + - "25:25" + image: ${TPOT_REPO}/mailoney:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/mailoney/log:/opt/mailoney/logs + +# Medpot service + medpot: + container_name: medpot + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - medpot_local + ports: + - "2575:2575" + image: ${TPOT_REPO}/medpot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/medpot/log/:/var/log/medpot + +# Redishoneypot service + redishoneypot: + container_name: redishoneypot + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - redishoneypot_local + ports: + - "6379:6379" + image: ${TPOT_REPO}/redishoneypot:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/redishoneypot/log:/var/log/redishoneypot + +# SentryPeer service + sentrypeer: + container_name: sentrypeer + restart: always + depends_on: + logstash: + condition: service_healthy +# SentryPeer offers to exchange bad actor data via DHT / P2P mode by setting the ENV to true (1) +# In some cases (i.e. internally deployed T-Pots) this might be confusing as SentryPeer will show +# the bad actors in its logs. Therefore this option is opt-in based. +# environment: +# - SENTRYPEER_PEER_TO_PEER=0 + networks: + - sentrypeer_local + ports: +# - "4222:4222/udp" + - "5060:5060/udp" +# - "127.0.0.1:8082:8082" + image: ${TPOT_REPO}/sentrypeer:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/sentrypeer/log:/var/log/sentrypeer + +#### Snare / Tanner +## Tanner Redis Service + tanner_redis: + container_name: tanner_redis + restart: always + depends_on: + logstash: + condition: service_healthy + tty: true + networks: + - tanner_local + image: ${TPOT_REPO}/redis:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + +## PHP Sandbox service + tanner_phpox: + container_name: tanner_phpox + restart: always + depends_on: + logstash: + condition: service_healthy + tty: true + networks: + - tanner_local + image: ${TPOT_REPO}/phpox:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + +## Tanner API Service + tanner_api: + container_name: tanner_api + restart: always + depends_on: + - tanner_redis + tmpfs: + - /tmp/tanner:uid=2000,gid=2000 + tty: true + networks: + - tanner_local + image: ${TPOT_REPO}/tanner:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/tanner/log:/var/log/tanner + command: tannerapi + +## Tanner Service + tanner: + container_name: tanner + restart: always + depends_on: + - tanner_api + - tanner_phpox + tmpfs: + - /tmp/tanner:uid=2000,gid=2000 + tty: true + networks: + - tanner_local + image: ${TPOT_REPO}/tanner:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + command: tanner + read_only: true + volumes: + - ${TPOT_DATA_PATH}/tanner/log:/var/log/tanner + - ${TPOT_DATA_PATH}/tanner/files:/opt/tanner/files + +## Snare Service + snare: + container_name: snare + restart: always + depends_on: + - tanner + tty: true + networks: + - tanner_local + ports: + - "80:80" + image: ${TPOT_REPO}/snare:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + + +################## +#### Tools +################## + +#### ELK +## Elasticsearch service + elasticsearch: + container_name: elasticsearch + restart: always + depends_on: + tpotinit: + condition: service_healthy + environment: + - bootstrap.memory_lock=true + - ES_JAVA_OPTS=-Xms2048m -Xmx2048m + - ES_TMPDIR=/tmp + cap_add: + - IPC_LOCK + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + mem_limit: 4g + ports: + - "127.0.0.1:64298:9200" + image: ${TPOT_REPO}/elasticsearch:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + volumes: + - ${TPOT_DATA_PATH}:/data + +## Logstash service + logstash: + container_name: logstash + restart: always + depends_on: + elasticsearch: + condition: service_healthy + environment: + - LS_JAVA_OPTS=-Xms1024m -Xmx1024m + mem_limit: 2g + image: ${TPOT_REPO}/logstash:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + volumes: + - ${TPOT_DATA_PATH}:/data + +## Map Redis Service + map_redis: + container_name: map_redis + restart: always + depends_on: + logstash: + condition: service_healthy + stop_signal: SIGKILL + tty: true + image: ${TPOT_REPO}/redis:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + +## Map Web Service + map_web: + container_name: map_web + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - MAP_COMMAND=AttackMapServer.py + stop_signal: SIGKILL + tty: true + ports: + - "127.0.0.1:64299:64299" + image: ${TPOT_REPO}/map:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + +## Map Data Service + map_data: + container_name: map_data + restart: always + depends_on: + logstash: + condition: service_healthy + environment: + - MAP_COMMAND=DataServer_v2.py + - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT} + - TZ=${TPOT_ATTACKMAP_TEXT_TIMEZONE} + stop_signal: SIGKILL + tty: true + image: ${TPOT_REPO}/map:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} +#### /ELK + +# Ewsposter service + ewsposter: + container_name: ewsposter + restart: always + depends_on: + logstash: + condition: service_healthy + networks: + - ewsposter_local + environment: + - EWS_HPFEEDS_ENABLE=false + - EWS_HPFEEDS_HOST=host + - EWS_HPFEEDS_PORT=port + - EWS_HPFEEDS_CHANNELS=channels + - EWS_HPFEEDS_IDENT=user + - EWS_HPFEEDS_SECRET=secret + - EWS_HPFEEDS_TLSCERT=false + - EWS_HPFEEDS_FORMAT=json + image: ${TPOT_REPO}/ewsposter:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + volumes: + - ${TPOT_DATA_PATH}:/data + - ${TPOT_DATA_PATH}/ews/conf/ews.ip:/opt/ewsposter/ews.ip + +# Nginx service + nginx: + container_name: nginx + restart: always + environment: + - COCKPIT=${COCKPIT} + - TPOT_OSTYPE=${TPOT_OSTYPE} + depends_on: + tpotinit: + condition: service_healthy + tmpfs: + - /var/tmp/nginx/client_body + - /var/tmp/nginx/proxy + - /var/tmp/nginx/fastcgi + - /var/tmp/nginx/uwsgi + - /var/tmp/nginx/scgi + - /run + - /var/lib/nginx/tmp:uid=100,gid=82 + network_mode: "host" + ports: + - "64297:64297" + - "127.0.0.1:64304:64304" + image: ${TPOT_REPO}/nginx:${TPOT_VERSION} + pull_policy: ${TPOT_PULL_POLICY} + read_only: true + volumes: + - ${TPOT_DATA_PATH}/nginx/cert/:/etc/nginx/cert/:ro + - ${TPOT_DATA_PATH}/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro + - ${TPOT_DATA_PATH}/nginx/log/:/var/log/nginx/ \ No newline at end of file diff --git a/compose/standard.yml b/compose/standard.yml index 0e71767b..7891a028 100644 --- a/compose/standard.yml +++ b/compose/standard.yml @@ -1,3 +1,4 @@ +# T-Pot: STANDARD version: '3.9' networks: @@ -25,11 +26,11 @@ networks: services: -############################################## +######################################### #### DEV -############################################## -#### T-Pot Light Init - Never delete this! -############################################## +######################################### +#### T-Pot Init - Never delete this! +######################################### # T-Pot Init Service tpotinit: @@ -227,7 +228,7 @@ services: ports: - "22:22" - "23:23" - image: ${TPOT_REPO}/cowrie:${TPOT_VERSION} + image: ${TPOT_REPO}/cowrie:${TPOT_VERSION} pull_policy: ${TPOT_PULL_POLICY} read_only: true volumes: @@ -631,7 +632,7 @@ services: ################## -#### Tools +#### Tools ################## #### ELK @@ -729,6 +730,8 @@ services: condition: service_healthy environment: - MAP_COMMAND=DataServer_v2.py + - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT} + - TZ=${TPOT_ATTACKMAP_TEXT_TIMEZONE} stop_signal: SIGKILL tty: true image: ${TPOT_REPO}/map:${TPOT_VERSION} diff --git a/docker-compose.yml b/docker-compose.yml index 0e71767b..fa82ce47 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,3 +1,4 @@ +# T-Pot: STANDARD version: '3.9' networks: @@ -25,11 +26,11 @@ networks: services: -############################################## +######################################### #### DEV -############################################## -#### T-Pot Light Init - Never delete this! -############################################## +######################################### +#### T-Pot Init - Never delete this! +######################################### # T-Pot Init Service tpotinit: @@ -729,6 +730,8 @@ services: condition: service_healthy environment: - MAP_COMMAND=DataServer_v2.py + - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT} + - TZ=${TPOT_ATTACKMAP_TEXT_TIMEZONE} stop_signal: SIGKILL tty: true image: ${TPOT_REPO}/map:${TPOT_VERSION} diff --git a/docker/elk/map/Dockerfile b/docker/elk/map/Dockerfile index 8d9510b8..676b5a11 100644 --- a/docker/elk/map/Dockerfile +++ b/docker/elk/map/Dockerfile @@ -7,15 +7,15 @@ FROM alpine:3.17 RUN apk -U --no-cache add \ build-base \ git \ - libcap \ - py3-pip \ + libcap \ + py3-pip \ python3 \ python3-dev && \ # # Install from GitHub and setup mkdir -p /opt && \ cd /opt/ && \ - git clone https://github.com/t3chn0m4g3/t-pot-attack-map -b 2.0.1 && \ + git clone https://github.com/t3chn0m4g3/t-pot-attack-map -b 2.1.0 && \ cd t-pot-attack-map && \ # git checkout eaf8d123d72a62e4c12093e4e8487e10e6ef60f3 && \ # git branch -a && \ @@ -36,6 +36,7 @@ RUN apk -U --no-cache add \ rm -rf /root/* /var/cache/apk/* /opt/t-pot-attack-map/.git # # Start T-Pot-Attack-Map +ENV TZ=UTC STOPSIGNAL SIGINT USER map:map WORKDIR /opt/t-pot-attack-map diff --git a/env.example b/env.example index b2d27eb2..14ea7275 100644 --- a/env.example +++ b/env.example @@ -14,6 +14,18 @@ WEB_USER='change:me' # DISABLED: This is the default and no stealth efforts are in place. TPOT_BLACKHOLE=DISABLED +# T-Pot AttackMap Text Output +# ENABLED: This is the default and the docker container map_data will print events to the console. +# DISABLED: Printing events to the console is disabled. +TPOT_ATTACKMAP_TEXT=ENABLED + +# T-Pot AttackMap Text Output Timezone +# UTC: (T-Pot default) This is usually the best option. +# Continent/City: In Linux you can check our timezone with `readlink` /etc/localtime or +# see the full list here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones +# Examples: America/New_York, Asia/Taipei, Australia/Melbourne, Europe/Athens, Europe/Berlin +TPOT_ATTACKMAP_TEXT_TIMEZONE=UTC + ################################################################################### # NEVER MAKE CHANGES TO THIS SECTION UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!!! # ###################################################################################