tweaking

healthcheck, watch pid not cpu
cleanup dockerfiles
bump dicompot, heralding, elasticpot, endlessh to alpine 3.19
bump dionaea, heralding to latest master

docker/adbhoney/Dockerfile

@@ -17,7 +17,7 @@ RUN apk --no-cache -U add \
 #    git checkout 2417a7a982f4fd527b3a048048df9a23178767ad && \
     git checkout 42afd98611724ca3d694a48b694c957e8d953db4 && \
     cp /root/dist/adbhoney.cfg /opt/adbhoney && \
-    cp /root/dist/cpu_check.py /opt/adbhoney && \
+    cp /root/dist/cpu_check.py / && \
     sed -i 's/dst_ip/dest_ip/' /opt/adbhoney/adbhoney/core.py && \
     sed -i 's/dst_port/dest_port/' /opt/adbhoney/adbhoney/core.py && \
 #
@@ -32,8 +32,8 @@ RUN apk --no-cache -U add \
 #
 # Set workdir and start adbhoney
 STOPSIGNAL SIGINT
-# Adbhoney sometimes hangs at 100% CPU usage, if detected process will be killed and container restarts per docker-compose settings
-HEALTHCHECK --interval=5m --timeout=30s --retries=3 CMD python3 /opt/adbhoney/cpu_check.py
+# Adbhoney sometimes hangs at 100% CPU usage, if detected container will become unhealthy and restarted by tpotinit
+HEALTHCHECK --interval=5m --timeout=30s --retries=3 CMD python3 /cpu_check.py $(pgrep -of run.py) 99
 USER adbhoney:adbhoney
 WORKDIR /opt/adbhoney/
 CMD /usr/bin/python3 run.py

docker/adbhoney/dist/cpu_check.py

@@ -1,10 +1,42 @@
 import psutil
+import sys
+import time
 
-# Get the overall CPU usage percentage
-cpu_usage = psutil.cpu_percent(interval=1)
-print(cpu_usage)
-# Check CPU usage threshold
-if cpu_usage >= 75:  # Adjust the threshold as needed
-    exit(1)
+if len(sys.argv) != 3:
+    print("Usage: script.py <PID> <CPU_USAGE_THRESHOLD>")
+    sys.exit(1)
+
+try:
+    pid = int(sys.argv[1])
+except ValueError:
+    print("Please provide a valid integer value for the PID.")
+    sys.exit(1)
+
+try:
+    cpu_threshold = float(sys.argv[2])
+except ValueError:
+    print("Please provide a valid number for the CPU usage threshold.")
+    sys.exit(1)
+
+try:
+    target_process = psutil.Process(pid)
+except psutil.NoSuchProcess:
+    print(f"No process with the PID {pid} was found.")
+    sys.exit(1)
+
+# Prepare to calculate the average CPU usage over 3 intervals of 1 second each
+cpu_usages = []
+for _ in range(3):
+    cpu_usages.append(target_process.cpu_percent(interval=1))
+
+# Calculate the average CPU usage
+average_cpu_usage = sum(cpu_usages) / len(cpu_usages)
+print(f"Average CPU Usage of PID {pid} over 3 seconds: {average_cpu_usage}%")
+
+# Check average CPU usage against the threshold
+if average_cpu_usage >= cpu_threshold:
+    print(f"Average CPU usage of PID {pid} is above or equal to the threshold of {cpu_threshold}%.")
+    sys.exit(1)
 else:
-    exit(0)
+    print(f"Average CPU usage of PID {pid} is below the threshold of {cpu_threshold}%. Exiting with code 0.")
+    sys.exit(0)

docker/conpot/Dockerfile

@@ -72,6 +72,7 @@ RUN apk --no-cache -U add \
     wget https://www.wireshark.org/download/automated/data/manuf -o /usr/share/wireshark/manuf && \
     cp /root/dist/conpot.cfg /etc/conpot/conpot.cfg && \
     cp -R /root/dist/templates /usr/lib/$(readlink -f $(type -P python3) | cut -f4 -d"/")/site-packages/conpot/ && \
+    cp /root/dist/cpu_check.py / && \
     addgroup -g 2000 conpot && \
     adduser -S -s /bin/ash -u 2000 -D -g 2000 conpot && \
 #
@@ -93,7 +94,7 @@ RUN apk --no-cache -U add \
 #
 # Start conpot
 STOPSIGNAL SIGINT
-# Conpot sometimes hangs at 100% CPU usage, if detected process will be killed and container restarts per docker-compose settings
-HEALTHCHECK CMD if [ $(ps -C mpv -p 1 -o %cpu | tail -n 1 | cut -f 1 -d ".") -gt 75 ]; then kill -2 1; else exit 0; fi
+# Conpot sometimes hangs at 100% CPU usage, if detected container will become unhealthy and restarted by tpotinit
+HEALTHCHECK --interval=5m --timeout=30s --retries=3 CMD python3 /cpu_check.py $(pgrep -of conpot) 99
 USER conpot:conpot
 CMD exec /usr/bin/conpot --mibcache $CONPOT_TMP --temp_dir $CONPOT_TMP --template $CONPOT_TEMPLATE --logfile $CONPOT_LOG --config $CONPOT_CONFIG

docker/conpot/dist/cpu_check.py

@@ -0,0 +1,42 @@
+import psutil
+import sys
+import time
+
+if len(sys.argv) != 3:
+    print("Usage: script.py <PID> <CPU_USAGE_THRESHOLD>")
+    sys.exit(1)
+
+try:
+    pid = int(sys.argv[1])
+except ValueError:
+    print("Please provide a valid integer value for the PID.")
+    sys.exit(1)
+
+try:
+    cpu_threshold = float(sys.argv[2])
+except ValueError:
+    print("Please provide a valid number for the CPU usage threshold.")
+    sys.exit(1)
+
+try:
+    target_process = psutil.Process(pid)
+except psutil.NoSuchProcess:
+    print(f"No process with the PID {pid} was found.")
+    sys.exit(1)
+
+# Prepare to calculate the average CPU usage over 3 intervals of 1 second each
+cpu_usages = []
+for _ in range(3):
+    cpu_usages.append(target_process.cpu_percent(interval=1))
+
+# Calculate the average CPU usage
+average_cpu_usage = sum(cpu_usages) / len(cpu_usages)
+print(f"Average CPU Usage of PID {pid} over 3 seconds: {average_cpu_usage}%")
+
+# Check average CPU usage against the threshold
+if average_cpu_usage >= cpu_threshold:
+    print(f"Average CPU usage of PID {pid} is above or equal to the threshold of {cpu_threshold}%.")
+    sys.exit(1)
+else:
+    print(f"Average CPU usage of PID {pid} is below the threshold of {cpu_threshold}%. Exiting with code 0.")
+    sys.exit(0)

docker/dicompot/Dockerfile

@@ -1,4 +1,7 @@
-FROM alpine:3.17
+FROM alpine:3.19
+#
+# Include dist
+COPY dist/ /root/dist/
 #
 # Setup apk
 RUN apk -U add --no-cache \
@@ -20,6 +23,7 @@ RUN apk -U add --no-cache \
 # Setup dicompot
     mkdir -p /opt/dicompot/images && \
     cp /opt/go/bin/server /opt/dicompot && \
+    cp -R /root/dist/dcm_pts/P1/ /opt/dicompot/images && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 dicompot && \

docker/dicompot/docker-compose.yml

@@ -7,7 +7,7 @@ services:
 
 # Dicompot service
 # Get the Horos Client for testing: https://horosproject.org/
-# Get Dicom images (CC BY 3.0): https://www.cancerimagingarchive.net/collections/
+# Get Dicom images (CC BY 3.0): https://dataverse.harvard.edu/dataverse/harvard/?q=dicom
 # Put images (which must be in Dicom DCM format or it will not work!) into /data/dicompot/images
   dicompot:
     build: .
@@ -22,5 +22,5 @@ services:
     image: "dtagdevsec/dicompot:alpha"
     read_only: true
     volumes:
-     - /data/dicompot/log:/var/log/dicompot
-#     - /data/dicompot/images:/opt/dicompot/images
+     - $HOME/tpotce/data/dicompot/log:/var/log/dicompot
+#     - $HOME/tpotce/data/dicompot/images:/opt/dicompot/images

docker/dionaea/Dockerfile

@@ -40,13 +40,14 @@ RUN ARCH=$(arch) && \
 		python3-boto3 \
 		python3-bson \
 		python3-yaml \
+		python3-psutil \
 		fonts-liberation && \
 #
 # Get and install dionaea
-    # Latest master is unstable, SIP causes crashing
-    git clone --depth=1 https://github.com/dinotools/dionaea -b 0.11.0 /root/dionaea/ && \
+    # git clone --depth=1 https://github.com/dinotools/dionaea -b 0.11.0 /root/dionaea/ && \
+    git clone --depth=1 https://github.com/dinotools/dionaea /root/dionaea/ && \
     cd /root/dionaea && \
-    #git checkout 1426750b9fd09c5bfeae74d506237333cd8505e2 && \
+    git checkout 4e459f1b672a5b4c1e8335c0bff1b93738019215 && \
     mkdir build && \
     cd build && \
     cmake -DCMAKE_INSTALL_PREFIX:PATH=/opt/dionaea .. && \
@@ -62,6 +63,7 @@ RUN ARCH=$(arch) && \
     chown -R dionaea:dionaea /opt/dionaea/var && \
     rm -rf /opt/dionaea/etc/dionaea/* && \
     mv /root/dist/etc/* /opt/dionaea/etc/dionaea/ && \
+    cp /root/dist/cpu_check.py / && \
 #
 # Setup runtime and clean up
     apt-get purge -y \
@@ -88,7 +90,7 @@ RUN ARCH=$(arch) && \
       python3-bson \
       python3-yaml \ 
       wget && \ 
-
+#
     apt-get install -y \
       ca-certificates \
       python3 \
@@ -111,7 +113,8 @@ RUN ARCH=$(arch) && \
 #
 # Start dionaea
 STOPSIGNAL SIGINT
-# Dionaea sometimes hangs at 100% CPU usage, if detected process will be killed and container restarts per docker-compose settings
-HEALTHCHECK CMD if [ $(ps -C mpv -p 1 -o %cpu | tail -n 1 | cut -f 1 -d ".") -gt 75 ]; then kill -2 1; else exit 0; fi
+#
+# Dionaea sometimes hangs at 100% CPU usage, if detected container will become unhealthy and restarted by tpotinit
+HEALTHCHECK --interval=5m --timeout=30s --retries=3 CMD python3 /cpu_check.py $(pgrep -of dionaea) 99
 USER dionaea:dionaea
 CMD ["/opt/dionaea/bin/dionaea", "-u", "dionaea", "-g", "dionaea", "-c", "/opt/dionaea/etc/dionaea/dionaea.cfg"]

docker/dionaea/dist/cpu_check.py

@@ -0,0 +1,42 @@
+import psutil
+import sys
+import time
+
+if len(sys.argv) != 3:
+    print("Usage: script.py <PID> <CPU_USAGE_THRESHOLD>")
+    sys.exit(1)
+
+try:
+    pid = int(sys.argv[1])
+except ValueError:
+    print("Please provide a valid integer value for the PID.")
+    sys.exit(1)
+
+try:
+    cpu_threshold = float(sys.argv[2])
+except ValueError:
+    print("Please provide a valid number for the CPU usage threshold.")
+    sys.exit(1)
+
+try:
+    target_process = psutil.Process(pid)
+except psutil.NoSuchProcess:
+    print(f"No process with the PID {pid} was found.")
+    sys.exit(1)
+
+# Prepare to calculate the average CPU usage over 3 intervals of 1 second each
+cpu_usages = []
+for _ in range(3):
+    cpu_usages.append(target_process.cpu_percent(interval=1))
+
+# Calculate the average CPU usage
+average_cpu_usage = sum(cpu_usages) / len(cpu_usages)
+print(f"Average CPU Usage of PID {pid} over 3 seconds: {average_cpu_usage}%")
+
+# Check average CPU usage against the threshold
+if average_cpu_usage >= cpu_threshold:
+    print(f"Average CPU usage of PID {pid} is above or equal to the threshold of {cpu_threshold}%.")
+    sys.exit(1)
+else:
+    print(f"Average CPU usage of PID {pid} is below the threshold of {cpu_threshold}%. Exiting with code 0.")
+    sys.exit(0)

docker/dionaea/docker-compose.yml

@@ -36,12 +36,12 @@ services:
     image: "dtagdevsec/dionaea:alpha"
     read_only: true
     volumes:
-     - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
-     - /data/dionaea/roots/tftp:/opt/dionaea/var/dionaea/roots/tftp
-     - /data/dionaea/roots/www:/opt/dionaea/var/dionaea/roots/www
-     - /data/dionaea/roots/upnp:/opt/dionaea/var/dionaea/roots/upnp
-     - /data/dionaea:/opt/dionaea/var/dionaea
-     - /data/dionaea/binaries:/opt/dionaea/var/dionaea/binaries
-     - /data/dionaea/log:/opt/dionaea/var/log
-     - /data/dionaea/rtp:/opt/dionaea/var/dionaea/rtp
+     - $HOME/tpotce/data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
+     - $HOME/tpotce/data/dionaea/roots/tftp:/opt/dionaea/var/dionaea/roots/tftp
+     - $HOME/tpotce/data/dionaea/roots/www:/opt/dionaea/var/dionaea/roots/www
+     - $HOME/tpotce/data/dionaea/roots/upnp:/opt/dionaea/var/dionaea/roots/upnp
+     - $HOME/tpotce/data/dionaea:/opt/dionaea/var/dionaea
+     - $HOME/tpotce/data/dionaea/binaries:/opt/dionaea/var/dionaea/binaries
+     - $HOME/tpotce/data/dionaea/log:/opt/dionaea/var/log
+     - $HOME/tpotce/data/dionaea/rtp:/opt/dionaea/var/dionaea/rtp
 

docker/elasticpot/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.17
+FROM alpine:3.19
 #
 # Include dist
 COPY dist/ /root/dist/
@@ -34,7 +34,7 @@ RUN apk -U --no-cache add \
     cd elasticpot && \
     git checkout d12649730d819bd78ea622361b6c65120173ad45 && \
     cp /root/dist/requirements.txt . && \
-    pip3 install -r requirements.txt && \
+    pip3 install --break-system-packages -r requirements.txt && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 elasticpot && \

docker/elasticpot/docker-compose.yml

@@ -19,4 +19,4 @@ services:
     image: "dtagdevsec/elasticpot:alpha"
     read_only: true
     volumes:
-     - /data/elasticpot/log:/opt/elasticpot/log
+     - $HOME/tpotce/data/elasticpot/log:/opt/elasticpot/log

docker/endlessh/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.13 as builder
+FROM alpine:3.16 as builder
 #
 # Include dist
 ADD dist/ /root/dist/
@@ -16,7 +16,7 @@ RUN apk -U add --no-cache \
     make && \
     mv /opt/endlessh/endlessh /root/dist
 #
-FROM alpine:3.17
+FROM alpine:3.19
 #
 COPY --from=builder /root/dist/* /opt/endlessh/
 #

docker/heralding/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.18
+FROM alpine:3.19
 #
 # Include dist
 COPY dist/ /root/dist/
@@ -33,18 +33,18 @@ RUN apk -U --no-cache add \
 #    git clone https://github.com/johnnykv/heralding && \
     git clone https://github.com/t3chn0m4g3/heralding && \
     cd heralding && \
-    git checkout 319065810d6e8ba62fb696a96584ac7500752380 && \
+    git checkout e863c8aa4cee6dd6308ccb20b2d6c816a0fda2a5 && \
     cp /root/dist/requirements.txt . && \
-    pip3 install --upgrade pip && \
-    pip3 install --no-cache-dir -r requirements.txt && \
-    pip3 install --no-cache-dir . && \
+    pip3 install --break-system-packages --upgrade pip && \
+    pip3 install --break-system-packages --no-cache-dir -r requirements.txt && \
+    pip3 install --break-system-packages --no-cache-dir . && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 heralding && \
     adduser -S -H -s /bin/ash -u 2000 -D -g 2000 heralding && \
     mkdir -p /var/log/heralding/ /etc/heralding && \
     mv /root/dist/heralding.yml /etc/heralding/ && \
-    setcap cap_net_bind_service=+ep /usr/bin/python3.11 && \
+    setcap cap_net_bind_service=+ep $(readlink -f $(type -P python3)) && \
     chown -R heralding:heralding /var/log/heralding && \
 #
 # Clean up

docker/tpotinit/Dockerfile

@@ -41,6 +41,6 @@ RUN apk --no-cache -U add \
 #
 # Run tpotinit
 WORKDIR /opt/tpot
-HEALTHCHECK --interval=5s CMD pgrep -f autoheal || exit 1
+HEALTHCHECK --interval=5m --timeout=30s --retries=3 CMD pgrep -f autoheal || exit 1
 STOPSIGNAL SIGKILL
 CMD ["/opt/tpot/entrypoint.sh"]

docker/tpotinit/dist/entrypoint.sh

@@ -305,7 +305,7 @@ echo
 # Start autoheal if running on a supported os
 if [ "${myOSTYPE}" != "linuxkit" ];
   then
-    sleep 1
+    sleep 60
     echo "# Dropping UDP connection tables to improve visibility of true source IPs."
     /usr/sbin/conntrack -D -p udp
     # Starting container health monitoring