Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-04-28 11:18:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

some changes for elasticpot

Browse source
This commit is contained in:
Marco Ochse 2016-01-15 23:11:49 +01:00
parent f3b2949eae
commit d4aa333e6f
5 changed files with 33 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
installer/data/full_images.conf
View file

@ -1,5 +1,6 @@
cowrie
dionaea
elasticpot
elk
glastopf
honeytrap

1
installer/data/sensor_images.conf
View file

@ -1,4 +1,5 @@
cowrie
dionaea
elasticpot
glastopf
honeytrap

1
installer/install.sh
View file

@ -276,6 +276,7 @@ chmod 644 /root/tpot/upstart/*
fuECHO "### Creating some files and folders."
mkdir -p /data/ews/log /data/ews/conf /data/ews/dionaea /data/ews/glastopf /data/ews/honeytrap \
/data/cowrie/log/tty/ /data/cowrie/downloads/ /data/cowrie/keys/ /data/cowrie/misc/ \
/data/elasticpot \
/data/dionaea/log /data/dionaea/bistreams /data/dionaea/binaries /data/dionaea/rtp /data/dionaea/wwwroot \
/data/elk/data /data/elk/log /data/glastopf /data/honeytrap/log/ /data/honeytrap/attacks/ /data/honeytrap/downloads/ \
/data/suricata/log /home/tsec/.ssh/

27
installer/upstart/elasticpot.conf Normal file
View file

@ -0,0 +1,27 @@
########################################################
# T-Pot #
# Elasticpot upstart script #
# #
# v16.03.2 by ms, DTAG, 2016-01-02 #
########################################################
description "Elasticpot"
author "ms"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
pre-start script
# Remove any existing elasticpot containers
myCID=$(docker ps -a | grep elasticpot | awk '{ print $1 }')
if [ "$myCID" != "" ];
then docker rm -v $myCID;
fi
# Remove any data from previous container
end script
script
/usr/bin/docker run --name elasticpot --rm=true -v /data/elasticpot:/data/elasticpot -p 9200:8080 dtagdevsec/elasticpot:latest1603
end script
post-start script
# Delay next start to avoid rapid respawning
sleep $(((RANDOM % 5)+5))
end script

6
installer/upstart/honeytrap.conf
View file

@ -2,7 +2,7 @@
# T-Pot #
# Honeytrap upstart script #
# #
# v16.03.2 by mo, DTAG, 2015-12-15 #
# v16.03.3 by mo, DTAG, 2016-01-15 #
########################################################
description "Honeytrap"
@ -21,7 +21,7 @@ pre-start script
mkdir -p /data/honeytrap/log/ /data/honeytrap/attacks/ /data/honeytrap/downloads/
chmod 760 /data/honeytrap/ -R
chown tpot:tpot /data/honeytrap/ -R
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,64295,64296 -j NFQUEUE
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,9200,64295,64296 -j NFQUEUE
end script
script
/usr/bin/docker run --name honeytrap --cap-add=NET_ADMIN --net=host --rm=true -v /data/honeytrap:/data/honeytrap -v /data/ews:/data/ews dtagdevsec/honeytrap:latest1603
@ -31,5 +31,5 @@ post-start script
sleep $(((RANDOM % 5)+5))
end script
post-stop script
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,64295,64296 -j NFQUEUE
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,9200,64295,64296 -j NFQUEUE
end script