Merge 873f515727 into bdea4e2932

docker/ewsposter/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.19
 #
 # Include dist
 COPY dist/ /root/dist/
@@ -22,8 +22,7 @@ RUN apk --no-cache -U upgrade && \
 		py3-requests \
 		py3-pip \
 		py3-setuptools \
-		py3-wheel \
+		py3-wheel && \
-		py3-xmltodict && \
 	pip3 install --break-system-packages --upgrade pip && \
 	pip3 install --break-system-packages --no-cache-dir \
 			configparser \
@@ -33,8 +32,7 @@ RUN apk --no-cache -U upgrade && \
 			xmljson && \
 #
 # Setup ewsposter
-#    git clone https://github.com/telekom-security/ewsposter -b V1.30.0 /opt/ewsposter && \
+    git clone https://github.com/telekom-security/ewsposter -b v1.25.0 /opt/ewsposter && \
-	git clone https://github.com/telekom-security/ewsposter /opt/ewsposter && \
     mkdir -p /opt/ewsposter/spool /opt/ewsposter/log && \
 #
 # Setup user and groups

docker/ewsposter/dist/ews.cfg

@@ -44,109 +44,23 @@ token = <your token for influx 2.0>
 bucket = <your bucket/database for 2.0/1.8>
 org = <your org for influx 2.0>
 
-[ADBHONEY]
+[GLASTOPFV3]
-adbhoney = true
+glastopfv3 = false
-nodeid = adbhoney-community-01
+nodeid = glastopfv3-community-01
-logfile = /data/adbhoney/log/adbhoney.json
+sqlitedb = /data/glastopf/db/glastopf.db
-malwaredir = /data/adbhoney/downloads
+malwaredir = /data/glastopf/data/files/
-
-[BEELZEBUB]
-beelzebub = false
-nodeid = beelzebub-community-01
-logfile = /data/beelzebub/log/beelzebub.json
-
-[CISCOASA]
-ciscoasa = true
-nodeid = ciscoasa-community-01
-logfile = /data/ciscoasa/log/ciscoasa.log
-
-[CITRIX]
-citrix = true
-nodeid = citrix-community-01
-logfile = /data/citrixhoneypot/logs/server.log
-
-[CONPOT]
-conpot = true
-nodeid = conpot-community-01
-logdir = /data/conpot/log
 
 [COWRIE]
 cowrie = true
 nodeid = cowrie-community-01
 logfile = /data/cowrie/log/cowrie.json
 
-[DDOSPOT]
-ddospot = true
-nodeid = ddospot-community-01
-logdir = /data/ddospot/log
-
-[DICOMPOT]
-dicompot = true
-nodeid = dicompot-community-01
-logfile = /data/dicompot/log/dicompot.log
-
 [DIONAEA]
 dionaea = true
 nodeid = dionaea-community-01
 malwaredir = /data/dionaea/binaries/
 sqlitedb = /data/dionaea/log/dionaea.sqlite
 
-[ELASTICPOT]
-elasticpot = true
-nodeid = elasticpot-community-01
-logfile = /data/elasticpot/log/elasticpot.json
-
-[ENDLESSH]
-endlessh = true
-nodeid = endlessh-community-01
-logfile = /data/endlessh/log/endlessh.log
-
-[FATT]
-fatt = false
-nodeid = fatt-community-01
-logfile = /data/fatt/log/fatt.log
-
-[GALAH]
-galah = true
-nodeid = galah-community-01
-logfile = /data/galah/log/galah.json
-
-[GLUTTON]
-glutton = true
-nodeid = glutton-community-01
-logfile = /data/glutton/log/glutton.log
-
-[GOPOT]
-gopot = true
-nodeid = gopot-community-01
-logfile = /data/go-pot/log/go-pot.json
-
-[H0NEYTR4P]
-h0neytr4p = false
-nodeid = h0neytr4p-community-01
-logfile = /data/h0neytr4p/log/log.json
-payloaddir = /data/h04neytr4p/payload
-
-[HELLPOT]
-hellpot = true
-nodeid = hellpot-community-01
-logfile = /data/hellpot/log/hellpot.log
-
-[HERALDING]
-heralding = true
-nodeid = heralding-community-01
-logfile = /data/heralding/log/auth.csv
-
-[HONEYAML]
-honeyaml = true
-nodeid = honeyaml-community-01
-logfile = /data/honeyaml/log/honeyaml.log
-
-[HONEYPOTS]
-honeypots = true
-nodeid = honeypots-community-01
-logdir = /data/honeypots/log
-
 [HONEYTRAP]
 honeytrap = true
 nodeid = honeytrap-community-01
@@ -154,52 +68,118 @@ newversion = true
 payloaddir = /data/honeytrap/attacks/
 attackerfile = /data/honeytrap/log/attacker.log
 
-[IPPHONEY]
+[EMOBILITY]
-ipphoney = true
+eMobility = false
-nodeid = ipphoney-community-01
+nodeid = emobility-community-01
-logfile = /data/ipphoney/log/ipphoney.json
+logfile = /data/emobility/log/centralsystemEWS.log
 
-[LOG4POT]
+[CONPOT]
-log4pot = true
+conpot = true
-nodeid = log4pot-community-01
+nodeid = conpot-community-01
-logfile = /data/log4pot/log/log4pot.log
+logfile = /data/conpot/log/conpot*.json
 
-[MAILONEY]
+[ELASTICPOT]
-mailoney = true
+elasticpot = true
-nodeid = mailoney-community-01
+nodeid = elasticpot-community-01
-logfile = /data/mailoney/log/commands.log
+logfile = /data/elasticpot/log/elasticpot.json
-
-[MEDPOT]
-medpot = true
-nodeid = medpot-community-01
-logfile = /data/medpot/log/medpot.log
-
-[MINIPRINT]
-miniprint = true
-nodeid = miniprint-community-01
-logfile = /data/miniprint/log/miniprint.json
-
-[REDISHONEYPOT]
-redishoneypot = true
-nodeid = redishoneypot-community-01
-logfile = /data/redishoneypot/log/redishoneypot.log
-
-[SENTRYPEER]
-sentrypeer = true
-nodeid = sentrypeer-community-01
-logfile = /data/sentrypeer/log/sentrypeer.json
 
 [SURICATA]
 suricata = false
 nodeid = suricata-community-01
 logfile = /data/suricata/log/eve.json
 
+[MAILONEY]
+mailoney = true
+nodeid = mailoney-community-01
+logfile = /data/mailoney/log/commands.log
+
+[RDPY]
+rdpy = false
+nodeid = rdpy-community-01
+logfile = /data/rdpy/log/rdpy.log
+
+[VNCLOWPOT]
+vnclowpot = false
+nodeid = vnclowpot-community-01
+logfile = /data/vnclowpot/log/vnclowpot.log
+
+[HERALDING]
+heralding = true
+nodeid = heralding-community-01
+logfile = /data/heralding/log/auth.csv
+
+[CISCOASA]
+ciscoasa = true
+nodeid = ciscoasa-community-01
+logfile = /data/ciscoasa/log/ciscoasa.log
+
 [TANNER]
 tanner = true
 nodeid = tanner-community-01
 logfile = /data/tanner/log/tanner_report.json
 
-[WORDPOT]
+[GLUTTON]
-wordpot = true
+glutton = true
-nodeid = wordpot-community-01
+nodeid = glutton-community-01
-logfile = /data/wordpot/log/wordpot.log
+logfile = /data/glutton/log/glutton.log
+
+[HONEYSAP]
+honeysap = false
+nodeid = honeysap-community-01
+logfile = /data/honeysap/log/honeysap-external.log
+
+[ADBHONEY]
+adbhoney = true
+nodeid = adbhoney-community-01
+logfile = /data/adbhoney/log/adbhoney.json
+malwaredir = /data/adbhoney/downloads
+
+[FATT]
+fatt = false
+nodeid = fatt-community-01
+logfile = /data/fatt/log/fatt.log
+
+[IPPHONEY]
+ipphoney = true
+nodeid = ipphoney-community-01
+logfile = /data/ipphoney/log/ipphoney.json
+
+[DICOMPOT]
+dicompot = true
+nodeid = dicompot-community-01
+logfile = /data/dicompot/log/dicompot.log
+
+[MEDPOT]
+medpot = true
+nodeid = medpot-community-01
+logfile = /data/medpot/log/medpot.log
+
+[HONEYPY]
+honeypy = false
+nodeid = honeypy-community-01
+logfile = /data/honeypy/log/json.log
+
+[CITRIX]
+citrix = true
+nodeid = citrix-community-01
+logfile = /data/citrixhoneypot/logs/server.log
+
+[REDISHONEYPOT]
+redishoneypot = true
+nodeid = redishoneypot-community-01
+logfile = /data/redishoneypot/log/redishoneypot.log
+
+[ENDLESSH]
+endlessh = true
+nodeid = endlessh-community-01
+logfile = /data/endlessh/log/endlessh.log
+
+[SENTRYPEER]
+sentrypeer = true
+nodeid = sentrypeer-community-01
+logfile = /data/sentrypeer/log/sentrypeer.json
+
+[LOG4POT]
+log4pot = true
+nodeid = log4pot-community-01
+logfile = /data/log4pot/log/log4pot.log

docker/ewsposter/docker-compose.yml

@@ -21,7 +21,7 @@ services:
      - EWS_HPFEEDS_SECRET=secret
      - EWS_HPFEEDS_TLSCERT=false
      - EWS_HPFEEDS_FORMAT=json
-    image: "ghcr.io/telekom-security/ewsposter:24.04.1"
+    image: "dtagdevsec/ewsposter:24.04"
     volumes:
      - $HOME/tpotce/data:/data
      - $HOME/tpotce/data/ews/conf/ews.ip:/opt/ewsposter/ews.ip