########################################################
# T-Pot                                                #
# Honeytrap upstart script                             #
#                                                      #
# v16.03.5 by mo, DTAG, 2016-02-08                     #
########################################################

description "Honeytrap"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
pre-start script
  # Remove any existing honeytrap containers
  myCID=$(docker ps -a | grep honeytrap | awk '{ print $1 }')
  if [ "$myCID" != "" ];
    then docker rm -v $myCID;
  fi
  # Remove any data from previous container
  rm -rf /data/honeytrap/* || true
  mkdir -p /data/honeytrap/log/ /data/honeytrap/attacks/ /data/honeytrap/downloads/
  chmod 760 /data/honeytrap/ -R
  chown tpot:tpot /data/honeytrap/ -R
  /sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,8081,9200,64295,64296 -j NFQUEUE
end script
script
  /usr/bin/docker run --name honeytrap --cap-add=NET_ADMIN --net=host --rm=true -v /data/honeytrap:/data/honeytrap -v /data/ews:/data/ews dtagdevsec/honeytrap:latest1603
end script
post-start script
  # Delay next start to avoid rapid respawning
  sleep $(((RANDOM % 5)+5))
end script
post-stop script
  /sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -m multiport ! --dports 21,22,42,80,135,443,445,1433,3306,5060,5061,8081,9200,64295,64296 -j NFQUEUE
end script