mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-04-29 03:38:51 +00:00
370 lines
8.4 KiB
YAML
370 lines
8.4 KiB
YAML
# T-Pot (Industrial)
|
|
# Do not erase ports sections, these are used by /opt/tpot/bin/rules.sh to setup iptables ACCEPT rules for NFQ (honeytrap / glutton)
|
|
version: '2.3'
|
|
|
|
networks:
|
|
conpot_local_default:
|
|
conpot_local_IEC104:
|
|
conpot_local_guardian_ast:
|
|
conpot_local_ipmi:
|
|
conpot_local_kamstrup_382:
|
|
cowrie_local:
|
|
cyberchef_local:
|
|
rdpy_local:
|
|
vnclowpot_local:
|
|
ewsposter_local:
|
|
spiderfoot_local:
|
|
|
|
services:
|
|
|
|
##################
|
|
#### Honeypots
|
|
##################
|
|
|
|
# Conpot default service
|
|
conpot_default:
|
|
build: .
|
|
container_name: conpot_default
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
- CONPOT_CONFIG=/etc/conpot/conpot.cfg
|
|
- CONPOT_JSON_LOG=/var/log/conpot/conpot_default.json
|
|
- CONPOT_LOG=/var/log/conpot/conpot_default.log
|
|
- CONPOT_TEMPLATE=default
|
|
- CONPOT_TMP=/tmp/conpot
|
|
tmpfs:
|
|
- /tmp/conpot:uid=2000,gid=2000
|
|
networks:
|
|
- conpot_local_default
|
|
ports:
|
|
- "69:69"
|
|
- "80:80"
|
|
- "102:102"
|
|
- "161:161"
|
|
- "502:502"
|
|
# - "623:623"
|
|
- "21:21"
|
|
- "44818:44818"
|
|
- "47808:47808"
|
|
image: "dtagdevsec/conpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/conpot/log:/var/log/conpot
|
|
|
|
# Conpot IEC104 service
|
|
conpot_IEC104:
|
|
container_name: conpot_iec104
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
- CONPOT_CONFIG=/etc/conpot/conpot.cfg
|
|
- CONPOT_JSON_LOG=/var/log/conpot/conpot_IEC104.json
|
|
- CONPOT_LOG=/var/log/conpot/conpot_IEC104.log
|
|
- CONPOT_TEMPLATE=IEC104
|
|
- CONPOT_TMP=/tmp/conpot
|
|
tmpfs:
|
|
- /tmp/conpot:uid=2000,gid=2000
|
|
networks:
|
|
- conpot_local_IEC104
|
|
ports:
|
|
# - "161:161"
|
|
- "2404:2404"
|
|
image: "dtagdevsec/conpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/conpot/log:/var/log/conpot
|
|
|
|
# Conpot guardian_ast service
|
|
conpot_guardian_ast:
|
|
container_name: conpot_guardian_ast
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
- CONPOT_CONFIG=/etc/conpot/conpot.cfg
|
|
- CONPOT_JSON_LOG=/var/log/conpot/conpot_guardian_ast.json
|
|
- CONPOT_LOG=/var/log/conpot/conpot_guardian_ast.log
|
|
- CONPOT_TEMPLATE=guardian_ast
|
|
- CONPOT_TMP=/tmp/conpot
|
|
tmpfs:
|
|
- /tmp/conpot:uid=2000,gid=2000
|
|
networks:
|
|
- conpot_local_guardian_ast
|
|
ports:
|
|
- "10001:10001"
|
|
image: "dtagdevsec/conpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/conpot/log:/var/log/conpot
|
|
|
|
# Conpot ipmi
|
|
conpot_ipmi:
|
|
container_name: conpot_ipmi
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
- CONPOT_CONFIG=/etc/conpot/conpot.cfg
|
|
- CONPOT_JSON_LOG=/var/log/conpot/conpot_ipmi.json
|
|
- CONPOT_LOG=/var/log/conpot/conpot_ipmi.log
|
|
- CONPOT_TEMPLATE=ipmi
|
|
- CONPOT_TMP=/tmp/conpot
|
|
tmpfs:
|
|
- /tmp/conpot:uid=2000,gid=2000
|
|
networks:
|
|
- conpot_local_ipmi
|
|
ports:
|
|
- "623:623"
|
|
image: "dtagdevsec/conpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/conpot/log:/var/log/conpot
|
|
|
|
# Conpot kamstrup_382
|
|
conpot_kamstrup_382:
|
|
container_name: conpot_kamstrup_382
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
- CONPOT_CONFIG=/etc/conpot/conpot.cfg
|
|
- CONPOT_JSON_LOG=/var/log/conpot/conpot_kamstrup_382.json
|
|
- CONPOT_LOG=/var/log/conpot/conpot_kamstrup_382.log
|
|
- CONPOT_TEMPLATE=kamstrup_382
|
|
- CONPOT_TMP=/tmp/conpot
|
|
tmpfs:
|
|
- /tmp/conpot:uid=2000,gid=2000
|
|
networks:
|
|
- conpot_local_kamstrup_382
|
|
ports:
|
|
- "1025:1025"
|
|
- "50100:50100"
|
|
image: "dtagdevsec/conpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/conpot/log:/var/log/conpot
|
|
|
|
# Cowrie service
|
|
cowrie:
|
|
container_name: cowrie
|
|
restart: always
|
|
tmpfs:
|
|
- /tmp/cowrie:uid=2000,gid=2000
|
|
- /tmp/cowrie/data:uid=2000,gid=2000
|
|
networks:
|
|
- cowrie_local
|
|
ports:
|
|
- "22:22"
|
|
- "23:23"
|
|
image: "dtagdevsec/cowrie:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/cowrie/downloads:/home/cowrie/cowrie/dl
|
|
- /data/cowrie/keys:/home/cowrie/cowrie/etc
|
|
- /data/cowrie/log:/home/cowrie/cowrie/log
|
|
- /data/cowrie/log/tty:/home/cowrie/cowrie/log/tty
|
|
|
|
# Honeytrap service
|
|
honeytrap:
|
|
container_name: honeytrap
|
|
restart: always
|
|
tmpfs:
|
|
- /tmp/honeytrap:uid=2000,gid=2000
|
|
network_mode: "host"
|
|
cap_add:
|
|
- NET_ADMIN
|
|
image: "dtagdevsec/honeytrap:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/honeytrap/attacks:/opt/honeytrap/var/attacks
|
|
- /data/honeytrap/downloads:/opt/honeytrap/var/downloads
|
|
- /data/honeytrap/log:/opt/honeytrap/var/log
|
|
|
|
# Rdpy service
|
|
rdpy:
|
|
container_name: rdpy
|
|
extra_hosts:
|
|
- hpfeeds.example.com:127.0.0.1
|
|
restart: always
|
|
environment:
|
|
- HPFEEDS_SERVER=hpfeeds.example.com
|
|
- HPFEEDS_IDENT=user
|
|
- HPFEEDS_SECRET=pass
|
|
- HPFEEDS_PORT=65000
|
|
- SERVERID=id
|
|
networks:
|
|
- rdpy_local
|
|
ports:
|
|
- "3389:3389"
|
|
image: "dtagdevsec/rdpy:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/rdpy/log:/var/log/rdpy
|
|
|
|
# Vnclowpot service
|
|
vnclowpot:
|
|
container_name: vnclowpot
|
|
restart: always
|
|
networks:
|
|
- vnclowpot_local
|
|
ports:
|
|
- "5900:5900"
|
|
image: "dtagdevsec/vnclowpot:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/vnclowpot/log:/var/log/vnclowpot
|
|
|
|
|
|
##################
|
|
#### NSM
|
|
##################
|
|
|
|
# P0f service
|
|
p0f:
|
|
container_name: p0f
|
|
restart: always
|
|
network_mode: "host"
|
|
image: "dtagdevsec/p0f:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/p0f/log:/var/log/p0f
|
|
|
|
# Suricata service
|
|
suricata:
|
|
container_name: suricata
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
environment:
|
|
# For ET Pro ruleset replace "OPEN" with your OINKCODE
|
|
- OINKCODE=OPEN
|
|
network_mode: "host"
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_NICE
|
|
- NET_RAW
|
|
image: "dtagdevsec/suricata:1804"
|
|
volumes:
|
|
- /data/suricata/log:/var/log/suricata
|
|
|
|
|
|
##################
|
|
#### Tools
|
|
##################
|
|
|
|
# Cyberchef service
|
|
cyberchef:
|
|
container_name: cyberchef
|
|
restart: always
|
|
networks:
|
|
- cyberchef_local
|
|
ports:
|
|
- "127.0.0.1:64299:8000"
|
|
image: "dtagdevsec/cyberchef:1804"
|
|
read_only: true
|
|
|
|
#### ELK
|
|
## Elasticsearch service
|
|
elasticsearch:
|
|
container_name: elasticsearch
|
|
restart: always
|
|
environment:
|
|
- bootstrap.memory_lock=true
|
|
- ES_JAVA_OPTS=-Xms1024m -Xmx1024m
|
|
- ES_TMPDIR=/tmp
|
|
cap_add:
|
|
- IPC_LOCK
|
|
ulimits:
|
|
memlock:
|
|
soft: -1
|
|
hard: -1
|
|
nofile:
|
|
soft: 65536
|
|
hard: 65536
|
|
mem_limit: 4g
|
|
ports:
|
|
- "127.0.0.1:64298:9200"
|
|
image: "dtagdevsec/elasticsearch:1804"
|
|
volumes:
|
|
- /data:/data
|
|
|
|
## Kibana service
|
|
kibana:
|
|
container_name: kibana
|
|
restart: always
|
|
stop_signal: SIGKILL
|
|
depends_on:
|
|
elasticsearch:
|
|
condition: service_healthy
|
|
ports:
|
|
- "127.0.0.1:64296:5601"
|
|
image: "dtagdevsec/kibana:1804"
|
|
|
|
## Logstash service
|
|
logstash:
|
|
container_name: logstash
|
|
restart: always
|
|
depends_on:
|
|
elasticsearch:
|
|
condition: service_healthy
|
|
env_file:
|
|
- /opt/tpot/etc/compose/elk_environment
|
|
image: "dtagdevsec/logstash:1804"
|
|
volumes:
|
|
- /data:/data
|
|
|
|
## Elasticsearch-head service
|
|
head:
|
|
container_name: head
|
|
restart: always
|
|
depends_on:
|
|
elasticsearch:
|
|
condition: service_healthy
|
|
ports:
|
|
- "127.0.0.1:64302:9100"
|
|
image: "dtagdevsec/head:1804"
|
|
read_only: true
|
|
|
|
# Ewsposter service
|
|
ewsposter:
|
|
container_name: ewsposter
|
|
restart: always
|
|
stop_signal: SIGINT
|
|
networks:
|
|
- ewsposter_local
|
|
env_file:
|
|
- /opt/tpot/etc/compose/elk_environment
|
|
image: "dtagdevsec/ewsposter:1804"
|
|
volumes:
|
|
- /data:/data
|
|
- /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
|
|
|
|
# Nginx service
|
|
nginx:
|
|
container_name: nginx
|
|
restart: always
|
|
tmpfs:
|
|
- /var/tmp/nginx/client_body
|
|
- /var/tmp/nginx/proxy
|
|
- /var/tmp/nginx/fastcgi
|
|
- /var/tmp/nginx/uwsgi
|
|
- /var/tmp/nginx/scgi
|
|
- /run
|
|
network_mode: "host"
|
|
ports:
|
|
- "64297:64297"
|
|
image: "dtagdevsec/nginx:1804"
|
|
read_only: true
|
|
volumes:
|
|
- /data/nginx/cert/:/etc/nginx/cert/:ro
|
|
- /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
|
|
- /data/nginx/log/:/var/log/nginx/
|
|
|
|
# Spiderfoot service
|
|
spiderfoot:
|
|
container_name: spiderfoot
|
|
restart: always
|
|
networks:
|
|
- spiderfoot_local
|
|
ports:
|
|
- "127.0.0.1:64303:8080"
|
|
image: "dtagdevsec/spiderfoot:1804"
|
|
volumes:
|
|
- /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
|