mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-04-30 04:08:50 +00:00
aea18d5f92
do not forward tcp connections to or from 127.0.0.1 to NFQ (fixes strange netdata behaviour) run netdata on network mode host again (update compose files) including host metrics
57 lines
3 KiB
Desktop File
57 lines
3 KiB
Desktop File
[Unit]
|
|
Description=tpot
|
|
Requires=docker.service
|
|
After=docker.service
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Get and set internal, external IP infos, but ignore errors
|
|
ExecStartPre=-/usr/share/tpot/bin/updateip.sh
|
|
|
|
# Clear state from /data
|
|
ExecStartPre=-/bin/bash -c '/usr/share/tpot/bin/clean.sh off'
|
|
|
|
# Remove old containers, images and volumes
|
|
ExecStartPre=-/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml down -v
|
|
ExecStartPre=-/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml rm -v
|
|
ExecStartPre=-/bin/bash -c 'docker volume rm $(docker volume ls -q)'
|
|
ExecStartPre=-/bin/bash -c 'docker rm -v $(docker ps -aq)'
|
|
ExecStartPre=-/bin/bash -c 'docker rmi $(docker images | grep "<none>" | awk \'{print $3}\')'
|
|
|
|
# Get IF, disable offloading, enable promiscious mode for p0f and suricata
|
|
ExecStartPre=/bin/bash -c '/sbin/ethtool --offload $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) rx off tx off'
|
|
ExecStartPre=/bin/bash -c '/sbin/ethtool -K $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) gso off gro off'
|
|
ExecStartPre=/bin/bash -c '/sbin/ip link set $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) promisc on'
|
|
|
|
# Modify access rights on docker.sock for netdata
|
|
ExecStartPre=-/bin/chmod 666 /var/run/docker.sock
|
|
|
|
# Set iptables accept rules to avoid forwarding to honeytrap / NFQUEUE
|
|
# Forward all other connections to honeytrap / NFQUEUE
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 64295:64303,7634,8125 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 21,22,23,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,11211 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
|
|
# Compose T-Pot up
|
|
ExecStart=/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml up
|
|
|
|
# Compose T-Pot down, remove containers and volumes
|
|
ExecStop=/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml down -v
|
|
|
|
# Remove only previously set iptables rules
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 64295:64303,7634,8125 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 21,22,23,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,11211 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|