mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-04-30 04:08:50 +00:00
d1c167bd5f
allow for ftp data forward ftp data into dionaea container disable ipv6 since it messes up dionaea ip logging
58 lines
3.1 KiB
Desktop File
58 lines
3.1 KiB
Desktop File
[Unit]
|
|
Description=tpot
|
|
Requires=docker.service
|
|
After=docker.service
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
# Get and set internal, external IP infos, but ignore errors
|
|
ExecStartPre=-/usr/share/tpot/bin/updateip.sh
|
|
|
|
# Clear state or if persistence is enabled rotate and compress logs from /data
|
|
ExecStartPre=-/bin/bash -c '/usr/share/tpot/bin/clean.sh on'
|
|
|
|
# Remove old containers, images and volumes
|
|
ExecStartPre=-/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml down -v
|
|
ExecStartPre=-/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml rm -v
|
|
ExecStartPre=-/bin/bash -c 'docker volume rm $(docker volume ls -q)'
|
|
ExecStartPre=-/bin/bash -c 'docker rm -v $(docker ps -aq)'
|
|
ExecStartPre=-/bin/bash -c 'docker rmi $(docker images | grep "<none>" | awk \'{print $3}\')'
|
|
|
|
# Get IF, disable offloading, enable promiscious mode for p0f and suricata
|
|
ExecStartPre=/bin/bash -c '/sbin/ethtool --offload $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) rx off tx off'
|
|
ExecStartPre=/bin/bash -c '/sbin/ethtool -K $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) gso off gro off'
|
|
ExecStartPre=/bin/bash -c '/sbin/ip link set $(/sbin/ip address | grep "^2: " | awk \'{ print $2 }\' | tr -d [:punct:]) promisc on'
|
|
|
|
# Modify access rights on docker.sock for netdata
|
|
ExecStartPre=-/bin/chmod 666 /var/run/docker.sock
|
|
|
|
# Set iptables accept rules to avoid forwarding to honeytrap / NFQUEUE
|
|
# Disregards UDP1900 traffic from/to localhost, too many false positives
|
|
# Forward all other connections to honeytrap / NFQUEUE
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 64295:64303,7634 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,27017 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
|
|
ExecStartPre=/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
|
|
# Compose T-Pot up
|
|
ExecStart=/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml up --no-color
|
|
|
|
# Compose T-Pot down, remove containers and volumes
|
|
ExecStop=/usr/local/bin/docker-compose -f /etc/tpot/tpot.yml down -v
|
|
|
|
# Remove only previously set iptables rules
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 64295:64303,7634 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,27017 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
|
|
ExecStopPost=/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|