Add T-Pot Technical Preview

preview/installer/ubuntu/install.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Ubuntu
+if ! grep -q 'ID=ubuntu' /etc/os-release; then
+  echo "This script is designed to run on Ubuntu. Aborting."
+  exit 1
+fi
+
+if [ -f /var/log/ubuntu-install-lock ]; then
+  echo "Error: The installer has already been run on this system. If you wish to run it again, please run the uninstall.sh first."
+  exit 1
+fi
+
+# Create installer lock file
+sudo touch /var/log/ubuntu-install-lock
+
+# Update SSH config
+echo "Updating SSH config..."
+sudo bash -c 'echo "Port 64295" >> /etc/ssh/sshd_config'
+sudo systemctl disable ssh.socket
+sudo rm /etc/systemd/system/ssh.service.d/00-socket.conf
+sudo systemctl enable ssh.service
+
+# Update DNS config
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/DNSStubListener=no/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Install recommended packages
+echo "Installing recommended packages..."
+sudo apt-get -y update
+sudo apt-get -y install bash-completion git grc net-tools vim
+
+# Remove old Docker
+echo "Removing old docker packages..."
+sudo apt-get -y remove docker docker-engine docker.io containerd runc
+
+# Add Docker to repositories, install latest docker
+echo "Adding Docker to repositories and installing..."
+sudo apt-get -y update
+sudo apt-get -y install ca-certificates curl gnupg
+sudo install -m 0755 -d /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+sudo chmod a+r /etc/apt/keyrings/docker.gpg
+echo \
+  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
+  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get -y update
+sudo apt-get -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo systemctl enable docker
+sudo systemctl stop docker
+sudo systemctl start docker
+
+# Add user to Docker group
+echo "Adding user to Docker group..."
+sudo usermod -aG docker $(whoami)
+
+# Add aliases
+echo "Adding aliases..."
+echo "alias dps='grc docker ps -a'" >> ~/.bashrc
+echo "alias dpsw='watch -c \"grc --colour=on docker ps -a\"'" >> ~/.bashrc
+
+# Show running services
+sudo grc netstat -tulpen
+echo "Please review for possible honeypot port conflicts."
+echo "While SSH is taken care of, other services such as"
+echo "SMTP, HTTP, etc. might prevent T-Pot from starting."
+
+echo "Done. Please reboot and re-connect via SSH on tcp/64295."
+

preview/installer/ubuntu/uninstall.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Needs to run as non-root
+myWHOAMI=$(whoami)
+if [ "$myWHOAMI" == "root" ]
+  then
+    echo "Need to run as user ..."
+    exit
+fi
+
+# Check if running on Ubuntu
+if ! grep -q 'ID=ubuntu' /etc/os-release; then
+  echo "This script is designed to run on Ubuntu. Aborting."
+  exit 1
+fi
+
+# Check if installer lock file exists
+if [ ! -f /var/log/ubuntu-install-lock ]; then
+  echo "Error: The installer has not been run on this system. Aborting."
+  exit 1
+fi
+
+# Remove SSH config changes
+echo "Removing SSH config changes..."
+sudo sed -i '/Port 64295/d' /etc/ssh/sshd_config
+sudo systemctl disable ssh.service
+sudo systemctl enable ssh.socket
+
+# Remove DNS config changes
+echo "Updating DNS config..."
+sudo bash -c "sed -i 's/^.*DNSStubListener=.*/#DNSStubListener=yes/' /etc/systemd/resolved.conf"
+sudo systemctl restart systemd-resolved.service
+
+# Uninstall Docker
+echo "Stopping and removing all containers ..."
+docker stop $(docker ps -aq)
+docker rm $(docker ps -aq)
+echo "Uninstalling Docker..."
+sudo systemctl stop docker
+sudo systemctl disable docker
+sudo apt-get -y remove docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+sudo apt-get -y autoremove
+sudo rm -rf /etc/apt/sources.list.d/docker.list
+sudo rm -rf /etc/apt/keyrings/docker.gpg
+
+# Remove user from Docker group
+echo "Removing user from Docker group..."
+sudo deluser $(whoami) docker
+
+# Remove aliases
+echo "Removing aliases..."
+sed -i '/alias dps=/d' ~/.bashrc
+sed -i '/alias dpsw=/d' ~/.bashrc
+
+# Remove installer lock file
+sudo rm -f /var/log/ubuntu-install-lock
+
+echo "Done. Please reboot and re-connect via SSH on tcp/22"
+