mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
re-implement distributed feature, without ssh
add sensor compose file add distributed option to tpot config housekeeping / cleanup
This commit is contained in:
t3chn0m4g3
89
docker/tpotinit/dist/bin/deprecated/change_ews_config.sh
vendored
Executable file
89
docker/tpotinit/dist/bin/deprecated/change_ews_config.sh
vendored
Executable file
@ -0,0 +1,89 @@
|
||||
#!/bin/bash
|
||||
|
||||
echo """
|
||||
|
||||
##############################
|
||||
# T-POT DTAG Data Submission #
|
||||
# Contact: #
|
||||
# cert@telekom.de #
|
||||
##############################
|
||||
"""
|
||||
|
||||
# Got root?
|
||||
myWHOAMI=$(whoami)
|
||||
if [ "$myWHOAMI" != "root" ]
|
||||
then
|
||||
echo "Need to run as root ..."
|
||||
sudo ./$0
|
||||
exit
|
||||
fi
|
||||
|
||||
printf "[*] Enter your API UserID: "
|
||||
read apiUser
|
||||
printf "[*] Enter your API Token: "
|
||||
read apiToken
|
||||
printf "[*] If you have multiple T-Pots running, give them each a unique NUMBER, e.g. '2' for your second T-Pot installation. Enter unique number for THIS T-Pot: "
|
||||
read indexNumber
|
||||
if ! [[ "$indexNumber" =~ ^[0-9]+$ ]]
|
||||
then
|
||||
echo "Sorry integers only. You have to start over..."
|
||||
exit 1
|
||||
fi
|
||||
apiURL="https://community.sicherheitstacho.eu/ews-0.1/alert/postSimpleMessage"
|
||||
printf "[*] Currently, your honeypot is configured to transmit data the default backend at 'https://community.sicherheitstacho.eu/ews-0.1/alert/postSimpleMessage'. Do you want to change this API endpoint? Only do this if you run your own PEBA backend instance? (N/y): "
|
||||
read replyAPI
|
||||
if [[ $replyAPI =~ ^[Yy]$ ]]
|
||||
then
|
||||
printf "[*] Enter your API endpoint URL and make sure it contains the full path, e.g. 'https://myDomain.local:9922/ews-0.1/alert/postSimpleMessage': "
|
||||
read apiURL
|
||||
fi
|
||||
|
||||
|
||||
|
||||
echo ""
|
||||
echo "[*] Recap! You defined: "
|
||||
echo "############################"
|
||||
echo "API User: " $apiUser
|
||||
echo "API Token: " $apiToken
|
||||
echo "API URL: " $apiURL
|
||||
echo "Unique numeric ID for your T-Pot Installation: " $indexNumber
|
||||
echo "Specific honeypot-IDs will look like : <honeypotType>-"$apiUser"-"$indexNumber
|
||||
echo "############################"
|
||||
echo ""
|
||||
printf "[*] Is the above correct (y/N)? "
|
||||
read reply
|
||||
if [[ ! $reply =~ ^[Yy]$ ]]
|
||||
then
|
||||
echo "OK, then run this again..."
|
||||
exit 1
|
||||
fi
|
||||
echo ""
|
||||
echo "[+] Creating config file with API UserID '$apiUser' and API Token '$apiToken'."
|
||||
echo "[+] Fetching config file from github. Outgoing https requests must be enabled!"
|
||||
wget -q https://raw.githubusercontent.com/telekom-security/tpotce/master/docker/ews/dist/ews.cfg -O ews.cfg.dist
|
||||
if [[ -f "ews.cfg.dist" ]]; then
|
||||
echo "[+] Successfully downloaded ews.cfg from github."
|
||||
else
|
||||
echo "[+] Could not download ews.cfg from github."
|
||||
exit 1
|
||||
fi
|
||||
echo "[+] Patching ews.cfg API Credentials."
|
||||
sed 's/community-01-user/'$apiUser'/' ews.cfg.dist > ews.cfg
|
||||
sed -i 's/foth{a5maiCee8fineu7/'$apiToken'/' ews.cfg
|
||||
echo "[+] Patching ews.cfg API Url."
|
||||
apiURL=${apiURL////\\/};
|
||||
sed -i 's/https:\/\/community.sicherheitstacho.eu\/ews-0.1\/alert\/postSimpleMessage/'$apiURL'/' ews.cfg
|
||||
echo "[+] Patching ews.cfg honeypot IDs."
|
||||
sed -i 's/community-01/'$apiUser'-'$indexNumber'/' ews.cfg
|
||||
|
||||
rm ews.cfg.dist
|
||||
|
||||
echo "[+] Changing tpot.yml to include new ews.cfg."
|
||||
|
||||
cp ews.cfg /data/ews/conf/ews.cfg
|
||||
cp /opt/tpot/etc/tpot.yml /opt/tpot/etc/tpot.yml.bak
|
||||
sed -i '/- \/data\/ews\/conf\/ews.ip:\/opt\/ewsposter\/ews.ip/a\ \ \ - \/data\/ews\/conf\/ews.cfg:\/opt\/ewsposter\/ews.cfg' /opt/tpot/etc/tpot.yml
|
||||
|
||||
echo "[+] Restarting T-Pot."
|
||||
systemctl restart tpot
|
||||
echo "[+] Done."
|
||||
182
docker/tpotinit/dist/bin/deprecated/deploy.sh
vendored
Executable file
182
docker/tpotinit/dist/bin/deprecated/deploy.sh
vendored
Executable file
@ -0,0 +1,182 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Do we have root?
|
||||
function fuGOT_ROOT {
|
||||
echo
|
||||
echo -n "### Checking for root: "
|
||||
if [ "$(whoami)" != "root" ];
|
||||
then
|
||||
echo "[ NOT OK ]"
|
||||
echo "### Please run as root."
|
||||
echo "### Example: sudo $0"
|
||||
exit
|
||||
else
|
||||
echo "[ OK ]"
|
||||
fi
|
||||
}
|
||||
|
||||
function fuDEPLOY_SENSOR () {
|
||||
echo
|
||||
echo "###############################"
|
||||
echo "# Deploying to T-Pot Hive ... #"
|
||||
echo "###############################"
|
||||
echo
|
||||
sshpass -e ssh -4 -t -T -l "$MY_TPOT_USERNAME" -p 64295 "$MY_HIVE_IP" << EOF
|
||||
echo "$SSHPASS" | sudo -S bash -c 'useradd -m -s /sbin/nologin -G tpotlogs "$MY_HIVE_USERNAME";
|
||||
mkdir -p /home/"$MY_HIVE_USERNAME"/.ssh;
|
||||
echo "$MY_SENSOR_PUBLICKEY" >> /home/"$MY_HIVE_USERNAME"/.ssh/authorized_keys;
|
||||
chmod 600 /home/"$MY_HIVE_USERNAME"/.ssh/authorized_keys;
|
||||
chmod 755 /home/"$MY_HIVE_USERNAME"/.ssh;
|
||||
chown "$MY_HIVE_USERNAME":"$MY_HIVE_USERNAME" -R /home/"$MY_HIVE_USERNAME"/.ssh'
|
||||
EOF
|
||||
|
||||
echo
|
||||
echo "###########################"
|
||||
echo "# Done. Please reboot ... #"
|
||||
echo "###########################"
|
||||
echo
|
||||
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Check Hive availability
|
||||
function fuCHECK_HIVE () {
|
||||
echo
|
||||
echo "############################################"
|
||||
echo "# Checking for T-Pot Hive availability ... #"
|
||||
echo "############################################"
|
||||
echo
|
||||
sshpass -e ssh -4 -t -l "$MY_TPOT_USERNAME" -p 64295 -f -N -L64305:127.0.0.1:64305 "$MY_HIVE_IP" -o "StrictHostKeyChecking=no"
|
||||
if [ $? -eq 0 ];
|
||||
then
|
||||
echo
|
||||
echo "#########################"
|
||||
echo "# T-Pot Hive available! #"
|
||||
echo "#########################"
|
||||
echo
|
||||
myHIVE_OK=$(curl -s http://127.0.0.1:64305)
|
||||
if [ "$myHIVE_OK" == "ok" ];
|
||||
then
|
||||
echo
|
||||
echo "##############################"
|
||||
echo "# T-Pot Hive tunnel test OK! #"
|
||||
echo "##############################"
|
||||
echo
|
||||
kill -9 $(pidof ssh)
|
||||
else
|
||||
echo
|
||||
echo "######################################################"
|
||||
echo "# T-Pot Hive tunnel test FAILED! #"
|
||||
echo "# Tunneled port tcp/64305 unreachable on T-Pot Hive. #"
|
||||
echo "# Aborting. #"
|
||||
echo "######################################################"
|
||||
echo
|
||||
kill -9 $(pidof ssh)
|
||||
rm $MY_SENSOR_PUBLICKEYFILE
|
||||
rm $MY_SENSOR_PRIVATEKEYFILE
|
||||
rm $MY_LS_ENVCONFIGFILE
|
||||
exit 1
|
||||
fi;
|
||||
else
|
||||
echo
|
||||
echo "#################################################################"
|
||||
echo "# Something went wrong, most likely T-Pot Hive was unreachable! #"
|
||||
echo "# Aborting. #"
|
||||
echo "#################################################################"
|
||||
echo
|
||||
rm $MY_SENSOR_PUBLICKEYFILE
|
||||
rm $MY_SENSOR_PRIVATEKEYFILE
|
||||
rm $MY_LS_ENVCONFIGFILE
|
||||
exit 1
|
||||
fi;
|
||||
}
|
||||
|
||||
function fuGET_DEPLOY_DATA () {
|
||||
echo
|
||||
echo "### Please provide data from your T-Pot Hive installation."
|
||||
echo "### This usually is the one running the 'T-Pot Hive' type."
|
||||
echo "### You will be needing the OS user (typically 'tsec'), the users' password and the IP / FQDN."
|
||||
echo "### Do not worry, the password will not be persisted!"
|
||||
echo
|
||||
|
||||
read -p "Username: " MY_TPOT_USERNAME
|
||||
read -s -p "Password: " SSHPASS
|
||||
echo
|
||||
export SSHPASS
|
||||
read -p "IP / FQDN: " MY_HIVE_IP
|
||||
MY_HIVE_USERNAME="$(hostname)"
|
||||
MY_TPOT_TYPE="SENSOR"
|
||||
MY_LS_ENVCONFIGFILE="/data/elk/logstash/ls_environment"
|
||||
|
||||
MY_SENSOR_PUBLICKEYFILE="/data/elk/logstash/$MY_HIVE_USERNAME.pub"
|
||||
MY_SENSOR_PRIVATEKEYFILE="/data/elk/logstash/$MY_HIVE_USERNAME"
|
||||
if ! [ -s "$MY_SENSOR_PRIVATEKEYFILE" ] && ! [ -s "$MY_SENSOR_PUBLICKEYFILE" ];
|
||||
then
|
||||
echo
|
||||
echo "##############################"
|
||||
echo "# Generating ssh keyfile ... #"
|
||||
echo "##############################"
|
||||
echo
|
||||
mkdir -p /data/elk/logstash
|
||||
ssh-keygen -f "$MY_SENSOR_PRIVATEKEYFILE" -N "" -C "$MY_HIVE_USERNAME"
|
||||
MY_SENSOR_PUBLICKEY="$(cat "$MY_SENSOR_PUBLICKEYFILE")"
|
||||
else
|
||||
echo
|
||||
echo "#############################################"
|
||||
echo "# There is already a ssh keyfile. Aborting. #"
|
||||
echo "#############################################"
|
||||
echo
|
||||
exit 1
|
||||
fi
|
||||
echo
|
||||
echo "###########################################################"
|
||||
echo "# Writing config to /data/elk/logstash/ls_environment. #"
|
||||
echo "# If you make changes to this file, you need to reboot or #"
|
||||
echo "# run /opt/tpot/bin/updateip.sh. #"
|
||||
echo "###########################################################"
|
||||
echo
|
||||
tee $MY_LS_ENVCONFIGFILE << EOF
|
||||
MY_TPOT_TYPE=$MY_TPOT_TYPE
|
||||
MY_SENSOR_PRIVATEKEYFILE=$MY_SENSOR_PRIVATEKEYFILE
|
||||
MY_HIVE_USERNAME=$MY_HIVE_USERNAME
|
||||
MY_HIVE_IP=$MY_HIVE_IP
|
||||
EOF
|
||||
}
|
||||
|
||||
# Deploy Pot to Hive
|
||||
fuGOT_ROOT
|
||||
echo
|
||||
echo "#################################"
|
||||
echo "# Ship T-Pot Logs to T-Pot Hive #"
|
||||
echo "#################################"
|
||||
echo
|
||||
echo "If you already have a T-Pot Hive installation running and"
|
||||
echo "this T-Pot installation is running the type \"Pot\" the"
|
||||
echo "script will automagically setup this T-Pot to ship and"
|
||||
echo "prepare the Hive to receive logs from this T-Pot."
|
||||
echo
|
||||
echo
|
||||
echo "###################################"
|
||||
echo "# Deploy T-Pot Logs to T-Pot Hive #"
|
||||
echo "###################################"
|
||||
echo
|
||||
echo "[c] - Continue deplyoment"
|
||||
echo "[q] - Abort and exit"
|
||||
echo
|
||||
while [ 1 != 2 ]
|
||||
do
|
||||
read -s -n 1 -p "Your choice: " mySELECT
|
||||
echo $mySELECT
|
||||
case "$mySELECT" in
|
||||
[c,C])
|
||||
fuGET_DEPLOY_DATA
|
||||
fuCHECK_HIVE
|
||||
fuDEPLOY_SENSOR
|
||||
break
|
||||
;;
|
||||
[q,Q])
|
||||
echo "Aborted."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
@ -1,94 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Export all Kibana objects through Kibana Saved Objects API
|
||||
# Make sure ES is available
|
||||
myES="http://127.0.0.1:64298/"
|
||||
myKIBANA="http://127.0.0.1:64296/"
|
||||
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
|
||||
if ! [ "$myESSTATUS" = "1" ]
|
||||
then
|
||||
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
|
||||
exit
|
||||
else
|
||||
echo "### Elasticsearch is available, now continuing."
|
||||
echo
|
||||
fi
|
||||
|
||||
# Set vars
|
||||
myDATE=$(date +%Y%m%d%H%M)
|
||||
myINDEXCOUNT=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=index-pattern' | jq '.saved_objects[].attributes' | tr '\\' '\n' | grep -E "scripted|url" | wc -w)
|
||||
myINDEXID=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=index-pattern' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myDASHBOARDS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=dashboard&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myVISUALIZATIONS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=visualization&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
mySEARCHES=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=search&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myCONFIGS=$(curl -s -XGET ''$myKIBANA'api/saved_objects/_find?type=config&per_page=500' | jq '.saved_objects[].id' | tr -d '"')
|
||||
myCOL1="[0;34m"
|
||||
myCOL0="[0;0m"
|
||||
|
||||
# Let's ensure normal operation on exit or if interrupted ...
|
||||
function fuCLEANUP {
|
||||
rm -rf patterns/ dashboards/ visualizations/ searches/ configs/
|
||||
}
|
||||
trap fuCLEANUP EXIT
|
||||
|
||||
# Export index patterns
|
||||
mkdir -p patterns
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $myINDEXCOUNT $myCOL1"index pattern fields." $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' | jq '. | {attributes, references}' > patterns/$myINDEXID.json &
|
||||
echo
|
||||
|
||||
# Export dashboards
|
||||
mkdir -p dashboards
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/dashboard/'$i'' | jq '. | {attributes, references}' > dashboards/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export visualizations
|
||||
mkdir -p visualizations
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/visualization/'$i'' | jq '. | {attributes, references}' > visualizations/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export searches
|
||||
mkdir -p searches
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/search/'$i'' | jq '. | {attributes, references}' > searches/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Export configs
|
||||
mkdir -p configs
|
||||
echo $myCOL1"### Now exporting"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XGET ''$myKIBANA'api/saved_objects/config/'$i'' | jq '. | {attributes, references}' > configs/$i.json &
|
||||
done;
|
||||
echo
|
||||
|
||||
# Wait for background exports to finish
|
||||
wait
|
||||
|
||||
# Building tar archive
|
||||
echo $myCOL1"### Now building archive"$myCOL0 "kibana-objects_"$myDATE".tgz"
|
||||
tar cvfz kibana-objects_$myDATE.tgz patterns dashboards visualizations searches configs > /dev/null
|
||||
|
||||
# Stats
|
||||
echo
|
||||
echo $myCOL1"### Statistics"
|
||||
echo $myCOL1"###### Exported"$myCOL0 $myINDEXCOUNT $myCOL1"index patterns." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
echo $myCOL1"###### Exported"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
echo
|
||||
134
docker/tpotinit/dist/bin/deprecated/hpfeeds_optin.sh
vendored
Executable file
134
docker/tpotinit/dist/bin/deprecated/hpfeeds_optin.sh
vendored
Executable file
@ -0,0 +1,134 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Run as root only.
|
||||
myWHOAMI=$(whoami)
|
||||
if [ "$myWHOAMI" != "root" ]
|
||||
then
|
||||
echo "Need to run as root ..."
|
||||
exit
|
||||
fi
|
||||
|
||||
myTPOTYMLFILE="/opt/tpot/etc/tpot.yml"
|
||||
|
||||
function fuGENERIC () {
|
||||
echo
|
||||
echo "You chose generic, please provide all the details of the broker"
|
||||
echo
|
||||
myENABLE="true"
|
||||
read -p "Host URL: " myHOST
|
||||
read -p "Port: " myPORT
|
||||
read -p "Channel: " myCHANNEL
|
||||
echo "For generic providers set this to 'false'"
|
||||
echo "If you received a CA certficate mount it into the ewsposter container by modifying $myTPOTYMLFILE"
|
||||
read -p "TLS - 'false' or path to CA in container: " myCERT
|
||||
read -p "Ident: " myIDENT
|
||||
read -p "Secret: " mySECRET
|
||||
read -p "Format ews (xml) or json: " myFORMAT
|
||||
}
|
||||
|
||||
function fuOPTOUT () {
|
||||
echo
|
||||
while [ 1 != 2 ]
|
||||
do
|
||||
read -s -n 1 -p "You chose to opt out (y/n)? " mySELECT
|
||||
echo $mySELECT
|
||||
case "$mySELECT" in
|
||||
[y,Y])
|
||||
echo "Opt out."
|
||||
break
|
||||
;;
|
||||
[n,N])
|
||||
echo "Aborted."
|
||||
exit
|
||||
;;
|
||||
esac
|
||||
done
|
||||
myENABLE="false"
|
||||
myHOST="host"
|
||||
myPORT="port"
|
||||
myCHANNEL="channels"
|
||||
myCERT="false"
|
||||
myIDENT="user"
|
||||
mySECRET="secret"
|
||||
myFORMAT="json"
|
||||
}
|
||||
|
||||
function fuWRITETOFILE () {
|
||||
if [ -f '/data/ews/conf/hpfeeds.cfg' ]; then
|
||||
echo "Creating backup of current config in /data/ews/conf/hpfeeds.cfg.old"
|
||||
mv /data/ews/conf/hpfeeds.cfg /data/ews/conf/hpfeeds.cfg.old
|
||||
fi
|
||||
echo "Storing new config in /data/ews/conf/hpfeeds.cfg"
|
||||
cat >> /data/ews/conf/hpfeeds.cfg <<EOF
|
||||
myENABLE=$myENABLE
|
||||
myHOST=$myHOST
|
||||
myPORT=$myPORT
|
||||
myCHANNEL=$myCHANNEL
|
||||
myCERT=$myCERT
|
||||
myIDENT=$myIDENT
|
||||
mySECRET=$mySECRET
|
||||
myFORMAT=$myFORMAT
|
||||
EOF
|
||||
}
|
||||
|
||||
function fuAPPLY () {
|
||||
echo "Now stopping T-Pot ..."
|
||||
systemctl stop tpot
|
||||
echo "Applying your settings to tpot.yml ... "
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_ENABLE.*/EWS_HPFEEDS_ENABLE=${myENABLE}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_HOST.*/EWS_HPFEEDS_HOST=${myHOST}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_PORT.*/EWS_HPFEEDS_PORT=${myPORT}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_CHANNELS.*/EWS_HPFEEDS_CHANNELS=${myCHANNEL}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s#EWS_HPFEEDS_TLSCERT.*#EWS_HPFEEDS_TLSCERT=${myCERT}#g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_IDENT.*/EWS_HPFEEDS_IDENT=${myIDENT}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_SECRET.*/EWS_HPFEEDS_SECRET=${mySECRET}/g" "$myTPOTYMLFILE"
|
||||
sed --follow-symlinks -i "s/EWS_HPFEEDS_FORMAT.*/EWS_HPFEEDS_FORMAT=${myFORMAT}/g" "$myTPOTYMLFILE"
|
||||
echo "Now starting T-Pot ..."
|
||||
systemctl start tpot
|
||||
echo "You can always change or review your settings in /data/ews/conf/hpfeeds.cfg and apply changes by"
|
||||
echo "running \"./hpfeeds_optin.sh --conf=/data/ews/conf/hpfeeds.cfg\""
|
||||
echo "Done."
|
||||
}
|
||||
|
||||
# Check for cmdline argument and parse config file
|
||||
filename=$(echo $@ | cut -d= -f2)
|
||||
if [ $# == 1 ] && echo $@ | grep '\-\-conf=' > /dev/null && [ ! -z $filename ] && [ -f $filename ]
|
||||
then
|
||||
source $filename
|
||||
else
|
||||
|
||||
# Proceed with interactive setup when no config file is found
|
||||
echo "HPFEEDS Delivery Opt-In for T-Pot"
|
||||
echo "---------------------------------"
|
||||
echo "By running this script you agree to share your data with a 3rd party and agree to their corresponding sharing terms."
|
||||
echo
|
||||
echo
|
||||
echo "Please choose your broker"
|
||||
echo "---------------------------"
|
||||
echo "[1] - Generic (enter details manually)"
|
||||
echo "[0] - Opt out of HPFEEDS"
|
||||
echo "[q] - Do not agree end exit"
|
||||
echo
|
||||
while [ 1 != 2 ]
|
||||
do
|
||||
read -s -n 1 -p "Your choice: " mySELECT
|
||||
echo $mySELECT
|
||||
case "$mySELECT" in
|
||||
[1])
|
||||
fuGENERIC
|
||||
break
|
||||
;;
|
||||
[0])
|
||||
fuOPTOUT
|
||||
break
|
||||
;;
|
||||
[q,Q])
|
||||
echo "Aborted."
|
||||
exit
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
fi
|
||||
fuWRITETOFILE
|
||||
fuAPPLY
|
||||
@ -1,126 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Import Kibana objects
|
||||
# Make sure ES is available
|
||||
myES="http://127.0.0.1:64298/"
|
||||
myKIBANA="http://127.0.0.1:64296/"
|
||||
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
|
||||
if ! [ "$myESSTATUS" = "1" ]
|
||||
then
|
||||
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
|
||||
exit
|
||||
else
|
||||
echo "### Elasticsearch is available, now continuing."
|
||||
echo
|
||||
fi
|
||||
|
||||
# Set vars
|
||||
myDUMP=$1
|
||||
myCOL1="[0;34m"
|
||||
myCOL0="[0;0m"
|
||||
|
||||
# Let's ensure normal operation on exit or if interrupted ...
|
||||
function fuCLEANUP {
|
||||
rm -rf patterns/ dashboards/ visualizations/ searches/ configs/
|
||||
}
|
||||
trap fuCLEANUP EXIT
|
||||
|
||||
# Check if parameter is given and file exists
|
||||
if [ "$myDUMP" = "" ];
|
||||
then
|
||||
echo $myCOL1"### Please provide a backup file name."$myCOL0
|
||||
echo $myCOL1"### import_kibana-objects.sh <kibana-objects.tgz>"$myCOL0
|
||||
echo
|
||||
exit
|
||||
fi
|
||||
if ! [ -a $myDUMP ];
|
||||
then
|
||||
echo $myCOL1"### File not found."$myCOL0
|
||||
exit
|
||||
fi
|
||||
|
||||
# Unpack tar
|
||||
tar xvfz $myDUMP > /dev/null
|
||||
|
||||
# Restore index patterns
|
||||
myINDEXID=$(ls patterns/*.json | cut -c 10- | rev | cut -c 6- | rev)
|
||||
myINDEXCOUNT=$(cat patterns/$myINDEXID.json | tr '\\' '\n' | grep -E "scripted|url" | wc -w)
|
||||
echo $myCOL1"### Now importing"$myCOL0 $myINDEXCOUNT $myCOL1"index pattern fields." $myCOL0
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/index-pattern/logstash-*' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/index-pattern/'$myINDEXID'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @patterns/$myINDEXID.json > /dev/null &
|
||||
echo
|
||||
|
||||
# Restore dashboards
|
||||
myDASHBOARDS=$(ls dashboards/*.json | cut -c 12- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myDASHBOARDS | wc -w)$myCOL1 "dashboards." $myCOL0
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/dashboard/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myDASHBOARDS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/dashboard/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @dashboards/$i.json > /dev/null &
|
||||
done;
|
||||
wait
|
||||
echo
|
||||
|
||||
# Restore visualizations
|
||||
myVISUALIZATIONS=$(ls visualizations/*.json | cut -c 16- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myVISUALIZATIONS | wc -w)$myCOL1 "visualizations." $myCOL0
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/visualization/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myVISUALIZATIONS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/visualization/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @visualizations/$i.json > /dev/null &
|
||||
done;
|
||||
wait
|
||||
echo
|
||||
|
||||
# Restore searches
|
||||
mySEARCHES=$(ls searches/*.json | cut -c 10- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $mySEARCHES | wc -w)$myCOL1 "searches." $myCOL0
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/search/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $mySEARCHES;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/search/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @searches/$i.json > /dev/null &
|
||||
done;
|
||||
echo
|
||||
wait
|
||||
|
||||
# Restore configs
|
||||
myCONFIGS=$(ls configs/*.json | cut -c 9- | rev | cut -c 6- | rev)
|
||||
echo $myCOL1"### Now importing "$myCOL0$(echo $myCONFIGS | wc -w)$myCOL1 "configs." $myCOL0
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
curl -s -XDELETE ''$myKIBANA'api/saved_objects/configs/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" > /dev/null &
|
||||
done;
|
||||
wait
|
||||
for i in $myCONFIGS;
|
||||
do
|
||||
echo $myCOL1"###### "$i $myCOL0
|
||||
curl -s -XPOST ''$myKIBANA'api/saved_objects/configs/'$i'' -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @configs/$i.json > /dev/null &
|
||||
done;
|
||||
echo
|
||||
wait
|
||||
|
||||
# Stats
|
||||
echo
|
||||
echo $myCOL1"### Statistics"
|
||||
echo $myCOL1"###### Imported"$myCOL0 $myINDEXCOUNT $myCOL1"index patterns." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myDASHBOARDS | wc -w) $myCOL1"dashboards." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myVISUALIZATIONS | wc -w) $myCOL1"visualizations." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $mySEARCHES | wc -w) $myCOL1"searches." $myCOL0
|
||||
echo $myCOL1"###### Imported"$myCOL0 $(echo $myCONFIGS | wc -w) $myCOL1"configs." $myCOL0
|
||||
echo
|
||||
|
||||
Reference in New Issue
Block a user