Add a new elasticsearch honeypot

adjust installer
adjust elasticpot configs to T-Pot's environment
create Dockerfile
adjust logstash config
update Readme

docker/elasticpot/Dockerfile

@@ -4,31 +4,41 @@ FROM alpine:latest
 ADD dist/ /root/dist/
 #
 # Install packages
-RUN apk -U --no-cache add \
+RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \
+    apk -U add \
+             build-base \
+	     ca-certificates \
              git \
+             libffi-dev \
+	     openssl \
+             openssl-dev \
+             py3-mysqlclient \
+             py3-requests \
 	     py3-pip \
-             python3 && \
-    pip3 install --no-cache-dir bottle \
-                                configparser \
-                                datetime \
-                                requests && \
+             python3 \
+             python3-dev && \
     mkdir -p /opt && \
     cd /opt/ && \
-    git clone --depth=1 https://github.com/schmalle/ElasticpotPY.git && \
+    git clone --depth=1 https://gitlab.com/bontchev/elasticpot.git/ && \
+    cd elasticpot && \
+    pip3 install -r requirements.txt && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 elasticpot && \
     adduser -S -H -s /bin/ash -u 2000 -D -g 2000 elasticpot && \
-    mv /root/dist/elasticpot.cfg /opt/ElasticpotPY/ && \
-    mkdir /opt/ElasticpotPY/log && \
+    mv /root/dist/honeypot.cfg /opt/elasticpot/etc/ && \
 #
 # Clean up
-    apk del --purge git && \
+    apk del --purge build-base \
+                    git \
+                    libffi-dev \
+		    openssl-dev \
+		    python3-dev && \
     rm -rf /root/* && \
     rm -rf /var/cache/apk/*
 #
 # Start elasticpot
 STOPSIGNAL SIGINT
 USER elasticpot:elasticpot
-WORKDIR /opt/ElasticpotPY/
-CMD ["/usr/bin/python3","main.py"]
+WORKDIR /opt/elasticpot/
+CMD ["/usr/bin/python3","elasticpot.py"]

docker/elasticpot/README.md

@@ -1,15 +0,0 @@
-[![](https://images.microbadger.com/badges/version/dtagdevsec/elasticpot:1903.svg)](https://microbadger.com/images/dtagdevsec/elasticpot:1903 "Get your own version badge on microbadger.com") [![](https://images.microbadger.com/badges/image/dtagdevsec/elasticpot:1903.svg)](https://microbadger.com/images/dtagdevsec/elasticpot:1903 "Get your own image badge on microbadger.com")
-
-# elasticpot
-
-[elasticpot](https://github.com/schmalle/ElasticPot) is a simple elastic search honeypot.
-
-This dockerized version is part of the **[T-Pot community honeypot](http://dtag-dev-sec.github.io/)** of Deutsche Telekom AG.
-
-The `Dockerfile` contains the blueprint for the dockerized elasticpot and will be used to setup the docker image.
-
-The `docker-compose.yml` contains the necessary settings to test elasticpot using `docker-compose`. This will ensure to start the docker container with the appropriate permissions and port mappings.
-
-# ElasticPot Dashboard
-
-![ElasticPot Dashboard](doc/dashboard.png)

docker/elasticpot/dist/elasticpot.cfg

@@ -1,31 +0,0 @@
-# ElasticPot Config
-
-[MAIN]
-# Manually set the externally accessible IP of the honeypot
-ip = 192.168.1.1 
-
-
-[ELASTICPOT]
-# ID pf the elasticpot instance
-nodeid = elasticpot-community-01
-
-# Location of the json logfile
-logfile = log/elasticpot.log
-
-# Set elasticpot = False to disable json logging and enable automatic attack submission to ews backend (soap)
-elasticpot = True
-
-
-[EWS]
-# Note: Only relevant if "elasticpot = False"
-# Username for ews submission
-username = community-01-user
-
-# Token for ews submission
-token = foth{a5maiCee8fineu7
-
-# API endpoint for ews submission
-rhost_first = https://community.sicherheitstacho.eu/ews-0.1/alert/postSimpleMessage
-
-# Ignore certificate warnings
-ignorecert = false

docker/elasticpot/dist/honeypot.cfg

@@ -0,0 +1,301 @@
+# ============================================================================
+# General Honeypot Options
+# ============================================================================
+[honeypot]
+
+# Sensor name is used to identify this honeypot instance. Used by the database
+# logging modules such as JSON.
+#
+# If not specified, the logging modules will instead use the IP address of the
+# server as the sensor name.
+#
+# (default: the name of the local machine)
+sensor_name = t-pot
+
+# The version of Elasticsearch reported by the honeypot.
+#
+# (default: 1.4.1)
+#spoofed_version = 1.4.1
+
+# The Elasticsearch instance name reported by the honeypot.
+#
+# (default = Green Goblin)
+instance_name = USNYES01
+
+# The name of the simulated Elasticsearch cluster
+#
+# (default = elasticsearch
+#cluster_name = elasticsearch
+
+# The name of the simulated host running Elasticsearch
+#
+# (default = elk)
+host_name = usnyes01
+
+# The build number of the simulated Elasticsearch instance
+# Use something realistic or simply don't touch this value
+#
+# (default = 89d3241)
+#build = 89d3241
+
+# The number of processors on the simulated host
+#
+# (default = 12)
+#total_processors = 12
+
+# The total number of CPU cores on the simulated host
+# Use a multiple of total_processors
+#
+# (default = 24)
+#total_cores = 24
+
+# The total number of sockets on the simulated host
+# Use a multiple of total_cores
+#
+# (default = 48)
+#total_sockets = 48
+
+# The MAC address of the networking card of the simulated host
+#
+# (default = 08:01:c7:3F:15:DD)
+#mac_address = 08:01:c7:3F:15:DD
+
+# Directory where to save log files in.
+# Log files are <log_filename>.YYYY-MM-DD in that directory
+#
+# (default: log)
+log_path = log
+
+# Log file name
+#
+# (default: stdout)
+#log_filename =
+
+# Directory containing the response files
+#
+# (default: responses)
+#responses_dir = responses
+
+# ============================================================================
+# Network Specific Options
+# ============================================================================
+
+# Port to listen for incoming connections.
+#
+# (default: 9200)
+#listen_port = 9200
+
+# Site to query for one's public IP address
+#
+# (default: https://ident.me)
+#public_ip_url = https://ident.me
+
+# Enable to log the public IP of the honeypot (useful if listening on 127.0.0.1)
+# IP address is obtained by querying public_ip_url
+#
+# (default: false)
+#report_public_ip = false
+
+
+# ============================================================================
+# Output Plugins
+# These provide an extensible mechanism to send audit log entries to third
+# parties. The audit entries contain information on clients connecting to
+# the honeypot.
+#
+# Output entries need to start with 'output_' and have the 'enabled' entry.
+# ============================================================================
+
+# JSON based logging module
+#
+[output_jsonlog]
+enabled = true
+logfile = log/elasticpot.json
+epoch_timestamp = false
+
+# MySQL logging module
+# Database structure for this module is supplied in docs/sql/mysql.sql
+#
+# MySQL logging requires extra software: sudo apt-get install libmysqlclient-dev
+# MySQL logging requires an extra Python module: pip install mysql-python
+#
+#[output_mysql]
+#enabled = false
+#host = localhost
+#database = elasticpot
+#username = elasticpot
+#password = secret
+#port = 3306
+#debug = false
+# Whether to store geolocation data in the database
+#geoip = true
+# Location of the databases used for geolocation
+#geoip_citydb = data/GeoLite2-City.mmdb
+#geoip_asndb = data/GeoLite2-ASN.mmdb
+
+# Text output
+# This writes audit log entries to a text file
+#
+#[output_textlog]
+#enabled = false
+#logfile = log/elasticpot.txt
+
+# HPFeeds
+#
+# Note the lack of "s" at the end:
+[output_hpfeed]
+enabled = false
+#server = hpfeeds.mysite.org
+#tlscert = /path/to/tls/cert/file
+#port = 10000
+#identifier = abc123
+#secret = secret
+#channel = elasticpot
+
+# MongoDB logging module
+#
+#[output_mongodb]
+#enabled = false
+#host = 127.0.0.1
+#port = 27017
+#username = elasticpot
+#password = secret
+#database = elasticpot
+# Note: .format(username, password, host, port, database) is done
+#  on the following string; make sure that there are 5 placeholders ({}) in it
+#connection_string = mongodb://{}:{}@{}:{}/{}
+# Whether to store geolocation data in the database
+#geoip = true
+# Location of the databases used for geolocation
+#geoip_citydb = data/GeoLite2-City.mmdb
+#geoip_asndb = data/GeoLite2-ASN.mmdb
+
+# RedisDB logging module
+#
+#[output_redisdb]
+#enabled = false
+#host = 127.0.0.1
+#port = 6379
+# DB of the redis server. Defaults to 0
+#db = 0
+# Password of the redis server. Defaults to None
+#password = secret
+# Name of the list to push to or the channel to publish to. Required
+#keyname = elasticpot
+# Method to use when sending data to redis.
+# Can be one of [lpush, rpush, publish]. Defaults to lpush
+#send_method = lpush
+
+# Rethinkdb output module
+#
+#[output_rethinkdblog]
+#enabled = false
+#host = 127.0.0.1
+#port = 28015
+#table = events
+#db = elasticpot
+#password =
+
+# InfluxDB logging module
+#
+#[output_influx]
+#enabled = false
+#host = 127.0.0.1
+#port = 8086
+#database_name = elasticpot
+#retention_policy_duration = 12w
+
+# InfluxDB 2.0 logging module
+#
+#[output_influx2]
+#enabled = false
+#host = hostname
+#token = token
+#org = organization
+#bucket = elasticpot
+
+# CouchDB logging module
+#
+#[output_couch]
+#enabled = false
+#host = localhost
+#port = 5984
+#username = elasticpot
+#password = secret
+#database = elasticpot
+#geoip = true
+# Location of the databases used for geolocation
+#geoip_citydb = data/GeoLite2-City.mmdb
+#geoip_asndb = data/GeoLite2-ASN.mmdb
+
+# SQLite3 logging module
+#
+# Logging to SQLite3 database. To init the database, use the script
+# docs/sql/sqlite3.sql:
+#     sqlite3 <db_file> < docs/sql/sqlite3.sql
+#
+#[output_sqlite]
+#enabled = false
+#debug = false
+#db_file = data/elasticpot.db
+# Whether to store geolocation data in the database
+#geoip = true
+# Location of the databases used for geolocation
+#geoip_citydb = data/GeoLite2-City.mmdb
+#geoip_asndb = data/GeoLite2-ASN.mmdb
+
+# Elasticsearch logging module
+#
+#[output_elastic]
+#enabled = false
+#host = localhost
+#port = 9200
+#index = elasticpot
+#
+# type has been deprecated since ES 6.0.0
+# use _doc which is the default type. See
+# https://stackoverflow.com/a/53688626 for
+# more information
+#
+#type = _doc
+#
+# set pipeline = geoip to map src_ip to
+# geo location data. You can use a custom
+# pipeline but you must ensure it exists
+# in elasticsearch.
+#
+#pipeline = geoip
+#
+# Authentication. When x-pack.security is enabled
+# in ES, default users have been created and requests
+# must be authenticated.
+#
+# Credentials
+#
+#username = elasticpot
+#password = secret
+#
+# TLS encryption. Communications between the client (elasticpot) 
+# and the ES server should naturally be protected by encryption
+# if requests are authenticated (to prevent from man-in-the-middle 
+# attacks). The following options are then paramount
+# if username and password are provided.
+#
+# use ssl/tls
+#ssl = true
+# verify SSL certificates
+#verify_certs = true
+# Path to trusted CA certs on disk
+#ca_certs = /path/to/cert/file/elastic_ca.crt
+
+
+# TODO:
+
+# Kafka logging module
+#
+#[output_kafka]
+#enabled = false
+#host = 127.0.0.1
+#port = 9092
+#topic = elasticpot
+

docker/elasticpot/docker-compose.yml

@@ -17,4 +17,4 @@ services:
     image: "dtagdevsec/elasticpot:2006"
     read_only: true
     volumes:
-     - /data/elasticpot/log:/opt/ElasticpotPY/log
+     - /data/elasticpot/log:/opt/elasticpot/log