telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

tweaking, persistence

Browse Source
This commit is contained in:
t3chn0m4g3
2016-03-04 21:47:14 +01:00
parent a7f98902e3
commit 2d5c498860
6 changed files with 55 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
installer/data/upstart/suricata.conf
View File

@ -2,7 +2,7 @@
# T-Pot #
# Suricata upstart script #
# #
# v16.03.2 by mo, DTAG, 2016-02-08 #
# v16.03.3 by mo, DTAG, 2016-03-04 #
########################################################
description "Suricata"
@ -16,21 +16,24 @@ pre-start script
if [ "$myCID" != "" ];
then docker rm -v $myCID;
fi
# Remove any data from previous container
rm -rf /data/suricata/* || true
mkdir -p /data/suricata/log
chmod 760 -R /data/suricata
chown tpot:tpot -R /data/suricata
# Remove any data from previous container if persistence is not enabled
if ! [ -f /data/persistence.on ];
then
rm -rf /data/suricata/* || true
mkdir -p /data/suricata/log
chmod 760 -R /data/suricata
chown tpot:tpot -R /data/suricata
fi
# Get IF, disable offloading, enable promiscious mode
myIF=$(route | grep default | awk '{ print $8 }')
/sbin/ethtool --offload $myIF rx off tx off
/sbin/ethtool -K $myIF gso off gro off
/sbin/ip link set $myIF promisc on
end script
script
# Delayed start to avoid rapid respawning
sleep 2
/usr/bin/docker run --name suricata --cap-add=NET_ADMIN --net=host --rm=true -v /data/suricata:/data/suricata dtagdevsec/suricata:latest1603
end script
post-start script
sleep $(((RANDOM % 5)+5))
# Delay next start to avoid rapid respawning
sleep 2
end script