telekom-security/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-02 01:27:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

update install scripts and cleanup

Browse Source
This commit is contained in:
t3chn0m4g3
2015-01-21 17:51:32 +01:00
parent 500ef969a6
commit 3ba90dc382
4 changed files with 137 additions and 466 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
installer/install1.sh
View File

@ -4,12 +4,15 @@
# and consoleblank permanently # # and consoleblank permanently #
# Ubuntu server 14.04.1, x64 # # Ubuntu server 14.04.1, x64 #
# # # #
# v0.05 by mo, DTAG, 2014-12-18 # # v0.07 by mo, DTAG, 2015-01-20 #
############################################################# #############################################################
# Let's replace "quiet splash" options and update grub # Let's replace "quiet splash" options and update grub
sed -i.bak 's#GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"#GRUB_CMDLINE_LINUX_DEFAULT="consoleblank=0"#' /etc/default/grub sed -i 's#GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"#GRUB_CMDLINE_LINUX_DEFAULT="consoleblank=0"#' /etc/default/grub
sed -i 's#\#GRUB_GFXMODE=640x480#GRUB_GFXMODE=800x600#' /etc/default/grub
update-grub update-grub
sed -i 's#FONTFACE="VGA"#FONTFACE="Terminus"#' /etc/default/console-setup
sed -i 's#FONTSIZE="16"#FONTSIZE="12x6"#' /etc/default/console-setup
# Let's move the install script to rc.local and reboot # Let's move the install script to rc.local and reboot
mv /root/install.sh /etc/rc.local && sleep 2 && reboot mv /root/install.sh /etc/rc.local && sleep 2 && reboot

194
installer/install2.sh
View File

@ -3,9 +3,12 @@
# T-Pot Community Edition post install script # # T-Pot Community Edition post install script #
# Ubuntu server 14.04, x64 # # Ubuntu server 14.04, x64 #
# # # #
# v0.19 by mo, DTAG, 2014-12-18 # # v0.20 by mo, DTAG, 2015-01-20 #
######################################################## ########################################################
# Let's fit more on the screen
setupcon
# Let's make sure there is a warning if running for a second time # Let's make sure there is a warning if running for a second time
if [ -f install.log ]; if [ -f install.log ];
then fuECHO "### Running more than once may complicate things. Erase install.log if you are really sure." then fuECHO "### Running more than once may complicate things. Erase install.log if you are really sure."
@ -44,20 +47,7 @@ apt-get dist-upgrade -y
# Let's install all the packages we need # Let's install all the packages we need
fuECHO "### Installing packages." fuECHO "### Installing packages."
apt-get install ntp lxc-docker git -y apt-get install ethtool git ntp libpam-google-authenticator lxc-docker-1.4.1 vim -y
# Create the data partition and limit its size
# If we want to extent the size of that filesystem later, without loss of data:
# resize2fs -p data.img 8192M
#fuECHO "### Creating data partition (Please be patient, this may take a while)."
#mkdir -p /opt/virtual-disk/
#dd if=/dev/zero of=/opt/virtual-disk/data.ext4 bs=1024 count=4096000
#mkfs.ext4 /opt/virtual-disk/data.ext4 -F
#tee -a /etc/fstab <<EOF
#/opt/virtual-disk/data.ext4 /data ext4 loop,rw,nosuid
#EOF
#mkdir -p /data
#mount /opt/virtual-disk/data.ext4 -o loop,rw,nosuid
# Let's add a new user # Let's add a new user
fuECHO "### Adding new user." fuECHO "### Adding new user."
@ -66,8 +56,7 @@ adduser --system --no-create-home --uid 2000 --disabled-password --disabled-logi
# Let's create some files and folders # Let's create some files and folders
fuECHO "### Creating some files and folders." fuECHO "### Creating some files and folders."
mkdir -p /data/ews/log /data/ews/conf mkdir -p /data/ews/log /data/ews/conf /data/elk/data /data/elk/log
#mkdir -p /data/puppet/
# Let's modify the ownership / access rights # Let's modify the ownership / access rights
chmod 760 -R /data chmod 760 -R /data
@ -78,27 +67,74 @@ fuECHO "### Setting a new hostname."
myHOST=ce$(date +%s)$RANDOM myHOST=ce$(date +%s)$RANDOM
hostnamectl set-hostname $myHOST hostnamectl set-hostname $myHOST
sed -i 's/127.0.1.1.*/127.0.1.1\t'"$myHOST"'/g' /etc/hosts sed -i 's/127.0.1.1.*/127.0.1.1\t'"$myHOST"'/g' /etc/hosts
#echo $myHOST > /data/puppet/name.conf
# Let's patch sshd_config # Let's patch sshd_config
fuECHO "### Patching sshd_config to listen on port 64295 and deny password authentication." fuECHO "### Patching sshd_config to listen on port 64295 and deny password authentication."
sed -i 's#Port 22#Port 64295#' /etc/ssh/sshd_config sed -i 's#Port 22#Port 64295#' /etc/ssh/sshd_config
sed -i 's#\#PasswordAuthentication yes#PasswordAuthentication no#' /etc/ssh/sshd_config sed -i 's#\#PasswordAuthentication yes#PasswordAuthentication no#' /etc/ssh/sshd_config
# Disable ssh service # Let's disable ssh service
mv /etc/init/ssh.conf /etc/init/ssh.conf.disable mv /etc/init/ssh.conf /etc/init/ssh.conf.disable
# Let's add the ssh keys # Let's create the 2FA enable script
#fuECHO "### Adding ssh keys for the admin user." fuECHO "### Creating 2FA enable script."
#mkdir -p /home/admin/.ssh/ tee /home/tsec/2fa_enable.sh <<EOF
#tee /home/admin/.ssh/authorized_keys <<EOF #!/bin/bash
#ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8f8Dq8/XuVZl3M8ARxPQNz74T46Gez8nFTV6xjGKh6VZmyU8BL/+ERXSTJg47HsncNLEpqHgPnZTTh1hZK7HxJvPLQ1JrfPO7Fbl2B5Qy26yzAYJTnHQYUBMGTpI8gmLczE6eZcGuK0huMOoot+m7WeIMHQbzZcuNAknPsxBhJHY4s3rvElrJnY7ckz4mroqRSZXvu6w7igthUX3a1A+xsxVmxUatzFJ1Ky4jYswKFdcNPA77/nRckxtt86ORpqJq/r2PjDpuv2JpRha9zdUDpvpdCIQJFM1SdRyGMSrvbMyEWZBCTB3YF/GmQT04sfEytqHUY7zbK7kzNyDhXeg5Q== av@telekom echo "### This script will enable Two-Factor-Authentication based on Google Authenticator for SSH."
#ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt6Af5L8FYaNiDG0JKHPlJDLAbXklK5wVHj1IYqLINR8dIBcGcFwIF+YoJypZmsf1geta9WPjEW8bpd4G6XiYYg6YNRYxgBZScSb0WGVn0rHBMH+cuQxkhIdHucEMq4JFsRTVFWXjpQspu6p5gQxafGHnsLY/RYrgFy9XktS7Ha0Tfa6WXxpF72jyCoRRBUKF8CSip1XFaHIIY0xA0wTHZpmAI7dea4XA44oVDfr6g/4CTDTPQJiwn0HrRnZjgqJPzCT4gyXv+L6c5lcdrob4JpRj/YIis6aD6AMw4PeDsp3d/P9L2Vm9+p2a5Xx5U5cfGNUanvkvicrzZC1v+v3H9 mo@telekom while true
#ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHM2Pht1q6VDfRs+gPYu3/Eg5wgFfQrM45A+jRduskcIJSlwO5m/dMEipc10Y+Ut+tIST8ydQA8ZTYicinOjoCbSUju7sTDRb5jMs60nBRaj4BmzCQOqo4hidt3iX8+IpU9JUl8RR5rQzwDsWTdkhuCEEjiD+2YDdJO5kjMoaa1UW19iFEOLY582psoDTmkNY9MOfhoJla4S7m0A6eOMfq4DO/eKMKgOxJ0W8K6fQjSAyMSmqlamirxSjZ2OGohS7r1JVYhTdU6cmJxYRVNa2Rr8BHn8uf1cR4uaV49CfqJgx3W5YMjSjc3nCLt0csfdQd+sur25Gv0033liq7ZQFR ms@telekom do
#EOF echo -n "### Do you want to continue (y/n)? "; read myANSWER;
#chmod 700 -R /home/admin/.ssh case \$myANSWER in
#chmod 600 /home/admin/.ssh/authorized_keys n)
#chown admin:admin -R /home/admin/.ssh echo "### Exiting."
exit 0;
;;
y)
break
;;
esac
done
if [ -f /etc/pam.d/sshd.bak ];
then echo "### Already enabled. Exiting."
exit 1;
fi
sudo sed -i.bak '\# PAM#aauth required pam_google_authenticator.so' /etc/pam.d/sshd
sudo sed -i.bak 's#ChallengeResponseAuthentication no#ChallengeResponseAuthentication yes#' /etc/ssh/sshd_config
google-authenticator -t -d -f -r 3 -R 30 -w 21
echo "### Please do not forget to run the ssh_enable script."
EOF
chmod 700 /home/tsec/2fa_enable.sh
chown tsec:tsec /home/tsec/2fa_enable.sh
# Let's create the ssh enable script
fuECHO "### Creating ssh enable script."
tee /home/tsec/ssh_enable.sh <<EOF
#!/bin/bash
echo "### This script will enable the ssh service (default port tcp/64295)."
echo "### Password authentication is disabled by default."
while true
do
echo -n "### Do you want to continue (y/n)? "; read myANSWER;
case \$myANSWER in
n)
echo "### Exiting."
exit 0;
;;
y)
break
;;
esac
done
if [ -f /etc/init/ssh.conf ];
then echo "### Already enabled. Exiting."
exit 1;
fi
mv /etc/init/ssh.conf.disable /etc/init/ssh.conf
service ssh start
EOF
chmod 700 /home/tsec/ssh_enable.sh
chown tsec:tsec /home/tsec/ssh_enable.sh
# Let's patch docker defaults, so we can run images as service # Let's patch docker defaults, so we can run images as service
fuECHO "### Patching docker defaults." fuECHO "### Patching docker defaults."
@ -108,7 +144,7 @@ EOF
# Let's create an upstart config for the dionaea docker image # Let's create an upstart config for the dionaea docker image
fuECHO "### Adding upstart config for the dionaea docker image." fuECHO "### Adding upstart config for the dionaea docker image."
tee -a /etc/init/dionaea.conf <<EOF tee /etc/init/dionaea.conf <<EOF
description "Dionaea" description "Dionaea"
author "mo" author "mo"
start on started docker and filesystem start on started docker and filesystem
@ -124,9 +160,27 @@ post-stop script
end script end script
EOF EOF
# Let's create an upstart config for the elk docker image
fuECHO "### Adding upstart config for the elk docker image."
tee /etc/init/elk.conf <<EOF
description "ELK"
author "mo"
start on started docker and filesystem and started suricata and started ews
stop on runlevel [!2345]
respawn
script
sleep 15
/usr/bin/docker run --name=elk --volumes-from ews --volumes-from suricata -v /data/elk/:/data/elk/ -p 127.0.0.1:64296:80 --rm=true dtagdevsec/elk
end script
post-stop script
sleep 1
/usr/bin/docker rm elk
end script
EOF
# Let's create an upstart config for the ews docker image # Let's create an upstart config for the ews docker image
fuECHO "### Adding upstart config for the ews docker image." fuECHO "### Adding upstart config for the ews docker image."
tee -a /etc/init/ews.conf <<EOF tee /etc/init/ews.conf <<EOF
description "EWS" description "EWS"
author "mo" author "mo"
start on started docker and filesystem and started dionaea and started honeytrap and started kippo and started glastopf start on started docker and filesystem and started dionaea and started honeytrap and started kippo and started glastopf
@ -144,7 +198,7 @@ EOF
# Let's create an upstart config for the glastopf docker image # Let's create an upstart config for the glastopf docker image
fuECHO "### Adding upstart config for the glastopf docker image." fuECHO "### Adding upstart config for the glastopf docker image."
tee -a /etc/init/glastopf.conf <<EOF tee /etc/init/glastopf.conf <<EOF
description "Glastopf" description "Glastopf"
author "mo" author "mo"
start on started docker and filesystem start on started docker and filesystem
@ -162,7 +216,7 @@ EOF
# Let's create an upstart config for the honeytrap docker image # Let's create an upstart config for the honeytrap docker image
fuECHO "### Adding upstart config for the honeytrap docker image." fuECHO "### Adding upstart config for the honeytrap docker image."
tee -a /etc/init/honeytrap.conf <<EOF tee /etc/init/honeytrap.conf <<EOF
description "Honeytrap" description "Honeytrap"
author "mo" author "mo"
start on started docker and filesystem start on started docker and filesystem
@ -170,22 +224,22 @@ stop on runlevel [!2345]
respawn respawn
pre-start script pre-start script
sleep 1 sleep 1
/sbin/iptables -A INPUT -w -p tcp --syn -m state --state NEW -j NFQUEUE /sbin/iptables -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
end script end script
script script
sleep 1 sleep 1
/usr/bin/docker run --name honeytrap --cap-add=NET_ADMIN --net=host --rm=true -v /data/honeytrap dtagdevsec/honeytrap /usr/bin/docker run --name honeytrap --cap-add=NET_ADMIN --net=host --rm -v /data/honeytrap dtagdevsec/honeytrap
end script end script
post-stop script post-stop script
sleep 1 sleep 1
/sbin/iptables -D INPUT -w -p tcp --syn -m state --state NEW -j NFQUEUE /sbin/iptables -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
/usr/bin/docker rm honeytrap /usr/bin/docker rm honeytrap
end script end script
EOF EOF
# Let's create an upstart config for the kippo docker image # Let's create an upstart config for the kippo docker image
fuECHO "### Adding upstart config for the kippo docker image." fuECHO "### Adding upstart config for the kippo docker image."
tee -a /etc/init/kippo.conf <<EOF tee /etc/init/kippo.conf <<EOF
description "Kippo" description "Kippo"
author "mo" author "mo"
start on started docker and filesystem start on started docker and filesystem
@ -201,20 +255,34 @@ post-stop script
end script end script
EOF EOF
# Let's load docker images from local # Let's create an upstart config for the suricata docker image
#fuECHO "### Loading docker images from local." fuECHO "### Adding upstart config for the suricata docker image."
#cd /root/images tee /etc/init/suricata.conf <<EOF
#for name in dionaea ews glastopf honeytrap kippo description "Suricata"
#do author "mo"
# docker load -i $(ls $name*) start on started docker and filesystem
# docker tag $(ls $name* | cut -d "_" -f 2 | cut -c-12) t3chn0m4g3/beehive:$name stop on runlevel [!2345]
#done respawn
#cd /root pre-start script
#rm -rf /root/images sleep 1
myIF=\$(route | grep default | awk '{ print \$8 }')
/sbin/ethtool --offload \$myIF rx off tx off
/sbin/ethtool -K \$myIF gso off gro off
/sbin/ip link set \$myIF promisc on
end script
script
sleep 1
/usr/bin/docker run --name suricata --cap-add=NET_ADMIN --net=host --rm=true -v /data/suricata/ dtagdevsec/suricata
end script
post-stop script
sleep 1
/usr/bin/docker rm suricata
end script
EOF
# Let's load docker images from remote # Let's load docker images from remote
fuECHO "### Downloading docker images from DockerHub. Please be patient, this may take a while." fuECHO "### Downloading docker images from DockerHub. Please be patient, this may take a while."
for name in dionaea ews glastopf honeytrap kippo for name in dionaea elk ews glastopf honeytrap kippo suricata
do do
docker pull dtagdevsec/$name docker pull dtagdevsec/$name
done done
@ -243,16 +311,12 @@ Hostname: \n
IP: IP:
___________ _____________________________
xxx . \\\__ ___/ \\\______ \\\_____ \\\__ ___/
xxx xxx == | | ______ | ___// | \\\| |
xxx xxx xxx === | | /_____/ | | / | \\\ |
/""""""""""""""""\___/ === |____| |____| \\\_______ /____|
~~~ {~~ ~~~~ ~~~ ~~~~ ~~ ~ / ===- ~~~ \\\/
\______ o __/
\ \ __/
\____\______/
CTRL+ALT+F2 - Display current container status CTRL+ALT+F2 - Display current container status
@ -260,10 +324,14 @@ CTRL+ALT+F1 - Return to this screen
EOF EOF
echo "#!/bin/sh -e" > /etc/rc.local.new tee /etc/rc.local.new <<EOF
echo "# Let's add the first local ip to the /etc/issue file" >> /etc/rc.local.new #!/bin/sh -e
echo 'sed -i "s#IP:.*#IP: ""$(hostname -I | awk '"'"'{ print $1 }'"'"')""#" /etc/issue' >> /etc/rc.local.new # Let's add the first local ip to the /etc/issue file
echo "exit 0" >> /etc/rc.local.new sed -i "s#IP:.*#IP: \$(hostname -I | awk '{ print \$1 }')#" /etc/issue
setupcon
exit 0
EOF
chmod +x /etc/rc.local.new chmod +x /etc/rc.local.new
# Final steps # Final steps

357
installer/install2.sh.backup
View File

@ -1,357 +0,0 @@
#!/bin/bash
########################################################
# Beehive post install script #
# Ubuntu server 14.04, x64 #
# #
# v0.12 by MO, DTAG, 2014-11-07 #
########################################################
# Let's make sure there is a warning if running for a second time
if [ -f install.log ];
then fuECHO "### Running more than once may complicate things. Erase install.log if you are really sure."
exit 1;
fi
# Let's log for the beauty of it
set -e
exec 2> >(tee "install.err")
exec > >(tee "install.log")
# Let's create a function for colorful output
fuECHO () {
local myRED=1
local myWHT=7
tput setaf $myRED
echo $1 "$2"
tput setaf $myWHT
}
# Let's modify the sources list
sed -i '/cdrom/d' /etc/apt/sources.list
# Let's add the docker repository
fuECHO "### Adding docker repository."
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
tee /etc/apt/sources.list.d/docker.list <<EOF
deb https://get.docker.io/ubuntu docker main
EOF
# Let's pull some updates
fuECHO "### Pulling Updates."
apt-get update -y
fuECHO "### Installing Updates."
apt-get dist-upgrade -y
# Let's install all the packages we need
fuECHO "### Installing packages."
apt-get install ntp lxc-docker puppet git -y
# Create the data partition and limit its size
# Reminder if you want to extent the size of the filesystem later, without loss of data:
# resize2fs -p data.img 8192M
fuECHO "### Creating data partition (Please be patient, this may take a while)."
mkdir -p /opt/virtual-disk/
dd if=/dev/zero of=/opt/virtual-disk/data.ext4 bs=1024 count=4096000
mkfs.ext4 /opt/virtual-disk/data.ext4 -F
tee -a /etc/fstab <<EOF
/opt/virtual-disk/data.ext4 /data ext4 loop,rw,nosuid
EOF
mkdir -p /data
mount /opt/virtual-disk/data.ext4 -o loop,rw,nosuid
# Let's add a new user
fuECHO "### Adding new user."
addgroup --gid 2000 bee
adduser --system --no-create-home --uid 2000 --disabled-password --disabled-login --gid 2000 bee
# Let's create some files and folders
fuECHO "### Creating some files and folders."
mkdir -p /data/ews
mkdir -p /data/ews/log
mkdir -p /data/ews/data
#mkdir -p /data/dionaea
#mkdir -p /data/dionaea/log
#mkdir -p /data/dionaea/bistreams
#mkdir -p /data/dionaea/binaries
#mkdir -p /data/dionaea/rtp
#mkdir -p /data/dionaea/wwwroot
mkdir -p /data/glastopf
tee /data/glastopf/glastopf.cfg <<EOF
[webserver]
host = 0.0.0.0
port = 80
uid = bee
gid = bee
proxy_enabled = False
#Generic logging for general monitoring
[logging]
consolelog_enabled = True
filelog_enabled = True
logfile = log/glastopf.log
[dork-db]
enabled = True
pattern = rfi
#Extracts dorks from a online dorks service operated by The Honeynet Project
mnem_service = True
[hpfeed]
enabled = False
host = hpfriends.honeycloud.net
port = 20000
secret =
# channels comma separated
chan_events = glastopf.events
chan_files = glastopf.files
ident =
[main-database]
#If disabled a sqlite database will be created (db/glastopf.db)
#to be used as dork storage.
enabled = True
#mongodb or sqlalchemy connection string, ex:
#mongodb://localhost:27017/glastopf
#mongodb://james:bond@localhost:27017/glastopf
#mysql://james:bond@somehost.com/glastopf
connection_string = sqlite:///db/glastopf.db
[surfcertids]
enabled = False
host = localhost
port = 5432
user =
password =
database = idsserver
[syslog]
enabled = False
socket = /dev/log
[mail]
enabled = False
# an email notification will be sent only if a specified matched pattern is identified.
# Use the wildcard char *, to be notified every time
patterns = rfi,lfi
user =
pwd =
mail_from =
mail_to =
smtp_host = smtp.gmail.com
smtp_port = 587
[taxii]
enabled = False
host = taxiitest.mitre.org
port = 80
inbox_path = /services/inbox/default/
use_https = False
use_auth_basic = False
auth_basic_username = your_username
auth_basic_password = your_password
use_auth_certificate = False
auth_certificate_keyfile = full_path_to_keyfile
auth_certificate_certfile = full_path_to_certfile
include_contact_info = False
contact_name = ...
contact_email = ...
[misc]
# set webserver banner
banner = Apache/2.0.48
EOF
mkdir -p /data/honeytrap
mkdir -p /data/honeytrap/log
mkdir -p /data/honeytrap/data
mkdir -p /data/honeytrap/attacks
mkdir -p /data/honeytrap/downloads
mkdir -p /data/kippo
mkdir -p /data/kippo/data
mkdir -p /data/kippo/log
mkdir -p /data/kippo/log/tty
tee /data/kippo/userdb.txt << EOF
root:0:12345
EOF
mkdir -p /data/puppet
# Let's set the hostname
fuECHO "### Setting a new hostname."
#myHOST=ce$(ifconfig docker0 | grep HWaddr | awk '{ print $5 }' | tr -d ":")
myHOST=ce$(date +%s)$RANDOM
hostnamectl set-hostname $myHOST
sed -i 's/127.0.1.1.*/127.0.1.1\t'"$myHOST"'/g' /etc/hosts
echo $myHOST > /data/puppet/name.conf
# Let's modify the ownership / access rights
chmod 760 -R /data
chown bee:bee -R /data
# Let's patch sshd_config
fuECHO "### Patching sshd_config to listen on port 64295 and deny password authentication."
sed -i 's#Port 22#Port 64295#' /etc/ssh/sshd_config
sed -i 's#\#PasswordAuthentication yes#PasswordAuthentication no#' /etc/ssh/sshd_config
# Let's add the ssh keys
fuECHO "### Adding ssh keys for the hive user."
mkdir -p /home/hive/.ssh/
tee /home/hive/.ssh/authorized_keys <<EOF
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA8f8Dq8/XuVZl3M8ARxPQNz74T46Gez8nFTV6xjGKh6VZmyU8BL/+ERXSTJg47HsncNLEpqHgPnZTTh1hZK7HxJvPLQ1JrfPO7Fbl2B5Qy26yzAYJTnHQYUBMGTpI8gmLczE6eZcGuK0huMOoot+m7WeIMHQbzZcuNAknPsxBhJHY4s3rvElrJnY7ckz4mroqRSZXvu6w7igthUX3a1A+xsxVmxUatzFJ1Ky4jYswKFdcNPA77/nRckxtt86ORpqJq/r2PjDpuv2JpRha9zdUDpvpdCIQJFM1SdRyGMSrvbMyEWZBCTB3YF/GmQT04sfEytqHUY7zbK7kzNyDhXeg5Q== av@telekom
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt6Af5L8FYaNiDG0JKHPlJDLAbXklK5wVHj1IYqLINR8dIBcGcFwIF+YoJypZmsf1geta9WPjEW8bpd4G6XiYYg6YNRYxgBZScSb0WGVn0rHBMH+cuQxkhIdHucEMq4JFsRTVFWXjpQspu6p5gQxafGHnsLY/RYrgFy9XktS7Ha0Tfa6WXxpF72jyCoRRBUKF8CSip1XFaHIIY0xA0wTHZpmAI7dea4XA44oVDfr6g/4CTDTPQJiwn0HrRnZjgqJPzCT4gyXv+L6c5lcdrob4JpRj/YIis6aD6AMw4PeDsp3d/P9L2Vm9+p2a5Xx5U5cfGNUanvkvicrzZC1v+v3H9 mo@telekom
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHM2Pht1q6VDfRs+gPYu3/Eg5wgFfQrM45A+jRduskcIJSlwO5m/dMEipc10Y+Ut+tIST8ydQA8ZTYicinOjoCbSUju7sTDRb5jMs60nBRaj4BmzCQOqo4hidt3iX8+IpU9JUl8RR5rQzwDsWTdkhuCEEjiD+2YDdJO5kjMoaa1UW19iFEOLY582psoDTmkNY9MOfhoJla4S7m0A6eOMfq4DO/eKMKgOxJ0W8K6fQjSAyMSmqlamirxSjZ2OGohS7r1JVYhTdU6cmJxYRVNa2Rr8BHn8uf1cR4uaV49CfqJgx3W5YMjSjc3nCLt0csfdQd+sur25Gv0033liq7ZQFR ms@telekom
EOF
chmod 700 -R /home/hive/.ssh
chmod 600 /home/hive/.ssh/authorized_keys
chown hive:hive -R /home/hive/.ssh
# Let's patch docker defaults, so we can run images as service
fuECHO "### Patching docker defaults."
tee -a /etc/default/docker <<EOF
DOCKER_OPTS="-r=false"
EOF
# Let's create an upstart config for the dionaea docker image
fuECHO "### Adding upstart config for the dionaea docker image."
tee -a /etc/init/dionaea.conf <<EOF
description "Dionaea"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
script
sleep 1
/usr/bin/docker run --name dionaea --cap-add=NET_ADMIN --rm -p 21:21 -p 42:42 -p 8080:80 -p 135:135 -p 443:443 -p 445:445 -p 1433:1433 -p 3306:3306 -p 5061:5061 -p 5060:5060 -p 69:69/udp -p 5060:5060/udp -v /data/dionaea t3chn0m4g3/beehive:dionaea
end script
post-stop script
sleep 1
/usr/bin/docker rm dionaea
end script
EOF
# Let's create an upstart config for the ews docker image
fuECHO "### Adding upstart config for the ews docker image."
tee -a /etc/init/ews.conf <<EOF
description "EWS"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
script
sleep 1
/usr/bin/docker run --name ews --rm -v /data/:/data/ --link kippo:kippo t3chn0m4g3/beehive:ews
end script
post-stop script
sleep 1
/usr/bin/docker rm ews
end script
EOF
# Let's create an upstart config for the glastopf docker image
fuECHO "### Adding upstart config for the glastopf docker image."
tee -a /etc/init/glastopf.conf <<EOF
description "Glastopf"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
script
sleep 1
/usr/bin/docker run --name glastopf --rm -p 80:80 -v /data/glastopf:/data/glastopf t3chn0m4g3/beehive:glastopf
end script
post-stop script
sleep 1
/usr/bin/docker rm glastopf
end script
EOF
# Let's create an upstart config for the honeytrap docker image
fuECHO "### Adding upstart config for the honeytrap docker image."
tee -a /etc/init/honeytrap.conf <<EOF
description "Honeytrap"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
pre-start script
sleep 1
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
end script
script
sleep 1
/usr/bin/docker run --name honeytrap --cap-add=NET_ADMIN --net=host --rm -v /data/honeytrap:/data/honeytrap t3chn0m4g3/beehive:honeytrap
end script
post-stop script
sleep 1
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
/usr/bin/docker rm honeytrap
end script
EOF
# Let's create an upstart config for the kippo docker image
fuECHO "### Adding upstart config for the kippo docker image."
tee -a /etc/init/kippo.conf <<EOF
description "Kippo"
author "mo"
start on started docker and filesystem
stop on runlevel [!2345]
respawn
script
sleep 1
/usr/bin/docker run --name kippo --rm -p 22:2222 -v /data/kippo:/data/kippo t3chn0m4g3/beehive:kippo
end script
post-stop script
sleep 1
/usr/bin/docker rm kippo
end script
EOF
# Let's load docker images from local
fuECHO "### Loading docker images from local."
cd /root/images
for name in dionaea ews glastopf honeytrap kippo
do
docker load -i $(ls $name*)
docker tag $(ls $name* | cut -d "_" -f 2 | cut -c-12) t3chn0m4g3/beehive:$name
done
cd /root
rm -rf /root/images
# Let's add the daily update check with a weekly clean interval
fuECHO "### Modifying update checks."
tee /etc/apt/apt.conf.d/10periodic <<EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "0";
APT::Periodic::AutocleanInterval "7";
EOF
# Let's add a nice and useful issue text and update rc.local accordingly
fuECHO "### Adding a nice and useful issue text and updating rc.local accordingly."
tee /etc/issue <<EOF
Beehive 14.04.1 Alpha
Hostname: \n
IP:
xxx .
xxx xxx ==
xxx xxx xxx ===
/""""""""""""""""\___/ ===
~~~ {~~ ~~~~ ~~~ ~~~~ ~~ ~ / ===- ~~~
\______ o __/
\ \ __/
\____\______/
EOF
echo "#!/bin/sh -e" > /etc/rc.local.new
echo "# Let's add the first local ip to the /etc/issue file" >> /etc/rc.local.new
echo 'sed -i "s#IP:.*#IP: ""$(hostname -I | awk '"'"'{ print $1 }'"'"')""#" /etc/issue' >> /etc/rc.local.new
echo "exit 0" >> /etc/rc.local.new
chmod +x /etc/rc.local.new
# Final steps
fuECHO "### Thanks for your patience. Now rebooting."
mv /etc/rc.local.new /etc/rc.local && sleep 2 && reboot

45
preseed/tpotce.seed
View File

@ -1,4 +1,4 @@
# Beehive preseed file by mo # T-Pot CE preseed file by mo
# Setting locale # Setting locale
d-i debian-installer/language string en d-i debian-installer/language string en
d-i debian-installer/country string DE d-i debian-installer/country string DE
@ -24,44 +24,6 @@ d-i clock-setup/utc boolean true
d-i time/zone string Europe/Berlin d-i time/zone string Europe/Berlin
d-i clock-setup/ntp boolean true d-i clock-setup/ntp boolean true
# Partitioning
# old, not working with nuc
#d-i partman-auto/init_automatically_partition select biggest_free
#d-i partman-auto/choose_recipe select atomic
#d-i partman-auto/method string regular
#d-i partman-lvm/confirm boolean true
#d-i partman-lvm/confirm_nooverwrite boolean true
#d-i partman-lvm/device_remove_lvm boolean true
#d-i partman-md/device_remove_md boolean true
#d-i partman/default_filesystem string ext4
#d-i partman-partitioning/confirm_write_new_label boolean true
#d-i partman/choose_partition select finish
#d-i partman/confirm boolean true
#d-i partman/confirm_nooverwrite boolean true
# testing, works with nuc, but trying ks file first
#d-i partman-auto/disk string /dev/sda
#d-i partman-auto/choose_recipe select atomic
#d-i partman-auto/method string regular
#d-i partman-lvm/confirm boolean true
#d-i partman-lvm/confirm_nooverwrite boolean true
#d-i partman-lvm/device_remove_lvm boolean true
#d-i partman-md/device_remove_md boolean true
#d-i partman/default_filesystem string ext4
#d-i partman-partitioning/confirm_write_new_label boolean true
#d-i partman/choose_partition select finish
#d-i partman/confirm boolean true
#d-i partman/confirm_nooverwrite boolean true
# User setup
#d-i passwd/user-fullname string admin
#d-i passwd/username string admin
# Encrypted using an MD5 hash (printf "password" | mkpasswd -s -m md5)
#d-i passwd/user-password-crypted password $1$8deB8hXr$S/5SDG559KmAPGAL62s3i1
#d-i user-setup/allow-password-weak boolean true
#d-i user-setup/encrypt-home boolean false
# Package Groups # Package Groups
tasksel tasksel/first multiselect ubuntu-server tasksel tasksel/first multiselect ubuntu-server
@ -71,15 +33,10 @@ d-i pkgsel/include string openssh-server
# Update Policy # Update Policy
d-i pkgsel/update-policy select unattended-upgrades d-i pkgsel/update-policy select unattended-upgrades
# Grub
#d-i grub-installer/only_debian boolean true
# Post install # Post install
d-i preseed/late_command string \ d-i preseed/late_command string \
cp /cdrom/tpotce/install1.sh /target/etc/rc.local; \ cp /cdrom/tpotce/install1.sh /target/etc/rc.local; \
cp /cdrom/tpotce/install2.sh /target/root/install.sh cp /cdrom/tpotce/install2.sh /target/root/install.sh
#mkdir -p /target/root/images/; \
#cp /cdrom/tpotce/images/* /target/root/images/
# Reboot # Reboot
d-i finish-install/reboot_in_progress note d-i finish-install/reboot_in_progress note