cleanup, tweaking, updating

make tpotinit aware of sigterm events to unload blackhole routes, firewall rules
fixes #1204 where citrixhoneypot logs use logs instead of log folder
bump ELK stack to 8.12.2
add wordpot logs to logstash pipeline
bump t-pot attackmap to 2.2.0, alpine 3.19

docker/elk/map/Dockerfile

@@ -1,29 +1,23 @@
-FROM alpine:3.17
-#
-# Include dist
-#COPY dist/ /root/dist/
+FROM alpine:3.19
 #
 # Install packages
 RUN apk -U --no-cache add \
-             build-base \
-             git \
-	         libcap \
-	         py3-pip \
-             python3 \
-             python3-dev \
-             tzdata && \
+		build-base \
+		git \
+		libcap \
+		py3-pip \
+		python3 \
+		python3-dev \
+		tzdata && \
 #	     
 # Install from GitHub and setup
     mkdir -p /opt && \
     cd /opt/ && \
-    git clone https://github.com/t3chn0m4g3/t-pot-attack-map -b 2.1.0 && \
+    git clone https://github.com/t3chn0m4g3/t-pot-attack-map -b 2.2.0 && \
     cd t-pot-attack-map && \
-#    git checkout eaf8d123d72a62e4c12093e4e8487e10e6ef60f3 && \
-#    git branch -a && \
-#    git checkout multi && \
-    pip3 install --upgrade pip && \
-    pip3 install -r requirements.txt && \
-    setcap cap_net_bind_service=+ep /usr/bin/python3.10 && \
+    pip3 install --break-system-packages --upgrade pip && \
+    pip3 install --break-system-packages -r requirements.txt && \
+    setcap cap_net_bind_service=+ep $(readlink -f $(type -P python3)) && \
 #
 # Setup user, groups and configs
     addgroup -g 2000 map && \
@@ -32,8 +26,8 @@ RUN apk -U --no-cache add \
 #
 # Clean up
     apk del --purge build-base \
-                    git \
-		    python3-dev && \
+		git \
+		python3-dev && \
     rm -rf /root/* /var/cache/apk/* /opt/t-pot-attack-map/.git
 #
 # Start T-Pot-Attack-Map

docker/elk/map/dist/entrypoint.sh

@@ -1,2 +0,0 @@
-#!/bin/ash
-sed -i "s/var hqLatLng = new L.LatLng(52.3058, 4.932);/var hqLatLng = new L.LatLng($MY_EXTIP_LAT, $MY_EXTIP_LONG);/g" /opt/geoip-attack-map/static/map.js

docker/elk/map/docker-compose.yml

@@ -21,8 +21,6 @@ services:
     restart: always
     environment:
      - MAP_COMMAND=AttackMapServer.py
-    env_file:
-     - /opt/tpot/etc/compose/elk_environment
     stop_signal: SIGKILL
     tty: true
     ports:
@@ -37,8 +35,8 @@ services:
     restart: always
     environment:
      - MAP_COMMAND=DataServer_v2.py
-    env_file:
-     - /opt/tpot/etc/compose/elk_environment
+#     - TPOT_ATTACKMAP_TEXT=${TPOT_ATTACKMAP_TEXT}
+#     - TZ=${TPOT_ATTACKMAP_TEXT_TIMEZONE}
     stop_signal: SIGKILL
     tty: true
     image: "dtagdevsec/map:alpha"