include rdpy honeypot

installer/etc/tpot/compose/all.yml

@@ -11,6 +11,7 @@ networks:
   ewsposter_local:
   glastopf_local:
   mailoney_local:
+  rdpy_local:
   spiderfoot_local:
   ui-for-docker_local:
   vnclowpot_local:
@@ -240,6 +241,18 @@ services:
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock
 
+# Rdpy service
+  rdpy:
+    container_name: rdpy
+    restart: always
+    networks:
+     - rdpy_local
+    ports:
+     - "3389:3389"
+    image: "dtagdevsec/rdpy:1706"
+    volumes:
+     - /data/rdpy/log:/var/log/rdpy
+
 # Spiderfoot service
   spiderfoot:
     container_name: spiderfoot

installer/etc/tpot/compose/hp.yml

@@ -9,6 +9,7 @@ networks:
   ewsposter_local:
   glastopf_local:
   mailoney_local:
+  rdpy_local:
   vnclowpot_local:
 
 services:
@@ -130,6 +131,18 @@ services:
     volumes:
      - /data/mailoney/log:/opt/mailoney/logs
 
+# Rdpy service
+  rdpy:
+    container_name: rdpy
+    restart: always
+    networks:
+     - rdpy_local
+    ports:
+     - "3389:3389"
+    image: "dtagdevsec/rdpy:1706"
+    volumes:
+     - /data/rdpy/log:/var/log/rdpy
+
 # Vnclowpot service
   vnclowpot:
     container_name: vnclowpot

installer/etc/tpot/compose/tpot.yml

@@ -9,6 +9,7 @@ networks:
   ewsposter_local:
   glastopf_local:
   mailoney_local:
+  rdpy_local:
   spiderfoot_local:
   ui-for-docker_local:
   vnclowpot_local:
@@ -210,6 +211,18 @@ services:
      - /sys:/host/sys:ro
      - /var/run/docker.sock:/var/run/docker.sock
 
+# Rdpy service
+  rdpy:
+    container_name: rdpy
+    restart: always
+    networks:
+     - rdpy_local
+    ports:
+     - "3389:3389"
+    image: "dtagdevsec/rdpy:1706"
+    volumes:
+     - /data/rdpy/log:/var/log/rdpy
+
 # Spiderfoot service
   spiderfoot:
     container_name: spiderfoot

installer/etc/tpot/logrotate/logrotate.conf

@@ -22,6 +22,7 @@
 /data/honeytrap/downloads.tgz
 /data/mailoney/log/commands.log
 /data/p0f/log/p0f.json
+/data/rdpy/log/rdpy.log
 /data/suricata/log/*.log
 /data/suricata/log/*.json
 /data/vnclowpot/log/vnclowpot.log

installer/etc/tpot/systemd/tpot.service

@@ -34,7 +34,7 @@ ExecStartPre=/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
 ExecStartPre=/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
 ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 64295:64303,7634 -j ACCEPT
 ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
-ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,5900,27017 -j ACCEPT
+ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 3306,3389,5060,5061,5601,5900,27017 -j ACCEPT
 ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
 ExecStartPre=/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
 
@@ -49,7 +49,7 @@ ExecStopPost=/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
 ExecStopPost=/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
 ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 64295:64303,7634 -j ACCEPT
 ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT
-ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 3306,5060,5061,5601,5900,27017 -j ACCEPT
+ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 3306,3389,5060,5061,5601,5900,27017 -j ACCEPT
 ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT
 ExecStopPost=/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE