mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
Work in progress!
This is the foundation for the distributed T-Pot feature, highly work in progress, only works with local docker image builds, will be available for prod for upcoming T-Pot 22xx.
This commit is contained in:
16
docker/elk/logstash/dist/update.sh
vendored
16
docker/elk/logstash/dist/update.sh
vendored
@ -35,6 +35,22 @@ if [ "$myCHECK" == "0" ];
|
||||
echo "Cannot reach Listbot, starting Logstash without latest translation maps."
|
||||
fi
|
||||
|
||||
# Distributed T-Pot installation needs a different pipeline config and autossh tunnel.
|
||||
if [ "$MY_TPOT_TYPE" == "POT" ];
|
||||
then
|
||||
echo
|
||||
echo "Distributed T-Pot setup, sending T-Pot logs to $MY_HIVE_IP."
|
||||
echo
|
||||
echo "T-Pot type: $MY_TPOT_TYPE"
|
||||
echo "Keyfile used: $MY_POT_PRIVATEKEYFILE"
|
||||
echo "Hive username: $MY_HIVE_USERNAME"
|
||||
echo "Hive IP: $MY_HIVE_IP"
|
||||
echo
|
||||
cp /usr/share/logstash/config/pipelines_pot.yml /usr/share/logstash/config/pipelines.yml
|
||||
autossh -f -M 0 -v -4 -l $MY_HIVE_USERNAME -i $MY_POT_PRIVATEKEYFILE -p 64295 -N -L64305:127.0.0.1:64305 $MY_HIVE_IP -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# We do want to enforce our es_template thus we always need to delete the default template, putting our default afterwards
|
||||
# This is now done via common_configs.rb => overwrite default logstash template
|
||||
echo "Removing logstash template."
|
||||
|
Reference in New Issue
Block a user