diff --git a/bin/updateip.sh b/bin/updateip.sh index b7d8080d..a0eecba1 100755 --- a/bin/updateip.sh +++ b/bin/updateip.sh @@ -12,6 +12,7 @@ mySSHUSER=$(cat /etc/passwd | grep 1000 | cut -d ':' -f1) sed -i "s#IP:.*#IP: $myLOCALIP ($myEXTIP)#" /etc/issue sed -i "s#SSH:.*#SSH: ssh -l tsec -p 64295 $myLOCALIP#" /etc/issue sed -i "s#WEB:.*#WEB: https://$myLOCALIP:64297#" /etc/issue +sed -i "s#ADMIN:.*#ADMIN: https://$myLOCALIP:64294#" /etc/issue tee /data/ews/conf/ews.ip << EOF [MAIN] ip = $myEXTIP @@ -21,8 +22,5 @@ MY_EXTIP=$myEXTIP MY_INTIP=$myLOCALIP MY_HOSTNAME=$HOSTNAME EOF -tee /opt/tpot/etc/compose/wetty_environment << EOF -MY_SSHUSER=$mySSHUSER -EOF chown tpot:tpot /data/ews/conf/ews.ip chmod 760 /data/ews/conf/ews.ip diff --git a/docker/nginx/dist/conf/tpotweb.conf b/docker/nginx/dist/conf/tpotweb.conf index 67cf9208..5dc71ec5 100644 --- a/docker/nginx/dist/conf/tpotweb.conf +++ b/docker/nginx/dist/conf/tpotweb.conf @@ -2,11 +2,6 @@ ### NGINX T-Pot configuration file by mo ### ############################################ -################################### -### Allow for 60 reloads per minute -################################### -limit_req_zone $binary_remote_addr zone=base:1m rate=1r/s; - server { ######################### @@ -39,16 +34,16 @@ server { ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; - + #################################### ### OWASP recommendations / settings #################################### ### Size Limits & Buffer Overflows ### the size may be configured based on the needs. - client_body_buffer_size 100K; + client_body_buffer_size 128k; client_header_buffer_size 1k; - client_max_body_size 100k; + client_max_body_size 256k; large_client_header_buffers 2 1k; ### Mitigate Slow HHTP DoS Attack @@ -89,14 +84,6 @@ server { auth_basic_user_file /etc/nginx/nginxpasswd; - ############################## - ### Limit brute-force attempts - ############################## - location = / { - limit_req zone=base burst=1 nodelay; - } - - ################# ### Proxied sites ################# @@ -119,27 +106,6 @@ server { rewrite /myhead/(.*)$ /$1 break; } - ### portainer - location /ui { - proxy_pass http://127.0.0.1:64299; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $http_connection; - proxy_set_header Host $host; - proxy_redirect off; - rewrite /ui/(.*)$ /$1 break; - } - ### web tty - location /wetty { - proxy_pass http://127.0.0.1:64300/wetty; - } - - ### netdata - location /netdata/ { - proxy_pass http://localhost:64301; - rewrite /netdata/(.*)$ /$1 break; - } - ### spiderfoot location /spiderfoot { proxy_pass http://127.0.0.1:64303; @@ -156,4 +122,5 @@ server { location /scandelete { proxy_pass http://127.0.0.1:64303/spiderfoot/scandelete; } + } diff --git a/docker/nginx/dist/html/navbar.html b/docker/nginx/dist/html/navbar.html index e3954f74..0069a138 100644 --- a/docker/nginx/dist/html/navbar.html +++ b/docker/nginx/dist/html/navbar.html @@ -10,12 +10,13 @@
Home - Kibana + ES Head - Netdata + Kibana Spiderfoot - Portainer - WebTTY
+ diff --git a/etc/compose/collector.yml b/etc/compose/collector.yml index 1586fc39..36619a18 100644 --- a/etc/compose/collector.yml +++ b/etc/compose/collector.yml @@ -171,26 +171,6 @@ services: - /data:/data - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip -# Netdata service - netdata: - container_name: netdata - restart: always - network_mode: "host" - depends_on: - elasticsearch: - condition: service_healthy - cap_add: - - SYS_PTRACE - security_opt: - - apparmor=unconfined - ports: - - "64301:64301" - image: "dtagdevsec/netdata:1804" - volumes: - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - # Nginx service nginx: container_name: nginx @@ -212,20 +192,6 @@ services: - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro - /data/nginx/log/:/var/log/nginx/ -# Portainer service - portainer: - container_name: portainer - command: -H unix:///var/run/docker.sock --no-auth - restart: always - networks: - - portainer_local - ports: - - "127.0.0.1:64299:9000" - image: "dtagdevsec/portainer:1804" - read_only: true - volumes: - - /var/run/docker.sock:/var/run/docker.sock - # Spiderfoot service spiderfoot: container_name: spiderfoot @@ -238,15 +204,3 @@ services: volumes: - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db -# Wetty service - wetty: - container_name: wetty - restart: always - stop_signal: SIGKILL - network_mode: "host" - env_file: - - /opt/tpot/etc/compose/wetty_environment - tmpfs: - - /home/wetty/.ssh/:uid=2000,gid=2000 - image: "dtagdevsec/wetty:1804" - read_only: true diff --git a/etc/compose/experimental.yml b/etc/compose/experimental.yml index 39f928cb..b20d1f26 100644 --- a/etc/compose/experimental.yml +++ b/etc/compose/experimental.yml @@ -505,26 +505,6 @@ services: - /data:/data - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip -# Netdata service - netdata: - container_name: netdata - restart: always - network_mode: "host" - depends_on: - elasticsearch: - condition: service_healthy - cap_add: - - SYS_PTRACE - security_opt: - - apparmor=unconfined - ports: - - "64301:64301" - image: "dtagdevsec/netdata:1804" - volumes: - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - # Nginx service nginx: container_name: nginx @@ -546,20 +526,6 @@ services: - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro - /data/nginx/log/:/var/log/nginx/ -# Portainer service - portainer: - container_name: portainer - command: -H unix:///var/run/docker.sock --no-auth - restart: always - networks: - - portainer_local - ports: - - "127.0.0.1:64299:9000" - image: "dtagdevsec/portainer:1804" - read_only: true - volumes: - - /var/run/docker.sock:/var/run/docker.sock - # Spiderfoot service spiderfoot: container_name: spiderfoot @@ -572,15 +538,3 @@ services: volumes: - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db -# Wetty service - wetty: - container_name: wetty - restart: always - stop_signal: SIGKILL - network_mode: "host" - env_file: - - /opt/tpot/etc/compose/wetty_environment - tmpfs: - - /home/wetty/.ssh/:uid=2000,gid=2000 - image: "dtagdevsec/wetty:1804" - read_only: true diff --git a/etc/compose/industrial.yml b/etc/compose/industrial.yml index 04330c77..c653e6af 100644 --- a/etc/compose/industrial.yml +++ b/etc/compose/industrial.yml @@ -324,26 +324,6 @@ services: - /data:/data - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip -# Netdata service - netdata: - container_name: netdata - restart: always - network_mode: "host" - depends_on: - elasticsearch: - condition: service_healthy - cap_add: - - SYS_PTRACE - security_opt: - - apparmor=unconfined - ports: - - "64301:64301" - image: "dtagdevsec/netdata:1804" - volumes: - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - # Nginx service nginx: container_name: nginx @@ -365,20 +345,6 @@ services: - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro - /data/nginx/log/:/var/log/nginx/ -# Portainer service - portainer: - container_name: portainer - command: -H unix:///var/run/docker.sock --no-auth - restart: always - networks: - - portainer_local - ports: - - "127.0.0.1:64299:9000" - image: "dtagdevsec/portainer:1804" - read_only: true - volumes: - - /var/run/docker.sock:/var/run/docker.sock - # Spiderfoot service spiderfoot: container_name: spiderfoot @@ -390,16 +356,3 @@ services: image: "dtagdevsec/spiderfoot:1804" volumes: - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db - -# Wetty service - wetty: - container_name: wetty - restart: always - stop_signal: SIGKILL - network_mode: "host" - env_file: - - /opt/tpot/etc/compose/wetty_environment - tmpfs: - - /home/wetty/.ssh/:uid=2000,gid=2000 - image: "dtagdevsec/wetty:1804" - read_only: true diff --git a/etc/compose/legacy.yml b/etc/compose/legacy.yml index 7c11b663..0aafb2ea 100644 --- a/etc/compose/legacy.yml +++ b/etc/compose/legacy.yml @@ -290,26 +290,6 @@ services: - /data:/data - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip -# Netdata service - netdata: - container_name: netdata - restart: always - network_mode: "host" - depends_on: - elasticsearch: - condition: service_healthy - cap_add: - - SYS_PTRACE - security_opt: - - apparmor=unconfined - ports: - - "64301:64301" - image: "dtagdevsec/netdata:1804" - volumes: - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - # Nginx service nginx: container_name: nginx @@ -331,20 +311,6 @@ services: - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro - /data/nginx/log/:/var/log/nginx/ -# Portainer service - portainer: - container_name: portainer - command: -H unix:///var/run/docker.sock --no-auth - restart: always - networks: - - portainer_local - ports: - - "127.0.0.1:64299:9000" - image: "dtagdevsec/portainer:1804" - read_only: true - volumes: - - /var/run/docker.sock:/var/run/docker.sock - # Spiderfoot service spiderfoot: container_name: spiderfoot @@ -357,15 +323,3 @@ services: volumes: - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db -# Wetty service - wetty: - container_name: wetty - restart: always - stop_signal: SIGKILL - network_mode: "host" - env_file: - - /opt/tpot/etc/compose/wetty_environment - tmpfs: - - /home/wetty/.ssh/:uid=2000,gid=2000 - image: "dtagdevsec/wetty:1804" - read_only: true diff --git a/etc/compose/standard.yml b/etc/compose/standard.yml index 21d432a7..6ec62fee 100644 --- a/etc/compose/standard.yml +++ b/etc/compose/standard.yml @@ -16,7 +16,6 @@ networks: vnclowpot_local: ewsposter_local: spiderfoot_local: - portainer_local: services: @@ -505,26 +504,6 @@ services: - /data:/data - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip -# Netdata service - netdata: - container_name: netdata - restart: always - network_mode: "host" - depends_on: - elasticsearch: - condition: service_healthy - cap_add: - - SYS_PTRACE - security_opt: - - apparmor=unconfined - ports: - - "64301:64301" - image: "dtagdevsec/netdata:1804" - volumes: - - /proc:/host/proc:ro - - /sys:/host/sys:ro - - /var/run/docker.sock:/var/run/docker.sock:ro - # Nginx service nginx: container_name: nginx @@ -546,20 +525,6 @@ services: - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro - /data/nginx/log/:/var/log/nginx/ -# Portainer service - portainer: - container_name: portainer - command: -H unix:///var/run/docker.sock --no-auth - restart: always - networks: - - portainer_local - ports: - - "127.0.0.1:64299:9000" - image: "dtagdevsec/portainer:1804" - read_only: true - volumes: - - /var/run/docker.sock:/var/run/docker.sock - # Spiderfoot service spiderfoot: container_name: spiderfoot @@ -572,15 +537,3 @@ services: volumes: - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db -# Wetty service - wetty: - container_name: wetty - restart: always - stop_signal: SIGKILL - network_mode: "host" - env_file: - - /opt/tpot/etc/compose/wetty_environment - tmpfs: - - /home/wetty/.ssh/:uid=2000,gid=2000 - image: "dtagdevsec/wetty:1804" - read_only: true diff --git a/host/etc/issue b/host/etc/issue index 55e4287e..fcad492c 100644 --- a/host/etc/issue +++ b/host/etc/issue @@ -1,12 +1,12 @@  -┌───────────────────────────────────────────────────┐ -│ _____ ____ _ _ ___ ___ _ _ │ -│|_ _| | _ \\ ___ | |_ / |( _ ) / _ \\| || | │ -│ | |_____| |_) / _ \\| __| | |/ _ \\| | | | || |_ │ -│ | |_____| __/ (_) | |_ | | (_) | |_| |__ _|│ -│ |_| |_| \\___/ \\__| |_|\\___(_)___/ |_| │ -│ │ -└───────────────────────────────────────────────────┘ +┌────────────────────────────────────────────────┐ +│ _____ ____ _ _ ___ _ ___ │ +│|_ _| | _ \\ ___ | |_ / |( _ ) / |/ _ \\ │ +│ | |_____| |_) / _ \\| __| | |/ _ \\ | | | | |│ +│ | |_____| __/ (_) | |_ | | (_) || | |_| |│ +│ |_| |_| \\___/ \\__| |_|\\___(_)_|\\___/ │ +│ │ +└────────────────────────────────────────────────┘ ,---- [ \n ] [ \d ] [ \t ] @@ -14,6 +14,7 @@ | IP: | SSH: | WEB: +| ADMIN: | `---- diff --git a/iso/installer/install.sh b/iso/installer/install.sh index fa562225..8c1fb2e7 100755 --- a/iso/installer/install.sh +++ b/iso/installer/install.sh @@ -131,7 +131,7 @@ fi # Let's check if all dependencies are met function fuGET_DEPS { -local myPACKAGES="apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount curl dialog dnsutils docker.io docker-compose dstat ethtool fail2ban genisoimage git glances grc html2text htop ifupdown iptables iw jq libcrack2 libltdl7 lm-sensors man multitail net-tools npm ntp openssh-server openssl pass prips syslinux psmisc pv python-pip unattended-upgrades unzip vim wireless-tools wpasupplicant" +local myPACKAGES="apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount cockpit cockpit-docker curl dialog dnsutils docker.io docker-compose dstat ethtool fail2ban genisoimage git glances grc html2text htop ifupdown iptables iw jq libcrack2 libltdl7 lm-sensors man multitail net-tools npm ntp openssh-server openssl pass prips syslinux psmisc pv python-pip unattended-upgrades unzip vim wireless-tools wpasupplicant" echo echo "### Getting update information." echo @@ -610,7 +610,8 @@ myHOST=$a$n hostnamectl set-hostname $myHOST 2>&1 | dialog --title "[ Setting new hostname ]" $myPROGRESSBOXCONF sed -i 's#127.0.1.1.*#127.0.1.1\t'"$myHOST"'#g' /etc/hosts 2>&1 | dialog --title "[ Setting new hostname ]" $myPROGRESSBOXCONF -# Let's patch sshd_config +# Let's patch cockpit.socket, sshd_config +sed -i 's#ListenStream=9090#ListeStream=64294#' /etc/systemd/system/sockets.target.wants/cockpit.socket 2>&1 | dialog --title "[ Cockpit listen on tcp/64294 ]" $myPROGRESSBOXCONF sed -i 's#\#Port 22#Port 64295#' /etc/ssh/sshd_config 2>&1 | dialog --title "[ SSH listen on tcp/64295 ]" $myPROGRESSBOXCONF # Let's make sure only myCONF_TPOT_FLAVOR images will be downloaded and started @@ -685,11 +686,23 @@ dialog --title "[ Setup fail2ban config ]" $myPROGRESSBOXCONF <&1>/dev/null <