mirror of
https://github.com/telekom-security/tpotce.git
synced 2025-07-02 01:27:27 -04:00
Tweaking
Finalize qhoneypots config, thanks to @giga-a for native JSON logging! Completely rework T-Pot Landing Page based on Bento (https://github.com/migueravila/Bento). New NGINX image is down by 100MB and only uses 3.3 MB of RAM at runtime. Keep legacy Sensor option (without logstash).
This commit is contained in:
t3chn0m4g3
105
docker/nginx/dist/conf/nginx.conf
vendored
Normal file
105
docker/nginx/dist/conf/nginx.conf
vendored
Normal file
@ -0,0 +1,105 @@
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
pid /run/nginx.pid;
|
||||
load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;
|
||||
|
||||
events {
|
||||
worker_connections 768;
|
||||
# multi_accept on;
|
||||
}
|
||||
|
||||
http {
|
||||
|
||||
##
|
||||
# Basic Settings
|
||||
##
|
||||
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
types_hash_max_size 2048;
|
||||
# server_tokens off;
|
||||
|
||||
# server_names_hash_bucket_size 64;
|
||||
# server_name_in_redirect off;
|
||||
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
##
|
||||
# SSL Settings
|
||||
##
|
||||
|
||||
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
|
||||
ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
##
|
||||
# Logging Settings
|
||||
##
|
||||
|
||||
log_format main_json escape=json '{'
|
||||
'"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution
|
||||
'"connection_serial": "$connection", ' # connection serial number
|
||||
'"connection_requests": "$connection_requests", ' # number of requests made in connection
|
||||
'"pid": "$pid", ' # process pid
|
||||
'"request_id": "$request_id", ' # the unique request id
|
||||
'"request_length": "$request_length", ' # request length (including headers and body)
|
||||
'"src_ip": "$remote_addr", ' # client IP
|
||||
'"remote_user": "$remote_user", ' # client HTTP username
|
||||
'"src_port": "$remote_port", ' # client port
|
||||
'"time_local": "$time_local", '
|
||||
'"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format
|
||||
'"request_data": "$request", ' # full path no arguments if the request
|
||||
'"request_uri": "$request_uri", ' # full path and arguments if the request
|
||||
'"args": "$args", ' # args
|
||||
'"status": "$status", ' # response status code
|
||||
'"body_bytes_sent": "$body_bytes_sent", ' # the number of body bytes exclude headers sent to a client
|
||||
'"bytes_sent": "$bytes_sent", ' # the number of bytes sent to a client
|
||||
'"http_referer": "$http_referer", ' # HTTP referer
|
||||
'"http_user_agent": "$http_user_agent", ' # user agent
|
||||
'"http_x_forwarded_for": "$http_x_forwarded_for", ' # http_x_forwarded_for
|
||||
'"http_host": "$http_host", ' # the request Host: header
|
||||
'"server_name": "$server_name", ' # the name of the vhost serving the request
|
||||
'"request_time": "$request_time", ' # request processing time in seconds with msec resolution
|
||||
'"upstream": "$upstream_addr", ' # upstream backend server for proxied requests
|
||||
'"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS
|
||||
'"upstream_header_time": "$upstream_header_time", ' # time spent receiving upstream headers
|
||||
'"upstream_response_time": "$upstream_response_time", ' # time spend receiving upstream body
|
||||
'"upstream_response_length": "$upstream_response_length", ' # upstream response length
|
||||
'"upstream_cache_status": "$upstream_cache_status", ' # cache HIT/MISS where applicable
|
||||
'"ssl_protocol": "$ssl_protocol", ' # TLS protocol
|
||||
'"ssl_cipher": "$ssl_cipher", ' # TLS cipher
|
||||
'"scheme": "$scheme", ' # http or https
|
||||
'"request_method": "$request_method", ' # request method
|
||||
'"server_protocol": "$server_protocol", ' # request protocol, like HTTP/1.1 or HTTP/2.0
|
||||
'"pipe": "$pipe", ' # “p” if request was pipelined, “.” otherwise
|
||||
'"gzip_ratio": "$gzip_ratio", '
|
||||
'"http_cf_ray": "$http_cf_ray"'
|
||||
'}';
|
||||
|
||||
access_log /var/log/nginx/access.log main_json;
|
||||
error_log /var/log/nginx/error.log;
|
||||
|
||||
##
|
||||
# Gzip Settings
|
||||
##
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
|
||||
# gzip_vary on;
|
||||
# gzip_proxied any;
|
||||
# gzip_comp_level 6;
|
||||
# gzip_buffers 16 8k;
|
||||
# gzip_http_version 1.1;
|
||||
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
##
|
||||
# Virtual Host Configs
|
||||
##
|
||||
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
include /etc/nginx/sites-enabled/*;
|
||||
}
|
||||
13
docker/nginx/dist/conf/ssl/dhparam4096.pem
vendored
Normal file
13
docker/nginx/dist/conf/ssl/dhparam4096.pem
vendored
Normal file
@ -0,0 +1,13 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEAiHmfakVLOStSULBdaTbZY/zeFyEeQ19GY9Z5CJg06dIIgIzhxk9L
|
||||
4xsQdQk8giKOjP6SfX0ZgF5CYaurQ3ljYlP0UlAQQo9+fEErbqj3hCzAxtIpd6Yj
|
||||
SV6zFdnSjwxWuKAPPywiQNljnHH+Y1KBdbl5VQ9gC3ehtaLo1A4y8q96f6fC5rGU
|
||||
nfgw4lTxLvPD7NwaOdFTCyK8tTxvUGNJIvf7805IxZ0BvAiBuVaXStaMcqf5BHLP
|
||||
fYpvIiVaCrtto4elu18nL0tf2CN5n9ai4hlr0nPmNrE/Zrrur78Re5F4Ien9kr4d
|
||||
xabXvVJJQa9j2NdQO7vk7Cz/dAIiqt/1XKFhll4TTYBqrFVXIwF+FNx636zyOjcO
|
||||
nlZk/V+IL/UTPnZOv2PGt5+WetvJJubi6B9XgOgVLduI07woAp5qnRJJt6fJW1aA
|
||||
M86By6WLy5P31Py6eFj8nYgj1V703XgQ5lESKYpeVgqA0bh7daNzOCoGQvvUKlTP
|
||||
RTu6fs7clw5ta4yYUyvuIKTngH5yGBNdTuP0GWo6Y+Dy1BctVwl2xSw+FhYeuIf/
|
||||
EB2A3129H59HhbWyNH337+1dfntHfQRXBsT0YSyDxPurI5/FNGcmw+GZEYk4BB8j
|
||||
g7TwH3GBjbKnjnr7SnhanqmWgybgQw6oR9gDC399eR4LiOk9sbxpX1MCAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
12
docker/nginx/dist/conf/ssl/gen-cert.sh
vendored
Normal file
12
docker/nginx/dist/conf/ssl/gen-cert.sh
vendored
Normal file
@ -0,0 +1,12 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Got root?
|
||||
myWHOAMI=$(whoami)
|
||||
if [ "$myWHOAMI" != "root" ]
|
||||
then
|
||||
echo "Need to run as root ..."
|
||||
exit
|
||||
fi
|
||||
|
||||
openssl req -nodes -x509 -sha512 -newkey rsa:8192 -keyout "nginx.key" -out "nginx.crt" -days 3650
|
||||
|
||||
16
docker/nginx/dist/conf/ssl/gen-dhparam.sh
vendored
Normal file
16
docker/nginx/dist/conf/ssl/gen-dhparam.sh
vendored
Normal file
@ -0,0 +1,16 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Got root?
|
||||
myWHOAMI=$(whoami)
|
||||
if [ "$myWHOAMI" != "root" ]
|
||||
then
|
||||
echo "Need to run as root ..."
|
||||
exit
|
||||
fi
|
||||
|
||||
if [ "$1" = "2048" ] || [ "$1" = "4096" ] || [ "$1" = "8192" ]
|
||||
then
|
||||
openssl dhparam -outform PEM -out dhparam$1.pem $1
|
||||
else
|
||||
echo "Usage: ./gen-dhparam [2048, 4096, 8192]..."
|
||||
fi
|
||||
148
docker/nginx/dist/conf/tpotweb.conf
vendored
Normal file
148
docker/nginx/dist/conf/tpotweb.conf
vendored
Normal file
@ -0,0 +1,148 @@
|
||||
############################################
|
||||
### NGINX T-Pot configuration file by mo ###
|
||||
############################################
|
||||
|
||||
server {
|
||||
|
||||
#########################
|
||||
### Basic server settings
|
||||
#########################
|
||||
listen 64297 ssl http2;
|
||||
index index.html;
|
||||
ssl_protocols TLSv1.3;
|
||||
server_name example.com;
|
||||
error_page 300 301 302 400 401 402 403 404 500 501 502 503 504 /error.html;
|
||||
root /var/lib/nginx/html;
|
||||
|
||||
|
||||
##############################################
|
||||
### Remove version number add different header
|
||||
##############################################
|
||||
server_tokens off;
|
||||
more_set_headers 'Server: apache';
|
||||
|
||||
|
||||
##############################################
|
||||
### SSL settings and Cipher Suites
|
||||
##############################################
|
||||
ssl_certificate /etc/nginx/cert/nginx.crt;
|
||||
ssl_certificate_key /etc/nginx/cert/nginx.key;
|
||||
|
||||
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!DHE:!SHA:!SHA256';
|
||||
ssl_ecdh_curve secp384r1;
|
||||
ssl_dhparam /etc/nginx/ssl/dhparam4096.pem;
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
|
||||
|
||||
####################################
|
||||
### OWASP recommendations / settings
|
||||
####################################
|
||||
|
||||
### Size Limits & Buffer Overflows
|
||||
### the size may be configured based on the needs.
|
||||
client_body_buffer_size 128k;
|
||||
client_header_buffer_size 1k;
|
||||
client_max_body_size 2M;
|
||||
large_client_header_buffers 2 1k;
|
||||
|
||||
### Mitigate Slow HHTP DoS Attack
|
||||
### Timeouts definition ##
|
||||
client_body_timeout 10;
|
||||
client_header_timeout 10;
|
||||
keepalive_timeout 5 5;
|
||||
send_timeout 10;
|
||||
|
||||
### X-Frame-Options is to prevent from clickJacking attack
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
### disable content-type sniffing on some browsers.
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
|
||||
### This header enables the Cross-site scripting (XSS) filter
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
### This will enforce HTTP browsing into HTTPS and avoid ssl stripping attack
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
|
||||
|
||||
|
||||
##################################
|
||||
### Restrict access and basic auth
|
||||
##################################
|
||||
|
||||
# satisfy all;
|
||||
satisfy any;
|
||||
|
||||
# allow 10.0.0.0/8;
|
||||
# allow 172.16.0.0/12;
|
||||
# allow 192.168.0.0/16;
|
||||
allow 127.0.0.1;
|
||||
allow ::1;
|
||||
deny all;
|
||||
|
||||
auth_basic "closed site";
|
||||
auth_basic_user_file /etc/nginx/nginxpasswd;
|
||||
|
||||
|
||||
#############################
|
||||
### T-Pot Landing Page & Apps
|
||||
#############################
|
||||
|
||||
location / {
|
||||
auth_basic "closed site";
|
||||
auth_basic_user_file /etc/nginx/nginxpasswd;
|
||||
try_files $uri $uri/ /index.html?$args;
|
||||
}
|
||||
|
||||
location ^~ /elasticvue {
|
||||
index index.html;
|
||||
alias /var/lib/nginx/html/esvue;
|
||||
try_files $uri $uri/ /index.html?$args;
|
||||
}
|
||||
|
||||
|
||||
#################
|
||||
### Proxied sites
|
||||
#################
|
||||
|
||||
### Kibana
|
||||
location /kibana/ {
|
||||
proxy_pass http://127.0.0.1:64296;
|
||||
rewrite /kibana/(.*)$ /$1 break;
|
||||
}
|
||||
|
||||
### ES
|
||||
location /es/ {
|
||||
proxy_pass http://127.0.0.1:64298/;
|
||||
rewrite /es/(.*)$ /$1 break;
|
||||
}
|
||||
|
||||
### CyberChef
|
||||
location /cyberchef {
|
||||
proxy_pass http://127.0.0.1:64299;
|
||||
rewrite ^/cyberchef(.*)$ /$1 break;
|
||||
}
|
||||
|
||||
### spiderfoot
|
||||
location /spiderfoot {
|
||||
proxy_pass http://127.0.0.1:64303;
|
||||
}
|
||||
|
||||
location /static {
|
||||
proxy_pass http://127.0.0.1:64303/spiderfoot/static;
|
||||
}
|
||||
|
||||
location /scanviz {
|
||||
proxy_pass http://127.0.0.1:64303/spiderfoot/scanviz;
|
||||
}
|
||||
|
||||
location /scandelete {
|
||||
proxy_pass http://127.0.0.1:64303/spiderfoot/scandelete;
|
||||
}
|
||||
|
||||
location /scaninfo {
|
||||
proxy_pass http://127.0.0.1:64303/spiderfoot/scaninfo;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user