T-Pot 22.04.0

[t3chn0m4g3]

Release Notes / Changelog

T-Pot 22.04.0 is probably the most feature rich release ever provided with long awaited (wanted!) features readily available after installation.

New Features

• Distributed Installation with HIVE and HIVE_SENSOR
• ARM64 support for all provided Docker images
• GeoIP Attack Map visualizing Live Attacks on a dedicated webpage
• Kibana Live Attack Map visualizing Live Attacks from different HIVE_SENSORS
• Blackhole is a script trying to avoid mass scanner detection
• Elasticvue a web front end for browsing and interacting with an Elastic Search cluster
• Ddospot a honeypot for tracking and monitoring UDP-based Distributed Denial of Service (DDoS) attacks
• Endlessh is a SSH tarpit that very slowly sends an endless, random SSH banner
• HellPot is an endless honeypot based on Heffalump that sends unruly HTTP bots to hell
• qHoneypots 25 honeypots in a single container for monitoring network traffic, bots activities, and username \ password credentials
• Redishoneypot is a honeypot mimicking some of the Redis' functions
• SentryPeer a dedicated SIP honeypot
• Index Lifecycle Management for Elasticseach indices is now being used

Upgrades

• Debian 11.x is now being used for the T-Pot ISO images and required for post installs
• Elastic Stack 8.x is now provided as Docker images

Updates

• Honeypots and tools were updated to their latest masters and releases
• Updates will be provided continuously through Docker Images updates

Breaking Changes

• For security reasons all Py2.x honeypots with the need of PyPi packages have been removed: HoneyPy, HoneySAP and RDPY
• If you are upgrading from a previous version of T-Pot (20.06.x) you need to import the new Kibana objects or some of the functionality will be broken or will be unavailabe
• Cyberchef is now part of the Nginx Docker image, no longer as individual image
• ElasticSearch Head is superseded by Elasticvue and part the Nginx Docker image
• Heimdall is no longer supported and superseded with a new Bento based landing page
• Elasticsearch Curator is no longer supprted and superseded with Index Lifecycle Policies available through Kibana.

Thanks & Credits

• @ghenry, for some fun late night debugging and of course SentryPeer!
• @giga-a, for adding much appreciated features (i.e. JSON logging,
  X-Forwarded-For, etc.) and of course qHoneypots!
• @sp3t3rs, @trixam, for their backend and ews support!
• @tadashi-oya, for spotting some errors and propose fixes!
• @tmariuss, @shaderecker for their cloud contributions!
• @vorband, for much appreciated and helpful insights regarding the GeoIP Attack Map!
• @yunginnanet, on not giving up on squashing a bug and of course Hellpot!

... and many others from the T-Pot community by opening valued issues and discussions, suggesting ideas and thus helping to improve T-Pot!

---

This discussion was created from the release T-Pot 22.04.0.

[yunginnanet]

Wow. I didn't even notice that you were the top contributor to this project. This project taught me a lot about honeynets. It's truly an honor.

[t3chn0m4g3]

Thank you!

[ghenry]

An absolute pleasure working with you @t3chn0m4g3 Peer to Peer is live now in the v1.4.0 container too (my Dockerfile updated) as I packaged up OpenDHT for Alpine. Have a play!

Thanks!

[t3chn0m4g3]

Thank you! As always, likewise!
Just added to the shortlist 😅

[lcia-projects]

very interested in the HIVE + HIVE_SENSOR setup.. is there any more information on that? searched discussion and issues.. nothing..

[t3chn0m4g3]

It is documented in the Readme.

[mibmit]

Deployed a couple of new T-Pot's - Great - seem to be working well, and nice visualisations.

I am getting

Raise network interfaces : Failed to start

All seems to be working fine, collecting logs and binaries.

[t3chn0m4g3]

It is documented in the Readme under Known Issues.

[ehnwebmaster]

Fantastic, awesome work!

Now my T-Pot is working fine (without emulation) on a RaspBerry Pi 4! Thank you for adding ARM64 support to all docker images.

[t3chn0m4g3]

Thank you for the great feedback. Would you mind sharing some details how you made it work?

[ehnwebmaster]

Frist I was thinking using tpot_arm64.iso (debian net install) but finally used Raspberry Pi OS (Kernel version: 5.15 based on Debian version: 11 bullseye) and do the post-installation primarlly because want to set led offs using the overlays and booting from USB pendrive instead of using SD card

Post install works fine:

git clone https://github.com/telekom-security/tpotce
cd tpotce/iso/installer/
./install.sh --type=user

Everything works flawless so all packages from Debian 11 arm64 are available on Raspi OS aarch64. No errors, no extra config.

Even I can use "standard" installation using Kibana, logstash, elasticsearch) (RaspBerry Pi 4 8GB, full ram used) but right now I'm using just the "sensor" with just 2GB ram in use). Just noticed sometimes high cpu usage from ewsposter (just normal, because it's reporting many IP's)

MiB Mem : 7811.5 total, 2173.0 free, 2312.4 used, 3326.1 buff/cache

Used and Left space:

Filesystem      Size  Used Avail Use% Mounted on
/dev/root       114G   15G   95G  14% /

Last time (using previous version of Tpot without arm support) installing and configuring Tpot wasn't easy...... I must use docker emulator based on qmeu to emulate all docker containers using:

docker run --rm --privileged aptman/qus -s -- -p x86_64

Then everything works (minus dioanaea last version reporting SMB failed due to "setgroups dropping groups failed"), but there was high cpu usage due to emulation (quite normal)

Log install.err

info: Trying to set 'docker.io/restart' [boolean] to 'true'
info: Loading answer for 'docker.io/restart'
info: Trying to set 'debconf/frontend' [select] to 'noninteractive'
info: Loading answer for 'debconf/frontend'
W: --force-yes is deprecated, use one of the options starting with --allow instead.
W: --force-yes is deprecated, use one of the options starting with --allow instead.
npm WARN deprecated [email protected]: this library is no longer supported
npm WARN deprecated [email protected]: This module is no longer maintained. It is provided as is.
npm WARN deprecated [email protected]: The querystring API is considered Legacy. new code should use the URLSearchParam>
npm WARN deprecated [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certai>
npm WARN deprecated [email protected]: request has been deprecated, see request/request#3142
Cloning into '/opt/tpot'...
Created symlink /etc/systemd/system/multi-user.target.wants/tpot.service → /etc/systemd/system/tpot.service.
sed: can't read /etc/default/grub: No such file or directory
sed: can't read /etc/default/grub: No such file or directory
./install.sh: line 865: update-grub: command not found

[t3chn0m4g3]

Thank you for sharing!

Will be ordering RasPi 4+ with 8GB and check out if support can be even improved further.

[dgarcia88]

I tried to install on pi4 with 8GB ram
Issues i have found:
In overview "dhcpd service keep failing"
Kitana won't open other link's works fine (maybe i did something wrong?)
CPU usage always around 80~100%

I gonna reinstall all over again and report back :)

[dgarcia88]

All seems running fine on Raspberry Pi it takes arround ~40min to all be working.

[damakusan]

Hello!
I have an error in installation progress. Can you help me?

[yunginnanet]

I would recommend using the issues section for this sort of thing: https://github.com/telekom-security/tpotce/issues

[damakusan]

Ok, thank you

[ghenry]

Afternoon. Not sure if anyone has reported, but the tpot_amd64.iso is actually a 32bit arch :-)

[ghenry]

I think it's the unattended conf doing this. If I run it as 32bit, the kernel is 64bit, so I need to change to manual on VirtualBox

[t3chn0m4g3]

The preseed has no influence on the architecture. The ISO is built against the Debian Netiso with AMD64 or ARM64.

[ghenry]

Must be how VirtualBox is doing things as it makes the option readonly unless you choose manual (via the GUI anyway).

Thanks.

[felipemor]

Hello ! I install my tpot in Vbox but now i dont see kibana app, do you have a solution for this ? Hugs

[t3chn0m4g3]

Kibana will only be shown if the service has been started already. If everything else works fine a reload of the landing page should show the Kibana link.

[felipemor]

Hello @t3chn0m4g3, i hope you're fine.

Thanks a lot for the support, i execute the instructions and now i have sucessfully on service.

Regards.

[TPOTinstallatiobnir]

Hi
I Wanna to install topot on ESXi (HP Server) which version should be install ?

[Cristobalvaldivia]

Hello!
I have an error in installation progress. Can you help me?

[t3chn0m4g3]

I just updated the release.

[Cristobalvaldivia]

I performed the installation but the kibana option does not appear.

[t3chn0m4g3]

It only appears once Kibana has been started successfully. Reload?

[jmargon]

I performed the installation in a VM, but the nginx container don't start.

What's going on? It don't start, it's always restarting.

[kssjoe]

It's it worth installing Defender on the VM?

[Cristobalvaldivia]

I have the following problem when configuring the t-pot with the manual network i get the following error what can i do and i am installing it in Vmware esxi

[famirapt]

this project is actually inspiring, which am currently using as for my final year project pls can you explain how i can download and install it on virtual machine

[famirapt]

Yes, I have import It on VMware, but need your assistance in complete the configuration and analyzing attacks, My project is on stimulating attack and detecting response from the honeypot , if you could help me in recommending finished project documents why I could find how to stimulate attack on my honey and analyze it.

…

On Sun, Feb 25, 2024, 5:19 PM Bobby420 ***@***.***> wrote: Did you get this figured out? I getting same error installing TPOT on Proxmox. This is something new as I have used the same setup for years with no issues. — Reply to this email directly, view it on GitHub <#1068 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AVZRQ2LR3Z2IVY6X75HDVYLYVNQCNAVCNFSM5THNWGK2U5DIOJSWCZC7NNSXTOKENFZWG5LTONUW63SDN5WW2ZLOOQ5TQNJYGM4TSOA> . You are receiving this because you commented.Message ID: ***@***.*** com>

[morenblakk]

after installing tpot, i cannot login. all username(tsec) and password is not working. including the username that i set while installing. i have uninstalled and reinstalled it more than 6 times now, each time it comes up with different names like briefrank login, usualuser login, etc. i need help folks