search

MatthewClarkMay / geoip-attack-map

Cyber security geoip attack map that follows syslog and parses IPs/port numbers to visualize attackers in real time.
Apache License 2.0
353 stars 203 forks source link

Problem #15

Closed artv2007 closed 7 years ago

artv2007 commented 7 years ago

Hello

Can you help me with your application. I try to make it work on a fresh Ubuntu Server 16.04.2 LTS. Installation successful.

Redis-server is active sudo service redis-server status ● redis-server.service - Advanced key-value store Loaded: loaded (/lib/systemd/system/redis-server.service; enabled; vendor preset: enabled) Active: active (running) since Fri 2017-03-17 18:57:18 MSK; 2 days ago Docs: http://redis.io/documentation, man:redis-server(1) Main PID: 1147 (redis-server) Tasks: 3 Memory: 2.0M CPU: 3min 12.186s CGroup: /system.slice/redis-server.service └─1147 /usr/bin/redis-server 0.0.0.0:6379

Mar 17 18:57:18 geoip systemd[1]: Starting Advanced key-value store... Mar 17 18:57:18 geoip run-parts[1085]: run-parts: executing /etc/redis/redis-server.pre-up.d/00_example Mar 17 18:57:18 geoip run-parts[1148]: run-parts: executing /etc/redis/redis-server.post-up.d/00_example Mar 17 18:57:18 geoip systemd[1]: Started Advanced key-value store.

  1. I start sudo python3 DataServer.py
  2. In another session I run ./syslog-gen.sh
  3. I see some events in first session with DataServer.py
  4. In another new session I start sudo python3 AttackMapServer.py - (see [*] Waiting on browser connections...)
  5. Open a browser and open a link of server:8888 - (map is open, I see a hq_point, but no traffic activities)
  6. In AttackMapServer.py session - I get an error geoip@geoip:/opt/geoip-attack-map/AttackMapServer$ sudo python3 AttackMapServer.py [sudo] password for geoip: [] Waiting on browser connections... [] WebSocketChatHandler opened [] Connected to Redis server [] Closing connection. ERROR:tornado.application:Exception in callback <function wrap..null_wrapper at 0x7f9c17c4d048> for <tornado.concurrent.Future object at 0x7f9c17c945f8> Traceback (most recent call last): File "/usr/local/lib/python3.5/dist-packages/tornado/concurrent.py", line 322, in _set_done cb(self) File "/usr/local/lib/python3.5/dist-packages/tornado/stack_context.py", line 275, in null_wrapper return fn(*args, **kwargs) File "/usr/local/lib/python3.5/dist-packages/tornado/gen.py", line 199, in final_callback if future.result() is not None: File "/usr/local/lib/python3.5/dist-packages/tornado/concurrent.py", line 237, in result raise_exc_info(self._exc_info) File "", line 3, in raise_exc_info File "/usr/local/lib/python3.5/dist-packages/tornado/gen.py", line 1024, in run yielded = self.gen.send(value) File "/usr/local/lib/python3.5/dist-packages/tornadoredis/client.py", line 1164, in listen callback(result) File "AttackMapServer.py", line 234, in on_message self.write_message(json.dumps(msg_to_send)) File "/usr/local/lib/python3.5/dist-packages/tornado/websocket.py", line 210, in write_message raise WebSocketClosedError() tornado.websocket.WebSocketClosedError WARNING:tornado.access:404 GET /favicon.ico (10.21.124.135) 0.98ms

What I do wrong? I try to check redis connection redis-cli 127.0.0.1:6379> ping PONG 127.0.0.1:6379> exit Seems it work...

How to make it work?

audduk commented 7 years ago

We have such problem. Have any ideas?

MatthewClarkMay commented 7 years ago

Sorry I have not replied to this sooner. Are you running all components on the same server you're using the browser to access the application, or are you browsing to it from another computer? I've never gotten this error so I'm trying to recreate it.

artv2007 commented 7 years ago

Hi Matthew. I try to describe the situation.

  1. Map is loaded and simulated traffic is show on the map. All components are running on one server. Browser is opened in GUI on this server to.

  2. Map is loaded but simulated traffic not show on the map. All components are running on one server. Browser is opened on the another computer in the local network where the server installed. When the map loaded on the browser on computer on network I see the error on the AttackMapServer.py session on the server - [] Waiting on browser connections... [] WebSocketChatHandler opened [] Connected to Redis server [] Closing connection. ERROR:tornado.application:Exception in callback <function wrap..null_wrapper at 0x7f9c17c4d048> for <tornado.concurrent.Future object at 0x7f9c17c945f8> Traceback (most recent call last): File "/usr/local/lib/python3.5/dist-packages/tornado/concurrent.py", line 322, in _set_done cb(self) File "/usr/local/lib/python3.5/dist-packages/tornado/stack_context.py", line 275, in null_wrapper return fn(*args, **kwargs) File "/usr/local/lib/python3.5/dist-packages/tornado/gen.py", line 199, in final_callback if future.result() is not None: File "/usr/local/lib/python3.5/dist-packages/tornado/concurrent.py", line 237, in result raise_exc_info(self._exc_info) File "", line 3, in raise_exc_info File "/usr/local/lib/python3.5/dist-packages/tornado/gen.py", line 1024, in run yielded = self.gen.send(value) File "/usr/local/lib/python3.5/dist-packages/tornadoredis/client.py", line 1164, in listen callback(result) File "AttackMapServer.py", line 234, in on_message self.write_message(json.dumps(msg_to_send)) File "/usr/local/lib/python3.5/dist-packages/tornado/websocket.py", line 210, in write_message raise WebSocketClosedError() tornado.websocket.WebSocketClosedError WARNING:tornado.access:404 GET /favicon.ico (10.21.124.135) 0.98ms

The problem solved for me only by generated certificates and use wss connection to websocket оn the port other than 8888.

Now I have problem with ... I need to install additional hqpoints on the map and draw traffic links to it too.