search

aplura / Tango

Honeypot Intelligence with Splunk
GNU General Public License v2.0
255 stars 43 forks source link

Cowrie: ERROR: You must not run cowrie as root! #34

Open ghost opened 7 years ago

ghost commented 7 years ago

Hi guys,

I'm trying to run bash-file in path /cowrie "start.sh" but terminal response:

Starting cowrie with extra arguments [ ] ...
ERROR: You must not run cowrie as root!

Now, when I switched to new added user "test" without root permission I'm getting error:

`Starting cowrie with extra arguments [ ] ...
Unhandled Error
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 648, in run
    runApp(config)
  File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 25, in runApp
    _SomeApplicationRunner(config).run()
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 379, in run
    self.application = self.createOrGetApplication()
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 439, in createOrGetApplication
    ser = plg.makeService(self.config.subOptions)
--- <exception caught here> ---
  File "/home/cowrie/twisted/plugins/cowrie_plugin.py", line 142, in makeService
    globals(), locals(), ['output']).Output(cfg)
  File "/home/cowrie/cowrie/output/jsonlog.py", line 50, in __init__
    self.outfile = twisted.python.logfile.DailyLogFile(base, dirs, defaultMode=0o664)
  File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 42, in __init__
    self._openFile()
  File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 252, in _openFile
    BaseLogFile._openFile(self)
  File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 85, in _openFile
    self._file = open(self.path, "w+", 1)
exceptions.IOError: [Errno 13] Permission denied: u'log/cowrie.json'

Traceback (most recent call last):
  File "/usr/local/bin/twistd", line 11, in <module>
    sys.exit(run())
  File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 29, in run
    app.run(runApp, ServerOptions)
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 648, in run
    runApp(config)
  File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 25, in runApp
    _SomeApplicationRunner(config).run()
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 379, in run
    self.application = self.createOrGetApplication()
  File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 439, in createOrGetApplication
    ser = plg.makeService(self.config.subOptions)
  File "/home/cowrie/twisted/plugins/cowrie_plugin.py", line 160, in makeService
    factory.portal = portal.Portal(core.realm.HoneyPotRealm(cfg))
  File "/home/cowrie/cowrie/core/realm.py", line 61, in __init__
    self.pckl = pickle.load(file(cfg.get('honeypot', 'filesystem_file'), 'rb'))
  File "/usr/lib/python2.7/pickle.py", line 1378, in load
    return Unpickler(file).load()
  File "/usr/lib/python2.7/pickle.py", line 858, in load
    dispatch[key](self)
  File "/usr/lib/python2.7/pickle.py", line 880, in load_eof
    raise EOFError
EOFError

What next should I do?

mackwage commented 7 years ago

You must give the cowrie user account you created permissions on the whole cowrie directory.

-Schuyler

On Feb 7, 2017, at 1:20 AM, br1877 notifications@github.com<mailto:notifications@github.com> wrote:

Hi guys,

I'm trying to run bash-file in path /cowrie "start.sh" but terminal response:

Starting cowrie with extra arguments [ ] ... ERROR: You must not run cowrie as root!

Now, when I switched to new added user "test" without root permission I'm getting error:

`Starting cowrie with extra arguments [ ] ... Unhandled Error Traceback (most recent call last): File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 648, in run runApp(config) File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 25, in runApp _SomeApplicationRunner(config).run() File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 379, in run self.application = self.createOrGetApplication() File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 439, in createOrGetApplication ser = plg.makeService(self.config.subOptions)

File "/home/cowrie/twisted/plugins/cowrie_plugin.py", line 142, in makeService globals(), locals(), ['output']).Output(cfg) File "/home/cowrie/cowrie/output/jsonlog.py", line 50, in init self.outfile = twisted.python.logfile.DailyLogFile(base, dirs, defaultMode=0o664) File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 42, in init self._openFile() File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 252, in _openFile BaseLogFile._openFile(self) File "/usr/local/lib/python2.7/dist-packages/twisted/python/logfile.py", line 85, in _openFile self._file = open(self.path, "w+", 1) exceptions.IOError: [Errno 13] Permission denied: u'log/cowrie.json'

Traceback (most recent call last): File "/usr/local/bin/twistd", line 11, in sys.exit(run()) File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 29, in run app.run(runApp, ServerOptions) File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 648, in run runApp(config) File "/usr/local/lib/python2.7/dist-packages/twisted/scripts/twistd.py", line 25, in runApp _SomeApplicationRunner(config).run() File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 379, in run self.application = self.createOrGetApplication() File "/usr/local/lib/python2.7/dist-packages/twisted/application/app.py", line 439, in createOrGetApplication ser = plg.makeService(self.config.subOptions) File "/home/cowrie/twisted/plugins/cowrie_plugin.py", line 160, in makeService factory.portal = portal.Portal(core.realm.HoneyPotRealm(cfg)) File "/home/cowrie/cowrie/core/realm.py", line 61, in init self.pckl = pickle.load(file(cfg.get('honeypot', 'filesystem_file'), 'rb')) File "/usr/lib/python2.7/pickle.py", line 1378, in load return Unpickler(file).load() File "/usr/lib/python2.7/pickle.py", line 858, in load dispatchkey File "/usr/lib/python2.7/pickle.py", line 880, in load_eof raise EOFError EOFError ` What next should I do?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHubhttps://github.com/aplura/Tango/issues/34, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AAbxGjbAquOipEaa5UTaX3cauQ3_Mts3ks5raDdPgaJpZM4L5PZ0.

ghost commented 7 years ago

Command chown -R cowrie:cowrie cowrie did not works for me. Also manually added cowrie user did not switched from "root". I do not why, but I initialized my VPS once again, I added manually user "cowrie" before run install Tango script and now seems that everything is work properly.

ghost commented 7 years ago

Thank you. Maybe someone tell me, what should I do to check if my Spunk and Tango works properly?

  1. My honeypot Cowrie seems works because in log /log/lastlog.txt I can see two accepted logon. Also I see log in cowrie.log: 
    [cowrie.ssh.factory.CowrieSSHFactory] New connection: 195.62.52.62:37814 (94.177.248.74:2222) [HoneyPotSSHTransport,11,195.62.52.62] Remote SSH version: SSH-2.0-ssh2js0.3.6
[HoneyPotSSHTransport,11,195.62.52.62] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
[HoneyPotSSHTransport,11,195.62.52.62] outgoing: '3des-cbc' 'hmac-sha1' 'none'
[HoneyPotSSHTransport,11,195.62.52.62] incoming: '3des-cbc' 'hmac-sha1' 'none'
[HoneyPotSSHTransport,11,195.62.52.62] NEW KEYS
[HoneyPotSSHTransport,11,195.62.52.62] starting service 'ssh-userauth'
[SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] 'root' trying auth 'password'
[SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] login attempt [root/111111] succeeded
[SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] 'root' authenticated with 'password'
[SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] starting service 'ssh-connection'
[HoneyPotSSHTransport,11,195.62.52.62] avatar root logging out
[HoneyPotSSHTransport,11,195.62.52.62] connection lost
[HoneyPotSSHTransport,11,195.62.52.62] Connection lost after 0 seconds
    1. My Spunk with Honey Tango App show still empty data (more less 1 hour after running Cowrie). For eg: 
      
Login Attempts vs Successes
No results found.
``