intelowlproject / GreedyBear

Threat Intel Platform for T-POTs
MIT License
129 stars 31 forks source link

tpot install (doesnt work) #347

Closed dmille6 closed 1 month ago

dmille6 commented 1 month ago

hi, i just set up a new tsec tpot.. its all up and running.. then wanted to try out GreedyBear. I followed the install instructions: https://intelowlproject.github.io/docs/GreedyBear/Installation/

I ran the ./installer_on_tpot.sh and it fails..

i apt installed :

and I got further through the install.. but its still failing..

this is the new error:

error: could not load font ivrit
error: could not load font ivrit
fatal: destination path '/opt/GreedyBear' already exists and is not an empty directory.
error: could not load font ivrit
error: could not load font ivrit
error: could not load font ivrit
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 214, in _retrieve_server_version
    return self.version(api_version=False)["ApiVersion"]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/daemon.py", line 181, in version
    return self._result(self._get(url), json=True)
                        ^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/utils/decorators.py", line 46, in inner
    return f(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 237, in _get
    return self.get(url, **self._set_request_timeout(kwargs))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 602, in get
    return self.request("GET", url, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 486, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 791, in urlopen
    response = self._make_request(
               ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 497, in _make_request
    conn.request(
TypeError: HTTPConnection.request() got an unexpected keyword argument 'chunked'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/docker-compose", line 33, in <module>
    sys.exit(load_entry_point('docker-compose==1.29.2', 'console_scripts', 'docker-compose')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 81, in main
    command_func()
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 200, in perform_command
    project = project_from_options('.', options)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/command.py", line 60, in project_from_options
    return get_project(
           ^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/command.py", line 152, in get_project
    client = get_client(
             ^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/docker_client.py", line 41, in get_client
    client = docker_client(
             ^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/docker_client.py", line 170, in docker_client
    client = APIClient(use_ssh_client=not use_paramiko_ssh, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 197, in __init__
    self._version = self._retrieve_server_version()
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 221, in _retrieve_server_version
    raise DockerException(
docker.errors.DockerException: Error while fetching server API version: HTTPConnection.request() got an unexpected keyword argument 'chunked'
error: could not load font ivrit
● greedybear.service - greedybear
     Loaded: loaded (/etc/systemd/system/greedybear.service; enabled; preset: enabled)
     Active: active (running) since Fri 2024-08-30 16:33:33 UTC; 17ms ago
   Main PID: 396820 (docker-compose)
      Tasks: 1 (limit: 19106)
     Memory: 1.6M (peak: 1.6M)
        CPU: 13ms
     CGroup: /system.slice/greedybear.service
             └─396820 /usr/bin/python3 /usr/bin/docker-compose up

Aug 30 16:33:32 keyserver1 systemd[1]: greedybear.service: Scheduled restart job, restart counter is at 6264.
Aug 30 16:33:33 keyserver1 systemd[1]: Started greedybear.service - greedybear.

any suggestions would be appreciated

mlodic commented 1 month ago

in the documentation it is explictly written that that installer is to be considered as a POC and it is not officialy supported: https://intelowlproject.github.io/docs/GreedyBear/Installation/#installer-for-tpot-instance

dmille6 commented 1 month ago

i understand, and i definately read the documentation explicitly.. but I thought someone might want to be aware of the issue. I'll see if I can track down the issue, and make necessary adjustments since it is explicitly included in the documentation and codebase :)

mlodic commented 1 month ago

I agree. I think it makes sense to remove it cause we agreed with the TPOT maintainers that it does not make sense to merge both applications into the same server and the best way to use them would be to leverage separate servers. I am sorry that you got stuck in this problem. I'll remove the script at the next release.