search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.25k stars 415 forks source link

docker image build failed #369

Closed sereysethy closed 6 years ago

sereysethy commented 6 years ago

Hi,

I think there is a small error in the README file, the option -f does not exist. I used a docker version.

# conpot -f --template default

                       _
   ___ ___ ___ ___ ___| |_
  |  _| . |   | . | . |  _|
  |___|___|_|_|  _|___|_|
              |_|

  Version 0.5.1
  MushMush Foundation

usage: conpot [-h] [-t TEMPLATE] [-c config.cfg] [-l LOGFILE] [-a RAW_MIB]
              [-m MIBPATHS] [-v]
conpot: error: unrecognized arguments: -f
xandfury commented 6 years ago

Did you build the container from source or fetched one from dockerhub?

sereysethy commented 6 years ago

I pulled it directly from dockerhub, I just want to test it first.

sereysethy commented 6 years ago

I tried to build using docker-compose, the build failed when running coverage. Please check the log below:

Running env:

Installed /opt/conpot/.eggs/nose-1.3.7-py2.7.egg running egg_info creating Conpot.egg-info writing requirements to Conpot.egg-info/requires.txt writing Conpot.egg-info/PKG-INFO writing top-level names to Conpot.egg-info/top_level.txt writing dependency_links to Conpot.egg-info/dependency_links.txt writing manifest file 'Conpot.egg-info/SOURCES.txt' reading manifest file 'Conpot.egg-info/SOURCES.txt' reading manifest template 'MANIFEST.in' writing manifest file 'Conpot.egg-info/SOURCES.txt' running build_ext WARNING:scapy.loading:Cannot read wireshark manuf database WARNING:scapy.loading:Failed to execute tcpdump. Check it is installed and in the PATH WARNING:scapy.runtime:No route found for IPv6 destination :: (no default route?) ERROR:scapy.interactive:Loading module scapy.layers.netflow Traceback (most recent call last): File "/usr/local/lib/python2.7/site-packages/scapy/main.py", line 121, in _load mod = importlib.import_module(module) File "/usr/local/lib/python2.7/importlib/init.py", line 37, in import_module import(name) File "/usr/local/lib/python2.7/site-packages/gevent/builtins.py", line 93, in import result = _import(*args, **kwargs) File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 86, in class NetflowRecordV5(Packet): File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 101, in NetflowRecordV5 ByteEnumField("prot", IP_PROTOS["tcp"], IP_PROTOS), File "/usr/local/lib/python2.7/site-packages/scapy/dadict.py", line 38, in getitem return getattr(self, attr) AttributeError: DADict instance has no attribute 'tcp' test_readProperty (conpot.tests.test_bacnet_server.TestBase) ... ok test_whoHas (conpot.tests.test_bacnet_server.TestBase) ... ok test_whoIs (conpot.tests.test_bacnet_server.TestBase) ... ok test_base (conpot.tests.test_base.TestBase) ... ok test_make_docs (conpot.tests.test_docs.TestMakeDocs) ... WARNING: html_static_path entry u'/opt/conpot/docs/source/_static' does not exist ok test_list_identity (conpot.tests.test_enip_server.TestBase) ... ok test_list_services (conpot.tests.test_enip_server.TestBase) ... ok test_read_tags (conpot.tests.test_enip_server.TestBase) ... ok test_write_tags (conpot.tests.test_enip_server.TestBase) ... ok test_ext_util (conpot.tests.test_ext_ip_util.TestExtIPUtil) ... 127.0.0.1 - - [2018-05-04 09:01:46] "GET / HTTP/1.1" 200 109 0.000299 ok test_ip_verify (conpot.tests.test_ext_ip_util.TestExtIPUtil) ... ok test_hpfriends (conpot.tests.test_hpfriends.Test_HPFriends) Objective: Test if data can be published to hpfriends without errors. ... SKIP: disabled until honeycloud up and running again test_http_backend_databus (conpot.tests.test_http_server.TestBase) Objective: Test if http backend is able to retrieve data from databus ... ok test_http_backend_tarpit (conpot.tests.test_http_server.TestBase) Objective: Test if http tarpit delays responses properly ... ok test_http_request_base (conpot.tests.test_http_server.TestBase) Objective: Test if http service delivers data on request ... ok test_http_subselect_trigger (conpot.tests.test_http_server.TestBase) Objective: Test if http subselect triggers work correctly ... ok test_startdt (conpot.tests.test_iec104_server.TestBase) Objective: Test if answered correctly to STARTDT act ... ok test_testfr (conpot.tests.test_iec104_server.TestBase) Objective: Test if answered correctly to TESTFR act ... ok test_write_for_non_existing (conpot.tests.test_iec104_server.TestBase) Objective: Test answer for a command to a device that doesn't exist ... ok test_write_no_relation_for_existing (conpot.tests.test_iec104_server.TestBase) Objective: Test answer for a correct command to a device that does exist and has no related sensor ... ok test_write_relation_for_existing (conpot.tests.test_iec104_server.TestBase) Objective: Test answer for a correct command to a device that does exist and has a related sensor ... ok test_write_wrong_type_for_existing (conpot.tests.test_iec104_server.TestBase) Objective: Test answer for a command of wrong type to a device that does exist ... ok test_something (conpot.tests.test_ipmi_server.TestIPMI) Objective: Test the IPMI server ... ok test_invalid_crc (conpot.tests.test_kamstrup_decoder.TestKamstrupDecoder) ... ok test_request_one (conpot.tests.test_kamstrup_decoder.TestKamstrupDecoder) ... ok test_request_get_register (conpot.tests.test_kamstrup_meter_protocol.TestKamstrup) ... ok test_log_event (conpot.tests.test_logger_json.TestJsonLogger) ... ok test_mysqllogger (conpot.tests.test_logger_mysql.Test_MySQLlogger) Objective: Test if events can be stored to and retrieved from mysql properly. ... ERROR:conpot.core.loggers.mysql_log:Could not create a stable database connection for logging. Check database and credentials. ERROR test_mac (conpot.tests.test_mac_addr.TestMacAddrUtil) Objective: Test if the spoofer is able to change MAC address ... ERROR test_modbus_logging (conpot.tests.test_modbus_server.TestBase) Objective: Test if modbus generates log messages as expected. ... ok test_read_coils (conpot.tests.test_modbus_server.TestBase) Objective: Test if we can extract the expected bits from a slave using the modbus protocol. ... ok test_read_nonexistent_slave (conpot.tests.test_modbus_server.TestBase) Objective: Test if the correct exception is raised when trying to read from nonexistent slave. ... ERROR:conpot.protocols.modbus.slave_db:Slave 5 doesn't exist ok test_write_read_coils (conpot.tests.test_modbus_server.TestBase) Objective: Test if we can change values using the modbus protocol. ... ok test_proxy (conpot.tests.test_proxy.TestProxy) ... WARNING:root:Closing proxied socket while receiving (127.0.0.1, 45855): socket closed. ok test_ssl_proxy (conpot.tests.test_proxy.TestProxy) ... WARNING:root:Closing proxied socket while receiving (127.0.0.1, 40087): socket closed. ok test_compile (conpot.tests.test_pysnmp_wrapper.TestBase) Tests that the wrapper can output mib files. ... ok test_find (conpot.tests.test_pysnmp_wrapper.TestBase) Tests that the wrapper can find mib files. ... ok test_wrapper_output (conpot.tests.test_pysnmp_wrapper.TestBase) Tests that the wrapper generates output that can be consumed by the command responder. ... ok test_wrapper_processing (conpot.tests.test_pysnmp_wrapper.TestBase) Tests that the wrapper can process a valid mib file without errors. ... ok test_s7 (conpot.tests.test_s7_server.TestBase) Objective: Test if the S7 server returns the values expected. ... ok test_snmp_get (conpot.tests.test_snmp_server.TestBase) Objective: Test if we can get data via snmp_get ... ok test_snmp_set (conpot.tests.test_snmp_server.TestBase) Objective: Test if we can set data via snmp_set ... ok test_stix_transform (conpot.tests.test_taxii.TestLoggers) Objective: Test if our STIX xml can be validated. ... SKIP: disabled until STIX 2.0 test_taxii (conpot.tests.test_taxii.TestLoggers) Objective: Test if we can transmit data to MITRE's TAXII test server. ... SKIP: disabled until taxii server is up and running again

====================================================================== ERROR: test_mysqllogger (conpot.tests.test_logger_mysql.Test_MySQLlogger) Objective: Test if events can be stored to and retrieved from mysql properly.

Traceback (most recent call last): File "/opt/conpot/conpot/tests/test_logger_mysql.py", line 50, in test_mysqllogger success = mysqllogger.log(test_event, 0) File "/opt/conpot/conpot/core/loggers/mysql_log.py", line 79, in log cursor = self.conn.cursor() AttributeError: 'MySQLlogger' object has no attribute 'conn' -------------------- >> begin captured logging << -------------------- conpot.core.loggers.mysql_log: ERROR: Could not create a stable database connection for logging. Check database and credentials. --------------------- >> end captured logging << ---------------------

====================================================================== ERROR: test_mac (conpot.tests.test_mac_addr.TestMacAddrUtil) Objective: Test if the spoofer is able to change MAC address

Traceback (most recent call last): File "/opt/conpot/conpot/tests/test_mac_addr.py", line 38, in test_mac s = subprocess.Popen(["modprobe", "dummy"], stderr=subprocess.STDOUT, stdout=subprocess.PIPE) File "/usr/local/lib/python2.7/site-packages/gevent/subprocess.py", line 585, in init reraise(*exc_info) File "/usr/local/lib/python2.7/site-packages/gevent/subprocess.py", line 554, in init restore_signals, start_new_session) File "/usr/local/lib/python2.7/site-packages/gevent/subprocess.py", line 1312, in _execute_child raise child_exception OSError: [Errno 2] No such file or directory -------------------- >> begin captured logging << -------------------- conpot.protocols.IEC104.IEC104_server: INFO: IEC104 Station disconnected. (2260826d-1850-42f9-9348-5836e62878b7) --------------------- >> end captured logging << ---------------------

Ran 44 tests in 42.038s

FAILED (errors=2, skipped=3) Test failed: Coverage.py warning: Trace function changed, measurement is likely wrong: <bound method PyTracer._trace of <PyTracer at 139713308371216: 4126 lines in 95 files>> (trace-changed) error: Test failed: ERROR: Service 'conpot' failed to build: The command '/bin/sh -c coverage run --timid --source=conpot setup.py test' returned a non-zero code: 1

xandfury commented 6 years ago

Could you try again after commenting out the tests? See if that works for you

sereysethy commented 6 years ago

@xandfury yes that was what I did. I commented it out and it seems to work fine. But now I need to capture the log.

xandfury commented 6 years ago

@sereysethy Like I said, conpot does create a logfile by default. For something more docker related - this should help.

xandfury commented 6 years ago

@sereysethy Were you able to resolve your issue? I think we can close this.

sereysethy commented 6 years ago

@xandfury there is still a problem indeed. Build is successful, but when I run docker-compose up, there seems to be a problem. You can check the log here. I used all the provided files, I meant docker-compose and Dockerfile.

It is supposed to run this command: CMD ["/usr/local/bin/conpot", "--template", "default", "--logfile", "/var/log/conpot/conpot.log"] but apparently it didnt found the config or something is missing.

conpot_conpot_1 is up-to-date
Attaching to conpot_conpot_1
conpot_1  | WARNING:scapy.loading:Cannot read wireshark manuf database
conpot_1  | WARNING:scapy.loading:Failed to execute tcpdump. Check it is installed and in the PATH
conpot_1  | WARNING:scapy.runtime:No route found for IPv6 destination :: (no default route?)
conpot_1  | ERROR:scapy.interactive:Loading module scapy.layers.netflow
conpot_1  | Traceback (most recent call last):
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/main.py", line 121, in _load
conpot_1  |     mod = importlib.import_module(module)
conpot_1  |   File "/usr/local/lib/python2.7/importlib/__init__.py", line 37, in import_module
conpot_1  |     __import__(name)
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/gevent/builtins.py", line 93, in __import__
conpot_1  |     result = _import(*args, **kwargs)
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 86, in <module>
conpot_1  |     class NetflowRecordV5(Packet):
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 101, in NetflowRecordV5
conpot_1  |     ByteEnumField("prot", IP_PROTOS["tcp"], IP_PROTOS),
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/dadict.py", line 38, in __getitem__
conpot_1  |     return getattr(self, attr)
conpot_1  | AttributeError: DADict instance has no attribute 'tcp'
conpot_1  | 2018-05-04 11:56:12,171 
conpot_1  | Could not find config file!
conpot_1  | Use -f option to try the test configuration
conpot_1  | 
conpot_1  |                        _
conpot_1  |    ___ ___ ___ ___ ___| |_
conpot_1  |   |  _| . |   | . | . |  _|
conpot_1  |   |___|___|_|_|  _|___|_|
conpot_1  |               |_|
conpot_1  | 
conpot_1  |   Version 0.5.1
conpot_1  |   MushMush Foundation
sereysethy commented 6 years ago

well it works now since I added option -f to run conpot but it still checks for wireshark.

conpot_1  | WARNING:scapy.loading:Cannot read wireshark manuf database
conpot_1  | WARNING:scapy.loading:Failed to execute tcpdump. Check it is installed and in the PATH
conpot_1  | WARNING:scapy.runtime:No route found for IPv6 destination :: (no default route?)
conpot_1  | ERROR:scapy.interactive:Loading module scapy.layers.netflow
conpot_1  | Traceback (most recent call last):
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/main.py", line 121, in _load
conpot_1  |     mod = importlib.import_module(module)
conpot_1  |   File "/usr/local/lib/python2.7/importlib/__init__.py", line 37, in import_module
conpot_1  |     __import__(name)
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/gevent/builtins.py", line 96, in __import__
conpot_1  |     result = _import(*args, **kwargs)
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 86, in <module>
conpot_1  |     class NetflowRecordV5(Packet):
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/layers/netflow.py", line 101, in NetflowRecordV5
conpot_1  |     ByteEnumField("prot", IP_PROTOS["tcp"], IP_PROTOS),
conpot_1  |   File "/usr/local/lib/python2.7/site-packages/scapy/dadict.py", line 38, in __getitem__
conpot_1  |     return getattr(self, attr)
conpot_1  | AttributeError: DADict instance has no attribute 'tcp'
conpot_1  | 2018-05-11 12:26:55,618 --force option specified. Using testing configuration:
conpot_1  | 2018-05-11 12:26:55,620 Starting Conpot using template: /usr/local/lib/python2.7/site-packages/Conpot-0.5.1-py2.7.egg/conpot/templates/default
conpot_1  | 2018-05-11 12:26:55,620 Starting Conpot using configuration found in: /usr/local/lib/python2.7/site-packages/Conpot-0.5.1-py2.7.egg/conpot/testing.cfg
conpot_1  | 2018-05-11 12:26:55,674 Fetched 138.48.202.82 as external ip.
conpot_1  | 2018-05-11 12:26:55,678 Conpot modbus initialized
conpot_1  | 2018-05-11 12:26:55,680 Found and enabled ('modbus', <class 'conpot.protocols.modbus.modbus_server.ModbusServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,684 Conpot S7Comm initialized
conpot_1  | 2018-05-11 12:26:55,685 Found and enabled ('s7comm', <class 'conpot.protocols.s7comm.s7_server.S7Server'>) protocol.
conpot_1  | 2018-05-11 12:26:55,687 Found and enabled ('http', <class 'conpot.protocols.http.web_server.HTTPServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,689 Found and enabled ('snmp', <class 'conpot.protocols.snmp.snmp_server.SNMPServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,691 Conpot Bacnet initialized using the /usr/local/lib/python2.7/site-packages/Conpot-0.5.1-py2.7.egg/conpot/templates/default/bacnet/bacnet.xml template.
conpot_1  | 2018-05-11 12:26:55,692 Found and enabled ('bacnet', <class 'conpot.protocols.bacnet.bacnet_server.BacnetServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,693 IPMI BMC initialized.
conpot_1  | 2018-05-11 12:26:55,694 Conpot IPMI initialized using /usr/local/lib/python2.7/site-packages/Conpot-0.5.1-py2.7.egg/conpot/templates/default/ipmi/ipmi.xml template
conpot_1  | 2018-05-11 12:26:55,695 Found and enabled ('ipmi', <class 'conpot.protocols.ipmi.ipmi_server.IpmiServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,697 Class    22/0x0016, Instance   1, Attribute     1 <== [{'class': 22}, {'instance': 1}, {'attribute': 1}]
conpot_1  | 2018-05-11 12:26:55,698 Class    22/0x0016, Instance   1, Attribute     2 <== [{'class': 22}, {'instance': 1}, {'attribute': 2}]
conpot_1  | 2018-05-11 12:26:55,698 Class    22/0x0016, Instance   1, Attribute     1 <== [{'class': 22}, {'instance': 1}, {'attribute': 1}]
conpot_1  | 2018-05-11 12:26:55,700 Class    22/0x0016, Instance   1, Attribute     3 <== [{'class': 22}, {'instance': 1}, {'attribute': 3}]
conpot_1  | 2018-05-11 12:26:55,700 Class    22/0x0016, Instance   1, Attribute     2 <== [{'class': 22}, {'instance': 1}, {'attribute': 2}]
conpot_1  | 2018-05-11 12:26:55,701 Class    22/0x0016, Instance   1, Attribute     1 <== [{'class': 22}, {'instance': 1}, {'attribute': 1}]
conpot_1  | 2018-05-11 12:26:55,702 Found and enabled ('enip', <class 'conpot.protocols.enip.enip_server.EnipServer'>) protocol.
conpot_1  | 2018-05-11 12:26:55,703 No proxy template found. Service will remain unconfigured/stopped.
conpot_1  | 2018-05-11 12:26:55,704 Modbus server started on: ('0.0.0.0', 502)
conpot_1  | 2018-05-11 12:26:55,705 S7Comm server started on: ('0.0.0.0', 102)
conpot_1  | 2018-05-11 12:26:55,705 HTTP server started on: ('0.0.0.0', 80)
conpot_1  | 2018-05-11 12:26:55,814 SNMP server started on: ('0.0.0.0', 161)
conpot_1  | 2018-05-11 12:26:55,815 Bacnet server started on: ('0.0.0.0', 47808)
conpot_1  | 2018-05-11 12:26:55,816 IPMI server started on: ('0.0.0.0', 623)
conpot_1  | 2018-05-11 12:26:55,817 handle server PID [    1] running on ('0.0.0.0', 44818)
conpot_1  | 2018-05-11 12:26:55,817 handle server PID [    1] responding to external done/disable signal in object 139801924020384
conpot_1  | 2018-05-11 12:27:00,674 Privileges dropped, running as "nobody:nogroup"
xandfury commented 6 years ago

@sereysethy Warnings are not Conpot related. They are about scapy. Regarding -f option, it is intentional behaviour. It means you are using the testing config bundled with Conpot, which you shouldn't.

xandfury commented 6 years ago

It seems that this issue is resolved (or longer relevant to you). If you need further assistance, feel free to re-open the issue again.