search

mushorg / conpot

ICS/SCADA honeypot
GNU General Public License v2.0
1.21k stars 409 forks source link

Conpot in docker-compose does not work with oschameleon #541

Open SubhasisMukh opened 3 years ago

SubhasisMukh commented 3 years ago

I have been using Conpot, for quite a while now. There is also a tool that is used to change the fingerprint of a machine by fooling nmap probes. It is called Oschameleon. Oschameleon flushes iptables in the machine it is being run. Now, when I run Conpot by using docker-compose along with Oschameleon in the same machine, one of them (either Conpot or Oschameleon) does not work. I am assuming it is because of oschameleon flushing IPtables regularly and docker-compose using it to map system ports to docker ports. However, when I install Conpot in the machine, it works smoothly with Oschameleon.

Is there any way of running Conpot in docker-compose as well as oschameleon in the same machine?

I posted this in Superuser too, check it out here

glaslos commented 3 years ago

Can you specify what you mean with "one of them [...] does not work"? Did you verify your assumption regarding the iptables rules? Seems like this is a weakness of OSChameleon assuming nobody else is using iptables. This could be solved in OSChameleon by only flushing its own rules instead of doing a full flush. I haven't been working on OSChameleon for a long time, so you might have to figure it out by yourself.