Support MHN Install on Raspberry Pi 4

[himuura]

Just a suggestion, i haven't actually tried because Rpi 4 4Gb are currently out of stock, but when i first experimented with MHN back in 2015, i had a Ubuntu VM as server and a couple of Rpi Zero (the Zero W hadn't came out yet) as probes. The specs on my VM were not actually very different from an Rpi 4 4Gb, the only one i can think of is the higher clock rate but 1.5GHz is actually not bad as it has 4 Cores. So, i pretty much think the installation CAN be made on a Rpi 4 to act as a server for a full RPi honeynet but it would be pretty sweet to have an optimized installation especially for those tremendous PCB's. Other than that, i said it 4 years ago and i'll keep saying it: fantastic work you guys do :) (p.s. i've been referencing MHN to every security colleague i know!)

[himuura]

Or even add support for Docker to run on a pot emulating a Windows operating machine. That'd be sweet!

[d1str0]

I will be receiving a RPi4 shortly and then we can test it.

[himuura]

Well, i've been tinkering with MHN for pi 4 and so far, i just had to change the "install_mongo.sh" script and changed the part where the lsb_release = 18.04 to 10 (Buster release on Pi). The install went through but stopped here:

• python /opt/hpfeeds/broker/add_user.py mnemosyne 232049bd473d4162a00b49d2b3805e75 '' amun.events,conpot.events,thug.events,beeswarm.hive,dionaea.capture,dionaea.connections,thug.files,beeswarn.feeder,cuckoo.analysis,kippo.sessions,cowrie.sessions,glastopf.events,glastopf.files,mwbinary.dionaea.sensorunique,snort.alerts,wordpot.events,p0f.events,suricata.events,shockpot.events,elastichoney.events,drupot.events,agave.events Traceback (most recent call last): File "/opt/hpfeeds/broker/add_user.py", line 29, in res = client.hpfeeds.auth_key.update({"identifier": ident}, {"$set": rec}, upsert=True) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/collection.py", line 3215, in update write_concern, collation=collation) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/collection.py", line 856, in _update_retryable _update, session) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/mongo_client.py", line 1492, in _retryable_write return self._retry_with_session(retryable, func, s, None) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/mongo_client.py", line 1374, in _retry_with_session server = self._select_server(writable_server_selector, session) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/mongo_client.py", line 1254, in _select_server server = topology.select_server(server_selector) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 231, in select_server address)) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 189, in select_servers selector, server_timeout, address) File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 221, in _select_servers_loop self._description.check_compatible() File "/opt/hpfeeds/env/local/lib/python2.7/site-packages/pymongo/topology_description.py", line 125, in check_compatible raise ConfigurationError(self._incompatible_err) pymongo.errors.ConfigurationError: Server at localhost:27017 reports wire version 0, but this version of PyMongo requires at least 2 (MongoDB 2.6).

Any ideas? I think most of the packages are available for Buster, it's just a matter of tinkering with the install script to see what's missing...

[himuura]

It has something to do with mongo version...it only installs v.2.4.XX and 2.6 is required at least...thats why. The thing is, for debian Buster i cannot simply install mongodb 3 or even 4. Searched around, poked a couple of foruns without success. Workaround?

[himuura]

Figured it out for now. I'm forcing mongodb for ubuntu 18.04 and on install_hpfeeds.sh, i'm using pip install pymongo==3.4.0. The script resumed without errors so far...I'm on the python initdatabase.py step. lets see how it goes from here.

[himuura]

UPDATE: Install went through but neither honeymap nor mhn-collector are working. I do have a login page but after login, i get an 500 internal error. Here's the status of supervisorctl:

sudo supervisorctl status geoloc RUNNING pid 1190, uptime 0:00:20 honeymap FATAL can't find command '/opt/honeymap/server/server' hpfeeds-broker RUNNING pid 1188, uptime 0:00:20 mhn-celery-beat RUNNING pid 1187, uptime 0:00:20 mhn-celery-worker RUNNING pid 1192, uptime 0:00:20 mhn-collector FATAL Exited too quickly (process log may have details) mhn-uwsgi RUNNING pid 1191, uptime 0:00:20 mnemosyne RUNNING pid 1189, uptime 0:00:20

Any ideas on how to solve this? I read another thread on the honeymap error but when i execute:

sudo go get /usr/bin/go: 1: /usr/bin/go:ELFP▒: not found /usr/bin/go: 1: /usr/bin/go: Syntax error: ")" unexpected

This is what i got.

[himuura]

mhn.log shows:

sudo tail -1000 /var/log/mhn/mhn.log 2019-09-23 10:14:38,435 - /opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py - Exception on / [GET] Traceback (most recent call last): File "/opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py", line 1982, in wsgi_app response = self.full_dispatch_request() File "/opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py", line 1614, in full_dispatch_request rv = self.handle_user_exception(e) File "/opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py", line 1517, in handle_user_exception reraise(exc_type, exc_value, tb) File "/opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py", line 1612, in full_dispatch_request rv = self.dispatch_request() File "/opt/mhn/env/local/lib/python2.7/site-packages/flask/app.py", line 1598, in dispatch_request return self.view_functionsrule.endpoint File "/opt/mhn/env/local/lib/python2.7/site-packages/flask_login.py", line 792, in decorated_view return func(*args, **kwargs) File "./mhn/ui/views.py", line 60, in dashboard attackcount = clio.session.count(hours_ago=24) File "./mhn/common/clio.py", line 180, in count return self.collection.find(query).count() File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/cursor.py", line 769, in count cmd, self.collation, session=self.session) File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/collection.py", line 1563, in _count with self._socket_for_reads(session) as (sock_info, slave_ok): File "/usr/lib/python2.7/contextlib.py", line 17, in enter return self.gen.next() File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/mongo_client.py", line 1099, in _socket_for_reads server = topology.select_server(read_preference) File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 224, in select_server address)) File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 183, in select_servers selector, server_timeout, address) File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/topology.py", line 209, in _select_servers_loop self._description.check_compatible() File "/opt/mhn/env/local/lib/python2.7/site-packages/pymongo/topology_description.py", line 121, in check_compatible raise ConfigurationError(self._incompatible_err) ConfigurationError: Server at localhost:27017 reports wire version 0, but this version of PyMongo requires at least 2 (MongoDB 2.6).

[Banthex]

Looking in indexes: https://pypi.org/simple, https://www.piwheels.org/simple Requirement already satisfied: virtualenv in /usr/local/lib/python2.7/dist-packages (16.7.7) ++ which virtualenv

• VIRTUALENV=/usr/local/bin/virtualenv
• ldconfig /usr/local/lib/
• bash install_mongo.sh
• '[' -f /etc/debian_version ']' ++ lsb_release -r -s
• '[' 10 == 14.04 ']' ++ lsb_release -r -s
• '[' 10 == 16.04 ']' ++ lsb_release -r -s
• '[' 10 == 18.04 ']'
• echo -e 'ERROR: Unknown OS\nExiting!' ERROR: Unknown OS Exiting!
• exit -1