to do's 18.11 - Githubissues

t3chn0m4g3 commented 6 years ago

[x] move github 18.11 branch => master
[x] move github master => 17.10 branch
[x] RewriteBasePath Kibana
[x] update script needs to ensure data folder presence and correct permissions (create folder map for updater and installer)
[x] dashboards finetuning since kiabana 6.3 introduces lots of whitespace
[x] create docker images from github 18.10 (then master) branch
[x] medpot files, folders, logrotation, maps, viz
[x] remove unused dashboards, objects
[x] visualizations for glutton => experimental (postponed, current log format does not allow for viz)
[x] BUG: SSH Port check for OTC needs to be implemented
[x] BUG: /etc/crontab fix escaping for installer
[x] BUG: Ins ome rare occasions containers are not updated. Nedd to take this into account for update.sh, tped.sh, weekly update (crontab)
[x] BUG: In some rare occasions containers are orphaning. Need to take this into account for update.sh, tped.sh and reboot (docker stop ($docker ps -aq), docker rm $(docker ps -aq))
[x] create edition selection tool to change edition after install
[x] rebuild glastopf, conpot, dionaea images as upstream PRs have been merged
[x] update script (take care of ubuntu versions (block if not supported), packages)
[x] update readme, changes
[x] snare: clone some sites, randomize startup ENV
[x] kibana selected menu item not highlighted
[x] include cyberchef as tool
[x] kibana 6.3 - Telekom logo looks distorted
[x] create test image with latest ubuntu 18.04 betas
[x] include latest ELK versions
[x] add config file for makeiso instead of multiple files
[x] rewrite makeiso with functions
[x] rewrite installer with functions
[x] installer => need a version tag for the updater
[x] replace wetty with docker image, use butlerx's source repo
[x] evaluate to ditch netdata, portainer & wetty for cockpit (https://cockpit-project.org/), previous versions did not work well with NGINX reverse proxy neither Ubuntu, so let's have a go again.
[x] evaluate splitting nginx, wetty from tpot.yml as extra service, so websession does not break
[x] if honeypots only installation do not enable nginx, wetty & do not ask for web creds (edition selection tool needs to be aware of this post-install)
[x] remove authorized_keys enforcement, strict SSH config in favor of fail2ban usage
[x] update visio
[x] update editions / docker-compose.yml
[x] visualizations for snare => experimental
[x] adjust dps.sh accordingly (procps)
[x] adjust viz for cowrie, ports are now tcp/22 and tcp/23
[x] tanner => experimental
[x] snare => experimental
[x] remove procps, bash where possible
[x] increase hardening (refactor ALL Dockerfiles, docker-compose.yml)
[x] Suricata needs DNS resolving for exception rules to work if FQDNs are used.
[x] visualizations for ciscoasa
[x] generate iptables rules from docker-compose.yml
[x] if glutton / honeytrap (NFQ) is not enabled in docker-compose.yml disable iptables at service start
[x] as prepared for s. run conpot in different personas in parallel (log in same folder, different logfiles, use the same conpot viz in kibana)
[x] add cisco asa honeypot
[x] add heralding honeypot (collector installation type)
[x] visualizations for heralding
[x] replace nginx with docker image, ensure ENVs for certain options
[x] support ubuntu 18.04 LTS
[x] glutton => experimental
[x] if low hanging fruit, upgrade elk to 6.x
[x] introduce exec on all Dockerfiles with CMD shell form
[x] where possible / useful increase dynamic options (i.e. ENVs)

UncleRaymondo commented 6 years ago

Update module dependencies where applicable and tested as functioning correctly

pysnmp @ 4.4.4 confirmed working for Conpot honeypot(s)
pysmi @ 0.2.2 confirmed working for Conpot honeypot(s)
Sphinx > 1.5.5 confirmed NOT working when building Conpot honeypot(s) (requires Python >3.5)

UncleRaymondo commented 6 years ago

Cisco ASA Honeypot sounds interesting however this will conflict with Cowrie's SSH and Dionaea's HTTPS in an Everything deployment no?

telekom-security / tpotce

to do's 18.11 #189