rezafathikohi commented 3 years ago

Hello,

I installed tpot on ESXI 6.5 and after installation there is no ip for web and admin on the first page and nothing works. please help me to solve it. Thanks

Before you post your issue make sure it has not been answered yet and provide basic support information if you come to the conclusion it is a new issue.

🔍 Use the search function first
🧐 Check our WIKI
📚 Consult the documentation of 💻 Debian, 🐳 Docker, the 🦌 ELK stack and the 🍯 T-Pot Readme.
⚠️ Provide basic support information or similiar information with regard to your issue or we can not help you and will close the issue without further notice

⚠️ Basic support information (commands are expected to run as `root`)

What version of the OS are you currently using lsb_release -a and uname -a? [tsec@inherentcomradeship:/]$ lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 10 (buster) Release: 10 Codename: buster

[tsec@inherentcomradeship:/]$ uname -a Linux inherentcomradeship 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 GNU/Linux

What T-Pot version are you currently using? T-Pot 20.06.1
What edition (Standard, Nextgen, etc.) of T-Pot are you running? Standard
What architecture are you running on (i.e. hardware, cloud, VM, etc.)? -ESXI 6.5
Did you have any problems during the install? If yes, please attach /install.log /install.err. [tsec@inherentcomradeship:~]$ cat /install.log

| | | |_ | | ()
| || ' \/ | / | | | | '_ \ / _ |
| || | | _ \ || (| | | | | | | | (| | |__|| ||/__,||||| ||_, | (||) |___/

Determine fastest mirror for your location.

Automatic mirror selection failed, using main mirror.

deb http://deb.debian.org/debian stable main contrib non-free deb-src http://deb.debian.org/debian stable main contrib non-free

Getting update information.

Get:1 http://deb.debian.org/debian stable InRelease [121 kB] Get:2 http://deb.debian.org/debian stable/contrib Sources [42.5 kB] Get:3 http://deb.debian.org/debian stable/main Sources [7,842 kB] Get:4 http://deb.debian.org/debian stable/non-free Sources [85.6 kB] Get:5 http://deb.debian.org/debian stable/main amd64 Packages [7,907 kB] Get:6 http://deb.debian.org/debian stable/main Translation-en [5,971 kB] Get:7 http://deb.debian.org/debian stable/contrib amd64 Packages [50.2 kB] Get:8 http://deb.debian.org/debian stable/contrib Translation-en [44.2 kB] Get:9 http://deb.debian.org/debian stable/non-free amd64 Packages [87.7 kB] Get:10 http://deb.debian.org/debian stable/non-free Translation-en [88.8 kB] Fetched 22.2 MB in 1min 19s (283 kB/s) Reading package lists...

Upgrading packages.

[apt-fast 18:04:46] [apt-fast 18:04:46]Working... this may take a while. Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Installing T-Pot dependencies.

[apt-fast 18:04:47] [apt-fast 18:04:47]Working... this may take a while.

Removing and holding back problematic packages ...

Reading package lists... Building dependency tree... Reading state information... Package 'cockpit-pcp' is not installed, so not removed Package 'elasticsearch-curator' is not installed, so not removed Package 'exim4-base' is not installed, so not removed Package 'mailutils' is not installed, so not removed Package 'pcp' is not installed, so not removed 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Reading package lists... Building dependency tree... Reading state information... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. exim4-base set on hold. mailutils set on hold. pcp set on hold. cockpit-pcp set on hold. elasticsearch-curator set on hold.

\ \ / /| | | |_ \ \ /\ / / \ ' | | | / |/ _ \ '| / | '/ \/ ` / | \ V V / / |) | || __ \ / | | (| | | / (| _ \ _/_/ _|./ \,|/\|_| _|| \|_,|___/

| \ | |/ | | \ | \ \/ / / | | |()/ () _ _ | | | | | | | || | |\ / | | / \ '| | | |_| |/ / _` | / \ | |\ | || || || |\ |/ \ | || / | | || | | | (| (| | || / || _|____||| _//_\ _\|| _||| ||_\,|_____|

| _| _ _ _ | | _ / () | | \ \/ / ` | ' _ \| '_ \| |/ _ \ / __/ _ \| '_ \| |_| |/ _ | | | > < (| | | | | | | |_) | | _/ | (| () | | | | | | (_| | |___//__,|| || || ./||\| __/|| ||| ||_, | || |___/

Example static ip config

Replace with the name of your physical interface name

#

auto eth0

iface eth0 inet static

address 192.168.1.1

netmask 255.255.255.0

network 192.168.1.0

broadcast 192.168.1.255

gateway 192.168.1.1

dns-nameservers 192.168.1.1

Example wireless config without 802.1x

This configuration was tested with the IntelNUC series

If problems occur you can try and change wpa-driver to "iwlwifi"

#

auto wlan0

iface wlan0 inet dhcp

wpa-driver wext

wpa-ssid

wpa-ap-scan 1

wpa-proto RSN

wpa-pairwise CCMP

wpa-group CCMP

wpa-key-mgmt WPA-PSK

wpa-psk ""

/ / || | | | () __ / |/ | \ _ | |_| | | '/ \ / | '_ | | ' \ / ` | / | || | _) |_) | | | | | () | (| | | | | | | | | | | (| | | () | | | |__/_/|| || || _/ _,|| || |||| ||__, | __/|| |_|
|___/
UseRoaming no

| | | |_ | | () _ | | __ _ __ | || ' \/ | / ` | | | | ' \ / ` | | ' | |/ / ` / | | || | | \ \ || (| | | | | | | | (| | | |) | < (| _ \ |_|| ||/__,||||| ||_, | | ./||\\, |_/ |_/ || |/

/ | _ _ | | | | | '/ \/ _` | / _ \ | | | / _|/ \ '| | |_| | | _/ (| | || / | || _ \ / |
___|| _|_,|__| \,|/\|_|

Adding group tpot' (GID 2000) ... Done. Adding system usertpot' (UID 2000) ... Adding new user tpot' (UID 2000) with grouptpot' ... Not creating home directory `/home/tpot'.

/ | | | | | | | _ _ \ \ / _ \ | | ' \ / \/ | | ' \ / | '_ \ / \ _) | / | | | | | () _ \ || | | | (_| | | | | | | / |__/ _|_| || ||_/|/_|| ||_,|| || ||___|

_       _  _           _                      _

/ \ | |() | | __ | |_ / \ / ` || | | | / | | | ' \ / _ | '| / _| / \ (| || | || _ \ | | |) | () | | | |_ \ // __,|/ |_,_|/_| | ._/ \/|| _|/ |/ ||
[Socket] ListenStream= ListenStream=64294

Port 64295

/ | |/ \ | \ | | \ / \ | | \ _ \ | | / \ | | | | | |/ \ | |_) | | | | ) || |/ | |\ | |_| / | <| || | |____/ |// __| \|__// __| \____/

| \ | | | () _ _ | |) | | | | | | | | ' _ \ / _ |/ ` |/ \/ | | /| || | | | | | | | | | | (| | (| | /\ \ || _,||| ||| || ||_,|_, |_||/ |___/

| \/ | _ _| ()/ | | | __ | | __ | |\/| |/ \ / ` | | || | | | / | ' \ / \/ | |/ / | | | | | () | (| | | | || | | (| | | | / (| <_ \ || ||\/ _,||| __, | _|| ||_|_||_\/ |___/
APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Download-Upgradeable-Packages "0"; APT::Periodic::AutocleanInterval "7";

| | ____ _| | _ | || | | | \ \ /\ / / \/ _` | |/ / / | | | / |/ | | | | | \ V V / / (| | < _ \ || _ \ (_| || | || _/_/ \|_,||\\ |/_, |_/_|\|_| |___/

Reboot after kernel panic, check via /proc/sys/kernel/panic[_on_oops]

Set required map count for ELK

kernel.panic = 1 kernel.panic_on_oops = 1 vm.max_map_count = 262144 net.ipv6.conf.all.disable_ipv6 = 1 net.ipv6.conf.default.disable_ipv6 = 1 net.ipv6.conf.lo.disable_ipv6 = 1

/ | | | / _| _ () | | |
_ \ / _ \ | | | | ' \ | | / _| | | __) | '_ \ / _ | '_ \ ) | / || || | |) | | | (| | | |/ /| |) | (| | | | | |_/ \|_|_,_| ./ || _,|||____|_./ _,|| || |_|
[DEFAULT] ignore-ip = 127.0.0.1/8 bantime = 3600 findtime = 600 maxretry = 5

[nginx-http-auth] enabled = true filter = nginx-http-auth port = 64297 logpath = /data/nginx/log/error.log

[pam-generic] enabled = true port = 64294 filter = pam-generic logpath = /var/log/auth.log

[sshd] enabled = true port = 64295 filter = sshd logpath = /var/log/auth.log

/ | | |_ _ _| | / () _ | | | / | / \ ' _ \ / _ | | || \ \/ / ) | || _ \ || / | | | | | (| | | | |> < |__/ __, |/__|| || ||_,| || |//_\ |___/
[Link] NamePolicy=kernel database onboard slot path MACAddressPolicy=none

_       _     _                         _       _

/ \ | | | | (_) _ | |_ / \ / |/ _ | / | '/ | ' \ | |/ | ' \/ | / \ (| | (_| | | (| | | () | | | || | () | |) _ \ // \\,_|\,| \|_| _/|| ||/ |_/|./|/ |__/

Check if updated images are available and download them

9 9 * root docker-compose -f /opt/tpot/etc/tpot.yml pull

Delete elasticsearch logstash indices older than 90 days

9 12 * root curator --config /opt/tpot/etc/curator/curator.yml /opt/tpot/etc/curator/actions.yml

Uploaded binaries are not supposed to be downloaded

/1 root mv --backup=numbered /data/dionaea/roots/ftp/ /data/dionaea/binaries/

Daily reboot

9 11 1-6 root systemctl stop tpot && docker stop $(docker ps -aq) || docker rm $(docker ps -aq) || reboot

Check for updated packages every sunday, upgrade and reboot

9 11 0 root apt-fast autoclean -y && apt-fast autoremove -y && apt-fast update -y && apt-fast upgrade -y && sleep 10 && reboot

| () | __ ( ) / | _ | | _| | | | | | |/ \/ | / \/\ | | / | |/ ` |/ \ '/ | | | | | | /_ \ | (> < | | () | | (| | / | \ \ || |||_||__/ \/\/ |_| _/||_,|\|_| |___/

mkdir: created directory '/data/adbhoney' mkdir: created directory '/data/adbhoney/downloads' mkdir: created directory '/data/adbhoney/log' mkdir: created directory '/data/ciscoasa' mkdir: created directory '/data/ciscoasa/log' mkdir: created directory '/data/conpot' mkdir: created directory '/data/conpot/log' mkdir: created directory '/data/citrixhoneypot' mkdir: created directory '/data/citrixhoneypot/logs' mkdir: created directory '/data/cowrie' mkdir: created directory '/data/cowrie/downloads' mkdir: created directory '/data/cowrie/keys' mkdir: created directory '/data/cowrie/misc' mkdir: created directory '/data/cowrie/log' mkdir: created directory '/data/cowrie/log/tty' mkdir: created directory '/data/dicompot' mkdir: created directory '/data/dicompot/images' mkdir: created directory '/data/dicompot/log' mkdir: created directory '/data/dionaea' mkdir: created directory '/data/dionaea/log' mkdir: created directory '/data/dionaea/bistreams' mkdir: created directory '/data/dionaea/binaries' mkdir: created directory '/data/dionaea/rtp' mkdir: created directory '/data/dionaea/roots' mkdir: created directory '/data/dionaea/roots/ftp' mkdir: created directory '/data/dionaea/roots/tftp' mkdir: created directory '/data/dionaea/roots/www' mkdir: created directory '/data/dionaea/roots/upnp' mkdir: created directory '/data/elasticpot' mkdir: created directory '/data/elasticpot/log' mkdir: created directory '/data/elk' mkdir: created directory '/data/elk/data' mkdir: created directory '/data/elk/log' mkdir: created directory '/data/fatt' mkdir: created directory '/data/fatt/log' mkdir: created directory '/data/honeytrap' mkdir: created directory '/data/honeytrap/log' mkdir: created directory '/data/honeytrap/attacks' mkdir: created directory '/data/honeytrap/downloads' mkdir: created directory '/data/glutton' mkdir: created directory '/data/glutton/log' mkdir: created directory '/data/heralding' mkdir: created directory '/data/heralding/log' mkdir: created directory '/data/honeypy' mkdir: created directory '/data/honeypy/log' mkdir: created directory '/data/honeysap' mkdir: created directory '/data/honeysap/log' mkdir: created directory '/data/ipphoney' mkdir: created directory '/data/ipphoney/log' mkdir: created directory '/data/mailoney' mkdir: created directory '/data/mailoney/log' mkdir: created directory '/data/medpot' mkdir: created directory '/data/medpot/log' mkdir: created directory '/data/nginx/log' mkdir: created directory '/data/nginx/heimdall' mkdir: created directory '/data/emobility' mkdir: created directory '/data/emobility/log' mkdir: created directory '/data/ews' mkdir: created directory '/data/ews/conf' mkdir: created directory '/data/rdpy' mkdir: created directory '/data/rdpy/log' mkdir: created directory '/data/spiderfoot' mkdir: created directory '/data/suricata' mkdir: created directory '/data/suricata/log' mkdir: created directory '/data/tanner' mkdir: created directory '/data/tanner/log' mkdir: created directory '/data/tanner/files' mkdir: created directory '/data/p0f' mkdir: created directory '/data/p0f/log' mkdir: created directory '/home/tsec/.ssh/'

/ | _ __ _ / () _ | | / | '_ | | | | / / | ' | || |/ ` / | | |_| () | |) | || | | (| () | | | | | | (| _ \ ____\/| ./ _, | \_/|| ||| ||_, |/ |_| |/ |/
data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/_state/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/_state/retention-leases-93.st data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/_state/state-1.st data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/translog/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/translog/translog-5.tlog data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/translog/translog.ckp data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6q.si data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.fdx data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.fnm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6q.cfe data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m.cfe data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6n.cfs data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.kdd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m_1_Lucene80_0.dvd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene84_0.tip data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_4_Lucene80_0.dvd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene84_0.tim data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6q.cfs data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene84_0.tmd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6n.cfe data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.nvm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m.si data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m.cfs data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene84_0.doc data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene80_0.dvd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/segments_5 data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene84_0.pos data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.si data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.kdi data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m_1.fnm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.kdm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_4.fnm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.fdt data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_Lucene80_0.dvm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.nvd data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6n.si data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l_4_Lucene80_0.dvm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/write.lock data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6m_1_Lucene80_0.dvm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/0/index/_6l.fdm data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/_state/ data/elk/data/nodes/0/indices/VMOHKVEXR22sT6GUuszIrA/_state/state-9.st

| _ \ (_) (_) | |) / _ \ '| ' ` | / / | |/ | ' \/ | | / / | | | | | | | _ _ \ | () | | | _ \ || \|| || || ||_|//_|__/|| |_|___/

/ \ | |() __ | | | | ' | | |/ | ' \/ | | || | |) | || | () | | | _ \ \/| ./ _||_/|| ||__/ ||

/ | | | __ | | _ \ / _ \ _| | | | ' \ / / | ' \/ |/ | |/ \ _) | _/ || || | |) | | (| () | | | \ \ (_) | | / |_/ \|_|_,| ./ \_/|| ||__/\/|_|__| ||
update-initramfs: Generating /boot/initrd.img-4.19.0-13-amd64

/ | | | _ _ | |_ _ \ / _ \ | | | | ' \ | ' | '/ | ' ` | ' | _| ) | / || || | |) | | |) | | | () | | | | | | |) | | |____/ \|_|_,| ./ | ./|| __/|| || || ./ \| || || |_|
[[ $- == i ]] || return PS1="[\033[38;5;8m][[$(tput sgr0)][\033[38;5;1m]\u[$(tput sgr0)][\033[38;5;6m]@[$(tput sgr0)][\033[38;5;4m]\h[$(tput sgr0)][\033[38;5;6m]:[$(tput sgr0)][\033[38;5;5m]\w[$(tput sgr0)][\033[38;5;8m]][$(tput sgr0)][\033[38;5;1m]\$[$(tput sgr0)][\033[38;5;15m] [$(tput sgr0)]" export LS_OPTIONS='--color=auto' eval "dircolors" alias ls='ls $LS_OPTIONS' alias ll='ls $LS_OPTIONS -l' alias l='ls $LS_OPTIONS -lA' PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/tpot/bin" [[ $- == i ]] || return PS1="[\033[38;5;8m][[$(tput sgr0)][\033[38;5;2m]\u[$(tput sgr0)][\033[38;5;6m]@[$(tput sgr0)][\033[38;5;4m]\h[$(tput sgr0)][\033[38;5;6m]:[$(tput sgr0)][\033[38;5;5m]\w[$(tput sgr0)][\033[38;5;8m]][$(tput sgr0)][\033[38;5;2m]\$[$(tput sgr0)][\033[38;5;15m] [$(tput sgr0)]" PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/tpot/bin"

| | | |_ | | | | _ | | \ | | | | ' \ / ` |/ ` | / \ | || |) | | || | |) | (| | (| | || / | || / _/| ./ _,|_,|_\| |__||
|_|
[MAIN] ip = 91.241.21.75 HONEY_UUID=8eed70ea-95fc-4d96-98f5-13414a2e061a MY_EXTIP=91.241.21.75 MY_INTIP=192.162.100.87 MY_HOSTNAME=inherentcomradeship

/ | | _
| | | |/ \/ ` | ' \ | | | | ' \ | |_| | _/ (| | | | | | || | |) | __||\|_,|| || _,| ._/ ||
Reading package lists... Building dependency tree... Reading state information... Reading package lists... Building dependency tree... Reading state information... 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

| _ \ _| |_ | |()
| |) / \ ' \ / \ / | | | ' \ / ` |
| _ < / |) | () | () | || | | | | (| | || _\|./ \/ _/ _||| ||\, | (||_) |___/
[tsec@inherentcomradeship:~]$

[tsec@inherentcomradeship:~]$ cat /install.err Using distribution stable. Retrieving the list of mirrors from www.debian.org...

--2020-12-18 17:59:18-- http://www.debian.org/mirror/mirrors_full Resolving www.debian.org (www.debian.org)... 149.20.4.15, 128.31.0.62, 130.89.148.77, ... Connecting to www.debian.org (www.debian.org)|149.20.4.15|:80... connected. HTTP request sent, awaiting response... 302 Found Location: https://www.debian.org/mirror/mirrors_full [following] --2020-12-18 17:59:23-- https://www.debian.org/mirror/mirrors_full Connecting to www.debian.org (www.debian.org)|149.20.4.15|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 163982 (160K) [text/html] Saving to: ‘/tmp/netselect-apt.ZAeTVp’

 0K .......... .......... .......... .......... .......... 31% 67.1K 2s
50K .......... .......... .......... .......... .......... 62%  196K 1s

100K .......... .......... .......... .......... .......... 93% 62.8K 0s 150K .......... 100% 41.1M=1.8s

2020-12-18 17:59:27 (89.1 KB/s) - ‘/tmp/netselect-apt.ZAeTVp’ saved [163982/163982]

Choosing a main Debian mirror using netselect. netselect: 345 (23 active) nameserver request(s)...
Duplicate address 93.187.162.100 (http://ftp.am.debian.org/debian/, http://mirrors.asnet.am/debian/); keeping only under first name. netselect: 341 (24 active) nameserver request(s)...
Duplicate address 212.50.0.19 (http://debian.mobiltel.bg/debian/, http://ftp.bg.debian.org/debian/); keeping only under first name. netselect: 335 (22 active) nameserver request(s)...
Duplicate address 195.234.45.114 (http://mirror.as35701.net/debian/, http://ftp.be.debian.org/debian/); keeping only under first name. netselect: 332 (24 active) nameserver request(s)...
Duplicate address 150.203.164.37 (http://mirror.linux.org.au/debian/, http://ftp.au.debian.org/debian/); keeping only under first name. netselect: 324 (23 active) nameserver request(s)...
Duplicate address 207.210.46.249 (http://debian.mirror.rafal.ca/debian/, http://ftp.ca.debian.org/debian/); keeping only under first name. netselect: 313 (24 active) nameserver request(s)...
Duplicate address 213.129.232.18 (http://debian.sil.at/debian/, http://ftp.at.debian.org/debian/); keeping only under first name. netselect: 298 (24 active) nameserver request(s)...
Duplicate address 78.128.211.127 (http://ftp.debian.cz/debian/, http://ftp.cz.debian.org/debian/); keeping only under first name. netselect: 296 (22 active) nameserver request(s)... Duplicate address 141.76.2.4 (http://ftp.de.debian.org/debian/, http://debian.inf.tu-dresden.de/debian/); keeping only under first name. netselect: 294 (23 active) nameserver request(s)...
Duplicate address 200.75.30.181 (http://ftp.cl.debian.org/debian/, http://200.75.30.181/debian/); keeping only under first name. netselect: 292 (24 active) nameserver request(s)...
Duplicate address 200.236.31.3 (http://ftp.br.debian.org/debian/, http://debian.c3sl.ufpr.br/debian/); keeping only under first name. netselect: 270 (23 active) nameserver request(s)...
Duplicate address 82.209.230.71 (http://ftp.by.debian.org/debian/, http://ftp.byfly.by/debian/); keeping only under first name. netselect: 256 (23 active) nameserver request(s)...
Duplicate address 130.225.254.116 (http://ftp.dk.debian.org/debian/, http://mirrors.dotsrc.org/debian/); keeping only under first name. netselect: 250 (22 active) nameserver request(s)...
Duplicate address 137.226.34.46 (http://ftp.halifax.rwth-aachen.de/debian/, http://ftp2.de.debian.org/debian/); keeping only under first name. netselect: 247 (22 active) nameserver request(s)...
Duplicate address 129.132.53.171 (http://ftp.ch.debian.org/debian/, http://debian.ethz.ch/debian/); keeping only under first name. netselect: 239 (24 active) nameserver request(s)...
Duplicate address 212.27.32.66 (http://debian.proxad.net/debian/, http://ftp.fr.debian.org/debian/); keeping only under first name. netselect: 225 (23 active) nameserver request(s)...
Duplicate address 45.125.0.6 (http://ftp.cn.debian.org/debian/, http://ftp2.cn.debian.org/debian/); keeping only under first name. netselect: 200 (21 active) nameserver request(s)...
Duplicate address 193.40.0.5 (http://ftp.eenet.ee/debian/, http://ftp.ee.debian.org/debian/); keeping only under first name. netselect: 200 (24 active) nameserver request(s)... Duplicate address 45.125.0.6 (http://ftp.cn.debian.org/debian/, http://mirror.xtom.com.hk/debian/); keeping only under first name. netselect: 198 (22 active) nameserver request(s)...
Duplicate address 82.194.78.250 (http://ulises.hostalia.com/debian/, http://ftp.es.debian.org/debian/); keeping only under first name. netselect: 182 (24 active) nameserver request(s)...
Duplicate address 78.129.164.123 (http://free.hands.com/debian/, http://ftp.uk.debian.org/debian/); keeping only under first name. netselect: 179 (21 active) nameserver request(s)... Duplicate address 78.129.164.123 (http://free.hands.com/debian/, http://ftp.is.debian.org/debian/); keeping only under first name. netselect: 167 (21 active) nameserver request(s)...
Duplicate address 147.102.222.211 (http://ftp.gr.debian.org/debian/, http://debian.noc.ntua.gr/debian/); keeping only under first name. netselect: 166 (23 active) nameserver request(s)...
Duplicate address 45.125.0.6 (http://ftp.cn.debian.org/debian/, http://ftp.hk.debian.org/debian/); keeping only under first name. netselect: 162 (22 active) nameserver request(s)...
Duplicate address 161.53.160.11 (http://ftp.hr.debian.org/debian/, http://debian.carnet.hr/debian/); keeping only under first name. netselect: 160 (24 active) nameserver request(s)...
Duplicate address 195.228.252.133 (http://ftp.fsn.hu/debian/, http://ftp.hu.debian.org/debian/); keeping only under first name. netselect: unknown host mirror.positive-internet.com
netselect: 143 (23 active) nameserver request(s)...
Duplicate address 85.94.199.210 (http://ftp.linux.it/debian/, http://ftp.it.debian.org/debian/); keeping only under first name. netselect: unknown host kartolo.sby.datautama.net.id
netselect: 138 (23 active) nameserver request(s)...
Duplicate address 178.17.160.48 (http://ftp.md.debian.org/debian/, http://mirror.as43289.net/debian/); keeping only under first name. netselect: 135 (22 active) nameserver request(s)...
Duplicate address 133.5.166.3 (http://dennou-q.gfd-dennou.org/debian/, http://ftp.jp.debian.org/debian/); keeping only under first name. netselect: 123 (23 active) nameserver request(s)...
Duplicate address 103.22.220.133 (http://ftp.kr.debian.org/debian/, http://ftp.kaist.ac.kr/debian/); keeping only under first name. netselect: 119 (22 active) nameserver request(s)...
Duplicate address 130.89.149.21 (http://debian.snt.utwente.nl/debian/, http://ftp.nl.debian.org/debian/); keeping only under first name. netselect: 115 (23 active) nameserver request(s)...
Duplicate address 158.129.159.169 (http://debian.mirror.vu.lt/debian/, http://ftp.lt.debian.org/debian/); keeping only under first name. netselect: 88 (23 active) nameserver request(s)...
Duplicate address 163.7.134.112 (http://ftp.nz.debian.org/debian/, http://mirror.fsmg.org.nz/debian/); keeping only under first name. netselect: 87 (23 active) nameserver request(s)... Duplicate address 129.240.118.47 (http://ftp.uio.no/debian/, http://ftp.no.debian.org/debian/); keeping only under first name. netselect: 81 (24 active) nameserver request(s)...
Duplicate address 103.2.186.81 (http://103.2.186.81/debian/, http://103.2.186.81/debian/); keeping only under first name. netselect: 79 (22 active) nameserver request(s)... Duplicate address 103.2.186.80 (http://103.2.186.80/debian/, http://103.2.186.80/debian/); keeping only under first name. netselect: 78 (24 active) nameserver request(s)...
Duplicate address 194.71.11.165 (http://194.71.11.165/debian/, http://194.71.11.165/debian/); keeping only under first name. netselect: 76 (22 active) nameserver request(s)... Duplicate address 194.71.11.173 (http://194.71.11.173/debian/, http://194.71.11.173/debian/); keeping only under first name. netselect: 74 (23 active) nameserver request(s)...
Duplicate address 194.71.11.173 (http://194.71.11.173/debian/, http://194.71.11.173/debian/); keeping only under first name. netselect: 73 (23 active) nameserver request(s)... Duplicate address 194.71.11.165 (http://194.71.11.165/debian/, http://194.71.11.165/debian/); keeping only under first name. netselect: 72 (23 active) nameserver request(s)...
Duplicate address 213.129.232.18 (http://debian.sil.at/debian/, http://ftp.si.debian.org/debian/); keeping only under first name. netselect: 53 (23 active) nameserver request(s)...
Duplicate address 193.140.98.183 (http://ftp.linux.org.tr/debian/, http://ftp.tr.debian.org/debian/); keeping only under first name. netselect: 50 (23 active) nameserver request(s)...
Duplicate address 176.31.102.224 (http://176.31.102.224/debian/, http://176.31.102.224/debian/); keeping only under first name. netselect: 50 (24 active) nameserver request(s)... Duplicate address 176.9.122.183 (http://176.9.122.183/debian/, http://176.9.122.183/debian/); keeping only under first name. netselect: 47 (23 active) nameserver request(s)...
Duplicate address 193.136.216.34 (http://ftp.pt.debian.org/debian/, http://debian.uevora.pt/debian/); keeping only under first name. netselect: 33 (21 active) nameserver request(s)...
Duplicate address 85.143.112.112 (http://mirror.mephi.ru/debian/, http://ftp.ru.debian.org/debian/); keeping only under first name. netselect: 25 (24 active) nameserver request(s)...
Duplicate address 195.80.174.186 (http://ftp.debian.sk/debian/, http://ftp.sk.debian.org/debian/); keeping only under first name. netselect: 16 (16 active) nameserver request(s)...
Duplicate address 140.110.240.80 (http://opensource.nchc.org.tw/debian/, http://ftp.tw.debian.org/debian/); keeping only under first name. netselect: 9 (9 active) nameserver request(s).....
Duplicate address 64.50.236.52 (http://64.50.236.52/debian/, http://64.50.236.52/debian/); keeping only under first name. netselect: 6 (6 active) nameserver request(s)...
Duplicate address 208.80.154.15 (http://208.80.154.15/debian/, http://mirrors.wikimedia.org/debian/); keeping only under first name. Running netselect to choose 10 out of 344 addresses.

Did not found any valid hosts (you requested 10) netselect was unable to find a mirror, this probably means that you are behind a firewall and it is blocking ICMP and/or UDP traceroute. Or the servers test are actively blocking ICMP and/or UDP traceroute probes. info: Trying to set 'docker.io/restart' [boolean] to 'true' info: Loading answer for 'docker.io/restart' info: Trying to set 'debconf/frontend' [select] to 'noninteractive' info: Loading answer for 'debconf/frontend' W: --force-yes is deprecated, use one of the options starting with --allow instead. W: --force-yes is deprecated, use one of the options starting with --allow instead. E: Unable to correct problems, you have held broken packages. [apt-fast 18:04:47]Package manager quit with exit code. Adding password for user rezafathi Generating a RSA private key ......................+++ ................................................................................................................................................................................................................................................................................................................................................................+++ writing new private key to '/data/nginx/cert/nginx.key'

./install.sh: line 699: npm: command not found ./install.sh: line 700: pip3: command not found sed: can't read /etc/pam.d/cockpit: No such file or directory ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found ./install.sh: line 770: docker: command not found tee: /etc/fail2ban/jail.d/tpot.conf: No such file or directory Created symlink /etc/systemd/system/multi-user.target.wants/tpot.service → /etc/systemd/system/tpot.service. Generating grub configuration file ... Found linux image: /boot/vmlinuz-4.19.0-13-amd64 Found initrd image: /boot/initrd.img-4.19.0-13-amd64 done Trying: curl -s eth0.me Trying: curl -s ipinfo.io/ip [tsec@inherentcomradeship:~]$

How long has your installation been running? 10 hours
Did you install upgrades, packages or use the update script? No
Did you modify any scripts or configs? If yes, please attach the changes. No
Please provide a screenshot of glances and htop. Command Not Found
How much free disk space is available (df -h)?

[tsec@inherentcomradeship:~]$ df -h Filesystem Size Used Avail Use% Mounted on udev 5.9G 0 5.9G 0% /dev tmpfs 1.2G 8.6M 1.2G 1% /run /dev/sda2 238G 1.2G 225G 1% / tmpfs 5.9G 0 5.9G 0% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock tmpfs 5.9G 0 5.9G 0% /sys/fs/cgroup tmpfs 1.2G 0 1.2G 0% /run/user/1000 [tsec@inherentcomradeship:~]$

What is the status of the T-Pot service (systemctl status tpot)?

[tsec@inherentcomradeship:/]$ systemctl status tpot ● tpot.service - tpot Loaded: loaded (/etc/systemd/system/tpot.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Fri 2020-12-18 18:08:51 UTC; 27min ago Process: 349 ExecStartPre=/opt/tpot/bin/updateip.sh (code=exited, status=0/SUCCESS) Process: 454 ExecStartPre=/bin/bash -c /opt/tpot/bin/clean.sh on (code=exited, status=0/SUCCESS) Process: 500 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml down -v (code=exited, status=0/SUCCESS) Process: 501 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml rm -v (code=exited, status=0/SUCCESS) Process: 502 ExecStartPre=/bin/bash -c docker network rm $(docker network ls -q) (code=exited, status=127) Process: 504 ExecStartPre=/bin/bash -c docker volume rm $(docker volume ls -q) (code=exited, status=127) Process: 506 ExecStartPre=/bin/bash -c docker rm -v $(docker ps -aq) (code=exited, status=127) Process: 508 ExecStartPre=/bin/bash -c docker rmi $(docker images | grep "" | awk '{print $3}') (code=exited, status=127) Process: 513 ExecStartPre=/bin/bash -c /sbin/ethtool --offload $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d [:punct:]) rx off tx off (code=exited Process: 519 ExecStartPre=/bin/bash -c /sbin/ethtool -K $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d [:punct:]) gso off gro off (code=exited, sta Process: 525 ExecStopPost=/opt/tpot/bin/rules.sh /opt/tpot/etc/tpot.yml unset (code=exited, status=0/SUCCESS) lines 1-14/14 (END)

What ports are being occupied? Stop T-Pot systemctl stop tpot and run netstat -tulpen

[tsec@inherentcomradeship:/]$ netstat -tulpen (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 0.0.0.0:64295 0.0.0.0: LISTEN 0 13862 -
tcp6 0 0 :::64295 ::: LISTEN 0 13864 -
udp 0 0 0.0.0.0:68 0.0.0.0:* 0 13083 -
[tsec@inherentcomradeship:/]$

If a single container shows as DOWN you can run docker logs <container-name> for the latest log entries

t3chn0m4g3 commented 3 years ago

During installation Debian was unable to find docker.io on the mirror. If the ISO install dies not work for you you can follow the Readme and install on top of a freshly installed Debian.

rezafathikohi commented 3 years ago

I managed to get it to work with enabling ICMP and Traceroute. But I update the tpot with /opt/tpot/update.sh -y command and it did updated but when i run the Systemctl status tpot it shows like this:

I can access the tpot on port 64297 and 64294
But I can not access it from different subnet
Attacks showed in dashboard are decreasing

● tpot.service - tpot Loaded: loaded (/etc/systemd/system/tpot.service; enabled; vendor preset: enabled) Active: active (running) since Sat 2020-12-19 21:28:59 UTC; 7h ago Process: 855 ExecStartPre=/opt/tpot/bin/updateip.sh (code=exited, status=0/SUCCESS) Process: 894 ExecStartPre=/bin/bash -c /opt/tpot/bin/clean.sh on (code=exited, status=0/SUCCESS) Process: 1089 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml down -v (code=exited, status=0/SUCCESS) Process: 1092 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml rm -v (code=exited, status=0/SUCCESS) Process: 1095 ExecStartPre=/bin/bash -c docker network rm $(docker network ls -q) (code=exited, status=1/FAILURE) Process: 1114 ExecStartPre=/bin/bash -c docker volume rm $(docker volume ls -q) (code=exited, status=1/FAILURE) Process: 1133 ExecStartPre=/bin/bash -c docker rm -v $(docker ps -aq) (code=exited, status=1/FAILURE) Process: 1152 ExecStartPre=/bin/bash -c docker rmi $(docker images | grep "" | awk '{print $3}') (code=exited, status=1/FAILURE) Process: 1173 ExecStartPre=/bin/bash -c /sbin/ethtool --offload $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d [:punct:]) rx off tx off (code=exited, status=0/S Process: 1179 ExecStartPre=/bin/bash -c /sbin/ethtool -K $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d [:punct:]) gso off gro off (code=exited, status=0/SUCCES Process: 1185 ExecStartPre=/bin/bash -c /sbin/ip link set $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d [:punct:]) promisc on (code=exited, status=0/SUCCESS) Process: 1191 ExecStartPre=/opt/tpot/bin/rules.sh /opt/tpot/etc/tpot.yml set (code=exited, status=0/SUCCESS) Main PID: 1267 (docker-compose) Tasks: 35 (limit: 4915) Memory: 497.5M CGroup: /system.slice/tpot.service └─1267 /usr/bin/python3 /usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml up --no-color

t3chn0m4g3 commented 3 years ago

Looks perfectly fine. If you cannot access it from a different subnet, make sure your networking is setup correctly.

Closing this, since T-Pot logs show it works as designed.

saad1039 commented 1 year ago

plz help it don't have ip I don't understand what's wrong I changed the network setting s but still it doesn't work.

telekom-security / tpotce

No ip is shown after install #740

⚠️ Basic support information (commands are expected to run as `root`)

Determine fastest mirror for your location.

Automatic mirror selection failed, using main mirror.

Getting update information.

Upgrading packages.

Installing T-Pot dependencies.

Removing and holding back problematic packages ...

Example static ip config

Replace with the name of your physical interface name

auto eth0

iface eth0 inet static

address 192.168.1.1

netmask 255.255.255.0

network 192.168.1.0

broadcast 192.168.1.255

gateway 192.168.1.1

dns-nameservers 192.168.1.1

Example wireless config without 802.1x

This configuration was tested with the IntelNUC series

If problems occur you can try and change wpa-driver to "iwlwifi"

auto wlan0

iface wlan0 inet dhcp

wpa-driver wext

wpa-ssid

wpa-ap-scan 1

wpa-proto RSN

wpa-pairwise CCMP

wpa-group CCMP

wpa-key-mgmt WPA-PSK

wpa-psk ""

Reboot after kernel panic, check via /proc/sys/kernel/panic[_on_oops]

Set required map count for ELK

Check if updated images are available and download them

Delete elasticsearch logstash indices older than 90 days

Uploaded binaries are not supposed to be downloaded

Daily reboot

Check for updated packages every sunday, upgrade and reboot

telekom-security / tpotce

No ip is shown after install #740

⚠️ Basic support information (commands are expected to run as root)

Determine fastest mirror for your location.

Automatic mirror selection failed, using main mirror.

Getting update information.

Upgrading packages.

Installing T-Pot dependencies.

Removing and holding back problematic packages ...

Example static ip config

Replace with the name of your physical interface name

auto eth0

iface eth0 inet static

address 192.168.1.1

netmask 255.255.255.0

network 192.168.1.0

broadcast 192.168.1.255

gateway 192.168.1.1

dns-nameservers 192.168.1.1

Example wireless config without 802.1x

This configuration was tested with the IntelNUC series

If problems occur you can try and change wpa-driver to "iwlwifi"

auto wlan0

iface wlan0 inet dhcp

wpa-driver wext

wpa-ssid

wpa-ap-scan 1

wpa-proto RSN

wpa-pairwise CCMP

wpa-group CCMP

wpa-key-mgmt WPA-PSK

wpa-psk ""

Reboot after kernel panic, check via /proc/sys/kernel/panic[_on_oops]

Set required map count for ELK

Check if updated images are available and download them

Delete elasticsearch logstash indices older than 90 days

Uploaded binaries are not supposed to be downloaded

Daily reboot

Check for updated packages every sunday, upgrade and reboot

⚠️ Basic support information (commands are expected to run as `root`)