 now provides Distributed Installation with HIVE and HIVE_SENSOR.

Last week, I was tasked with setting up a honeypot for personal research. While finding out on how to build a honeypot, I came across 

, an open source honeypot platform. T-Pot looks to be an interesting project for a quick deployment of a honeypot. It is designed to run without any interaction or maintenance which seems perfect for me to test.

A honeypot is a security feature that sets up a simulated trap for attackers to fall into. An attacker can exploit weaknesses on a deliberately compromised computer system, allowing you to analyze them and enhance your security practices.

T-Pot is based on the Debian 10 (Buster) network installer. The honeypot daemons as well as other support components are dockered. This allows T-Pot to run multiple honeypot daemons and tools on the same network interface while maintaining a small footprint and constrain each honeypot within its own environment.

T-Pot may also includes other tools depending on the installation type:

 for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.

 a web app for encryption, encoding, compression and data analysis.

 to beautifully visualize all the events captured by T-Pot.

 a web front end for browsing and interacting with an Elastic Search cluster.

 a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic.

 a open source intelligence automation tool.

The figure below shows the architecture of the T-Pot system

8 GB RAM (less RAM is possible but might introduce swapping / instabilities)

128 GB SSD (smaller is possible but limits the capacity of storing events)

A working, non-proxied, internet connection

To start testing it, I made use of the provided ISO image in the GitHub 

 and booted it up in a virtual machine (VM). The installation process was extremely simple, it took me about 5-10 minutes to get a fully functionally honeypot up and running from nothing.

To view and analyze the events/logs of the Honeypots, there is an Elasticsearch, Logstash, Kibana (ELK) dashboard to learn about the cyberattacks on the Honeypot system. Running a nmap scan on the Honeypot produce a result shown in the figures below.

T-Pot does not have any remote logging which did not make sense to me, it stores all of the events that was captured in the honeypot itself. Wouldn’t that mean that if an attacker has successfully compromised the honeypot, they could delete the logs?. Of course they will have to escape the docker container too, but a hacker is skilled enough, it is entirely possible. However, since I am not an expert in this matter, I do not know if this is truly the case. Nevertheless, I would still like to setup a distributed system for remote logging.

 regarding on a distributed installation type. Which discuss about the advantages and possible issues on a distributed installation. It also gives some hints on how to setup a distributed system. One example would be 

, derp7331 has developed scripts to setup a distributed T-Pot (18.11) infrastructure, which is a good starting point. The author of T-Pot mentioned that distributed installation is not a priority, and will be on the to-do list.

Setting up a distributed T-Pot system requires manual tweaking of the docker-compose file. or utilizing derp7331’s scripts to tweak the configuration files. However, derp7331 scripts is outdated and would not work on the latest version of T-Pot. Thus, we will have to look into the first method. Luckily for me, someone has already done that for us: 

, a lightweight shipper for forwarding and centralizing log data. The system architecture of a distributed system can be seen in the figure below.

For Filebeat to send the raw log data to the central logging server, it requires a filebeat.yml config for T-Pot, you can refer to my forked T-Pot repository at 

. Logstash will listen to the request from Filebeat from 64299/tcp.

Hosting it on AWS is pretty simple, make sure to properly configure the Security groups and just follow the guide written by @mkmety. You may want to setup encrpytion for remote logging using SSL, or setup a Wireguard VPN to communication between the central logging server and honeypot sensors.

https://medium.com/@mkmety/deploying-t-pot-the-all-in-one-honeypot-platform-on-aws-ec2-33f019c645fb

Speical thanks to Theo Chen and all of the resources I found below.

https://github.com/telekom-security/tpotce

https://github.com/derp7331/tpot_distributed

https://blog.theo.com.tw/Research/Deploy-A-Distributed-T-Pot-System-For-Personal-Research-In-Budget-Part-2/

Setting up a distributed T-Pot honeypot on AWS

Distributed T-Pot System