Unable to accomplish a distributed installation #1153

clopmz · 2022-08-17T12:14:57Z

clopmz
Aug 17, 2022

Hi all,

I am trying to accomplish a distributed install with T-PotCE release 22.04 ... When I try to execute deploy.sh script from the hive_sensor, the following error is returned:

###################################
# Deploy T-Pot Logs to T-Pot Hive #
###################################

[c] - Continue deplyoment
[q] - Abort and exit

Your choice: c

### Please provide data from your T-Pot Hive installation.
### This usually is the one running the 'T-Pot Hive' type.
### You will be needing the OS user (typically 'tsec'), the users' password and the IP / FQDN.
### Do not worry, the password will not be persisted!

Username: root
Password:
IP / FQDN: 172.22.55.8

##############################
# Generating ssh keyfile ... #
##############################

Generating public/private rsa key pair.
Your identification has been saved in /data/elk/logstash/educationalflower
Your public key has been saved in /data/elk/logstash/educationalflower.pub
The key fingerprint is:
SHA256:XO75nT+IC/18xtpCiTmCwW4rdJo1BbKy2aErZw5opbs educationalflower
The key's randomart image is:
+---[RSA 3072]----+
|                 |
|     . .         |
|      + . .      |
|   . o + +       |
|   .* o S . o .  |
|. o+ o B o.= o   |
|.+  o * o.+.+ o  |
|..o+ + .  .oo+.* |
| E*.  .    .o+Boo|
+----[SHA256]-----+

###########################################################
# Writing config to /data/elk/logstash/ls_environment.    #
# If you make changes to this file, you need to reboot or #
# run /opt/tpot/bin/updateip.sh.                          #
###########################################################

MY_TPOT_TYPE=SENSOR
MY_SENSOR_PRIVATEKEYFILE=/data/elk/logstash/educationalflower
MY_HIVE_USERNAME=educationalflower
MY_HIVE_IP=172.22.55.8

############################################
# Checking for T-Pot Hive availability ... #
############################################


#########################
# T-Pot Hive available! #
#########################


######################################################
# T-Pot Hive tunnel test FAILED!                     #
# Tunneled port tcp/64305 unreachable on T-Pot Hive. #
# Aborting.                                          #
######################################################

kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]

hive_sensor can access to hive via SSH in port 64295.

What am I doing wrong?

t3chn0m4g3 · 2022-08-17T12:19:55Z

t3chn0m4g3
Aug 17, 2022
Maintainer

root is not permitted to login remotely. You need to use a user with SSH login permission.

6 replies

t3chn0m4g3 Aug 17, 2022
Maintainer

I doubt this will work with root and it is not recommended.

clopmz Aug 17, 2022
Author

Ok, thanks ... I will create a normal user and test it.

clopmz Aug 17, 2022
Author

Uhmm ... Same result:

Your choice: c

Please provide data from your T-Pot Hive installation.

This usually is the one running the 'T-Pot Hive' type.

You will be needing the OS user (typically 'tsec'), the users' password and the IP / FQDN.

Do not worry, the password will not be persisted!

Username: sysop
Password:
IP / FQDN: 172.22.55.8

##############################

Generating ssh keyfile ...

##############################

Generating public/private rsa key pair.
Your identification has been saved in /data/elk/logstash/educationalflower
Your public key has been saved in /data/elk/logstash/educationalflower.pub
The key fingerprint is:
SHA256:1+5yquo/YVYtfWtNmjzmhI+3GGgYnC9xwz2z7h9Zs8A educationalflower
The key's randomart image is:
+---[RSA 3072]----+
| |
| |
| o |
| . ooo+ . .|
| S.=.=E B.|
| +B +.+@o+|
| oo.+ +Boo |
| .o.ooo+. |
| .oooo.==oo. |
+----[SHA256]-----+

###########################################################

Writing config to /data/elk/logstash/ls_environment.

If you make changes to this file, you need to reboot or

run /opt/tpot/bin/updateip.sh.

###########################################################

MY_TPOT_TYPE=SENSOR
MY_SENSOR_PRIVATEKEYFILE=/data/elk/logstash/educationalflower
MY_HIVE_USERNAME=educationalflower
MY_HIVE_IP=172.22.55.8

############################################

Checking for T-Pot Hive availability ...

############################################

#########################

T-Pot Hive available!

#########################

######################################################

T-Pot Hive tunnel test FAILED!

Tunneled port tcp/64305 unreachable on T-Pot Hive.

Aborting.

######################################################

kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]

t3chn0m4g3 Aug 17, 2022
Maintainer

Were you using the Post Install method? If yes, please try the ISO, otherwise retrace all steps from deploy.sh to see where / what the culprit is.

clopmz Aug 17, 2022
Author

Yes, I have installed both tpotce nodes in a Debian 11 clean install ..

clopmz · 2022-08-17T12:59:24Z

clopmz
Aug 17, 2022
Author

Uhmm .. It seems a bug. I have enabled "-x" flag in deploy.sh script and returuns this error:

+ tee /data/elk/logstash/ls_environment
MY_TPOT_TYPE=SENSOR
MY_SENSOR_PRIVATEKEYFILE=/data/elk/logstash/educationalflower
MY_HIVE_USERNAME=educationalflower
MY_HIVE_IP=172.22.55.8
+ fuCHECK_HIVE
+ echo

+ echo '############################################'
############################################
+ echo '# Checking for T-Pot Hive availability ... #'
# Checking for T-Pot Hive availability ... #
+ echo '############################################'
############################################
+ echo

+ sshpass -e ssh -4 -t -l sysop -p 64295 -f -N -L64305:127.0.0.1:64305 172.22.55.8 -o StrictHostKeyChecking=no
+ '[' 0 -eq 0 ']'
+ echo

+ echo '#########################'
#########################
+ echo '# T-Pot Hive available! #'
# T-Pot Hive available! #
+ echo '#########################'
#########################
+ echo

++ curl -s http://127.0.0.1:64305
+ myHIVE_OK=
+ '[' '' == ok ']'
+ echo

+ echo '######################################################'
######################################################
+ echo '# T-Pot Hive tunnel test FAILED!                     #'
# T-Pot Hive tunnel test FAILED!                     #
+ echo '# Tunneled port tcp/64305 unreachable on T-Pot Hive. #'
# Tunneled port tcp/64305 unreachable on T-Pot Hive. #
+ echo '# Aborting.                                          #'
# Aborting.                                          #
+ echo '######################################################'
######################################################
+ echo

++ pidof ssh
+ kill -9
kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]
+ rm /data/elk/logstash/educationalflower.pub
+ rm /data/elk/logstash/educationalflower
+ rm /data/elk/logstash/ls_environment
+ exit 1

But running commands in another console, it works:

[root@educationalflower:~]# ssh -4 -t -l sysop -p 64295 -f -N -L64305:127.0.0.1:64305 172.22.55.8
sysop@172.22.55.8's password:
[root@educationalflower:~]# curl -s http://127.0.0.1:64305
ok[root@educationalflower:~]#

As you can see, curl works ... but not from deploy.sh script ...

5 replies

t3chn0m4g3 Aug 17, 2022
Maintainer

I cannot reproduce this with the ISO installs I am currently having.

t3chn0m4g3 Aug 17, 2022
Maintainer

Fresh ISO deployments work perfectly fine as well.

[root@surroundingcrotch:~]# bash -x deploy.sh
+ fuGOT_ROOT
+ echo

+ echo -n '### Checking for root: '
### Checking for root: ++ whoami
+ '[' root '!=' root ']'
+ echo '[ OK ]'
[ OK ]
+ echo

+ echo '#################################'
#################################
+ echo '# Ship T-Pot Logs to T-Pot Hive #'
# Ship T-Pot Logs to T-Pot Hive #
+ echo '#################################'
#################################
+ echo

+ echo 'If you already have a T-Pot Hive installation running and'
If you already have a T-Pot Hive installation running and
+ echo 'this T-Pot installation is running the type "Pot" the'
this T-Pot installation is running the type "Pot" the
+ echo 'script will automagically setup this T-Pot to ship and'
script will automagically setup this T-Pot to ship and
+ echo 'prepare the Hive to receive logs from this T-Pot.'
prepare the Hive to receive logs from this T-Pot.
+ echo

+ echo

+ echo '###################################'
###################################
+ echo '# Deploy T-Pot Logs to T-Pot Hive #'
# Deploy T-Pot Logs to T-Pot Hive #
+ echo '###################################'
###################################
+ echo

+ echo '[c] - Continue deplyoment'
[c] - Continue deplyoment
+ echo '[q] - Abort and exit'
[q] - Abort and exit
+ echo

+ '[' 1 '!=' 2 ']'
+ read -s -n 1 -p 'Your choice: ' mySELECT
Your choice: + echo c
c
+ case "$mySELECT" in
+ fuGET_DEPLOY_DATA
+ echo

+ echo '### Please provide data from your T-Pot Hive installation.'
### Please provide data from your T-Pot Hive installation.
+ echo '### This usually is the one running the '\''T-Pot Hive'\'' type.'
### This usually is the one running the 'T-Pot Hive' type.
+ echo '### You will be needing the OS user (typically '\''tsec'\''), the users'\'' password and the IP / FQDN.'
### You will be needing the OS user (typically 'tsec'), the users' password and the IP / FQDN.
+ echo '### Do not worry, the password will not be persisted!'
### Do not worry, the password will not be persisted!
+ echo

+ read -p 'Username: ' MY_TPOT_USERNAME
Username: tsec
+ read -s -p 'Password: ' SSHPASS
Password: + echo

+ export SSHPASS
+ read -p 'IP / FQDN: ' MY_HIVE_IP
IP / FQDN: 172.20.254.154
++ hostname
+ MY_HIVE_USERNAME=surroundingcrotch
+ MY_TPOT_TYPE=SENSOR
+ MY_LS_ENVCONFIGFILE=/data/elk/logstash/ls_environment
+ MY_SENSOR_PUBLICKEYFILE=/data/elk/logstash/surroundingcrotch.pub
+ MY_SENSOR_PRIVATEKEYFILE=/data/elk/logstash/surroundingcrotch
+ '[' -s /data/elk/logstash/surroundingcrotch ']'
+ '[' -s /data/elk/logstash/surroundingcrotch.pub ']'
+ echo

+ echo '##############################'
##############################
+ echo '# Generating ssh keyfile ... #'
# Generating ssh keyfile ... #
+ echo '##############################'
##############################
+ echo

+ mkdir -p /data/elk/logstash
+ ssh-keygen -f /data/elk/logstash/surroundingcrotch -N '' -C surroundingcrotch
Generating public/private rsa key pair.
Your identification has been saved in /data/elk/logstash/surroundingcrotch
Your public key has been saved in /data/elk/logstash/surroundingcrotch.pub
The key fingerprint is:
SHA256:LUrkVE8JOSRDPL/Olteil+ZJbh3L2liji8OrrjBRiuI surroundingcrotch
The key's randomart image is:
+---[RSA 3072]----+
|     o+.+o..     |
|      o+oo.      |
|    . oo ..      |
| . o +  ..       |
|o o   o S..      |
|o  . . ...  .    |
| Eo   .+ ..=oo   |
|   o    B+B*=.   |
|    .ooo+XO+.    |
+----[SHA256]-----+
++ cat /data/elk/logstash/surroundingcrotch.pub
+ MY_SENSOR_PUBLICKEY='ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDoyikJyMHfiM0mY2/+rHHZkaIgo92olFGGJ/cjDiBqMaSwA2+fmv4+gVtjku+zKyswIKBztUMy8Z3iHFW6DQY9c7794sl4J3ku8QUmYmqri7XGJ0JTIq/RcaW9kIfFT2O3iPbs46h4CTVUTJr98Pjp4ZUVStUgt8jQ8Q0+iW40EbWH7069ewPCGhZkrLw2HNCLlc3xiz1C9BHugQEuDduSCQBEzGIWnlhG85piXCzaEyZAqQGKq1H3OHvjuJZSB5rpmpLVgj2LdlOD4AUC8i3pBfLN5dubADwnonfnj316Y9wYDO141tEn7mxfxU+zYzA+e6G7Nr7CqOIs0+8pG5+VeIkwmyeH/EeurU0iNJoqjgScJYfzILC83rtZJzaa38BsdQJ3L11IFJihxbPlqpTIsR+o5nPd4F3zD40VTaSWDsibqKKmdOj7oStQtGDQZa2DX7QPZEx4QVtm3IA1AhU4X/UjXDHZgOSYwrpdPcTKbo416rsJG3BaXnhr94qRWj0= surroundingcrotch'
+ echo

+ echo '###########################################################'
###########################################################
+ echo '# Writing config to /data/elk/logstash/ls_environment.    #'
# Writing config to /data/elk/logstash/ls_environment.    #
+ echo '# If you make changes to this file, you need to reboot or #'
# If you make changes to this file, you need to reboot or #
+ echo '# run /opt/tpot/bin/updateip.sh.                          #'
# run /opt/tpot/bin/updateip.sh.                          #
+ echo '###########################################################'
###########################################################
+ echo

+ tee /data/elk/logstash/ls_environment
MY_TPOT_TYPE=SENSOR
MY_SENSOR_PRIVATEKEYFILE=/data/elk/logstash/surroundingcrotch
MY_HIVE_USERNAME=surroundingcrotch
MY_HIVE_IP=172.20.254.154
+ fuCHECK_HIVE
+ echo

+ echo '############################################'
############################################
+ echo '# Checking for T-Pot Hive availability ... #'
# Checking for T-Pot Hive availability ... #
+ echo '############################################'
############################################
+ echo

+ sshpass -e ssh -4 -t -l tsec -p 64295 -f -N -L64305:127.0.0.1:64305 172.20.254.154 -o StrictHostKeyChecking=no
+ '[' 0 -eq 0 ']'
+ echo

+ echo '#########################'
#########################
+ echo '# T-Pot Hive available! #'
# T-Pot Hive available! #
+ echo '#########################'
#########################
+ echo

++ curl -s http://127.0.0.1:64305
+ myHIVE_OK=ok
+ '[' ok == ok ']'
+ echo

+ echo '##############################'
##############################
+ echo '# T-Pot Hive tunnel test OK! #'
# T-Pot Hive tunnel test OK! #
+ echo '##############################'
##############################
+ echo

++ pidof ssh
+ kill -9 11787
+ fuDEPLOY_SENSOR
+ echo

+ echo '###############################'
###############################
+ echo '# Deploying to T-Pot Hive ... #'
# Deploying to T-Pot Hive ... #
+ echo '###############################'
###############################
+ echo

+ sshpass -e ssh -4 -t -T -l tsec -p 64295 172.20.254.154
Linux digitaldictionary 5.10.0-17-arm64 #1 SMP Debian 5.10.136-1 (2022-08-13) aarch64
[sudo] password for tsec: + echo

+ echo '###########################'
###########################
+ echo '# Done. Please reboot ... #'
# Done. Please reboot ... #
+ echo '###########################'
###########################
+ echo

+ exit 0

clopmz Aug 18, 2022
Author

Ok ... tested and it works ... Many thanks for your help @t3chn0m4g3

Only last question: how can I change passwords for tsec user and web admin?

t3chn0m4g3 Aug 18, 2022
Maintainer

Perfect. You can find the procedure in the documentation.

clopmz Aug 23, 2022
Author

Ok. Done

Nuke492 · 2022-09-07T22:57:31Z

Nuke492
Sep 7, 2022

Hey im running into the same issue? any fix for this error? using the ISO method.

0 replies

lullu57 · 2022-10-18T15:25:10Z

lullu57
Oct 18, 2022

Hi, I am running the Distributed version of TPot hosted on 2 bridged networking VMs. They are fresh tpot ISO downloads. The required ports for all the honey pots have been opened and directed to the sensor IP as required. When trying to run the deploy.sh script, using the standard tsec tpot user, the final connectivity test is failing:

T-Pot Hive tunnel test FAILED!
Tunneled port tcp/64305 unreachable on T-Pot Hive.

Running netstat -tulpn on the Hive shows that it is listening over port 64305 on the normal local address (127.0.0.1). Could you guide me as to how to troubleshoot this issue given that I am not using the root user, and I am using clean ISO downloads?

7 replies

t3chn0m4g3 Oct 18, 2022
Maintainer

No, please check the prev. posts.

lullu57 Oct 19, 2022

Does this work?

t3chn0m4g3 Oct 19, 2022
Maintainer

Thanks, unfortunately it is the same reason as mentioned above, and I cannot reproduce it. Neither with ISO nor Post Install method.

For some reason the ...

++ curl -s http://127.0.0.1:64305
+ myHIVE_OK=
+ '[' '' == ok ']'
+ echo

... tunnel test fails while trying to reach the remote endpoint via SSH tunnel, which usually is an indicator that some ports / service are unavailable, but this clearly is not the case here. Since I cannot reproduce it, maybe it is a timing issue. Can you add a sleep 10 before the curl command to rule this out. If that is the case I can wait for the availability and break after a certain amount of time to avoid this.

lullu57 Oct 19, 2022

Hi I tried the above and still didn't work. Tried my luck with a fresh install again for both the hive and the sensors and connection worked this time. Not sure what the issue was before. Thankyou for your help. :)

t3chn0m4g3 Oct 19, 2022
Maintainer

Thanks for the feedback, I hope someone finds a common connection so I can finally reproduce this.

NetManDE · 2022-11-22T13:23:30Z

NetManDE
Nov 22, 2022

I created a pull request to fix this issue, which did it for me locally: #1209

SSHPASS is only used in the Deploy Sensor function, where it deploys the SSH Key. Without a deployed SSH Key it will fail, as in the check Hive function it expects a cert based authentication, as no Password is being provided

1 reply

lullu57 Nov 22, 2022

Thank you, hopefully it will fix the issue for everyone :)

nicolasRamirez98 · 2023-02-27T18:57:22Z

nicolasRamirez98
Feb 27, 2023

Hello everyone, sorry if my English is not very good, I am using a translator.

I think I found the bug when deploying the sensor and the main hive. Basically I did the following:

parsing the script "deploy.sh", I find the line:
sshpass -e ssh -4 -t -l "$MY_TPOT_USERNAME" -p 64295 -f -N -L64305:127.0.0.1:64305 "$MY_HIVE_IP" -o "StrictHostKeyChecking=no"

This command allows to establish a tunnel between the two machines, what it does is that if in the sensor a query is executed to port 64305, it redirects to the same port of the hive machine.

I do not know exactly why the sshpass command does not work well, however I think it may be when you try to export the environment variable SSHPASS, in the following line.
Well, I did the following, seeing that the sshpass command was not working correctly.

First run the sshpass command, to rule out any events.
Then I just ran the ssh command with the related parameters in the script and it ran without any problems, as you can see below

You can see, that with red color I tried to explain that I had the error which we tried to solve.
With green color, I show the sshpass command with a small variation, which instead of the -e parameter I changed it to -p 'qwerty' which forces the password, instead of taking it from an environment variable called "SSHPASS".
Later I show with cyan color that after executing the ssh command and inserting the password, it already shows me the port being used.
It finally worked by running the deploy.sh script again.

Additionally I have to say that I executed previous commands for the diagnostic, such as: iptables to open port 64305, netstat and ss to check the connections, and finally I studied the ssh documentation with: man ssh, this to understand what the parameters in the command do.

Please let me know if this solution worked for you, I will gladly read and help in any way I can.

3 replies

t3chn0m4g3 Feb 28, 2023
Maintainer

It seems, as previously established, the reason is the kill command which is unavailable in some conditions. There seem to be specific conditions necessary for reproduction which do not seem to occur in our setup, so I cannot reproduce this.

nicolasRamirez98 Feb 28, 2023

Ok, when you say that about your conditions, what exactly do you mean, because, I am installing the two machines with the latest iso version, in a vmware esxi environment, and no previous packages installed or other things. Also both machines are in layer 2 Hive ip: 10.42.6.3 and the sensor ip: 10.42.6.4, so the communication is direct and does not go through firewalls or routers.

Thanks for you reply. :)

t3chn0m4g3 Feb 28, 2023
Maintainer

I have tested this with the iso and post install methods during development, after this discussion started and tried numerous times to reproduce this within VMWare Fusion, UTM, VirtualBox, Parallels and KVM even. Everything works perfectly fine as outlined in my previous posts.

halfliffe · 2024-04-16T08:06:46Z

halfliffe
Apr 16, 2024

I encountered the same error.
When I try to run deploy.sh on a clean installation of HIVE_SENSOR, I get the error:

Tell me how to fix this?

0 replies

Unable to accomplish a distributed installation #1153

Replies: 7 comments · 22 replies

t3chn0m4g3 Aug 17, 2022 Maintainer

t3chn0m4g3 Aug 17, 2022 Maintainer

clopmz Aug 17, 2022 Author

clopmz Aug 17, 2022 Author

Please provide data from your T-Pot Hive installation.

This usually is the one running the 'T-Pot Hive' type.

You will be needing the OS user (typically 'tsec'), the users' password and the IP / FQDN.

Do not worry, the password will not be persisted!

Generating ssh keyfile ...

Writing config to /data/elk/logstash/ls_environment.

If you make changes to this file, you need to reboot or

run /opt/tpot/bin/updateip.sh.

Checking for T-Pot Hive availability ...

T-Pot Hive available!

T-Pot Hive tunnel test FAILED!

Tunneled port tcp/64305 unreachable on T-Pot Hive.

Aborting.

t3chn0m4g3 Aug 17, 2022 Maintainer

clopmz Aug 17, 2022 Author

clopmz Aug 17, 2022 Author

t3chn0m4g3 Aug 17, 2022 Maintainer

t3chn0m4g3 Aug 17, 2022 Maintainer

clopmz Aug 18, 2022 Author

t3chn0m4g3 Aug 18, 2022 Maintainer

clopmz Aug 23, 2022 Author

t3chn0m4g3 Oct 18, 2022 Maintainer

t3chn0m4g3 Oct 19, 2022 Maintainer

t3chn0m4g3 Oct 19, 2022 Maintainer

t3chn0m4g3 Feb 28, 2023 Maintainer

t3chn0m4g3 Feb 28, 2023 Maintainer

Replies: 7 comments 22 replies

t3chn0m4g3
Aug 17, 2022
Maintainer

t3chn0m4g3 Aug 17, 2022
Maintainer

clopmz Aug 17, 2022
Author

clopmz Aug 17, 2022
Author

t3chn0m4g3 Aug 17, 2022
Maintainer

clopmz Aug 17, 2022
Author

clopmz
Aug 17, 2022
Author

t3chn0m4g3 Aug 17, 2022
Maintainer

t3chn0m4g3 Aug 17, 2022
Maintainer

clopmz Aug 18, 2022
Author

t3chn0m4g3 Aug 18, 2022
Maintainer

clopmz Aug 23, 2022
Author

t3chn0m4g3 Oct 18, 2022
Maintainer

t3chn0m4g3 Oct 19, 2022
Maintainer

t3chn0m4g3 Oct 19, 2022
Maintainer

t3chn0m4g3 Feb 28, 2023
Maintainer

t3chn0m4g3 Feb 28, 2023
Maintainer