Huginn 0.40.0: optional goodbye on logout, faster Campaigns

Update both sides: Huginn and the honeypot (update-honeypot.sh) — the honeypot gets one new Cowrie patch.

New

• An optional goodbye, off by default. Turn it on with ./update-honeypot.sh --goodbye-on (off again with --goodbye-off, no restart). When someone who really logged in types exit or logout, they get a short note:

    Thanks for the 4 min 12 s, 203.0.113.7.
    You typed 9 lines. All of it is logged, along with your address.
    Say hi to the rest of the botnet.
  

  It only shows at the very end, after the session is fully logged, and never for sh -c, scripts, nested shells or bots that just disconnect. It does tell whoever reads it that this is a honeypot, and a bot that types exit can learn to recognise yours, which is why it is off unless you choose it. The session log shows who got it; Account › Honeypot protection shows whether it is on (never an alert).

Fixed and improved (from a review before release)

• Campaigns is fast with long scripts. 0.39's comparison of alike scripts could take seconds on crafted scripts with thousands of repeated commands. It now groups rows by the shape of their first commands, compares sorted neighbours and reads at most 1,000 commands per script (60 alike scripts: about 0.4 s instead of 8 s).
• Scripts that differ only in an address or number are compared as the same step; two rows that read the same no longer both say "ends after".
• Safer Cowrie upgrades. update-honeypot.sh --cowrie puts Huginn's patches back if git pull or pip install fails, and says honestly whether that worked.
• The honeypot's status report checks a file is regular and not a symlink before reading it.

Update

On Huginn: cd Huginn && git pull && sudo ./update-huginn.sh (or the new huginn_all.deb / Docker image).
On the honeypot: cd Huginn && git pull && sudo ./update-honeypot.sh.