Install

[fabianossilvasantos]

[fabianossilvasantos]

I'm having problems installing.
I managed to generate the HIVE certificate.
However, I can't install the SENSOR, can anyone help me?

[FreakyLetsFail]

Hi!

Describe your infrastructure. Is it behind a proxy? Is the sensor continuously in a loop when you check systemctl status tpot?

Have you received the certificate to the sensor?

[fabianossilvasantos]

Hello.

How do I know if I received the SENSOR certificate?

I'm not using a proxy.
I'm using a virtual box in bridge mode.
After installing Hive I had difficulty installing SENSOR, I believe it was installed.
However, all honeypot IPs are represented by 0.0.0.0:port
When I do scan tests, the return is that the host is not active

[FreakyLetsFail]

You need this step to verify before deploying the certificate, ensuring the sensor does not end up in a continuous loop:

Deploying Sensors
Once you have rebooted the sensor as instructed by the installer, you can proceed with the distributed deployment by logging into Hive and navigating to the cd ~/tpotce folder. Ensure you understand the planning and certificates before proceeding with the actual deployment.

If you haven’t already, generate an SSH key to securely log in to the sensor and allow Ansible to run a playbook on it:
1. Run ssh-keygen, follow the instructions, and leave the passphrase empty:
• Generating public/private rsa key pair.
2. Enter the file in which to save the key (/home/<your_user>/.ssh/id_rsa):
3. Enter passphrase (leave empty for no passphrase):
4. Confirm the same passphrase:
5. Your identification has been saved in /home/<your_user>/.ssh/id_rsa.
6. Your public key has been saved in /home/<your_user>/.ssh/id_rsa.pub.

Next, deploy the key to the sensor by running:
ssh-copy-id -p 64295 <Sensor_SSH_USER>@<Sensor_IP>

You may see the following prompts during deployment:
• /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/<your_user>/.ssh/id_rsa.pub".
• The authenticity of host [<Sensor_IP>]:64295 ([<Sensor_IP>]:64295) cannot be established.
• ED25519 key fingerprint is SHA256:naIDxFiw/skPJadTcgmWZQtgt+CdfRbUCoZn5RmkOnQ.
• This key is not known by any other names.

When prompted, confirm by typing yes.
You’ll also be asked for the password of <your_user>@<Sensor_IP>.

Finally, test the connection with:
ssh -p '64295' '<your_user>@<Sensor_IP>'

If the key was deployed successfully, run ./deploy.sh and follow the instructions.

Additional Checks:
Always test the network connection between the Hive and the sensor using tcpdump. Verify that port 64295 is open to deploy the certificate.

On the sensor itself, check the Logstash logs with:
docker logs -f logstash

Share the collected data for further analysis.

[fabianossilvasantos]

We did these steps, however our honeypots and services continue with IP:0.0.0.0:port