installation problems

[dmille6]

hi, i've read the installation instructions and I've got some things I'm unsure about.

I'm currently running a single TPOT 24.04 honeypot.. if I get this working I'll expand to a hive installation with 5-8 honeypots.
honeypot are running on ubuntu 24.04 server, its reasonably stable and working.

from what I can tell elasticsearch port 64298 is only open to localhost.. so i'd need to run greedybear from the honeypot instance? (which is fine)

I guess if I run a hive I could open that port up behind a firewall..

when I follow the greedy bear instructions:

cp .env_template .env
cd docker/
cp env_file_template env_file
cp env_file_postgres_template env_file_postgres

and modify the files appropriately.. i get this error when trying to start up (build) the docker container:

/opt/GreedyBear$ sudo docker-compose build
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 214, in _retrieve_server_version
    return self.version(api_version=False)["ApiVersion"]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/daemon.py", line 181, in version
    return self._result(self._get(url), json=True)
                        ^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/utils/decorators.py", line 46, in inner
    return f(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 237, in _get
    return self.get(url, **self._set_request_timeout(kwargs))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 602, in get
    return self.request("GET", url, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 486, in send
    resp = conn.urlopen(
           ^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 791, in urlopen
    response = self._make_request(
               ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 497, in _make_request
    conn.request(
TypeError: HTTPConnection.request() got an unexpected keyword argument 'chunked'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/docker-compose", line 33, in <module>
    sys.exit(load_entry_point('docker-compose==1.29.2', 'console_scripts', 'docker-compose')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 81, in main
    command_func()
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 200, in perform_command
    project = project_from_options('.', options)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/command.py", line 60, in project_from_options
    return get_project(
           ^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/command.py", line 152, in get_project
    client = get_client(
             ^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/docker_client.py", line 41, in get_client
    client = docker_client(
             ^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/compose/cli/docker_client.py", line 170, in docker_client
    client = APIClient(use_ssh_client=not use_paramiko_ssh, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 197, in __init__
    self._version = self._retrieve_server_version()
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/docker/api/client.py", line 221, in _retrieve_server_version
    raise DockerException(
docker.errors.DockerException: Error while fetching server API version: HTTPConnection.request() got an unexpected keyword argument 'chunked'

any help would be appreciated

[mlodic]

hey, thanks for your interest in the project! :)

Last TPOT release could have brought some changes so it is normal that some configuration adjusts must be done to have a proper installation of GreedyBear. We are not always 100% aligned with the last release.

from what I can tell elasticsearch port 64298 is only open to localhost.. so i'd need to run greedybear from the honeypot instance? (which is fine). I guess if I run a hive I could open that port up behind a firewall..

You can do either you want. I suggest installing GB in a separate instance for better maintenance in the long term. However, as you mentioned, if ElasticSearch is not open externally, you should do that by changing the docker compose file of the TPOT. See here and then re-execute the TPOT. In such case, I would also add a Firewall rule to allow connections only against my GB instance if possible.

About your error, I think it is related to an old version of Docker Compose. Please refer to IntelOwl installation requirements.

[dmille6]

you were right.. thank you for such a quick response.

in the instructions you have "docker-compose"
I think new versions of docker use "docker compose" (no '-')
that fixed it..

I've got it running internally and should connect to my tpot. my issue is I can get to the web interface but don't have a login and password. is there a default username and password (I looked in the documentation and didn't find any info on that)

I'm guessing I need to set up a sendmail server to or some type mail server to create/register accounts?

(thank you for your help)

[mlodic]

as stated in the doc, you need to create a superuser first

docker exec -ti greedybear_uwsgi python3 manage.py createsuperuser

then you can login with that account and create as many users and api keys as you want

[dmille6]

thank you, some how i missed that.

[dmille6]

Thank you for all your help getting this up and running. not sure how I missed that last step. i got everything working.

i do have a few questions. I'm not sure if it would be best to continue the questions here or start a new thread:

• the interface is nice and clean, thank you.
• as far as data goes.. there is ALOT more data within a tpot than is being used in greedy bear.. what was the goals or motivation for the project? just black listing malicious IPs?
• what about the other useful information:
  • usernames and passwords being tried to login to the tpot? (I think cowrie and a few other honeypots record those)
  • the hashes of files being uploaded
  • shell commands attempted

[mlodic]

the overall goal of the project is to have a central hub that could generate simple feeds for Threat Intelligence purposes (a Threat Intel Platform).
If you want to operationalize the data from your TPOTs (maybe collect it periodically and use it in your SIEM, SOAR, TIP, firewalls, IDS, etc), you can't do that easily without an application as GB. With GB you can have aggregated feeds that can be easily exported.

About other useful information: I agree, that could be integrated in this project as well and is definitely something that could be added. But, you know, IP addresses are IOCs that are really easy to put in action and make them useful. Other information like shell commands are not so easy to be used so they were not the focus of the project once I wrote it