The PATH added in install.sh is fixed to the PATH at the time of installation.

[tadashi-oya]

Situation

The PATH added in install.sh is fixed to the PATH at the time of installation.

[root@bravesculpture:~]# tail -n 1 /home/admin/.bashrc
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/tpot/bin"
[root@bravesculpture:~]# tail -n 1 /root/.bashrc
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/tpot/bin"

tpotce/iso/installer/install.sh

Lines 882 to 895 in e275245

	tee -a /root/.bashrc <<EOF
	$mySHELLCHECK
	$myROOTPROMPT
	$myROOTCOLORS
	PATH="$PATH:/opt/tpot/bin"
	EOF
	for i in $(ls -d /home/*/)
	do
	tee -a $i.bashrc <<EOF
	$mySHELLCHECK
	$myUSERPROMPT
	PATH="$PATH:/opt/tpot/bin"
	EOF
	done

Proposal

Using /etc/profile.d seems to be a some idea.

tee -a /etc/profile.d/tpot-bin.sh <<EOF
PATH=$PATH:/opt/tpot/bin
EOF

Basic support information

• What version of the OS are you currently using lsb_release -a and uname -a?

[root@bravesculpture:~]# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:        10
Codename:       buster

[root@bravesculpture:~]# uname -a
Linux bravesculpture 4.19.0-20-cloud-amd64 #1 SMP Debian 4.19.235-1 (2022-03-17) x86_64 GNU/Linux

• What T-Pot version are you currently using?

[root@bravesculpture:~]# cat /opt/tpot/version
20.06.2

[root@bravesculpture:~]# head -n 10 /opt/tpot/CHANGELOG.md
# Changelog

## 20210222
- **New Release 20.06.2**
- **Countless Cloud Contributions**
  - Thanks to @shaderecker

## 20210219
- **Rebuild Snare, Tanner, Redis, Phpox**
  - Rebuild images to their latest masters and upgrade Alpine OS to 3.13 where possible.

• What edition (Standard, Nextgen, etc.) of T-Pot are you running?

[root@bravesculpture:~]# ls -l /opt/tpot/etc/tpot.yml
lrwxrwxrwx 1 root root 34 Dec 20 02:36 /opt/tpot/etc/tpot.yml -> /opt/tpot/etc/compose/standard.yml

• What architecture are you running on (i.e. hardware, cloud, VM, etc.)?

Amazon AWS EC2

• Did you have any problems during the install? If yes, please attach /install.log /install.err.

No

• How long has your installation been running?

2.5 months

• Did you install upgrades, packages or use the update script?

I have never explicitly run update.sh.
Docker image pulls run by cron have been performed several times.

• Did you modify any scripts or configs? If yes, please attach the changes.

T-Pot runs with no problem as I expected.

[root@bravesculpture:~]# cat /opt/tpot/etc/tpot.yml
(snip)
## Logstash service
  logstash:
    container_name: logstash
    restart: always
#    environment:
#     - LS_JAVA_OPTS=-Xms2048m -Xmx2048m
    depends_on:
      elasticsearch:
        condition: service_healthy
    env_file:
     - /opt/tpot/etc/compose/elk_environment
    image: "dtagdevsec/logstash:2006"
    volumes:
     - /data:/data
     - /data/elk/pipelines.yml:/usr/share/logstash/config/pipelines.yml
     - /data/elk/jvm.options:/usr/share/logstash/config/jvm.options
     - /data/elk/elasticcloud.conf:/etc/logstash/conf.d/elasticcloud.conf
(snip)

• Please provide a screenshot of glances and htop.

• How much free disk space is available (df -h)?

[root@bravesculpture:~]# df -h
Filesystem       Size  Used Avail Use% Mounted on
udev             7.8G     0  7.8G   0% /dev
tmpfs            1.6G  158M  1.4G  10% /run
/dev/nvme0n1p1   256G  131G  115G  54% /
tmpfs            7.8G     0  7.8G   0% /dev/shm
tmpfs            5.0M     0  5.0M   0% /run/lock
tmpfs            7.8G     0  7.8G   0% /sys/fs/cgroup
/dev/nvme0n1p15  124M  278K  124M   1% /boot/efi
(snip)

• What is the current container status (dps.sh)?

[root@bravesculpture:~]# dps.sh
========| System |========
    Date:  Fri Apr  1 08:33:08 UTC 2022
  Uptime:  08:33:08 up 12:51,  2 users,  load average: 2.19, 2.11, 2.26

NAME                  STATUS                       PORTS
adbhoney              Up 13 hours             0.0.0.0:5555->5555/tcp
ciscoasa              Up 13 hours
citrixhoneypot        Up 13 hours             0.0.0.0:443->443/tcp
conpot_guardian_ast   Up 13 hours             0.0.0.0:10001->10001/tcp
conpot_iec104         Up 13 hours             0.0.0.0:161->161/udp, 0.0.0.0:2404->2404/tcp
conpot_ipmi           Up 13 hours             0.0.0.0:623->623/udp
conpot_kamstrup_382   Up 13 hours             0.0.0.0:1025->1025/tcp, 0.0.0.0:50100->50100/tcp
cowrie                Up 13 hours             0.0.0.0:22-23->22-23/tcp
cyberchef             Up 13 hours (healthy)   127.0.0.1:64299->8000/tcp
dicompot              Up 13 hours             0.0.0.0:11112->11112/tcp
dionaea               Up About an hour        0.0.0.0:20-21->20-21/tcp, 0.0.0.0:42->42/tcp, 0.0.0.0:81->81/tcp, 0.0.0.0:135->135/tcp, 0.0.0.0:445->445/tcp, 0.0.0.0:1433->1433/tcp, 0.0.0.0:1723->1723/tcp, 0.0.0.0:1883->1883/tcp, 0.0.0.0:3306->3306/tcp, 0.0.0.0:69->69/udp, 0.0.0.0:5060-5061->5060-5061/tcp, 0.0.0.0:27017->27017/tcp, 0.0.0.0:5060->5060/udp
elasticpot            Up 13 hours             0.0.0.0:9200->9200/tcp
elasticsearch         Up 13 hours (healthy)   127.0.0.1:64298->9200/tcp
ewsposter             Up 13 hours
fatt                  Up 13 hours
head                  Up 13 hours (healthy)   127.0.0.1:64302->9100/tcp
heralding             Up 13 hours             0.0.0.0:110->110/tcp, 0.0.0.0:143->143/tcp, 0.0.0.0:465->465/tcp, 0.0.0.0:993->993/tcp, 0.0.0.0:995->995/tcp, 0.0.0.0:1080->1080/tcp, 0.0.0.0:5432->5432/tcp, 0.0.0.0:5900->5900/tcp
honeysap              Up 13 hours             0.0.0.0:3299->3299/tcp
honeytrap             Up 13 hours
kibana                Up 13 hours (healthy)   127.0.0.1:64296->5601/tcp
logstash              Up 13 hours (healthy)
mailoney              Up 13 hours             0.0.0.0:25->25/tcp
medpot                Up 13 hours             0.0.0.0:2575->2575/tcp
nginx                 Up 13 hours
p0f                   Up 13 hours
rdpy                  Up 13 hours             0.0.0.0:3389->3389/tcp
snare                 Up 13 hours             0.0.0.0:80->80/tcp
spiderfoot            Up 13 hours (healthy)   127.0.0.1:64303->8080/tcp
suricata              Up 13 hours
tanner                Up 13 hours
tanner_api            Up 13 hours
tanner_phpox          Up 13 hours
tanner_redis          Up 13 hours             6379/tcp

• What is the status of the T-Pot service (systemctl status tpot)?

[root@bravesculpture:~]# systemctl status tpot.service
● tpot.service - tpot
   Loaded: loaded (/etc/systemd/system/tpot.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2022-03-31 19:42:31 UTC; 12h ago
  Process: 868 ExecStartPre=/opt/tpot/bin/updateip.sh (code=exited, status=0/SUCCESS)
  Process: 897 ExecStartPre=/bin/bash -c /opt/tpot/bin/clean.sh on (code=exited, status=0/SUCCESS)
  Process: 1146 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml down -v (code=exited, status=0/SUCCESS)
  Process: 1149 ExecStartPre=/usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml rm -v (code=exited, status=0/SUCCESS)
  Process: 1152 ExecStartPre=/bin/bash -c docker network rm $(docker network ls -q) (code=exited, status=1/FAILURE)
  Process: 1172 ExecStartPre=/bin/bash -c docker volume rm $(docker volume ls -q) (code=exited, status=1/FAILURE)
  Process: 1191 ExecStartPre=/bin/bash -c docker rm -v $(docker ps -aq) (code=exited, status=1/FAILURE)
  Process: 1211 ExecStartPre=/bin/bash -c docker rmi $(docker images | grep "<none>" | awk '{print $3}') (code=exited, s
  Process: 1231 ExecStartPre=/bin/bash -c /sbin/ethtool --offload $(/sbin/ip address | grep "^2: " | awk '{ print $2 }'
  Process: 1237 ExecStartPre=/bin/bash -c /sbin/ethtool -K $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -d
  Process: 1243 ExecStartPre=/bin/bash -c /sbin/ip link set $(/sbin/ip address | grep "^2: " | awk '{ print $2 }' | tr -
  Process: 1249 ExecStartPre=/opt/tpot/bin/rules.sh /opt/tpot/etc/tpot.yml set (code=exited, status=0/SUCCESS)
 Main PID: 1326 (docker-compose)
    Tasks: 35 (limit: 4915)
   Memory: 65.7M
   CGroup: /system.slice/tpot.service
           └─1326 /usr/bin/python3 /usr/bin/docker-compose -f /opt/tpot/etc/tpot.yml up --no-color

Apr 01 08:33:52 bravesculpture docker-compose[1326]: honeytrap              |   Core module initialized.
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [cowrie.ssh.usera
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [cowrie.ssh.usera
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [cowrie.ssh.trans
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [HoneyPotSSHTrans
Apr 01 08:33:53 bravesculpture docker-compose[1326]: honeytrap              | [2022-04-01 08:33:53] 5.188.206.50:63765 r
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [cowrie.ssh.facto
Apr 01 08:33:53 bravesculpture docker-compose[1326]: cowrie                 | 2022-04-01T08:33:53+0000 [cowrie.ssh.facto

• What ports are being occupied? Stop T-Pot systemctl stop tpot and run netstat -tulpen

[root@bravesculpture:~]# systemctl stop tpot.service
[root@bravesculpture:~]# netstat -tulpen
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      PID/Program name

tcp        0      0 127.0.0.1:61209         0.0.0.0:*               LISTEN      0          12949      639/python3

tcp        0      0 0.0.0.0:64295           0.0.0.0:*               LISTEN      0          14878      650/sshd

tcp6       0      0 :::64294                :::*                    LISTEN      0          12181      1/init

tcp6       0      0 :::64295                :::*                    LISTEN      0          14880      650/sshd

udp        0      0 0.0.0.0:68              0.0.0.0:*                           0          13403      450/dhclient

• If a single container shows as DOWN you can run docker logs <container-name> for the latest log entries

All containers are running.

[t3chn0m4g3]

Thank you, good idea, I will look into it for 22.x.

[t3chn0m4g3]

Does not seem to work, at least not for the Debian Netiso image T-Pot is based on.

[tadashi-oya]

First of all, I apologize for inaccuracies in my writing.
Escaping "$PATH" is needed.
tadashi-oya@7f9703c

Does not seem to work, at least not for the Debian Netiso image T-Pot is based on.

It seems that the tree made by in-target in tpot.seed must contain a commit regarding /etc/profile.d.

tpotce/iso/preseed/tpot.seed

Line 134 in e275245

in-target git clone --depth=1 https://github.com/telekom-security/tpotce /opt/tpot; \

Somewhat paradoxically, it appears to be a "commit and it will work right" situation.

I forked telekom-security/tpotce. https://github.com/tadashi-oya/tpotce
This fork includes

• Commit to use /etc/profile.d
• Commit tpot.seed which refer the tree including "Commit to use /etc/profile.d"

Running makeiso.sh with this fork, it will generate a tpot.iso that uses /etc/profile.d.

[tadashi-oya]

On second thought, escaping "$PATH" in the existing code would also accomplish the goal.

tpotce/iso/installer/install.sh

Line 886 in e275245

PATH="$PATH:/opt/tpot/bin"

tpotce/iso/installer/install.sh

Line 893 in e275245

PATH="$PATH:/opt/tpot/bin"

to

PATH="\$PATH:/opt/tpot/bin"

Considerations regarding the in-target of tpot.seed, "commit and it will work right" situation, are still necessary, though.

[t3chn0m4g3]

Thanks, adjusted with ab46fcb