Last year I did a post about a great tool; TPOT https://github.com/dtag-dev-sec/tpotce. In short, it is a collection of different honeypots put together by Docker and Elastic stack. I promised to cover setting up cowrie to report to SANS ISC, and here it is. If you are not familiar with Docker, this config would take a while to figure out. 

 

Copy the cowrie config from the Docker and store it on the host for persistence in /data/cowrie/config

# mkdir /data/cowrie/config

#docker cp cowrie:/home/cowrie/cowrie/cowrie.cfg /data/cowrie/config

 

Now we need to map the local folder where we are creating the custom config into the Docker so that it will use ours.

 

#vi /opt/tpot/etc/tpot.yml

Look for the section #Cowrie Service. Add the below in a similar section. 

 

    - /data/cowrie/config/cowrie.cfg:/home/cowrie/cowrie/cowrie.cfg

 

Then we need to enable the Dshield portion. You need to remove ‘#’ from the part starting with the plugin name. You’ll also need your account info.

 

To get your ISC Dshield key:

Log into ISC, go to My Accounts -> My reports. 

Select Update info, and you’ll see your auth_key.

 

#vi /data/cowrie/config/cowrie.cfg

 

[output_dshield]

enabled = true

userid = 0123456789

auth_key = mysuperawesomekeycode

batch_size = 100

 

Once you saved the changes, restart tpot.

#systemctl restart tpot

 

 

You use to be able to search for dshield in the logs to make sure it was working. In the current version the Docker is using, this is not working. I would still check the log for errors in /data/cowrie/log/cowrie.log.

The best way to check to make sure this is working is by going to https://isc.sans.edu/myreports.html. Check the last report section and see what the time stamp is. It may take a day to populate this data, so you might want to check the next day after setup. 

 

 ssh/kippo reports: 2020-03-28 17:54:12

 

Also dont forget about ISC own honeypot for Pi https://isc.sans.edu/honeypot.html

 

--

Tom Webb

@twsecblog