Adds kippo SSH honeypot

This commit is contained in:
Thomas Bereknyei 2014-01-11 17:15:11 -05:00 committed by Rok Garbas
parent 1343ce97cb
commit 57e3feda74
4 changed files with 183 additions and 0 deletions

View File

@ -168,6 +168,7 @@
./services/networking/ifplugd.nix
./services/networking/iodined.nix
./services/networking/ircd-hybrid/default.nix
./services/networking/kippo.nix
./services/networking/minidlna.nix
./services/networking/nat.nix
./services/networking/networkmanager.nix

View File

@ -0,0 +1,115 @@
# NixOS module for kippo honeypot ssh server
# See all the options for configuration details.
#
# Default port is 2222. Recommend using something like this for port redirection to default SSH port:
# networking.firewall.extraCommands = ''
# iptables -t nat -A PREROUTING -i IN_IFACE -p tcp --dport 22 -j REDIRECT --to-port 2222'';
#
# Lastly: use this service at your own risk. I am working on a way to run this inside a VM.
{ pkgs, config, ... }:
with pkgs.lib;
let
cfg = config.services.kippo;
in
rec {
options = {
services.kippo = {
enable = mkOption {
default = false;
type = types.uniq types.bool;
description = ''Enable the kippo honeypot ssh server.'';
};
port = mkOption {
default = 2222;
type = types.uniq types.int;
description = ''TCP port number for kippo to bind to.'';
};
hostname = mkOption {
default = "nas3";
type = types.string;
description = ''Hostname for kippo to present to SSH login'';
};
varPath = mkOption {
default = "/var/lib/kippo";
type = types.string;
description = ''Path of read/write files needed for operation and configuration.'';
};
logPath = mkOption {
default = "/var/log/kippo";
type = types.string;
description = ''Path of log files needed for operation and configuration.'';
};
pidPath = mkOption {
default = "/run/kippo";
type = types.string;
description = ''Path of pid files needed for operation.'';
};
extraConfig = mkOption {
default = "";
type = types.string;
description = ''Extra verbatim configuration added to the end of kippo.cfg.'';
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = with pkgs.pythonPackages; [
python twisted pycrypto pyasn1 ];
environment.etc."kippo.cfg".text = ''
# Automatically generated by NixOS.
# See ${pkgs.kippo}/src/kippo.cfg for details.
[honeypot]
log_path = ${cfg.logPath}
download_path = ${cfg.logPath}/dl
filesystem_file = ${cfg.varPath}/honeyfs
filesystem_file = ${cfg.varPath}/fs.pickle
data_path = ${cfg.varPath}/data
txtcmds_path = ${cfg.varPath}/txtcmds
public_key = ${cfg.varPath}/keys/public.key
private_key = ${cfg.varPath}/keys/private.key
ssh_port = ${toString cfg.port}
hostname = ${cfg.hostname}
${cfg.extraConfig}
'';
users.extraUsers = singleton {
name = "kippo";
description = "kippo web server privilege separation user";
};
users.extraGroups = singleton { name = "kippo"; };
systemd.services.kippo = with pkgs; {
description = "Kippo Web Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
environment.PYTHONPATH = "${pkgs.kippo}/src/:${pkgs.pythonPackages.pycrypto}/lib/python2.7/site-packages/:${pkgs.pythonPackages.pyasn1}/lib/python2.7/site-packages/:${pkgs.pythonPackages.python}/lib/python2.7/site-packages/:${pkgs.pythonPackages.twisted}/lib/python2.7/site-packages/:.";
preStart = ''
if [ ! -d ${cfg.varPath}/ ] ; then
mkdir -p ${cfg.pidPath}
mkdir -p ${cfg.logPath}/tty
mkdir -p ${cfg.logPath}/dl
mkdir -p ${cfg.varPath}/keys
cp ${pkgs.kippo}/src/honeyfs ${cfg.varPath} -r
cp ${pkgs.kippo}/src/fs.pickle ${cfg.varPath}/fs.pickle
cp ${pkgs.kippo}/src/data ${cfg.varPath} -r
cp ${pkgs.kippo}/src/txtcmds ${cfg.varPath} -r
chmod u+rw ${cfg.varPath} -R
chmod u+rw ${cfg.pidPath}
chown kippo.kippo ${cfg.varPath} -R
chown kippo.kippo ${cfg.pidPath}
chown kippo.kippo ${cfg.logPath} -R
chmod u+rw ${cfg.logPath} -R
fi
'';
serviceConfig.ExecStart = "${pkgs.pythonPackages.twisted}/bin/twistd -y ${pkgs.kippo}/src/kippo.tac --syslog --rundir=${cfg.varPath}/ --pidfile=${cfg.pidPath}/kippo.pid --prefix=kippo -n";
serviceConfig.PermissionsStartOnly = true;
serviceConfig.User = "kippo";
serviceConfig.Group = "kippo";
};
};
}

View File

@ -0,0 +1,65 @@
# This is the installation portion of kippo.
# This is somewhat jumbled together. There is no "easy_install" for kippo,
# and there isn't a way to regenerate the twistd plugin cache.
#
# Use the services.kippo options to properly configure if on NixOS.
# On other platforms there is a problem with hardcoded paths.
# Your best bet is to change kippo source to customise
# or manually copy the proper filesystems.
# At a minimum the following are required in /var/lib/kippo:
# honeyfs/
# fs.pickle
# data/
# txtcmds/
#
# There is also benefit in preparing /var/log/kippo
# tty/
# dl/
#
# Most of these files need read/write permissions.
#
# Read only files: kippo.tac and kippo.cfg
#
# Execution may look like this:
# twistd -y kippo.tac --syslog --pidfile=kippo.pid
#
# Use this package at your own risk.
{stdenv, pkgs, config, fetchurl, ... }:
stdenv.mkDerivation rec {
name = "kippo-${version}";
version = "0.8";
src = fetchurl {
url = "https://kippo.googlecode.com/files/kippo-${version}.tar.gz";
sha1 = "f57a5cf88171cb005afe44a4b33cb16f825c33d6";
};
buildInputs = with pkgs.pythonPackages; [ pycrypto pyasn1 twisted ];
installPhase = ''
substituteInPlace ./kippo.tac --replace "kippo.cfg" "$out/src/kippo.cfg"
substituteInPlace ./kippo.cfg --replace "log_path = log" "log_path = /var/log/kippo" \
--replace "download_path = dl" "download_path = /var/log/kippo/dl" \
--replace "contents_path = honeyfs" "filesystem_file = /var/lib/kippo/honeyfs" \
--replace "filesystem_file = fs.pickle" "filesystem_file = /var/lib/kippo/fs.pickle" \
--replace "data_path = data" "data_path = /var/lib/kippo/data" \
--replace "txtcmds_path = txtcmds" "txtcmds_path = /var/lib/kippo/txtcmds" \
--replace "public_key = public.key" "public_key = /var/lib/kippo/keys/public.key" \
--replace "private_key = private.key" "private_key = /var/lib/kippo/keys/private.key"
mkdir -p $out/bin
mkdir -p $out/src
mv ./* $out/src
mv $out/src/utils/* $out/bin
'';
meta = {
homepage = https://code.google.com/p/kippo;
description = "SSH Honeypot";
longDescription = ''
Default port is 2222. Recommend using something like this for port redirection to default SSH port:
networking.firewall.extraCommands = '''
iptables -t nat -A PREROUTING -i IN_IFACE -p tcp --dport 22 -j REDIRECT --to-port 2222''' '';
license = stdenv.lib.licenses.bsd3;
platforms = pkgs.stdenv.lib.platforms.linux;
maintainers = pkgs.stdenv.lib.maintainers.tomberek;
};
}

View File

@ -1225,6 +1225,8 @@ let
logstash = callPackage ../tools/misc/logstash { };
kippo = callPackage ../servers/kippo { };
klavaro = callPackage ../games/klavaro {};
minidlna = callPackage ../tools/networking/minidlna {