2018-04-04 18:10:28 +00:00
|
|
|
# DO NOT EDIT THIS FILE!
|
|
|
|
|
# Changes to default files will be lost on update and are difficult to
|
|
|
|
|
# manage and support.
|
2010-10-31 12:20:07 +00:00
|
|
|
#
|
2018-04-04 18:10:28 +00:00
|
|
|
# Please make any changes to system defaults by overriding them in
|
|
|
|
|
# cowrie.cfg
|
2010-10-31 12:20:07 +00:00
|
|
|
#
|
2018-04-04 18:10:28 +00:00
|
|
|
# To override a specific setting, copy the name of the stanza and
|
|
|
|
|
# setting to the file where you wish to override it.
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
2018-04-04 18:10:28 +00:00
|
|
|
# General Cowrie Options
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
2009-11-22 06:56:30 +00:00
|
|
|
[honeypot]
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# Sensor name is used to identify this Cowrie instance. Used by the database
|
2014-12-09 09:25:15 +00:00
|
|
|
# logging modules such as mysql.
|
|
|
|
|
#
|
|
|
|
|
# If not specified, the logging modules will instead use the IP address of the
|
2016-01-19 11:14:51 +00:00
|
|
|
# server as the sensor name.
|
2014-12-09 09:25:15 +00:00
|
|
|
#
|
|
|
|
|
# (default: not specified)
|
|
|
|
|
#sensor_name=myhostname
|
|
|
|
|
|
2010-10-31 12:20:07 +00:00
|
|
|
# Hostname for the honeypot. Displayed by the shell prompt of the virtual
|
2016-01-19 11:14:51 +00:00
|
|
|
# environment
|
2010-10-31 12:20:07 +00:00
|
|
|
#
|
2015-05-13 06:40:21 +00:00
|
|
|
# (default: svr04)
|
|
|
|
|
hostname = svr04
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
|
2010-10-31 12:20:07 +00:00
|
|
|
# Directory where to save log files in.
|
|
|
|
|
#
|
|
|
|
|
# (default: log)
|
2009-11-22 06:56:30 +00:00
|
|
|
log_path = log
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
|
|
|
|
|
# Directory where to save downloaded artifacts in.
|
2010-10-31 12:20:07 +00:00
|
|
|
#
|
|
|
|
|
# (default: dl)
|
2009-11-22 06:56:30 +00:00
|
|
|
download_path = dl
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
|
|
|
|
|
# Directory for miscellaneous data files, such as the password database.
|
2018-06-27 22:55:30 +00:00
|
|
|
# (DEPRECATED: will be removed in near future)
|
2018-04-05 19:31:04 +00:00
|
|
|
# (default: data)
|
2016-01-19 11:14:51 +00:00
|
|
|
data_path = data
|
|
|
|
|
|
2013-01-08 19:31:20 +00:00
|
|
|
|
2018-06-27 22:47:11 +00:00
|
|
|
# Directory for static data files
|
|
|
|
|
#
|
|
|
|
|
# (default: share/cowrie)
|
|
|
|
|
share_path = share/cowrie
|
|
|
|
|
|
|
|
|
|
|
2018-06-28 11:35:52 +00:00
|
|
|
# Directory for variable state files
|
|
|
|
|
#
|
|
|
|
|
# (default: var/lib/cowrie)
|
|
|
|
|
state_path = var/lib/cowrie
|
|
|
|
|
|
|
|
|
|
|
2018-06-27 22:55:30 +00:00
|
|
|
# Directory for config files
|
|
|
|
|
#
|
2018-06-27 23:31:05 +00:00
|
|
|
# (default: etc)
|
2018-06-27 22:55:30 +00:00
|
|
|
etc_path = etc
|
|
|
|
|
|
|
|
|
|
|
2010-10-31 12:20:07 +00:00
|
|
|
# Directory where virtual file contents are kept in.
|
|
|
|
|
#
|
|
|
|
|
# This is only used by commands like 'cat' to display the contents of files.
|
|
|
|
|
# Adding files here is not enough for them to appear in the honeypot - the
|
|
|
|
|
# actual virtual filesystem is kept in filesystem_file (see below)
|
|
|
|
|
#
|
|
|
|
|
# (default: honeyfs)
|
2009-11-23 14:45:48 +00:00
|
|
|
contents_path = honeyfs
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
|
|
|
|
|
# Directory for creating simple commands that only output text.
|
2010-10-31 12:20:07 +00:00
|
|
|
#
|
2016-01-19 11:14:51 +00:00
|
|
|
# The command must be placed under this directory with the proper path, such
|
|
|
|
|
# as:
|
|
|
|
|
# txtcmds/usr/bin/vi
|
|
|
|
|
# The contents of the file will be the output of the command when run inside
|
|
|
|
|
# the honeypot.
|
|
|
|
|
#
|
2016-04-13 16:12:38 +00:00
|
|
|
# In addition to this, the file must exist in the virtual filesystem
|
2016-01-19 11:14:51 +00:00
|
|
|
#
|
|
|
|
|
# (default: txtcmds)
|
|
|
|
|
txtcmds_path = txtcmds
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Maximum file size (in bytes) for downloaded files to be stored in 'download_path'.
|
|
|
|
|
# A value of 0 means no limit. If the file size is known to be too big from the start,
|
|
|
|
|
# the file will not be stored on disk at all.
|
|
|
|
|
#
|
|
|
|
|
# (default: 0)
|
|
|
|
|
#download_limit_size = 10485760
|
|
|
|
|
|
2017-02-18 15:50:00 +00:00
|
|
|
# TTY logging will log a transcript of the complete terminal interaction in UML
|
|
|
|
|
# compatible format.
|
|
|
|
|
# (default: true)
|
2017-02-18 15:58:55 +00:00
|
|
|
ttylog = true
|
2017-02-18 15:50:00 +00:00
|
|
|
|
2018-01-02 07:34:26 +00:00
|
|
|
# Default directory for TTY logs.
|
|
|
|
|
# (default: ttylog_path = %(log_path)s/tty)
|
2018-06-27 23:21:55 +00:00
|
|
|
ttylog_path = ${honeypot:log_path}/tty
|
2018-01-02 07:34:26 +00:00
|
|
|
|
2017-06-16 12:06:36 +00:00
|
|
|
# Interactive timeout determines when logged in sessions are
|
2017-07-07 09:05:30 +00:00
|
|
|
# terminated for being idle. In seconds.
|
2017-06-16 12:06:36 +00:00
|
|
|
# (default: 180)
|
|
|
|
|
interactive_timeout = 180
|
|
|
|
|
|
2018-07-15 10:41:27 +00:00
|
|
|
# Authentication Timeout
|
|
|
|
|
# The server disconnects after this time if the user has not successfully logged in. If the value is 0,
|
|
|
|
|
# there is no time limit. The default is 120 seconds.
|
|
|
|
|
authentication_timeout = 120
|
|
|
|
|
|
2017-09-23 06:52:00 +00:00
|
|
|
# EXPERIMENTAL: back-end to user for Cowrie, options: proxy or shell
|
|
|
|
|
# a limited implementation is available for proxy, with request_exec functionality only
|
|
|
|
|
# (default: shell)
|
|
|
|
|
backend = shell
|
|
|
|
|
|
2017-02-18 15:50:00 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# Network Specific Options
|
|
|
|
|
# ============================================================================
|
|
|
|
|
|
2016-04-13 16:12:38 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# IP address to bind to when opening outgoing connections. Used by wget and
|
|
|
|
|
# curl commands.
|
|
|
|
|
#
|
|
|
|
|
# (default: not specified)
|
|
|
|
|
#out_addr = 0.0.0.0
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Fake address displayed as the address of the incoming connection.
|
|
|
|
|
# This doesn't affect logging, and is only used by honeypot commands such as
|
|
|
|
|
# 'w' and 'last'
|
|
|
|
|
#
|
|
|
|
|
# If not specified, the actual IP address is displayed instead (default
|
|
|
|
|
# behaviour).
|
|
|
|
|
#
|
|
|
|
|
# (default: not specified)
|
|
|
|
|
#fake_addr = 192.168.66.254
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# The IP address on which this machine is reachable on from the internet.
|
|
|
|
|
# Useful if you use portforwarding or other mechanisms. If empty, Cowrie
|
|
|
|
|
# will determine by itself. Used in 'netstat' output
|
|
|
|
|
#
|
|
|
|
|
#internet_facing_ip = 9.9.9.9
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Enable to log the public IP of the honeypot (useful if listening on 127.0.0.1)
|
|
|
|
|
# IP address is obtained by querying http://myip.threatstream.com
|
|
|
|
|
#report_public_ip = true
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ============================================================================
|
|
|
|
|
# Authentication Specific Options
|
|
|
|
|
# ============================================================================
|
|
|
|
|
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2015-03-17 22:00:35 +00:00
|
|
|
# Class that implements the checklogin() method.
|
2015-06-23 08:20:38 +00:00
|
|
|
#
|
2015-05-12 14:57:29 +00:00
|
|
|
# Class must be defined in cowrie/core/auth.py
|
2015-03-17 22:00:35 +00:00
|
|
|
# Default is the 'UserDB' class which uses the password database.
|
|
|
|
|
#
|
|
|
|
|
# Alternatively the 'AuthRandom' class can be used, which will let
|
|
|
|
|
# a user login after a random number of attempts.
|
|
|
|
|
# It will also cache username/password combinations that allow login.
|
|
|
|
|
#
|
|
|
|
|
auth_class = UserDB
|
2016-01-19 11:14:51 +00:00
|
|
|
|
2015-06-23 08:20:38 +00:00
|
|
|
# When AuthRandom is used also set the
|
2015-03-17 22:00:35 +00:00
|
|
|
# auth_class_parameters: <min try>, <max try>, <maxcache>
|
|
|
|
|
# for example: 2, 5, 10 = allows access after randint(2,5) attempts
|
|
|
|
|
# and cache 10 combinations.
|
|
|
|
|
#
|
|
|
|
|
#auth_class = AuthRandom
|
|
|
|
|
#auth_class_parameters = 2, 5, 10
|
|
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
|
2015-08-19 14:19:01 +00:00
|
|
|
# No authentication checking at all
|
|
|
|
|
# enabling 'auth_none' will enable the ssh2 'auth_none' authentication method
|
|
|
|
|
# this allows the requested user in without any verification at all
|
|
|
|
|
#
|
|
|
|
|
# (default: false)
|
2016-01-19 11:14:51 +00:00
|
|
|
#auth_none_enabled = false
|
2015-08-19 14:19:01 +00:00
|
|
|
|
|
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
2017-02-18 15:50:00 +00:00
|
|
|
# Historical SSH Specific Options
|
|
|
|
|
# historical options in [honeypot] that have not yet been moved to [ssh]
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
2010-10-31 12:20:07 +00:00
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
# Source Port to report in logs (useful if you use iptables to forward ports to Cowrie)
|
|
|
|
|
#reported_ssh_port = 22
|
2014-08-18 12:25:10 +00:00
|
|
|
|
2010-10-31 12:20:07 +00:00
|
|
|
|
|
|
|
|
|
2018-05-03 05:49:16 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# Shell Options
|
|
|
|
|
# Options around Cowrie's Shell Emulation
|
|
|
|
|
# ============================================================================
|
|
|
|
|
|
|
|
|
|
[shell]
|
|
|
|
|
|
2018-06-27 23:31:05 +00:00
|
|
|
# File in the Python pickle format containing the virtual filesystem.
|
|
|
|
|
#
|
|
|
|
|
# This includes the filenames, paths, permissions for the Cowrie filesystem,
|
|
|
|
|
# but not the file contents. This is created by the bin/createfs utility from
|
|
|
|
|
# a real template linux installation.
|
|
|
|
|
#
|
|
|
|
|
# (default: fs.pickle)
|
|
|
|
|
filesystem = ${honeypot:share_path}/fs.pickle
|
|
|
|
|
|
|
|
|
|
|
2018-07-07 18:11:32 +00:00
|
|
|
# File that contains output for the `ps` command.
|
|
|
|
|
#
|
|
|
|
|
# (default: share/cowrie/cmdoutput.json)
|
|
|
|
|
processes = share/cowrie/cmdoutput.json
|
|
|
|
|
|
|
|
|
|
|
2018-05-03 05:49:16 +00:00
|
|
|
# Fake architectures/OS
|
|
|
|
|
# When Cowrie receive a command like /bin/cat XXXX (where XXXX is an executable)
|
|
|
|
|
# it replies with the content of a dummy executable (located in data_path/arch)
|
|
|
|
|
# compiled for an architecture/OS/endian_mode
|
|
|
|
|
# arch can be a comma separated list. When there are multiple elements, a random
|
|
|
|
|
# is chosen at login time.
|
|
|
|
|
# (default: linux-x64-lsb)
|
|
|
|
|
|
|
|
|
|
arch = linux-x64-lsb
|
|
|
|
|
|
|
|
|
|
# Here the list of supported OS-ARCH-ENDIANESS executables
|
|
|
|
|
# bsd-aarch64-lsb: 64-bit LSB ARM aarch64 version 1 (SYSV)
|
|
|
|
|
# bsd-aarch64-msb: 64-bit MSB ARM aarch64 version 1 (SYSV)
|
|
|
|
|
# bsd-bfin-msb: 32-bit MSB Analog Devices Blackfin version 1 (SYSV)
|
|
|
|
|
# bsd-mips64-lsb: 64-bit LSB MIPS MIPS-III version 1 (SYSV)
|
|
|
|
|
# bsd-mips64-msb: 64-bit MSB MIPS MIPS-III version 1 (SYSV)
|
|
|
|
|
# bsd-mips-lsb: 32-bit LSB MIPS MIPS-I version 1 (FreeBSD)
|
|
|
|
|
# bsd-mips-msb: 32-bit MSB MIPS MIPS-I version 1 (FreeBSD)
|
|
|
|
|
# bsd-powepc64-lsb: 64-bit MSB 64-bit PowerPC or cisco 7500 version 1 (FreeBSD)
|
|
|
|
|
# bsd-powepc-msb: 32-bit MSB PowerPC or cisco 4500 version 1 (FreeBSD)
|
|
|
|
|
# bsd-riscv64-lsb: 64-bit LSB UCB RISC-V version 1 (SYSV)
|
|
|
|
|
# bsd-sparc64-msb: 64-bit MSB SPARC V9 relaxed memory ordering version 1 (FreeBSD)
|
|
|
|
|
# bsd-sparc-msb: 32-bit MSB SPARC version 1 (SYSV) statically
|
|
|
|
|
# bsd-x32-lsb: 32-bit LSB Intel 80386 version 1 (FreeBSD)
|
|
|
|
|
# bsd-x64-lsb: 64-bit LSB x86-64 version 1 (FreeBSD)
|
|
|
|
|
# linux-aarch64-lsb: 64-bit LSB ARM aarch64 version 1 (SYSV)
|
|
|
|
|
# linux-aarch64-msb: 64-bit MSB ARM aarch64 version 1 (SYSV)
|
|
|
|
|
# linux-alpha-lsb: 64-bit LSB Alpha (unofficial) version 1 (SYSV)
|
|
|
|
|
# linux-am33-lsb: 32-bit LSB Matsushita MN10300 version 1 (SYSV)
|
|
|
|
|
# linux-arc-lsb: 32-bit LSB ARC Cores Tangent-A5 version 1 (SYSV)
|
|
|
|
|
# linux-arc-msb: 32-bit MSB ARC Cores Tangent-A5 version 1 (SYSV)
|
|
|
|
|
# linux-arm-lsb: 32-bit LSB ARM EABI5 version 1 (SYSV)
|
|
|
|
|
# linux-arm-msb: 32-bit MSB ARM EABI5 version 1 (SYSV)
|
|
|
|
|
# linux-avr32-lsb: 32-bit LSB Atmel AVR 8-bit version 1 (SYSV)
|
|
|
|
|
# linux-bfin-lsb: 32-bit LSB Analog Devices Blackfin version 1 (SYSV)
|
|
|
|
|
# linux-c6x-lsb: 32-bit LSB TI TMS320C6000 DSP family version 1
|
|
|
|
|
# linux-c6x-msb: 32-bit MSB TI TMS320C6000 DSP family version 1
|
|
|
|
|
# linux-cris-lsb: 32-bit LSB Axis cris version 1 (SYSV)
|
|
|
|
|
# linux-frv-msb: 32-bit MSB Cygnus FRV (unofficial) version 1 (SYSV)
|
|
|
|
|
# linux-h8300-msb: 32-bit MSB Renesas H8/300 version 1 (SYSV)
|
|
|
|
|
# linux-hppa64-msb: 64-bit MSB PA-RISC 02.00.00 (LP64) version 1
|
|
|
|
|
# linux-hppa-msb: 32-bit MSB PA-RISC *unknown arch 0xf* version 1 (GNU/Linux)
|
|
|
|
|
# linux-ia64-lsb: 64-bit LSB IA-64 version 1 (SYSV)
|
|
|
|
|
# linux-m32r-msb: 32-bit MSB Renesas M32R version 1 (SYSV)
|
|
|
|
|
# linux-m68k-msb: 32-bit MSB Motorola m68k 68020 version 1 (SYSV)
|
|
|
|
|
# linux-microblaze-msb: 32-bit MSB Xilinx MicroBlaze 32-bit RISC version 1 (SYSV)
|
|
|
|
|
# linux-mips64-lsb: 64-bit LSB MIPS MIPS-III version 1 (SYSV)
|
|
|
|
|
# linux-mips64-msb: 64-bit MSB MIPS MIPS-III version 1 (SYSV)
|
|
|
|
|
# linux-mips-lsb: 32-bit LSB MIPS MIPS-I version 1 (SYSV)
|
|
|
|
|
# linux-mips-msb: 32-bit MSB MIPS MIPS-I version 1 (SYSV)
|
|
|
|
|
# linux-mn10300-lsb: 32-bit LSB Matsushita MN10300 version 1 (SYSV)
|
|
|
|
|
# linux-nios-lsb: 32-bit LSB Altera Nios II version 1 (SYSV)
|
|
|
|
|
# linux-nios-msb: 32-bit MSB Altera Nios II version 1 (SYSV)
|
|
|
|
|
# linux-powerpc64-lsb: 64-bit LSB 64-bit PowerPC or cisco 7500 version 1 (SYSV)
|
|
|
|
|
# linux-powerpc64-msb: 64-bit MSB 64-bit PowerPC or cisco 7500 version 1 (SYSV)
|
|
|
|
|
# linux-powerpc-lsb: 32-bit LSB PowerPC or cisco 4500 version 1 (SYSV)
|
|
|
|
|
# linux-powerpc-msb: 32-bit MSB PowerPC or cisco 4500 version 1 (SYSV)
|
|
|
|
|
# linux-riscv64-lsb: 64-bit LSB UCB RISC-V version 1 (SYSV)
|
|
|
|
|
# linux-s390x-msb: 64-bit MSB IBM S/390 version 1 (SYSV)
|
|
|
|
|
# linux-sh-lsb: 32-bit LSB Renesas SH version 1 (SYSV)
|
|
|
|
|
# linux-sh-msb: 32-bit MSB Renesas SH version 1 (SYSV)
|
|
|
|
|
# linux-sparc64-msb: 64-bit MSB SPARC V9 relaxed memory ordering version 1 (SYSV)
|
|
|
|
|
# linux-sparc-msb: 32-bit MSB SPARC version 1 (SYSV)
|
|
|
|
|
# linux-tilegx64-lsb: 64-bit LSB Tilera TILE-Gx version 1 (SYSV)
|
|
|
|
|
# linux-tilegx64-msb: 64-bit MSB Tilera TILE-Gx version 1 (SYSV)
|
|
|
|
|
# linux-tilegx-lsb: 32-bit LSB Tilera TILE-Gx version 1 (SYSV)
|
|
|
|
|
# linux-tilegx-msb: 32-bit MSB Tilera TILE-Gx version 1 (SYSV)
|
|
|
|
|
# linux-x64-lsb: 64-bit LSB x86-64 version 1 (SYSV)
|
|
|
|
|
# linux-x86-lsb: 32-bit LSB Intel 80386 version 1 (SYSV)
|
|
|
|
|
# linux-xtensa-msb: 32-bit MSB Tensilica Xtensa version 1 (SYSV)
|
|
|
|
|
# osx-x32-lsb: 32-bit LSB Intel 80386
|
|
|
|
|
# osx-x64-lsb: 64-bit LSB x86-64
|
|
|
|
|
|
2018-07-15 11:18:47 +00:00
|
|
|
# arch = bsd-aarch64-lsb, bsd-aarch64-msb, bsd-bfin-msb, bsd-mips-lsb, bsd-mips-msb, bsd-mips64-lsb, bsd-mips64-msb, bsd-powepc-msb, bsd-powepc64-lsb, bsd-riscv64-lsb, bsd-sparc-msb, bsd-sparc64-msb, bsd-x32-lsb, bsd-x64-lsb, linux-aarch64-lsb, linux-aarch64-msb, linux-alpha-lsb, linux-am33-lsb, linux-arc-lsb, linux-arc-msb, linux-arm-lsb, linux-arm-msb, linux-avr32-lsb, linux-bfin-lsb, linux-c6x-lsb, linux-c6x-msb, linux-cris-lsb, linux-frv-msb, linux-h8300-msb, linux-hppa-msb, linux-hppa64-msb, linux-ia64-lsb, linux-m32r-msb, linux-m68k-msb, linux-microblaze-msb, linux-mips-lsb, linux-mips-msb, linux-mips64-lsb, linux-mips64-msb, linux-mn10300-lsb, linux-nios-lsb, linux-nios-msb, linux-powerpc-lsb, linux-powerpc-msb, linux-powerpc64-lsb, linux-powerpc64-msb, linux-riscv64-lsb, linux-s390x-msb, linux-sh-lsb, linux-sh-msb, linux-sparc-msb, linux-sparc64-msb, linux-tilegx-lsb, linux-tilegx-msb, linux-tilegx64-lsb, linux-tilegx64-msb, linux-x64-lsb, linux-x86-lsb, linux-xtensa-msb, osx-x32-lsb, osx-x64-lsb
|
2018-05-03 05:49:16 +00:00
|
|
|
|
2018-06-18 10:32:42 +00:00
|
|
|
# Modify the response of '/bin/uname'
|
|
|
|
|
# Default (uname -a): Linux <hostname> <kernel_version> <kernel_build_string> <hardware_platform> <operating system>
|
|
|
|
|
kernel_version = 3.2.0-4-amd64
|
|
|
|
|
kernel_build_string = #1 SMP Debian 3.2.68-1+deb7u1
|
|
|
|
|
hardware_platform = x86_64
|
|
|
|
|
operating_system = GNU/Linux
|
2018-05-03 05:49:16 +00:00
|
|
|
|
|
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# SSH Specific Options
|
|
|
|
|
# ============================================================================
|
|
|
|
|
[ssh]
|
|
|
|
|
|
|
|
|
|
# Enable SSH support
|
|
|
|
|
# (default: true)
|
|
|
|
|
enabled = true
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Public and private SSH key files. If these don't exist, they are created
|
|
|
|
|
# automatically.
|
2018-06-27 23:21:55 +00:00
|
|
|
rsa_public_key = ${honeypot:etc_path}/ssh_host_rsa_key.pub
|
|
|
|
|
rsa_private_key = ${honeypot:etc_path}/ssh_host_rsa_key
|
|
|
|
|
dsa_public_key = ${honeypot:etc_path}/ssh_host_dsa_key.pub
|
|
|
|
|
dsa_private_key = ${honeypot:etc_path}/ssh_host_dsa_key
|
2016-01-19 11:14:51 +00:00
|
|
|
|
2015-01-27 11:01:06 +00:00
|
|
|
|
2018-07-06 23:02:06 +00:00
|
|
|
# SSH version string as present to the client.
|
|
|
|
|
#
|
|
|
|
|
# Version string MUST start with SSH-2.0- or SSH-1.99-
|
2014-02-16 09:50:41 +00:00
|
|
|
#
|
2016-01-19 11:14:51 +00:00
|
|
|
# Use these to disguise your honeypot from a simple SSH version scan
|
|
|
|
|
# Examples:
|
2014-02-16 09:50:41 +00:00
|
|
|
# SSH-2.0-OpenSSH_5.1p1 Debian-5
|
2014-05-28 04:13:55 +00:00
|
|
|
# SSH-1.99-OpenSSH_4.3
|
|
|
|
|
# SSH-1.99-OpenSSH_4.7
|
|
|
|
|
# SSH-1.99-Sun_SSH_1.1
|
2014-02-16 09:50:41 +00:00
|
|
|
# SSH-2.0-OpenSSH_4.2p1 Debian-7ubuntu3.1
|
2014-05-28 04:13:55 +00:00
|
|
|
# SSH-2.0-OpenSSH_4.3
|
|
|
|
|
# SSH-2.0-OpenSSH_4.6
|
2014-02-16 09:50:41 +00:00
|
|
|
# SSH-2.0-OpenSSH_5.1p1 Debian-5
|
|
|
|
|
# SSH-2.0-OpenSSH_5.1p1 FreeBSD-20080901
|
|
|
|
|
# SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu5
|
|
|
|
|
# SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu6
|
|
|
|
|
# SSH-2.0-OpenSSH_5.3p1 Debian-3ubuntu7
|
|
|
|
|
# SSH-2.0-OpenSSH_5.5p1 Debian-6
|
|
|
|
|
# SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze1
|
|
|
|
|
# SSH-2.0-OpenSSH_5.5p1 Debian-6+squeeze2
|
|
|
|
|
# SSH-2.0-OpenSSH_5.8p2_hpn13v11 FreeBSD-20110503
|
|
|
|
|
# SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1
|
2015-05-13 06:40:21 +00:00
|
|
|
# SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
|
2014-02-16 09:50:41 +00:00
|
|
|
# SSH-2.0-OpenSSH_5.9
|
|
|
|
|
#
|
2015-05-13 06:40:21 +00:00
|
|
|
# (default: "SSH-2.0-SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2")
|
2017-03-16 06:57:53 +00:00
|
|
|
version = SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u2
|
2014-02-16 09:50:41 +00:00
|
|
|
|
2011-02-10 16:33:59 +00:00
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
# IP addresses to listen for incoming SSH connections.
|
2017-04-30 12:40:25 +00:00
|
|
|
# (DEPRECATED: use listen_endpoints instead)
|
2017-03-16 06:57:53 +00:00
|
|
|
#
|
|
|
|
|
# (default: 0.0.0.0) = any IPv4 address
|
|
|
|
|
#listen_addr = 0.0.0.0
|
|
|
|
|
# (use :: for listen to all IPv6 and IPv4 addresses)
|
|
|
|
|
#listen_addr = ::
|
2016-01-19 11:14:51 +00:00
|
|
|
|
|
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
# Port to listen for incoming SSH connections.
|
2017-04-30 12:40:25 +00:00
|
|
|
# (DEPRECATED: use listen_endpoints instead)
|
2017-03-16 06:57:53 +00:00
|
|
|
#
|
|
|
|
|
# (default: 2222)
|
|
|
|
|
#listen_port = 2222
|
2016-01-19 11:14:51 +00:00
|
|
|
|
|
|
|
|
|
2017-04-30 12:31:00 +00:00
|
|
|
# Endpoint to listen on for incoming SSH connections.
|
|
|
|
|
# See https://twistedmatrix.com/documents/current/core/howto/endpoints.html#servers
|
2017-04-30 12:40:25 +00:00
|
|
|
# (default: listen_endpoints = tcp:2222:interface=0.0.0.0)
|
|
|
|
|
# (use systemd: endpoint for systemd activation)
|
|
|
|
|
# listen_endpoints = systemd:domain=INET:index=0
|
2017-08-20 05:57:31 +00:00
|
|
|
# For both IPv4 and IPv6: listen_endpoints = tcp6:2222:interface=\:\:
|
2018-07-12 21:26:22 +00:00
|
|
|
# Listening on multiple endpoints is supported with a single space seperator
|
|
|
|
|
# e.g listen_endpoints = "tcp:2222:interface=0.0.0.0 tcp:1022:interface=0.0.0.0" will result listening both on ports 2222 and 1022
|
|
|
|
|
# use authbind for port numbers under 1024
|
|
|
|
|
|
2017-04-30 12:40:25 +00:00
|
|
|
listen_endpoints = tcp:2222:interface=0.0.0.0
|
2017-04-30 12:31:00 +00:00
|
|
|
|
|
|
|
|
|
2017-04-30 12:40:25 +00:00
|
|
|
# Enable the SFTP subsystem
|
|
|
|
|
# (default: true)
|
2016-01-19 11:14:51 +00:00
|
|
|
sftp_enabled = true
|
2011-10-21 09:29:06 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
# Enable SSH direct-tcpip forwarding
|
|
|
|
|
# (default: true)
|
|
|
|
|
forwarding = true
|
|
|
|
|
|
2016-06-15 14:31:22 +00:00
|
|
|
|
|
|
|
|
# This enables redirecting forwarding requests to another address
|
2017-03-16 06:57:53 +00:00
|
|
|
# Useful for forwarding protocols to other honeypots
|
2016-06-15 14:31:22 +00:00
|
|
|
# (default: false)
|
2017-03-16 06:57:53 +00:00
|
|
|
forward_redirect = false
|
2016-06-15 14:31:22 +00:00
|
|
|
|
2017-03-16 06:57:53 +00:00
|
|
|
|
|
|
|
|
# Configure where to forward the data to.
|
2016-06-24 16:09:30 +00:00
|
|
|
# forward_redirect_<portnumber> = <redirect ip>:<redirect port>
|
2017-03-16 06:57:53 +00:00
|
|
|
|
|
|
|
|
# Redirect http/https
|
2017-06-04 08:25:55 +00:00
|
|
|
# forward_redirect_80 = 127.0.0.1:8000
|
|
|
|
|
# forward_redirect_443 = 127.0.0.1:8443
|
2017-03-16 06:57:53 +00:00
|
|
|
|
|
|
|
|
# To record SMTP traffic, install an SMTP honeypoint.
|
2016-06-15 14:31:22 +00:00
|
|
|
# (e.g https://github.com/awhitehatter/mailoney), run
|
|
|
|
|
# python mailoney.py -s yahoo.com -t schizo_open_relay -p 12525
|
2017-06-04 08:25:55 +00:00
|
|
|
# forward_redirect_25 = 127.0.0.1:12525
|
|
|
|
|
# forward_redirect_587 = 127.0.0.1:12525
|
2016-01-19 11:14:51 +00:00
|
|
|
|
2016-08-14 04:08:47 +00:00
|
|
|
|
2018-03-27 07:58:32 +00:00
|
|
|
# This enables tunneling forwarding requests to another address
|
|
|
|
|
# Useful for forwarding protocols to a proxy like Squid
|
|
|
|
|
# (default: false)
|
|
|
|
|
forward_tunnel = false
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Configure where to tunnel the data to.
|
|
|
|
|
# forward_tunnel_<portnumber> = <tunnel ip>:<tunnel port>
|
|
|
|
|
|
|
|
|
|
# Tunnel http/https
|
|
|
|
|
# forward_tunnel_80 = 127.0.0.1:3128
|
|
|
|
|
# forward_tunnel_443 = 127.0.0.1:3128
|
|
|
|
|
|
2017-02-18 15:50:00 +00:00
|
|
|
|
2016-08-14 04:08:47 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# Telnet Specific Options
|
|
|
|
|
# ============================================================================
|
2016-08-22 11:56:19 +00:00
|
|
|
[telnet]
|
|
|
|
|
|
|
|
|
|
# Enable Telnet support, disabled by default
|
|
|
|
|
enabled = false
|
2016-08-14 04:08:47 +00:00
|
|
|
|
|
|
|
|
# IP addresses to listen for incoming Telnet connections.
|
2017-04-30 12:40:25 +00:00
|
|
|
# (DEPRECATED: use listen_endpoints instead)
|
2016-08-14 04:08:47 +00:00
|
|
|
#
|
|
|
|
|
# (default: 0.0.0.0) = any IPv4 address
|
2016-08-22 11:56:19 +00:00
|
|
|
#listen_addr = 0.0.0.0
|
2016-08-14 04:08:47 +00:00
|
|
|
# (use :: for listen to all IPv6 and IPv4 addresses)
|
2016-08-22 11:56:19 +00:00
|
|
|
#listen_addr = ::
|
2016-08-14 04:08:47 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
# Port to listen for incoming Telnet connections.
|
2017-04-30 12:40:25 +00:00
|
|
|
# (DEPRECATED: use listen_endpoints instead)
|
2016-08-14 04:08:47 +00:00
|
|
|
#
|
|
|
|
|
# (default: 2223)
|
2016-08-22 11:56:19 +00:00
|
|
|
#listen_port = 2223
|
2016-08-14 04:08:47 +00:00
|
|
|
|
2017-04-30 12:40:25 +00:00
|
|
|
|
2017-04-30 12:31:00 +00:00
|
|
|
# Endpoint to listen on for incoming Telnet connections.
|
|
|
|
|
# See https://twistedmatrix.com/documents/current/core/howto/endpoints.html#servers
|
2017-04-30 12:40:25 +00:00
|
|
|
# (default: listen_endpoints = tcp:2223:interface=0.0.0.0)
|
|
|
|
|
# (use systemd: endpoint for systemd activation)
|
|
|
|
|
# listen_endpoints = systemd:domain=INET:index=0
|
2017-05-09 13:29:58 +00:00
|
|
|
# For IPv4 and IPv6: listen_endpoints = tcp6:2223:interface=\:\: tcp:2223:interface=0.0.0.0
|
2018-07-12 21:26:22 +00:00
|
|
|
# Listening on multiple endpoints is supported with a single space seperator
|
|
|
|
|
# e.g "listen_endpoints = tcp:2223:interface=0.0.0.0 tcp:2323:interface=0.0.0.0" will result listening both on ports 2223 and 2323
|
|
|
|
|
# use authbind for port numbers under 1024
|
|
|
|
|
|
2017-04-30 12:40:25 +00:00
|
|
|
listen_endpoints = tcp:2223:interface=0.0.0.0
|
2017-04-30 12:31:00 +00:00
|
|
|
|
|
|
|
|
|
2016-08-14 04:08:47 +00:00
|
|
|
# Source Port to report in logs (useful if you use iptables to forward ports to Cowrie)
|
2016-08-22 11:56:19 +00:00
|
|
|
#reported_port = 23
|
2016-08-14 04:08:47 +00:00
|
|
|
|
|
|
|
|
|
2017-02-18 15:50:00 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# Database logging Specific Options
|
|
|
|
|
# ============================================================================
|
|
|
|
|
|
2010-12-02 19:39:23 +00:00
|
|
|
# XMPP Logging
|
|
|
|
|
# Log to an xmpp server.
|
2015-11-18 19:22:17 +00:00
|
|
|
#
|
2010-12-02 19:39:23 +00:00
|
|
|
#[database_xmpp]
|
|
|
|
|
#server = sensors.carnivore.it
|
|
|
|
|
#user = anonymous@sensors.carnivore.it
|
|
|
|
|
#password = anonymous
|
|
|
|
|
#muc = dionaea.sensors.carnivore.it
|
2015-05-12 14:57:29 +00:00
|
|
|
#signal_createsession = cowrie-events
|
|
|
|
|
#signal_connectionlost = cowrie-events
|
|
|
|
|
#signal_loginfailed = cowrie-events
|
|
|
|
|
#signal_loginsucceeded = cowrie-events
|
|
|
|
|
#signal_command = cowrie-events
|
|
|
|
|
#signal_clientversion = cowrie-events
|
2010-12-02 19:39:23 +00:00
|
|
|
#debug=true
|
2013-03-29 15:04:52 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
|
2016-04-13 16:12:38 +00:00
|
|
|
|
2018-05-06 20:35:17 +00:00
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
|
|
|
|
# Output Plugins
|
2016-04-13 16:12:38 +00:00
|
|
|
# These provide an extensible mechanism to send audit log entries to third
|
|
|
|
|
# parties. The audit entries contain information on clients connecting to
|
|
|
|
|
# the honeypot.
|
2018-04-27 10:09:30 +00:00
|
|
|
#
|
|
|
|
|
# Output entries need to start with 'output_' and have the 'enabled' entry.
|
2016-01-19 11:14:51 +00:00
|
|
|
# ============================================================================
|
2014-11-04 10:31:26 +00:00
|
|
|
|
2018-05-06 20:35:17 +00:00
|
|
|
#[output_xmpp]
|
|
|
|
|
#enabled=true
|
|
|
|
|
#server = conference.cowrie.local
|
|
|
|
|
#user = cowrie@cowrie.local
|
|
|
|
|
#password = cowrie
|
|
|
|
|
#muc = hacker_room
|
2015-11-06 09:42:38 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
# JSON based logging module
|
|
|
|
|
#
|
2015-05-12 15:34:53 +00:00
|
|
|
[output_jsonlog]
|
2018-04-27 10:09:30 +00:00
|
|
|
enabled = true
|
2015-05-12 14:57:29 +00:00
|
|
|
logfile = log/cowrie.json
|
2015-03-10 09:29:29 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
|
2016-04-13 16:12:38 +00:00
|
|
|
# Supports logging to Elasticsearch
|
2015-11-17 00:25:17 +00:00
|
|
|
# This is a simple early release
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_elasticsearch]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = localhost
|
|
|
|
|
#port = 9200
|
|
|
|
|
#index = cowrie
|
|
|
|
|
#type = cowrie
|
2018-06-24 06:46:29 +00:00
|
|
|
#pipeline = geoip
|
2015-11-06 09:42:38 +00:00
|
|
|
|
2015-11-18 17:38:15 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
# Send login attemp information to SANS DShield
|
|
|
|
|
# See https://isc.sans.edu/ssh.html
|
2016-01-19 11:14:51 +00:00
|
|
|
# You must signup for an api key.
|
2015-11-18 19:28:20 +00:00
|
|
|
# Once registered, find your details at: https://isc.sans.edu/myaccount.html
|
2015-11-18 19:22:17 +00:00
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_dshield]
|
|
|
|
|
#userid = userid_here
|
|
|
|
|
#auth_key = auth_key_here
|
|
|
|
|
#batch_size = 100
|
|
|
|
|
#enabled = false
|
2015-11-18 17:38:15 +00:00
|
|
|
|
2015-11-18 19:22:17 +00:00
|
|
|
|
2015-07-30 07:41:14 +00:00
|
|
|
# Local Syslog output module
|
|
|
|
|
#
|
|
|
|
|
# This sends log messages to the local syslog daemon.
|
|
|
|
|
# Facility can be:
|
|
|
|
|
# KERN, USER, MAIL, DAEMON, AUTH, LPR, NEWS, UUCP, CRON, SYSLOG and LOCAL0 to LOCAL7.
|
|
|
|
|
#
|
2016-02-16 14:42:40 +00:00
|
|
|
# Format can be:
|
|
|
|
|
# text, cef
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_localsyslog]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#facility = USER
|
|
|
|
|
#format = text
|
2016-02-16 14:42:40 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
# Text output
|
2016-04-13 16:12:38 +00:00
|
|
|
# This writes audit log entries to a text file
|
2016-02-16 14:42:40 +00:00
|
|
|
#
|
|
|
|
|
# Format can be:
|
|
|
|
|
# text, cef
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_textlog]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#logfile = log/audit.log
|
|
|
|
|
#format = text
|
2015-07-30 07:41:14 +00:00
|
|
|
|
2015-08-09 11:39:30 +00:00
|
|
|
|
2016-04-13 16:12:38 +00:00
|
|
|
# MySQL logging module
|
2015-11-06 09:42:38 +00:00
|
|
|
# Database structure for this module is supplied in doc/sql/mysql.sql
|
2015-11-18 19:22:17 +00:00
|
|
|
#
|
2016-10-30 06:10:27 +00:00
|
|
|
# MySQL logging requires extra software: sudo apt-get install libmysqlclient-dev
|
|
|
|
|
# MySQL logging requires an extra Python module: pip install mysql-python
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_mysql]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = localhost
|
|
|
|
|
#database = cowrie
|
|
|
|
|
#username = cowrie
|
|
|
|
|
#password = secret
|
|
|
|
|
#port = 3306
|
|
|
|
|
#debug = false
|
2015-11-06 09:42:38 +00:00
|
|
|
|
2016-11-05 15:37:01 +00:00
|
|
|
# Rethinkdb output module
|
|
|
|
|
# Rethinkdb output module requires extra Python module: pip install rethinkdb
|
|
|
|
|
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_rethinkdblog]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = 127.0.0.1
|
|
|
|
|
#port = 28015
|
|
|
|
|
#table = output
|
|
|
|
|
#password =
|
|
|
|
|
#db = cowrie
|
2015-11-06 09:42:38 +00:00
|
|
|
|
2016-02-21 21:40:28 +00:00
|
|
|
# SQLite3 logging module
|
|
|
|
|
#
|
2016-02-23 19:17:04 +00:00
|
|
|
# Logging to SQLite3 database. To init the database, use the script
|
|
|
|
|
# doc/sql/sqlite3.sql:
|
|
|
|
|
# sqlite3 <db_file> < doc/sql/sqlite3.sql
|
2016-02-21 21:40:28 +00:00
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_sqlite]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#db_file = cowrie.db
|
2016-04-13 16:12:38 +00:00
|
|
|
|
2017-01-13 13:57:19 +00:00
|
|
|
# MongoDB logging module
|
|
|
|
|
#
|
|
|
|
|
# MongoDB logging requires an extra Python module: pip install pymongo
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_mongodb]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#connection_string = mongodb://username:password@host:port/database
|
|
|
|
|
#database = dbname
|
2017-01-13 13:57:19 +00:00
|
|
|
|
2016-02-21 21:40:28 +00:00
|
|
|
|
2016-07-19 13:42:30 +00:00
|
|
|
# Splunk SDK output module - Legacy. Requires Splunk API installed
|
2015-08-09 13:10:39 +00:00
|
|
|
# This sends logs directly to Splunk using the Python REST SDK
|
2015-11-18 19:22:17 +00:00
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_splunklegacy]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = localhost
|
|
|
|
|
#port = 8889
|
|
|
|
|
#username = admin
|
|
|
|
|
#password = password
|
|
|
|
|
#index = cowrie
|
2015-08-09 11:39:30 +00:00
|
|
|
|
|
|
|
|
|
2017-02-18 15:50:00 +00:00
|
|
|
# Splunk HTTP Event Collector (HEC) output module
|
2016-07-19 13:42:30 +00:00
|
|
|
# Sends JSON directly to Splunk over HTTPS
|
|
|
|
|
# mandatory fields: url, token
|
|
|
|
|
# optional fields: index, source, sourcetype, host
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_splunk]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#url = https://localhost:8088/services/collector/event
|
|
|
|
|
#token = 6A0EA6C6-8006-4E39-FC44-C35FF6E561A8
|
|
|
|
|
#index = cowrie
|
|
|
|
|
#sourcetype = cowrie
|
|
|
|
|
#source = cowrie
|
2016-07-19 13:42:30 +00:00
|
|
|
|
|
|
|
|
|
2016-09-28 18:29:56 +00:00
|
|
|
# HPFeeds
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_hpfeeds]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#server = hpfeeds.mysite.org
|
|
|
|
|
#port = 10000
|
|
|
|
|
#identifier = abc123
|
|
|
|
|
#secret = secret
|
|
|
|
|
#debug=false
|
2016-09-28 18:29:56 +00:00
|
|
|
|
|
|
|
|
|
2016-01-19 11:14:51 +00:00
|
|
|
# VirusTotal output module
|
|
|
|
|
# You must signup for an api key.
|
2016-01-04 13:07:40 +00:00
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_virustotal]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#api_key = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
|
|
|
|
|
#upload = True
|
|
|
|
|
#debug = False
|
2018-01-08 16:59:17 +00:00
|
|
|
|
2016-01-04 13:07:40 +00:00
|
|
|
|
2017-07-04 06:28:20 +00:00
|
|
|
# Cuckoo output module
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_cuckoo]
|
|
|
|
|
#enabled = false
|
2017-07-10 08:10:07 +00:00
|
|
|
# no slash at the end
|
2018-04-27 10:13:38 +00:00
|
|
|
#url_base = http://127.0.0.1:8090
|
|
|
|
|
#user = user
|
|
|
|
|
#passwd = passwd
|
2017-07-10 08:10:07 +00:00
|
|
|
# force will upload duplicated files to cuckoo
|
2018-04-27 10:13:38 +00:00
|
|
|
#force = 0
|
2017-07-04 06:28:20 +00:00
|
|
|
|
2018-03-02 18:47:15 +00:00
|
|
|
# upload to MalShare
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_malshare]
|
|
|
|
|
#enabled = false
|
2018-03-02 18:47:15 +00:00
|
|
|
|
2016-12-20 07:15:28 +00:00
|
|
|
# This will produce a _lot_ of messages - you have been warned....
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_slack]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#channel = channel_that_events_should_be_posted_in
|
|
|
|
|
#token = slack_token_for_your_bot
|
|
|
|
|
#debug = false
|
2016-12-20 07:15:28 +00:00
|
|
|
|
|
|
|
|
|
2016-12-05 10:46:49 +00:00
|
|
|
# https://csirtg.io
|
|
|
|
|
# You must signup for an api key.
|
|
|
|
|
#
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_csirtg]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#username = wes
|
|
|
|
|
#feed = scanners
|
|
|
|
|
#description = random scanning activity
|
|
|
|
|
#token = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
|
2017-04-13 14:16:22 +00:00
|
|
|
|
|
|
|
|
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_socketlog]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#address = 127.0.0.1:9000
|
|
|
|
|
#timeout = 5
|
2017-10-27 12:26:12 +00:00
|
|
|
|
|
|
|
|
# Upload files that cowrie has captured to an S3 (or compatible bucket)
|
|
|
|
|
# Files are stored with a name that is the SHA of their contents
|
|
|
|
|
#
|
|
|
|
|
#[output_s3]
|
|
|
|
|
#
|
2018-03-26 12:43:56 +00:00
|
|
|
# The AWS credentials to use.
|
|
|
|
|
# Leave these blank to use botocore's credential discovery e.g .aws/config or ENV variables.
|
|
|
|
|
# As per https://github.com/boto/botocore/blob/develop/botocore/credentials.py#L50-L65
|
2017-10-27 12:26:12 +00:00
|
|
|
#access_key_id = AKIDEXAMPLE
|
|
|
|
|
#secret_access_key = wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY
|
|
|
|
|
#
|
|
|
|
|
# The bucket to store the files in. The bucket must already exist.
|
|
|
|
|
#bucket = my-cowrie-bucket
|
|
|
|
|
#
|
|
|
|
|
# The region the bucket is in
|
|
|
|
|
#region = eu-west-1
|
|
|
|
|
#
|
|
|
|
|
# An alternate endpoint URL. If you self host a pithos instance you can set
|
|
|
|
|
# this to its URL (e.g. https://s3.mydomain.com) - can otherwise be blank
|
|
|
|
|
#endpoint =
|
|
|
|
|
#
|
|
|
|
|
# Whether or not to validate the S3 certificate. Set this to 'no' to turn this
|
|
|
|
|
# off. Do not do this for real AWS. It's only needed for self-hosted S3 clone
|
|
|
|
|
# where you don't yet have real certificates.
|
|
|
|
|
#verify = no
|
2018-01-31 17:49:44 +00:00
|
|
|
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_influx]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = 127.0.0.1
|
|
|
|
|
#port = 8086
|
|
|
|
|
#database_name = cowrie
|
|
|
|
|
#retention_policy_duration = 12w
|
2018-03-26 12:43:07 +00:00
|
|
|
|
2018-06-18 13:04:57 +00:00
|
|
|
[output_kafka]
|
|
|
|
|
enabled = false
|
|
|
|
|
host = 127.0.0.1
|
|
|
|
|
port = 9092
|
|
|
|
|
topic = cowrie
|
|
|
|
|
|
2018-03-26 12:43:07 +00:00
|
|
|
|
2018-04-27 10:13:38 +00:00
|
|
|
#[output_redis]
|
|
|
|
|
#enabled = false
|
|
|
|
|
#host = 127.0.0.1
|
|
|
|
|
#port = 6379
|
2018-03-26 12:43:07 +00:00
|
|
|
# DB of the redis server. Defaults to 0
|
2018-04-27 10:13:38 +00:00
|
|
|
#db = 0
|
2018-03-26 12:43:07 +00:00
|
|
|
# Password of the redis server. Defaults to None
|
|
|
|
|
#password = secret
|
|
|
|
|
# Name of the list to push to or the channel to publish to. Required
|
2018-04-27 10:13:38 +00:00
|
|
|
#keyname = cowrie
|
2018-03-26 12:43:07 +00:00
|
|
|
# Method to use when sending data to redis.
|
|
|
|
|
# Can be one of [lpush, rpush, publish]. Defaults to lpush
|
|
|
|
|
#send_method = lpush
|
