anti
8dd4c78b33
Rename the container-side logging module decnet_logging → syslog_bridge (canonical at templates/syslog_bridge.py, synced into each template by the deployer). Drop the stale per-template copies; setuptools find was picking them up anyway. Swap useradd/USER/chown "decnet" for "logrelay" so no obvious token appears in the rendered container image. Apply the same cloaking pattern to the telnet template that SSH got: syslog pipe moves to /run/systemd/journal/syslog-relay and the relay is cat'd via exec -a "systemd-journal-fwd". rsyslog.d conf rename 99-decnet.conf → 50-journal-forward.conf. SSH capture script: /var/decnet/captured → /var/lib/systemd/coredump (real systemd path), logger tag decnet-capture → systemd-journal. Compose volume updated to match the new in-container quarantine path. SD element ID shifts decnet@55555 → relay@55555; synced across collector, parser, sniffer, prober, formatter, tests, and docs so the host-side pipeline still matches what containers emit.
76 lines
2.9 KiB
Python
76 lines
2.9 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
FTP server using Twisted's FTP server infrastructure.
|
|
Accepts any credentials, logs all commands and file requests,
|
|
forwards events as JSON to LOG_TARGET if set.
|
|
"""
|
|
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from twisted.internet import defer, reactor
|
|
from twisted.protocols.ftp import FTP, FTPFactory, FTPAnonymousShell
|
|
from twisted.python.filepath import FilePath
|
|
from twisted.python import log as twisted_log
|
|
from syslog_bridge import syslog_line, write_syslog_file, forward_syslog
|
|
|
|
NODE_NAME = os.environ.get("NODE_NAME", "ftpserver")
|
|
SERVICE_NAME = "ftp"
|
|
LOG_TARGET = os.environ.get("LOG_TARGET", "")
|
|
PORT = int(os.environ.get("PORT", "21"))
|
|
BANNER = os.environ.get("FTP_BANNER", "220 (vsFTPd 3.0.3)")
|
|
|
|
def _log(event_type: str, severity: int = 6, **kwargs) -> None:
|
|
line = syslog_line(SERVICE_NAME, NODE_NAME, event_type, severity, **kwargs)
|
|
write_syslog_file(line)
|
|
forward_syslog(line, LOG_TARGET)
|
|
|
|
def _setup_bait_fs() -> str:
|
|
bait_dir = Path("/tmp/ftp_bait")
|
|
bait_dir.mkdir(parents=True, exist_ok=True)
|
|
|
|
(bait_dir / "backup.tar.gz").write_bytes(b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x03\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00")
|
|
(bait_dir / "db_dump.sql").write_text("CREATE TABLE users (id INT, username VARCHAR(50), password VARCHAR(50));\nINSERT INTO users VALUES (1, 'admin', 'pbkdf2:sha256:5000$...');\n")
|
|
(bait_dir / "config.ini").write_text("[database]\nuser = dbadmin\npassword = db_super_admin_pass_!\nhost = localhost\n")
|
|
(bait_dir / "credentials.txt").write_text("admin:super_secret_admin_pw\nroot:toor\nalice:wonderland\n")
|
|
|
|
return str(bait_dir)
|
|
|
|
class ServerFTP(FTP):
|
|
def connectionMade(self):
|
|
peer = self.transport.getPeer()
|
|
_log("connection", src_ip=peer.host, src_port=peer.port)
|
|
super().connectionMade()
|
|
|
|
def ftp_USER(self, username):
|
|
self._server_user = username
|
|
_log("user", username=username)
|
|
return super().ftp_USER(username)
|
|
|
|
def ftp_PASS(self, password):
|
|
_log("auth_attempt", username=getattr(self, "_server_user", "?"), password=password)
|
|
# Accept everything — we're a honeypot server
|
|
self.state = self.AUTHED
|
|
self._user = getattr(self, "_server_user", "anonymous")
|
|
self.shell = FTPAnonymousShell(FilePath(_setup_bait_fs()))
|
|
return defer.succeed((230, "Login successful."))
|
|
|
|
def ftp_RETR(self, path):
|
|
_log("download_attempt", path=path)
|
|
return super().ftp_RETR(path)
|
|
|
|
def connectionLost(self, reason):
|
|
peer = self.transport.getPeer()
|
|
_log("disconnect", src_ip=peer.host, src_port=peer.port)
|
|
super().connectionLost(reason)
|
|
|
|
class ServerFTPFactory(FTPFactory):
|
|
protocol = ServerFTP
|
|
welcomeMessage = BANNER
|
|
|
|
if __name__ == "__main__":
|
|
twisted_log.startLoggingWithObserver(lambda e: None, setStdout=False)
|
|
_log("startup", msg=f"FTP server starting as {NODE_NAME} on port {PORT}")
|
|
reactor.listenTCP(PORT, ServerFTPFactory())
|
|
reactor.run()
|