anti
f2b3393669
Replaces LICENSE (GPLv3 -> AGPLv3) and prepends `SPDX-License-Identifier: AGPL-3.0-or-later` to every source file across decnet/, decnet_web/, tests/, scripts/, and tools/. Rationale: closes the GPLv3 ASP loophole so any party operating a modified DECNET as a network service must offer their modified source. Personal copyright (Samuel Paschuan) + inbound=outbound contributions make a future unilateral relicense infeasible. - LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt) - COPYRIGHT: project copyright notice - tools/add_spdx_headers.py: idempotent header injector (shebang- and PEP 263-aware) Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh). No behavior change; comments only.
122 lines
4.8 KiB
Python
122 lines
4.8 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
import os
|
|
from pathlib import Path
|
|
|
|
from decnet.services.base import BaseService, ServiceConfigField
|
|
|
|
TEMPLATES_DIR = Path(__file__).parent.parent / "templates" / "ssh"
|
|
ARTIFACTS_ROOT = os.environ.get("DECNET_ARTIFACTS_ROOT", "/var/lib/decnet/artifacts")
|
|
|
|
|
|
class SSHService(BaseService):
|
|
"""
|
|
Interactive OpenSSH server for general-purpose deckies.
|
|
|
|
Replaced Cowrie emulation with a real sshd so fingerprinting tools and
|
|
experienced attackers cannot trivially identify the honeypot. Auth events,
|
|
sudo activity, and interactive commands are all forwarded to stdout as
|
|
RFC 5424 via the rsyslog bridge baked into the image.
|
|
|
|
service_cfg keys:
|
|
password Root password (default: "admin")
|
|
user Non-root user name (default: "ubuntu") for
|
|
realistic "ssh user@host" lures + privesc capture
|
|
user_password Non-root user's password (default: "admin")
|
|
hostname Override container hostname
|
|
"""
|
|
|
|
name = "ssh"
|
|
ports = [22]
|
|
default_image = "build"
|
|
|
|
config_schema = [
|
|
ServiceConfigField(
|
|
key="password",
|
|
label="Root password",
|
|
type="password",
|
|
default="admin",
|
|
secret=True,
|
|
help="Plaintext root password for the in-container sshd.",
|
|
),
|
|
ServiceConfigField(
|
|
key="user",
|
|
label="Non-root user",
|
|
type="string",
|
|
default="ubuntu",
|
|
help=(
|
|
"Username for the second account on the decoy. Real Linux "
|
|
"boxes (especially Ubuntu cloud images) ship a non-root "
|
|
"admin user — having one makes the decoy more lifelike, "
|
|
"captures attackers who try `ssh user@host` for network "
|
|
"enumeration, and surfaces sudo/privesc behaviour the root-"
|
|
"only path misses."
|
|
),
|
|
),
|
|
ServiceConfigField(
|
|
key="user_password",
|
|
label="Non-root user password",
|
|
type="password",
|
|
default="admin",
|
|
secret=True,
|
|
help=(
|
|
"Password for the non-root user. Captured at PAM auth time "
|
|
"via the same auth-helper that handles root logins. The "
|
|
"user is in the `sudo` group; subsequent privesc attempts "
|
|
"fan out through the existing sudo-log capture."
|
|
),
|
|
),
|
|
ServiceConfigField(
|
|
key="hostname",
|
|
label="Container hostname",
|
|
type="string",
|
|
help=(
|
|
"Cosmetic override for the SSH banner/PS1 — keeps the decoy "
|
|
"looking heterogeneous. Decky identity (NODE_NAME) is unaffected."
|
|
),
|
|
placeholder="e.g. mail-01.corp.local",
|
|
),
|
|
]
|
|
|
|
def compose_fragment(
|
|
self,
|
|
decky_name: str,
|
|
log_target: str | None = None,
|
|
service_cfg: dict | None = None,
|
|
) -> dict:
|
|
cfg = service_cfg or {}
|
|
env: dict = {
|
|
"SSH_ROOT_PASSWORD": cfg.get("password", "admin"),
|
|
# Non-root user account — created at runtime by the entrypoint
|
|
# iff SSH_USER is non-empty. Defaults to "ubuntu"/"admin" so
|
|
# `ssh ubuntu@<decky>` works out of the box (the conventional
|
|
# cloud-init account on Ubuntu cloud images, very low-friction
|
|
# for attackers running ssh enumeration scripts).
|
|
"SSH_USER": cfg.get("user", "ubuntu"),
|
|
"SSH_USER_PASSWORD": cfg.get("user_password", "admin"),
|
|
# NODE_NAME is the authoritative decky identifier for log
|
|
# attribution — matches the host path used for the artifacts
|
|
# bind mount below. The container hostname (optionally overridden
|
|
# via SSH_HOSTNAME) is cosmetic and may differ to keep the
|
|
# decoy looking heterogeneous.
|
|
"NODE_NAME": decky_name,
|
|
}
|
|
if "hostname" in cfg:
|
|
env["SSH_HOSTNAME"] = cfg["hostname"]
|
|
|
|
# File-catcher quarantine: bind-mount a per-decky host dir so attacker
|
|
# drops (scp/sftp/wget) are mirrored out-of-band for forensic analysis.
|
|
# The in-container path masquerades as systemd-coredump so `mount`/`df`
|
|
# from inside the container looks benign.
|
|
quarantine_host = f"{ARTIFACTS_ROOT}/{decky_name}/ssh"
|
|
return {
|
|
"build": {"context": str(TEMPLATES_DIR)},
|
|
"container_name": f"{decky_name}-ssh",
|
|
"restart": "unless-stopped",
|
|
"cap_add": ["NET_BIND_SERVICE"],
|
|
"environment": env,
|
|
"volumes": [f"{quarantine_host}:/var/lib/systemd/coredump:rw"],
|
|
}
|
|
|
|
def dockerfile_context(self) -> Path:
|
|
return TEMPLATES_DIR
|