Skip to content

Commit dc4384d

Browse files
t3chn0m4g3t3chn0m4g3
authored
Merge pull request #1369 from swiftsolves-msft/pr-azure
Azure Deployment via ARM template
2 parents 81fab84 + 1af7cdc commit dc4384d

3 files changed

Lines changed: 379 additions & 0 deletions

File tree

‎cloud/azure/README.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
2+
# Azure T-Pot
3+
4+
The following deployment template will deploy a Standard T-Pot server on a Azure VM on a Network\Subnet of your choosing. [Click here to learn more on T-Pot](https://github.com/telekom-security/tpotce)
5+
6+
[![Deploy To Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazure.svg?sanitize=true)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Ftelekom-security%2Ftpotce%2Fmaster%2Fcloud%2Fazure%2Fazuredeploy.json)
7+
[![Deploy To Azure US Gov](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazuregov.svg?sanitize=true)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Ftelekom-security%2Ftpotce%2Fmaster%2Fcloud%2Fazure%2Fazuredeploy.json)
8+
[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Ftelekom-security%2Ftpotce%2Fmaster%2Fcloud%2Fazure%2Fazuredeploy.json)
9+
10+
## Install Instructions
11+
12+
1. Update the VM Name to reflect your naming convention and taxonomy.
13+
2. Place you Azure Virtual Network Resource Id *(Recommendation of
14+
placement depending on goal, you may want to place in Hub Virtual
15+
Network to detect activity from on-premise or other virtual
16+
network spokes. You can also place in DMZ or isolated in a unique
17+
virtual network exposed to direct internet.)*
18+
3. My Connection IP of a public ip address you are coming from to use dashboards and manage.
19+
4. Cloud Init B64 Encoded write your cloud init yaml contents and base 64 encode them into this string parameter.
20+
21+
Cloud-Init Yaml Example before B64 Encoding:
22+
23+
packages:
24+
- git
25+
26+
runcmd:
27+
- curl -sS --retry 5 https://github.com
28+
- git clone https://github.com/telekom-security/tpotce /root/tpot
29+
- /root/tpot/iso/installer/install.sh --type=auto --conf=/root/tpot.conf
30+
- rm /root/tpot.conf
31+
- /sbin/shutdown -r now
32+
33+
password: w3b$ecrets2!
34+
chpasswd:
35+
expire: false
36+
37+
write_files:
38+
- content: |
39+
# tpot configuration file
40+
myCONF_TPOT_FLAVOR='STANDARD'
41+
myCONF_WEB_USER='webuser'
42+
myCONF_WEB_PW='w3b$ecrets2!'
43+
owner: root:root
44+
path: /root/tpot.conf
45+
permissions: '0600'
46+
47+
Be sure to copy and update values like:
48+
49+
- password:
50+
- myCONF_TPOT_FLAVOR= (Different flavors as follows: [STANDARD,
51+
HIVE, HIVE_SENSOR, INDUSTRIAL, LOG4J, MEDICAL, MINI, SENSOR]
52+
**Recommend deploying STANDARD** if you are exploring first time)
53+
- myCONF_WEB_USER=
54+
- myCONF_WEB_PW=
55+
56+
Once you update the cloud init yaml file locally then base 64 encode and paste this string to in the securestring parameter.
57+
58+
B64 Example:
59+
60+
I2Nsb3VkLWNvbmZpZwp0aW1lem9uZTogVVMvRWFzdGVybgoKcGFja2FnZXM6CiAgLSBnaXQKCnJ1bmNtZDoKICAtIGN1cmwgLXNTIC0tcmV0cnkgNSBodHRwczovL2dpdGh1Yi5jb20KICAtIGdpdCBjbG9uZSBodHRwczovL2dpdGh1Yi5jb20vdGVsZWtvbS1zZWN1cml0eS90cG90Y2UgL3Jvb3QvdHBvdAogIC0gL3Jvb3QvdHBvdC9pc28vaW5zdGFsbGVyL2luc3RhbGwuc2ggLS10eXBlPWF1dG8gLS1jb25mPS9yb290L3Rwb3QuY29uZgogIC0gcm0gL3Jvb3QvdHBvdC5jb25mCiAgLSAvc2Jpbi9zaHV0ZG93biAtciBub3cKCnBhc3N3b3JkOiB3M2IkZWNyZXRzMiEKY2hwYXNzd2Q6CiAgZXhwaXJlOiBmYWxzZQoKd3JpdGVfZmlsZXM6CiAgLSBjb250ZW50OiB8CiAgICAgICMgdHBvdCBjb25maWd1cmF0aW9uIGZpbGUKICAgICAgbXlDT05GX1RQT1RfRkxBVk9SPSdTVEFOREFSRCcKICAgICAgbXlDT05GX1dFQl9VU0VSPSd3ZWJ1c2VyJwogICAgICBteUNPTkZfV0VCX1BXPSd3M2IkZWNyZXRzMiEnCiAgICBvd25lcjogcm9vdDpyb290CiAgICBwYXRoOiAvcm9vdC90cG90LmNvbmYKICAgIHBlcm1pc3Npb25zOiAnMDYwMCc=
61+
62+
Click review and create, deployment of VM should take less than 5 minutes, however Cloud-Init will take some time, **typically 15 minutes** before T-Pot services are up and running.
63+
64+
## Post Install Instructions
65+
Install **may take around 15 minutes** for services to come up. Check to make sure from your public IP you can connect to https://azurepuplicip:64297 you will be prompted for your username and password supplied in the B64 Cloud Init String you supplied for *myCONF_WEB_PW=*
66+
67+
Review the [available honeypots architecture section](https://raw.githubusercontent.com/telekom-security/tpotce/master/doc/architecture.png) and [available ports](https://github.com/telekom-security/tpotce#required-ports) and poke a hole in the Network Security Group to expose the T-Pot to your on-premise network CIDR, or other Azure virtual network CIDRs, finally you can also expose a port to the public Internet for Threat Intelligence gathering.
68+
69+
## Network Security Group
70+
Please study the rules carefully. You may need to make some additional rules or modifications based on your needs and considerations. As an example if this is for internal private ip range detections you may want to remove rules and place a higher priority DENY rule preventing all the T-Pot ports and services being exposed internally, and then place a few ALLOW rules to your on-premise private ip address CIDR, other Hub Private IPs, and some Spoke Private IPs.
71+
![enter image description here](https://raw.githubusercontent.com/telekom-security/tpotce/master/cloud/azure/images/nsg.png)

‎cloud/azure/azuredeploy.json‎

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
{
2+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"VMName": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "VM Name and convention your company uses, be sure to entice naming EX. vm-fileshares-prod-eastus-003"
9+
},
10+
"defaultValue": "vm-fileshares-prod-eastus-003"
11+
},
12+
"virtualNetworkId": {
13+
"type": "string",
14+
"metadata": {
15+
"description": "Virtual Network Resource ID to Deploy Azure VM into"
16+
},
17+
"defaultValue": "/subscriptions/{SUBID}/resourceGroups/{RG NAME}/providers/Microsoft.Network/virtualNetworks/{VNET NAME}"
18+
},
19+
"subnetName": {
20+
"type": "string",
21+
"metadata": {
22+
"description": "Virtual Network Subnet Name to Deploy Azure VM into"
23+
}
24+
},
25+
"MyConnectionIP": {
26+
"type": "string",
27+
"minLength": 7,
28+
"maxLength": 15,
29+
"metadata": {
30+
"description": "The Public IP I will be connecting from to administer and configure"
31+
},
32+
"defaultValue": "XXX.XXX.XXX.XXX"
33+
},
34+
"adminUsername": {
35+
"type": "string",
36+
"minLength": 1,
37+
"defaultValue": "webuser",
38+
"metadata": {
39+
"description": "Admin user name for Linux VM"
40+
}
41+
},
42+
"authenticationType": {
43+
"type": "string",
44+
"defaultValue": "password",
45+
"allowedValues": [
46+
"sshPublicKey",
47+
"password"
48+
],
49+
"metadata": {
50+
"description": "Type of authentication to use on the Virtual Machine. SSH key is recommended."
51+
}
52+
},
53+
"adminPasswordOrKey": {
54+
"type": "securestring",
55+
"metadata": {
56+
"description": "SSH Key or password for the Virtual Machine. SSH key is recommended."
57+
}
58+
},
59+
"CloudInitB64Encoded": {
60+
"type": "securestring",
61+
"metadata": {
62+
"description": "Cloud Init Configuration as a Base 64 encoded string, decode to examine a few variables to change and encode and submit"
63+
},
64+
"defaultValue": "I2Nsb3VkLWNvbmZpZwp0aW1lem9uZTogVVMvRWFzdGVybgoKcGFja2FnZXM6CiAgLSBnaXQKCnJ1bmNtZDoKICAtIGN1cmwgLXNTIC0tcmV0cnkgNSBodHRwczovL2dpdGh1Yi5jb20KICAtIGdpdCBjbG9uZSBodHRwczovL2dpdGh1Yi5jb20vdGVsZWtvbS1zZWN1cml0eS90cG90Y2UgL3Jvb3QvdHBvdAogIC0gL3Jvb3QvdHBvdC9pc28vaW5zdGFsbGVyL2luc3RhbGwuc2ggLS10eXBlPWF1dG8gLS1jb25mPS9yb290L3Rwb3QuY29uZgogIC0gcm0gL3Jvb3QvdHBvdC5jb25mCiAgLSAvc2Jpbi9zaHV0ZG93biAtciBub3cKCnBhc3N3b3JkOiB3M2IkZWNyZXRzMiEKY2hwYXNzd2Q6CiAgZXhwaXJlOiBmYWxzZQoKd3JpdGVfZmlsZXM6CiAgLSBjb250ZW50OiB8CiAgICAgICMgdHBvdCBjb25maWd1cmF0aW9uIGZpbGUKICAgICAgbXlDT05GX1RQT1RfRkxBVk9SPSdTVEFOREFSRCcKICAgICAgbXlDT05GX1dFQl9VU0VSPSd3ZWJ1c2VyJwogICAgICBteUNPTkZfV0VCX1BXPSd3M2IkZWNyZXRzMiEnCiAgICBvd25lcjogcm9vdDpyb290CiAgICBwYXRoOiAvcm9vdC90cG90LmNvbmYKICAgIHBlcm1pc3Npb25zOiAnMDYwMCc="
65+
}
66+
},
67+
"variables": {
68+
"vnetId": "[parameters('virtualNetworkId')]",
69+
"subnetRef": "[concat(variables('vnetId'), '/subnets/', parameters('subnetName'))]",
70+
"linuxConfiguration": {
71+
"disablePasswordAuthentication": true,
72+
"ssh": {
73+
"publicKeys": [
74+
{
75+
"path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]",
76+
"keyData": "[parameters('adminPasswordOrKey')]"
77+
}
78+
]
79+
}
80+
}
81+
},
82+
"resources": [
83+
{
84+
"name": "[concat(uniqueString(resourceGroup().id, deployment().name),'-nic')]",
85+
"type": "Microsoft.Network/networkInterfaces",
86+
"apiVersion": "2021-08-01",
87+
"location": "[resourceGroup().location]",
88+
"dependsOn": [
89+
"[resourceId('Microsoft.Network/networkSecurityGroups/', concat(uniqueString(resourceGroup().id, deployment().name),'-nsg'))]",
90+
"[resourceId('Microsoft.Network/publicIpAddresses', concat(uniqueString(resourceGroup().id, deployment().name),'-pip'))]"
91+
],
92+
"properties": {
93+
"ipConfigurations": [
94+
{
95+
"name": "ipconfig1",
96+
"properties": {
97+
"subnet": {
98+
"id": "[variables('subnetRef')]"
99+
},
100+
"privateIPAllocationMethod": "Dynamic",
101+
"publicIpAddress": {
102+
"id": "[resourceId(resourceGroup().name, 'Microsoft.Network/publicIpAddresses', concat(uniqueString(resourceGroup().id, deployment().name),'-pip'))]",
103+
"properties": {
104+
"deleteOption": "Detach"
105+
}
106+
}
107+
}
108+
}
109+
],
110+
"enableAcceleratedNetworking": true,
111+
"networkSecurityGroup": {
112+
"id": "[resourceId('Microsoft.Network/networkSecurityGroups/', concat(uniqueString(resourceGroup().id, deployment().name),'-nsg'))]"
113+
}
114+
}
115+
},
116+
{
117+
"name": "[concat(uniqueString(resourceGroup().id, deployment().name),'-nsg')]",
118+
"type": "Microsoft.Network/networkSecurityGroups",
119+
"apiVersion": "2019-02-01",
120+
"location": "[resourceGroup().location]",
121+
"properties": {
122+
"securityRules": [
123+
{
124+
"name": "AllowAzureCloud22Inbound",
125+
"properties": {
126+
"protocol": "*",
127+
"sourcePortRange": "*",
128+
"destinationPortRange": "22",
129+
"sourceAddressPrefix": "AzureCloud",
130+
"destinationAddressPrefix": "*",
131+
"access": "Allow",
132+
"priority": 1011,
133+
"direction": "Inbound",
134+
"sourcePortRanges": [],
135+
"destinationPortRanges": [],
136+
"sourceAddressPrefixes": [],
137+
"destinationAddressPrefixes": []
138+
}
139+
},
140+
{
141+
"name": "AllowCustom64294Inbound",
142+
"properties": {
143+
"protocol": "*",
144+
"sourcePortRange": "*",
145+
"destinationPortRange": "64294",
146+
"sourceAddressPrefix": "[parameters('MyConnectionIP')]",
147+
"destinationAddressPrefix": "*",
148+
"access": "Allow",
149+
"priority": 1021,
150+
"direction": "Inbound",
151+
"sourcePortRanges": [],
152+
"destinationPortRanges": [],
153+
"sourceAddressPrefixes": [],
154+
"destinationAddressPrefixes": []
155+
}
156+
},
157+
{
158+
"name": "AllowSSHCustom64295Inbound",
159+
"properties": {
160+
"protocol": "*",
161+
"sourcePortRange": "*",
162+
"destinationPortRange": "64295",
163+
"sourceAddressPrefix": "[parameters('MyConnectionIP')]",
164+
"destinationAddressPrefix": "*",
165+
"access": "Allow",
166+
"priority": 1031,
167+
"direction": "Inbound",
168+
"sourcePortRanges": [],
169+
"destinationPortRanges": [],
170+
"sourceAddressPrefixes": [],
171+
"destinationAddressPrefixes": []
172+
}
173+
},
174+
{
175+
"name": "AllowAzureCloud64295Inbound",
176+
"properties": {
177+
"protocol": "*",
178+
"sourcePortRange": "*",
179+
"destinationPortRange": "64295",
180+
"sourceAddressPrefix": "AzureCloud",
181+
"destinationAddressPrefix": "*",
182+
"access": "Allow",
183+
"priority": 1041,
184+
"direction": "Inbound",
185+
"sourcePortRanges": [],
186+
"destinationPortRanges": [],
187+
"sourceAddressPrefixes": [],
188+
"destinationAddressPrefixes": []
189+
}
190+
},
191+
{
192+
"name": "AllowCustom64297Inbound",
193+
"properties": {
194+
"protocol": "*",
195+
"sourcePortRange": "*",
196+
"destinationPortRange": "64297",
197+
"sourceAddressPrefix": "[parameters('MyConnectionIP')]",
198+
"destinationAddressPrefix": "*",
199+
"access": "Allow",
200+
"priority": 1051,
201+
"direction": "Inbound",
202+
"sourcePortRanges": [],
203+
"destinationPortRanges": [],
204+
"sourceAddressPrefixes": [],
205+
"destinationAddressPrefixes": []
206+
}
207+
},
208+
{
209+
"name": "AllowAllHomeOfficeCustomAnyInbound",
210+
"properties": {
211+
"protocol": "*",
212+
"sourcePortRange": "*",
213+
"destinationPortRange": "*",
214+
"sourceAddressPrefix": "[parameters('MyConnectionIP')]",
215+
"destinationAddressPrefix": "*",
216+
"access": "Allow",
217+
"priority": 1061,
218+
"direction": "Inbound",
219+
"sourcePortRanges": [],
220+
"destinationPortRanges": [],
221+
"sourceAddressPrefixes": [],
222+
"destinationAddressPrefixes": []
223+
}
224+
}
225+
]
226+
}
227+
},
228+
{
229+
"name": "[concat(uniqueString(resourceGroup().id, deployment().name),'-pip')]",
230+
"type": "Microsoft.Network/publicIpAddresses",
231+
"apiVersion": "2020-08-01",
232+
"location": "[resourceGroup().location]",
233+
"properties": {
234+
"publicIpAllocationMethod": "Static"
235+
},
236+
"sku": {
237+
"name": "Standard"
238+
},
239+
"zones": [
240+
"1"
241+
]
242+
},
243+
{
244+
"name": "[parameters('VMName')]",
245+
"type": "Microsoft.Compute/virtualMachines",
246+
"apiVersion": "2022-03-01",
247+
"location": "[resourceGroup().location]",
248+
"dependsOn": [
249+
"[resourceId('Microsoft.Network/networkInterfaces', concat(uniqueString(resourceGroup().id, deployment().name),'-nic'))]"
250+
],
251+
"properties": {
252+
"hardwareProfile": {
253+
"vmSize": "Standard_D4s_v3"
254+
},
255+
"storageProfile": {
256+
"osDisk": {
257+
"createOption": "fromImage",
258+
"managedDisk": {
259+
"storageAccountType": "StandardSSD_LRS"
260+
},
261+
"deleteOption": "Delete"
262+
},
263+
"imageReference": {
264+
"publisher": "debian",
265+
"offer": "debian-11",
266+
"sku": "11-gen2",
267+
"version": "latest"
268+
},
269+
"dataDisks": [
270+
{
271+
"name": "[concat(parameters('VMName'),'-datadisk')]",
272+
"diskSizeGB": 256,
273+
"lun": 0,
274+
"createOption": "Empty",
275+
"caching": "ReadWrite"
276+
}
277+
]
278+
},
279+
"networkProfile": {
280+
"networkInterfaces": [
281+
{
282+
"id": "[resourceId('Microsoft.Network/networkInterfaces', concat(uniqueString(resourceGroup().id, deployment().name),'-nic'))]",
283+
"properties": {
284+
"deleteOption": "Delete"
285+
}
286+
}
287+
]
288+
},
289+
"osProfile": {
290+
"computerName": "[parameters('VMName')]",
291+
"adminUsername": "[parameters('adminUsername')]",
292+
"adminPassword": "[parameters('adminPasswordOrKey')]",
293+
"linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), null(), variables('linuxConfiguration'))]",
294+
"customData": "[parameters('CloudInitB64Encoded')]"
295+
},
296+
"diagnosticsProfile": {
297+
"bootDiagnostics": {
298+
"enabled": true
299+
}
300+
}
301+
},
302+
"zones": [
303+
"1"
304+
]
305+
}
306+
],
307+
"outputs": {}
308+
}

‎cloud/azure/images/nsg.png‎

48.7 KB
Loading

0 commit comments

Comments
 (0)