Cockpit support is deprecated, port used for distributed T-Pot deployment

[MM-CMA]

Hello,

I have reviewed your response regarding the following ticket:

Tpot - Cockpit can’t connect to 64294 (Issue #1821)

After going through the documentation, I was unable to find any information related to port 64294. I therefore have several questions:

Why am I able to access Tpot through port 64294, where a login field is displayed?

Why do I encounter a permission issue when attempting to log in?

You mentioned that this port (64294) no longer provides access to the management console, unlike in previous versions. In that case, what is the new procedure to access the management console as before?

Finally, could you let us know if any documentation is available to guide us on how to access the management console?

Thank you in advance for your clarification.

[t3chn0m4g3]

1. Find the port description here.
2. The port has been repurposed that is why it is requesting credentials.
3. The Cockpit Project has got you covered.

[MM-CMA]

Hello,

Thank you.

I will follow the cockpit documentation and i come back to you

Regards,
Mehdi M

[MM-CMA]

Hello,

I was able to successfully install Cockpit, however I have another question:

We are trying to deploy the TPot honeypot in a restricted environment (DMZ).
According to the TPot documentation, an internet connection is required for TPot to function.
We would like to restrict network access and only allow the minimum connections needed for TPot to operate.
Do you have a list of FQDNs or IP addresses that need to be allowed in order to ensure the proper functioning of the TPot honeypot?

Regards,
Mehdi M,

[t3chn0m4g3]

Restricting T-Pot's outgoing communication will limit the quality of events you will see in T-Pot - as described here - since some honeypots require an outgoing connection as well (i.e. to retrieve attacker payloads).
Basically, for T-Pot to work as intended, you allow all outgoing communication and restrict inbound communication to ports 1-64000 or, depending on your use-case, to the exact honeypot services you want to be reachable, i.e. tcp/22 / or if you have a distributed setup you will also need to allow the required ports as mentioned in the ReadMe.