$ show telekom-security/tpotce
T-Pot Community Edition (tpotce) is an all-in-one honeypot platform that orchestrates 20+ honeypots (e.g., cowrie, dionaea, conpot, heralding) alongside network security monitoring tools (p0f, Suricata, fatt) and the Elastic Stack (Elasticsearch, Logstash, Kibana) for centralized log storage, analysis, and real-time attack visualization. The system is deployed via Docker Compose with an Ansible-based installer supporting multiple Linux distributions. It offers several deployment flavors (standard, sensor, mini, LLM, tarpit, mobile) and supports a distributed Hive/Sensor architecture where remote sensors forward encrypted logs to a central Hive over HTTPS. Architecturally, each honeypot runs in an isolated container with read-only filesystems, non-root user, and dedicated networks. The ELK stack processes all telemetry: Logstash ingests JSON logs from persistent volumes, Elasticsearch indexes them, and Kibana provides dashboards and an attack map. A custom p0f (passive OS fingerprinting) fork is bundled and compiled from C source, demonstrating deep network-level analysis. The update and backup system (`update.sh`) is a robust, self-contained script that handles version pinning, configuration backups, Elasticsearch state exports, and image rollouts. The codebase includes a reusable test harness (`docker/_tests/lib/common.sh`) for validating individual honeypot containers with protocol-specific probes.
The LLM identified 2 files worth highlighting for reuse:
A reusable shell function library that provides consistent primitives for testing Docker-based services: container readiness checks, dynamic port mapping resolution, log file text matching, and safe Docker Compose teardown. Each test script sources this library and follows a structured pattern (validate args → prepare compose → start container → probe protocol → assert logs). This pattern is directly portable to any project needing smoke tests for Dockerized applications.
Core TCP/IP fingerprinting engine extracted from the p0f passive OS detection tool. It implements signature matching against a database of TCP stack quirks (MSS, window size, TTL, options, IP ID, ECN) to identify remote operating systems and detect NAT/proxies. The code demonstrates non-obvious skill in low-level packet parsing, hash-based signature lookup (using DJB hash), and scoring heuristics. This module could be extracted and integrated into any network monitoring or security tool requiring passive fingerprinting.