Dockerized conpot in T-Pot
conpot is a low interactive server side ICS/SCADA honeypot with the goal to collect intelligence about the motives and methods of adversaries targeting industrial control systems.
This repository contains the necessary files to create a dockerized version of conpot.
For this setup, it is inteded to extend and configure conpot to use the new PowerLogic ION6200 module only.
Dockerfile contains the blueprint for the dockerized conpot and will be used to setup the docker image.
conpot.conf is tailored to fit the T-Pot (honyepot) environment. All important data is stored in
supervisord.conf is used to start conpot under supervision of supervisord.
In case you want to run the dockerized conpot independently, you must modify the config files to match your environment and rebuild the docker image.
Using upstart, copy the
/etc/init/conpot.conf and start using the command: service conpot start
This will make sure that the docker container is started with the appropriate rights. Further, it autostarts during boot. In the T-Pot setup, some ports are excluded as they need to be reserved for other honeypot daemons running in parallel.