T-pot not finding the right network interface after reboot

[CountyWorker]

Hi and good continuing!

It seems that on my network the main host interface is not ready before T-Pot is started, hence the docker instances just finds interface docker0 after the daily reboot. By restarting it manually (systemctl restart tpot) after reboot it finds the right interface.

Some docker instances has a command for greping the interface name from a list produced by the command /sbin/ip. It would be easily solved by being able to define the interface in a configuration file for tpot.

Example:

In the file tpotce/docker/suricata/Dockerfile you find in the end:

CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }')

At reboot this command does not find the main interface but docker0.

Tried solutions:

1. I have reinstalled tpot on a freshly installed Ubuntu 24.04 Server a couple of times.
2. Added fixed IP-address
3. Tried configuration systemd services to really wait out the interface (see below)
4. ?

Thanks for a great product!! Love it!

[dmille6]

there is a service file called "tpot.service" for tpot in the : /etc/systemd/system folder
you can add a "timer" option to it.

i * think * you just add the timer option:

[Timer]
OnBootSec=30s

so it would look something like this:

[Unit]
Description=T-Pot
Wants=docker.service network-online.target
After=docker.service network-online.target

[Timer]
OnBootSec=30s

[Service]
Restart=always
RestartSec=5
Type=simple
TimeoutSec=infinity
ExecStartPre=-/usr/bin/docker compose -f /home/mike/tpotce/docker-compose.yml down -v
ExecStart=/usr/bin/docker compose -f /home/mike/tpotce/docker-compose.yml up
ExecStop=/usr/bin/docker compose -f /home/mike/tpotce/docker-compose.yml down -v
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

[dmille6]

it would be somethign like this.. this should at least give you a place to start.

[CountyWorker]

I think I've solved it, will post back if it doesn't.

Solution that seems to work:

1. Fixed IP-address
2. Added a service that wait for domain lookup to work:

[Unit]
DefaultDependencies=no
After=nss-lookup.target
Before=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=sh -c 'until ping -c 1 example.com; do sleep 1; done'

[Install]
WantedBy=network-online.target

Solution that doesn't:

3. Added some specifics to tpot-service:

[Unit]
Description=T-Pot
BindsTo=sys-subsystem-net-devices-{INTERFACE_NAME}.device
Wants=docker.service network-online.target sys-subsystem-net-devices-{INTERFACE_NAME}.device
After=docker.service network-online.target sys-subsystem-net-devices-{INTERFACE_NAME}.device

[Service]
Restart=always
RestartSec=10
Type=simple
TimeoutSec=infinity
ExecStartPre=-/usr/bin/docker compose -f /home/user/tpotce/docker-compose.yml down -v
ExecStart=/usr/bin/docker compose -f /home/user/tpotce/docker-compose.yml up
ExecStop=/usr/bin/docker compose -f /home/user/tpotce/docker-compose.yml down -v
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

I think the best solution would be if one could specify the interface in the configuration file for tpotce.

Cheers!