Using with Cowrie

[rangerrkm]

Hello,

I just got done setting up Kippo-Graph for use with Cowrie.

My setup is Ubuntu 14.04 64-bit, Kippo-Graph 1.5.1 and Cowrie (latest from git clone).

Installed location is: /home/cowrie/cowrie/

kippo is in the /var/www/html/kippo-graph/

I believe most of the charts and graphs are working, but Kippo-Playlog is not working.

On the Kippo-Input section, at the very bottom.

I see Interesting Commands, when I click play, under PlayLog, it takes me to Kippo-PlayLog.

All that I see is a blackbox with *** End of log! ***. Does this seem correct.

Also, when I click on the PlayLog Hyperlink, all that is it showing is Replay input by attackers captured by the honeypot system.

I checked my apache2 log files and it is free of errors.

I would like some help in trying to fix this issue, if this is not the correct function of PlayLog.

I did try using the playlog.py command and it works great from the command line.

Thanks for any help,

[micheloosterhof]

@ikoniaris hi! there are several tickets open for integration with Cowrie. Do you intend to continue to keep kippo-graph and cowrie interoperable or would it be better if there was a fork cowrie-graph fork?

[ikoniaris]

@micheloosterhof hi! Ideally... it would be nice if Kippo-Graph could support both. But, I think most people nowadays switch to Cowrie (I think there might need to be some better "marketing" for it since some people still use Kippo, but Cowrie is more modern and maintained). So, I'd be inclined to switch support to Cowrie. Problem is I don't have enough time to spend maintaining the project unfortunately. Have you taken a look at the code so far to determine if fixes for Cowrie as "easy" or not?

[micheloosterhof]

Actually it works fine once you install all the prereqs and set the right config variables.
Maybe you can change the defaults a little (BACKEND = cowrie) and the directory.