The idea for T-Pot Mobile started a couple of years back when T-Pot started to support the ARM64 architecture. Raspberry Pi hardware was hard to come by at reasonable prices so the journey took a little longer than anticipated. Started as a one-day-a-month project at work, it fastly turned into a weekend / evening project (winter was coming) and the first version was done in December 2023.<br><br> While already being an eye catcher the display was not bright enough, the resistive touchpanel and the resolution really did limit the possibilities. In consequence a new display had to be found that helped overcome the drawbacks. The Waveshare 4.3" capacitive display was a great choice with a higher resolution.<br><br> Bigger is better - and in this case (pun intended) it is really true. T-Pot Mobile now supports an 8" display to make it an even bigger eye catcher!<br><br> To support the 8" display alongside the 4.3" a new case had to to be created while adjusting the code to make use of the added screen estate. <br><br> We are very happy to share this project continiously as open source, with a huge thanks to Telekom Security to make this possible.<br><br> Create yours today, all files for 3d printing included!

T-Pot Mobile

<!-- vscode-markdown-toc -->

• 1. Hardware requirements
  • 1.1. 8 inch
  • 1.2. 4.3 inch
• 2. Requirements
• 3. Installation
  • 3.1. One liner installation
  • 3.2. Manual installation
• 4. LTE Stick settings
• 5. Usage
  • 5.1. Turn on
  • 5.2. Turn off
• 6. T-Pot Mobile UI
  • 6.1. Waiting for Elasticsearch
  • 6.2. Stats Mode
  • 6.3. Map Mode
  • 6.4. Open Dialog Box
    • 6.4.1. Cancel
    • 6.4.2. Map / Stats
    • 6.4.3. Reboot
    • 6.4.4. Power Off
• 7. Maintenance and Troubleshooting
  • 7.1. Connect a keyboard
  • 7.2. Exit the GUI
  • 7.3. Starting / Stopping T-Pot services
  • 7.4. Cronjob
  • 7.5. Updates
  • 7.6. Network Settings
• 8. 3d Print Settings
• 9. Assembling the parts - 8 inch
• 10. Assembling the parts - 4.3 inch
• 11. Credits
• 12. Licenses

<!-- vscode-markdown-toc-config numbering=true autoSave=true /vscode-markdown-toc-config --> <!-- /vscode-markdown-toc -->

1. <a name='Hardwarerequirements'></a>Hardware requirements

T-Pot Mobile is developed specifically to make T-Pot a tangible, fully wireless honeypot using hardware components for:

<details> <summary>

1.1. <a name='inch'></a>8 inch

</summary>

• Raspberry Pi 4 model B with 8GB of RAM, 64GB microSD card
• Waveshare 8" touch display
• Waveshare UPS HAT with 2 * 18650 batteries
• ZTE MF79U Wingle CAT4-4G with the USB plug removed
• Nuts and standoff assortment for M2.5 and M3

</details> <details> <summary>

1.2. <a name='inch-1'></a>4.3 inch

</summary>

• Raspberry Pi 4 model B with 8GB of RAM, 64GB microSD card
• Waveshare 4.3" touch display, make sure to order the version including the case
• Waveshare UPS HAT with 2 * 18650 batteries
• ZTE MF79U Wingle CAT4-4G with the USB plug removed
• Nuts and standoff assortment

</details>

Regarding the hardware limits of the Raspberry Pi4 platform (mainly RAM and storage) T-Pot Mobile will use a docker-compose.yml specifically adjusted for this use case.

2. <a name='Requirements'></a>Requirements

• Raspbian Lite, 64bit based on Raspbian / Debian Bookworm
• At least T-Pot 24.04.0 which will be installed by the T-Pot Mobile installer
• Prepare the microSD Card with a user i.e. tsec and the WiFi settings for your local network (adjustments of the Wifi settings are described here)

3. <a name='Installation'></a>Installation

3.1. <a name='Onelinerinstallation'></a>One liner installation

env bash -c "$(curl -sL https://github.com/telekom-security/tpotmobile/raw/main/install.sh)"

3.2. <a name='Manualinstallation'></a>Manual installation

Boot the machine, SSH into Raspbian on tcp/22, run the following commands and follow the installer:

sudo apt install git
git clone https://github.com/telekom-security/tpotmobile
cd tpotmobile
bash install.sh

The install.sh script will also install T-Pot. When the installer asks for a T-Pot type, please choose (M)obile in order to download the correct docker images.

Then sudo reboot the machine, please notice after the reboot SSH will only be available via tcp/64295.

It takes about 8 minutes until all services are started successfully after installation.

4. <a name='LTESticksettings'></a>LTE Stick settings

• Login: Factory default, adjust after setup
• SSID: Factory default, adjust after setup
• PSK: Factory default, adjust after setup
• For Telekom in Germany: Setup the LTE stick to use APN with NAT Type 2: internet.t-d1.de.
• Use NAT forwarding only for ports 1-64000 to avoid exposing T-Pot management ports, such as SSH.
• For DHCP / MAC settings ensure that the same IP will always be assigned to the T-Pot Wifi Adapter or NAT will break once a new IP lease starts.

5. <a name='Usage'></a>Usage

5.1. <a name='Turnon'></a>Turn on

• After turning the device on (UPS HAT power switch in on-position) the device will automatically boot and wait for the mobile network / WiFi to be fully enabled.
• It takes roughly 8-10 minutes until all services have been started, then the first events should trickle in.

5.2. <a name='Turnoff'></a>Turn off

• After Shutting Down the device can be turned off (UPS HAT power switch in off-position). Always shutdown the device first to avoid damaging the elasticsearch index and / or filesystem.

6. <a name='T-PotMobileUI'></a>T-Pot Mobile UI

The UI has been developed using Pygame (Raspbian / Debian Bookworm is fully supported and required).<br>

6.1. <a name='WaitingforElasticsearch'></a>Waiting for Elasticsearch

• Once the device has started the UI will wait for Elasticsearch to be available, afterwards the UI will switch into stats mode (default: Last 1h). The UI can be fully utilized once events have been written to the Elasticsearch index.

6.2. <a name='StatsMode'></a>Stats Mode

• A single touch will switch between the available timeframes (Last 1m, 15m, 1h, 24h).

6.3. <a name='MapMode'></a>Map Mode

• In Map Mode the UI will display the events on a map utilizing some animations.

6.4. <a name='OpenDialogBox'></a>Open Dialog Box

• Swiping up from the bottom of the screen towards the top of the screen (at least half the height of the screen) will open the dialog box. <br> <br>

6.4.1. <a name='Cancel'></a>Cancel

• Will exit the dialog box.

6.4.2. <a name='MapStats'></a>Map / Stats

• While in Stats mode the button will be called "Map" and when pressed will open the Map mode.
• While in Map mode the button will be called "Stats" and when pressed will open the Stats mode.

6.4.3. <a name='Reboot'></a>Reboot

• The Reboot button will reboot the system.

6.4.4. <a name='PowerOff'></a>Power Off

• The Power Off button will shut down the system. The system is designed for 24/7 operation, however it needs to be turned off using the Power Off function to avoid damaging the file system or elastic search indices.

7. <a name='MaintenanceandTroubleshooting'></a>Maintenance and Troubleshooting

7.1. <a name='Connectakeyboard'></a>Connect a keyboard

• For troubleshooting you can connect a keyboard.

7.2. <a name='ExittheGUI'></a>Exit the GUI

• Press q to exit the GUI.
• Login to the system with your username, i.e. tsec and the password you chose.
• You now have access to the console as with any other Raspbian / Debian installation.

7.3. <a name='StartingStoppingT-Potservices'></a>Starting / Stopping T-Pot services

• In /etc/systemd/system are the T-Pot systemd service files tpot.service and tpotdisplay.service located. While tpot.service does control the T-Pot services tpotdisplay.service controls the T-Pot Mobile GUI.
• Start T-Pot: sudo systemctl start tpot.service
• Start T-Pot Mobile GUI: sudo systemctl start tpotdisplay.service
• Stop T-Pot: sudo systemctl stop tpot.service
• Stop T-Pot Mobile GUI: sudo systemctl stop tpotdisplay.service

7.4. <a name='Cronjob'></a>Cronjob

• T-Pot Mobile will restart the device by default every day. You can change the cronjob se