Deploy HIVE and HIVE-SENSOR on the same server

[Bastibaard]

Hey everyone,

I would like to introduce T-POT in my organization as an internship project. The HIVE and SENSOR editions are exactly what would be the most beneficial for our situation.

My question: is it possible to install both HIVE and HIVE-SENSOR on the same machine? I didn't get it to work however I think it has to do with the fact that you cannot have a HIVE and HIVE-SENSOR edition active on the same machine at the same time?

A possible solution is to make a standalone T-POT server first and have it act as a hive. At a later time we could then expand other T-POT servers on different locations and have them send their logstash data (as noted in the wiki) to that one HIVE-like machine.

I have deployed HIVE and HIVE-SENSOR on different machines and that worked like a charm.

Could anyone help explain why this is or is not possible or if anyone has an idea on how to achieve this or has other ideas, I would love to hear them.

Thanks all!

[t3chn0m4g3]

I'd recommend to start with Standard (which will not accept Logstash transmits on 64305 via 64295). However you can switch editions with tped.sh which will maintain the data from Standard should you ever switch to Hive.

[Bastibaard]

Thank you for your reply! If I get it right, it is not possible then to install hive and the hive-sensor on the same virtual server?

[t3chn0m4g3]

Correct.

[Bastibaard]

Allright, thank you again for taking the time to answer my questions 😄