Disabling or Throttling ewsposter?

[GeorgiaM-honestly]

Hello! I love this project. I run it in a virtual machine in a datacenter and love watching attackers have a go at it.

The only issue I am having is that often when ewsposter runs (ews.py), reserved ram (RSS) gets very high for that process. I have been needing to give the virtual machine 26GB of RAM to keep it happy and I have seen ews.py using upwards of 22GB of RAM RSS (that is not a typing mistake) and push the system to use all ram and swap and OOM killer takes out python3 as a result.

Is there a way to disable this process or restrict it in some way? The host on which the virtual machine is running only has 32 GB of ram and it doesn't do as well as I would like it to needing to give T-Pot so much more ram than is suggested in the documentation. My goal is to use 16 GB of ram in the virtual machine or perhaps 20.

[t3chn0m4g3]

Thank you.

Can you provide some more details (i.e. screenshots from glances and docker logs ewsposter)?

[GeorgiaM-honestly]

Sure. This is an instance of a high amount of RAM being used by the process, however, I have seen it get to the point where the OOM killer terminated python3 which launched it.

Is there anything else I can provide?

Edit: Added another glances screenshot where it seems to be showing other issues + more ram usage.

docker-logs-ewsposter.txt.gz

[t3chn0m4g3]

Thanks for the swift response. This is literally the first time since start of the project in 2015 we are seeing such a behavior.
According to the logs ewsposter is only able to transmit small chunks of data. Is it possible you have a very limited upstream?

For us to better understand what the problem is, can you please locally rebuilt ewsposter with debug options:

systemctl stop tpot &
cd /opt/tpot/docker/ews

Change CMD line to CMD sleep 10 && exec /usr/bin/python3 -u /opt/ewsposter/ews.py --verbose --debug -l $(shuf -i 10-60 -n 1) and then...

docker build -t ghcr.io/telekom-security/ewsposter:2006 .
docker build -t dtagdevsec/ewsposter:2006 .
systemctl start tpot &
docker logs -f ewsposter

Please check with docker images if your images come from DockerHub (dtagdevsec) oder GHCR.io (ghcr.io/telekom-security) and adjust the command accordingly.

[GeorgiaM-honestly]

I am happy to hear that this is not common! My upstream is quite strong, sitting in a data center with unmetered 1Gbps outbound. There isn't much else going on where t-pot is running. When I first noticed the issue, initially I tried several things such as killing it with signal 15 (HUP), which it did not listen to, and moving to 9, and perhaps that caused various issues.

I then wrote a script to both ensure the process was reniced to 20, and an iopriority of idle, hoping to at least still let it run and contribute information back. I then experimented with different disk elevators and also zswap. The later made a significant difference with responsiveness of t-pot. Of course, none of this was preventing the high memory usage.

I am starting to think that something I did (perhaps especially kill -9'ing ews.py, if not any of the other things) caused issues. For now I have stopped the ewsposter docker, and I am going to perform a fresh install in another VM and see what happens. It is not my intention to discard your advice, which I will try if this happens again.

I'll let you know how it works out.