first commit

2016-11-22 12:50:26 -08:00
commit 02e5451452
15 changed files with 1054 additions and 0 deletions
@@ -0,0 +1,40 @@
+FROM milcom/centos7-systemd
+
+COPY config/*.repo /etc/yum.repos.d/
+
+RUN rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
+
+RUN yum -y update; yum clean all;
+RUN yum -y install epel-release openssl useradd; yum clean all
+RUN groupadd -g 1000 ossec
+RUN useradd -u 1000 -g 1000 ossec
+RUN yum install -y wazuh-manager wazuh-api
+
+
+ADD config/default_agent /var/ossec/default_agent
+
+RUN service wazuh-manager restart &&\
+  /var/ossec/bin/manage_agents -f /default_agent &&\
+  rm /var/ossec/default_agent &&\
+  service wazuh-manager stop &&\
+  echo -n "" /var/ossec/logs/ossec.log
+
+
+ADD config/data_dirs.env /data_dirs.env
+ADD config/init.bash /init.bash
+# Sync calls are due to https://github.com/docker/docker/issues/9547
+RUN chmod 755 /init.bash &&\
+  sync && /init.bash &&\
+  sync && rm /init.bash
+
+
+ADD config/run.sh /tmp/run.sh
+RUN chmod 755 /tmp/run.sh
+
+VOLUME ["/var/ossec/data"]
+
+EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp
+
+# Run supervisord so that the container will stay alive
+
+ENTRYPOINT ["/tmp/run.sh"]
@@ -0,0 +1,7 @@
+i=0
+DATA_DIRS[((i++))]="etc"
+DATA_DIRS[((i++))]="rules"
+DATA_DIRS[((i++))]="logs"
+DATA_DIRS[((i++))]="stats"
+DATA_DIRS[((i++))]="queue"
+export DATA_DIRS
@@ -0,0 +1 @@
+127.0.0.1,DEFAULT_LOCAL_AGENT
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+#
+# Initialize the custom data directory layout
+#
+source /data_dirs.env
+
+cd /var/ossec
+for ossecdir in "${DATA_DIRS[@]}"; do
+  mv ${ossecdir} ${ossecdir}-template
+  ln -s data/${ossecdir} ${ossecdir}
+done
@@ -0,0 +1,106 @@
+#!/bin/bash
+
+#
+# OSSEC container bootstrap. See the README for information of the environment
+# variables expected by this script.
+#
+
+#
+
+#
+# Startup the services
+#
+
+source /data_dirs.env
+FIRST_TIME_INSTALLATION=false
+DATA_PATH=/var/ossec/data
+
+for ossecdir in "${DATA_DIRS[@]}"; do
+  if [ ! -e "${DATA_PATH}/${ossecdir}" ]
+  then
+    echo "Installing ${ossecdir}"
+    cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}
+    FIRST_TIME_INSTALLATION=true
+  fi
+done
+
+touch ${DATA_PATH}/process_list
+chgrp ossec ${DATA_PATH}/process_list
+chmod g+rw ${DATA_PATH}/process_list
+
+AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
+
+if [ $FIRST_TIME_INSTALLATION == true ]
+then
+
+  if [ $AUTO_ENROLLMENT_ENABLED == true ]
+  then
+    if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
+    then
+      echo "Creating ossec-authd key and cert"
+      openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096
+      openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key\
+        -out ${DATA_PATH}/etc/sslmanager.cert -days 3650\
+        -subj /CN=${HOSTNAME}/
+    fi
+  fi
+  #
+  # Support SYSLOG forwarding, if configured
+  #
+  SYSLOG_FORWADING_ENABLED=${SYSLOG_FORWADING_ENABLED:-false}
+  if [ $SYSLOG_FORWADING_ENABLED == true ]
+  then
+    if [ -z "$SYSLOG_FORWARDING_SERVER_IP" ]
+    then
+      echo "Cannot setup sylog forwarding because SYSLOG_FORWARDING_SERVER_IP is not defined"
+    else
+      SYSLOG_FORWARDING_SERVER_PORT=${SYSLOG_FORWARDING_SERVER_PORT:-514}
+      SYSLOG_FORWARDING_FORMAT=${SYSLOG_FORWARDING_FORMAT:-default}
+      SYSLOG_XML_SNIPPET="\
+  <syslog_output>\n\
+    <server>${SYSLOG_FORWARDING_SERVER_IP}</server>\n\
+    <port>${SYSLOG_FORWARDING_SERVER_PORT}</port>\n\
+    <format>${SYSLOG_FORWARDING_FORMAT}</format>\n\
+  </syslog_output>";
+
+      cat /var/ossec/etc/ossec.conf |\
+        perl -pe "s,<ossec_config>,<ossec_config>\n${SYSLOG_XML_SNIPPET}\n," \
+        > /var/ossec/etc/ossec.conf-new
+      mv -f /var/ossec/etc/ossec.conf-new /var/ossec/etc/ossec.conf
+      chgrp ossec /var/ossec/etc/ossec.conf
+      /var/ossec/bin/ossec-control enable client-syslog
+    fi
+  fi
+fi
+
+function ossec_shutdown(){
+  /var/ossec/bin/ossec-control stop;
+  if [ $AUTO_ENROLLMENT_ENABLED == true ]
+  then
+     kill $AUTHD_PID
+  fi
+}
+
+# Trap exit signals and do a proper shutdown
+trap "ossec_shutdown; exit" SIGINT SIGTERM
+
+chmod -R g+rw ${DATA_PATH}
+
+
+if [ $AUTO_ENROLLMENT_ENABLED == true ]
+then
+  echo "Starting ossec-authd..."
+  /var/ossec/bin/ossec-authd -p 1515 -g ossec $AUTHD_OPTIONS >/dev/null 2>&1 &
+  AUTHD_PID=$!
+fi
+sleep 15 # give ossec a reasonable amount of time to start before checking status
+LAST_OK_DATE=`date +%s`
+
+## Update rules and decoders with Wazuh Ruleset
+cd /var/ossec/update/ruleset && python ossec_ruleset.py
+
+/bin/node /var/ossec/api/app.js &
+/var/ossec/bin/ossec-control restart
+
+
+tail -f /var/ossec/logs/ossec.log
@@ -0,0 +1,7 @@
+[wazuh_repo]
+gpgcheck=1
+gpgkey=https://packages.wazuh.com/key/RPM-GPG-KEY-WAZUH
+enabled=1
+name=CENTOS-$releasever - Wazuh
+baseurl=https://packages.wazuh.com/yumtest/el/$releasever/$basearch
+protect=1