From 919500bd741ff020cc46e070b8a64a95dc055e18 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 14 Jul 2023 16:22:52 -0300 Subject: [PATCH 01/72] bump master to 4.8.0 --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- build-docker-images/wazuh-dashboard/config/config.sh | 4 ++-- build-docker-images/wazuh-indexer/config/config.sh | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- indexer-certs-creator/config/entrypoint.sh | 4 ++-- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 12 files changed, 28 insertions(+), 22 deletions(-) diff --git a/.env b/.env index a4909eb4..08a3c7ed 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.7.0 -WAZUH_IMAGE_VERSION=4.7.0 +WAZUH_VERSION=4.8.0 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 95764f97..ee5833ce 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.7.0-1 + - 4.8.0-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 8dd8664a..d032d59a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.8.0 +### Added + +- Update Wazuh to version [4.8.0](https://github.com/wazuh/wazuh/blob/v4.8.0/CHANGELOG.md#v480) + ## Wazuh Docker v4.7.0 ### Added diff --git a/README.md b/README.md index 8dc20aa5..ff52c494 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.8.0 | | | | v4.7.0 | | | | v4.6.0 | | | | v4.5.1 | | | diff --git a/VERSION b/VERSION index aa9abeed..ad87fa06 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.7.0" -REVISION="40700" +WAZUH-DOCKER_VERSION="4.8.0" +REVISION="40800" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index ded56d43..250f6dee 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.7.0 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 8cdb1a01..79306721 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 0bdd1bef..a01b761c 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE} ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 277b6e6c..c1184918 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -5,7 +5,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -ARG TEMPLATE_VERSION=4.7 +ARG TEMPLATE_VERSION=4.8 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 03d866e7..5379402b 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 1ecbe45f..fdf63047 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.7.0 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 79919e53..76e71c17 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.7.0 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: From 7db3d0d27896d2664af2c6e1167e1e68c58490cd Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 21 Jul 2023 15:22:22 -0300 Subject: [PATCH 02/72] Bump branch for trivy scan --- .github/workflows/trivy-dashboard-4-4.yml | 2 +- .github/workflows/trivy-indexer-4-4.yml | 2 +- .github/workflows/trivy-manager-4-4.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy-dashboard-4-4.yml b/.github/workflows/trivy-dashboard-4-4.yml index eb3f3b4f..863f4b03 100644 --- a/.github/workflows/trivy-dashboard-4-4.yml +++ b/.github/workflows/trivy-dashboard-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml index d48d0d85..9baec82c 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager-4-4.yml index 8a886871..d8631089 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | From d0eaae482c9314efb0d4fcfffbde32fd5175d47d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 11 Aug 2023 12:15:28 -0300 Subject: [PATCH 03/72] modify base for Wazuh Docker images --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ++-- build-docker-images/wazuh-indexer/Dockerfile | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 1b95ca88..e6c8c71b 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal AS builder +FROM ubuntu:jammy AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/ # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM ubuntu:focal +FROM ubuntu:jammy # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 696c0462..f2b809c3 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal AS builder +FROM ubuntu:jammy AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -26,7 +26,7 @@ RUN bash config.sh # Copy wazuh-indexer from stage 0 # Add entrypoint ################################################################################ -FROM ubuntu:focal +FROM ubuntu:jammy ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index c1184918..20ceac4e 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal +FROM ubuntu:jammy RUN rm /bin/sh && ln -s /bin/bash /bin/sh From 6a4dc3c3eb01d9c530dcceb46eebc1cce3e18d4d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:11:21 -0300 Subject: [PATCH 04/72] change repository checkout --- .../workflows/{trivy-dashboard-4-4.yml => trivy-dashboard.yml} | 3 ++- .github/workflows/{trivy-indexer-4-4.yml => trivy-indexer.yml} | 3 ++- .github/workflows/{trivy-manager-4-4.yml => trivy-manager.yml} | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) rename .github/workflows/{trivy-dashboard-4-4.yml => trivy-dashboard.yml} (94%) rename .github/workflows/{trivy-indexer-4-4.yml => trivy-indexer.yml} (94%) rename .github/workflows/{trivy-manager-4-4.yml => trivy-manager.yml} (94%) diff --git a/.github/workflows/trivy-dashboard-4-4.yml b/.github/workflows/trivy-dashboard.yml similarity index 94% rename from .github/workflows/trivy-dashboard-4-4.yml rename to .github/workflows/trivy-dashboard.yml index 863f4b03..a9c04a23 100644 --- a/.github/workflows/trivy-dashboard-4-4.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer.yml similarity index 94% rename from .github/workflows/trivy-indexer-4-4.yml rename to .github/workflows/trivy-indexer.yml index 9baec82c..2a5b182a 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager.yml similarity index 94% rename from .github/workflows/trivy-manager-4-4.yml rename to .github/workflows/trivy-manager.yml index d8631089..8b1dc659 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh From bd513e80cc524132c22e57643e5c07ccbdeecfa2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:18:56 -0300 Subject: [PATCH 05/72] add new step --- .github/workflows/trivy-dashboard.yml | 3 +++ .github/workflows/trivy-indexer.yml | 3 +++ .github/workflows/trivy-manager.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index a9c04a23..8ee00521 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index 2a5b182a..71d272e0 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index 8b1dc659..e5787f80 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh From a2f50192b6c560b414a3acd326a06230b2d5fd06 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:21:07 -0300 Subject: [PATCH 06/72] add new step --- .github/workflows/trivy-dashboard.yml | 1 + .github/workflows/trivy-indexer.yml | 1 + .github/workflows/trivy-manager.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index 8ee00521..5f247878 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index 71d272e0..aacb42b9 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index e5787f80..89db7dc7 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest From 1d8332725f2f5ce90140e2002219b44664a9a49d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:23:12 -0300 Subject: [PATCH 07/72] add fetch --- .github/workflows/trivy-dashboard.yml | 1 + .github/workflows/trivy-indexer.yml | 1 + .github/workflows/trivy-manager.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index 5f247878..8bc2decf 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index aacb42b9..3582e21d 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index 89db7dc7..18bdf1b8 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images From b40e90d19c11d2bb7fe5272603a281d8e3454d32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= <33964202+teddytpc1@users.noreply.github.com> Date: Wed, 20 Sep 2023 08:29:53 -0300 Subject: [PATCH 08/72] Create SECURITY.md Wazuh security policy added. --- SECURITY.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..54e59de1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,45 @@ +# Wazuh Open Source Project Security Policy + +Version: 2023-06-12 + +## Introduction +This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities. + +## Scope +This policy applies to all open source projects developed, maintained, or hosted by Wazuh. + +## Reporting Security Vulnerabilities +If you believe you've discovered a potential security vulnerability in one of our open source projects, we strongly encourage you to report it to us responsibly. + +Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com). + +## Vulnerability Disclosure Policy +Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: + +- Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. +- Validation: We will validate the issue and work on reproducing it in our environment. +- Remediation: We will work on a fix and thoroughly test it +- Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. +- Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. + +This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. + +## Automatic Scanning +We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner. + +## Credit +We believe in giving credit where credit is due. If you report a security vulnerability to us, and we determine that it is a valid vulnerability, we will publicly credit you for the discovery when we disclose the vulnerability. If you wish to remain anonymous, please indicate so in your initial report. + +We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. + +## Compliance with this Policy +We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. + +Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. + +We ask that all users and contributors respect this policy and the security of our community's users by disclosing vulnerabilities to us in accordance with this policy. + +## Changes to this Security Policy +This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. + +If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com). From 5aaeb0d944647c055eea49de46ba2855f6877c70 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 9 Oct 2023 06:34:35 -0300 Subject: [PATCH 09/72] Updated version in new builder script --- build-docker-images/README.md | 2 +- build-docker-images/build-images.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index a62978ac..10ba48d0 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.2. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.6.0. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.7.1. -h, --help Show this help. ``` \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 092cdc67..611b065a 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="4.6.0" +WAZUH_IMAGE_VERSION="4.7.1" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.2" From 4d153f6705e613a84d7f3b3a48f36bc7fe40e12a Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 11 Oct 2023 05:44:48 -0300 Subject: [PATCH 10/72] bump new builder script --- build-docker-images/README.md | 4 ++-- build-docker-images/build-images.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 10ba48d0..10a5da78 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: ``` -$ build-docker-images/build-images.sh -v 4.5.2 +$ build-docker-images/build-images.sh -v 4.8.0 ``` To get all the available script options use the -h or --help option: @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.2. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.7.1. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.8.0. -h, --help Show this help. ``` \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index cabc2b99..04e1084f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.7.1 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') @@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="4.7.1" +WAZUH_IMAGE_VERSION="4.8.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.2" From 4c2582952fb6077801f5d873fdd5404da78028c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Mon, 23 Oct 2023 13:28:22 -0300 Subject: [PATCH 11/72] Dashboard default route update --- .../wazuh-dashboard/config/opensearch_dashboards.yml | 2 +- multi-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- single-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml index 994b83e2..68e6c85f 100644 --- a/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml +++ b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml @@ -9,5 +9,5 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/config/certs/dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/config/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml index b065a625..3a53c3f8 100644 --- a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -9,4 +9,4 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml index 2a9cdba2..ccaec070 100644 --- a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -9,4 +9,4 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home From 486c41e3f9c931632d37f0b345a3b10bef1c5260 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 9 Nov 2023 09:09:08 -0300 Subject: [PATCH 12/72] Updated security config files --- README.md | 1 + build-docker-images/wazuh-indexer/Dockerfile | 2 ++ .../wazuh-indexer/config/action_groups.yml | 12 ++++++++++++ build-docker-images/wazuh-indexer/config/config.sh | 1 + build-docker-images/wazuh-indexer/config/roles.yml | 12 ++++++++++-- .../wazuh-indexer/config/roles_mapping.yml | 11 +++++++++-- 6 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 build-docker-images/wazuh-indexer/config/action_groups.yml diff --git a/README.md b/README.md index 46b093fe..e1df9d68 100644 --- a/README.md +++ b/README.md @@ -101,6 +101,7 @@ WAZUH_MONITORING_REPLICAS=0 ## │   │   └── Dockerfile │   ├── wazuh-indexer │   │   ├── config + │ │ │ ├── action_groups.yml │   │   │   ├── config.sh │   │   │   ├── config.yml │   │   │   ├── entrypoint.sh diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index f2b809c3..985a3a05 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -12,6 +12,8 @@ COPY config/config.sh . COPY config/config.yml / +COPY config/action_groups.yml / + COPY config/internal_users.yml / COPY config/roles_mapping.yml / diff --git a/build-docker-images/wazuh-indexer/config/action_groups.yml b/build-docker-images/wazuh-indexer/config/action_groups.yml new file mode 100644 index 00000000..04119c8a --- /dev/null +++ b/build-docker-images/wazuh-indexer/config/action_groups.yml @@ -0,0 +1,12 @@ +--- +_meta: + type: "actiongroups" + config_version: 2 + +# ISM API permissions group +manage_ism: + reserved: true + hidden: false + allowed_actions: + - "cluster:admin/opendistro/ism/*" + static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 0b953fc5..0b4b3791 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -120,6 +120,7 @@ cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/ # Copy Wazuh's config files for the security plugin cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /action_groups.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} # Copy Wazuh indexer's certificates diff --git a/build-docker-images/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml index ed47beae..f8bc557a 100644 --- a/build-docker-images/wazuh-indexer/config/roles.yml +++ b/build-docker-images/wazuh-indexer/config/roles.yml @@ -142,7 +142,7 @@ wazuh_ui_user: allowed_actions: - "read" tenant_permissions: [] - static: false + static: false wazuh_ui_admin: reserved: true @@ -160,4 +160,12 @@ wazuh_ui_admin: - "manage" - "index" tenant_permissions: [] - static: false \ No newline at end of file + static: false + +# ISM API permissions role +manage_ism: + reserved: true + hidden: false + cluster_permissions: + - "manage_ism" + static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml index 6f893132..7fa57a4d 100644 --- a/build-docker-images/wazuh-indexer/config/roles_mapping.yml +++ b/build-docker-images/wazuh-indexer/config/roles_mapping.yml @@ -33,7 +33,7 @@ kibana_user: - "kibanauser" users: - "wazuh_user" - - "wazuh_admin" + - "wazuh_admin" description: "Maps kibanauser to kibana_user" readall: @@ -68,4 +68,11 @@ wazuh_ui_user: hosts: [] users: - "wazuh_user" - and_backend_roles: [] \ No newline at end of file + and_backend_roles: [] + +# ISM API permissions role mapping +manage_ism: + reserved: true + hidden: false + users: + - "kibanaserver" \ No newline at end of file From b55cfaa9a078e793b1febab4c517c49e196be1ea Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 09:25:00 -0300 Subject: [PATCH 13/72] add ism policies --- .env | 5 ++++- build-docker-images/wazuh-indexer/Dockerfile | 6 +++++- build-docker-images/wazuh-indexer/config/entrypoint.sh | 2 ++ build-docker-images/wazuh-indexer/config/ism-check.sh | 10 ++++++++++ multi-node/docker-compose.yml | 1 + single-node/docker-compose.yml | 3 ++- 6 files changed, 24 insertions(+), 3 deletions(-) create mode 100644 build-docker-images/wazuh-indexer/config/ism-check.sh diff --git a/.env b/.env index 08a3c7ed..9471b392 100755 --- a/.env +++ b/.env @@ -1,3 +1,6 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 -WAZUH_TAG_REVISION=1 +WAZUH_TAG_REVISION=40800 +FILEBEAT_TEMPLATE_BRANCH=4.8.0 +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_UI_REVISION=40800 diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 985a3a05..abb95e22 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -35,6 +35,8 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" +RUN apt-get update -y && apt-get install curl -y + RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ @@ -52,7 +54,9 @@ COPY config/entrypoint.sh / COPY config/securityadmin.sh / -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh +COPY config/ism-check.sh / + +RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && chmod 700 /ism-check.sh RUN chown 1000:1000 /*.sh diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 2acb4aa0..2d3396d6 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -90,4 +90,6 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi +nohup /ism-check.sh & + run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh new file mode 100644 index 00000000..fcfeeaa0 --- /dev/null +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +if [[ -n "$INDEXER_PASSWORD" ]]; then + until [[ `curl -XGET https://0.0.0.0:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] + do + echo "Wazuh indexer Security is not initiaized"; + sleep 30 + done + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -i 127.0.0.1 -p $INDEXER_PASSWORD +fi \ No newline at end of file diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..684d9813 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -89,6 +89,7 @@ services: environment: - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "bootstrap.memory_lock=true" + - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 45a8feb7..8627df27 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -52,7 +52,8 @@ services: ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" + - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m" + - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 From ed136c994e84efb474f2ddda9180c58ba5c87ca1 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 09:26:54 -0300 Subject: [PATCH 14/72] change apt-key add command --- .../wazuh-manager/config/check_repository.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index adc94e79..bd7ffea9 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,6 +1,7 @@ ## variables +GPG_SIGN='[arch=amd64 signed-by=/etc/apt/keyrings/wazuh.gpg]' APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH -REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" +REPOSITORY="deb ${GPG_SIGN} https://packages.wazuh.com/4.x/apt/ stable main" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -12,18 +13,18 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" fi fi fi -apt-key adv --fetch-keys ${APT_KEY} +curl ${APT_KEY} | gpg --dearmor -o /etc/apt/keyrings/wazuh.gpg echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file From ff5e59982bbed7eec8ef5c2ff773dfc07384d73d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 13:59:56 -0300 Subject: [PATCH 15/72] change hostname from apply ism policy --- build-docker-images/wazuh-indexer/config/ism-check.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index fcfeeaa0..7a605399 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -1,10 +1,10 @@ #!/bin/bash - +SERVER=`hostname` if [[ -n "$INDEXER_PASSWORD" ]]; then - until [[ `curl -XGET https://0.0.0.0:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] + until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] do echo "Wazuh indexer Security is not initiaized"; sleep 30 done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -i 127.0.0.1 -p $INDEXER_PASSWORD + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER fi \ No newline at end of file From 95bd43c7e56476ae867af3c4e8d71f4cbf157bd5 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 10 Nov 2023 13:03:44 -0300 Subject: [PATCH 16/72] change revision tag --- .env | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.env b/.env index 9471b392..6b66d4a0 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 -WAZUH_TAG_REVISION=40800 +WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz -WAZUH_UI_REVISION=40800 +WAZUH_UI_REVISION=1 From 9f58e6f21fb73c13ae7ce242f208ddaea19d93f8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Nov 2023 05:00:31 -0300 Subject: [PATCH 17/72] add more optionsfor ism policies deploy --- build-docker-images/wazuh-indexer/config/ism-check.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index 7a605399..08900dc0 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -1,4 +1,8 @@ #!/bin/bash +MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25} +MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"} +MIN_DOC_COUNT=${MIN_DOC_COUNT:-600000000} +ISM_PRIORITY=${ISM_PRIORITY:-50} SERVER=`hostname` if [[ -n "$INDEXER_PASSWORD" ]]; then until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] @@ -6,5 +10,5 @@ if [[ -n "$INDEXER_PASSWORD" ]]; then echo "Wazuh indexer Security is not initiaized"; sleep 30 done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE fi \ No newline at end of file From c38a25224c65a04a388ab34bbd1cc88538a69fb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 13:52:41 +0100 Subject: [PATCH 18/72] Adapted docker build to multiple Wazuh Dashboards plugins --- .../wazuh-dashboard/config/install_wazuh_app.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index a95158cb..95782530 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,5 +1,8 @@ ## variables WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CHECK_UPDATES=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CORE=https://packages-dev.wazuh.com/staging/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -22,4 +25,6 @@ elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then fi # Install Wazuh App -$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root \ No newline at end of file +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_CHECK_UPDATES --allow-root +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_CORE --allow-root \ No newline at end of file From 573090edcb6a2367ec62d09dc6eb74ee204c41fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 15:54:25 +0100 Subject: [PATCH 19/72] Added variables in validations for different repositories --- .../wazuh-dashboard/config/install_wazuh_app.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index 95782530..49f11b53 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,8 +1,7 @@ ## variables WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CHECK_UPDATES=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -WAZUH_CORE=https://packages-dev.wazuh.com/staging/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CORE=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -14,12 +13,18 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi fi fi From 37d38ecf9267d08242e86e2bb57aa42971cce837 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 15:59:44 +0100 Subject: [PATCH 20/72] Fixed identation --- build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index 49f11b53..a9cea3a5 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -18,7 +18,7 @@ if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip - WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then From 10008a792b5f2ed80655cfc52d01a1e9721fc44e Mon Sep 17 00:00:00 2001 From: c-bordon Date: Tue, 19 Dec 2023 09:27:17 -0300 Subject: [PATCH 21/72] Updated Filebeat module version --- .env | 2 +- build-docker-images/README.md | 2 +- build-docker-images/build-images.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.env b/.env index 6b66d4a0..d8abf73e 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 7753ca77..b51af049 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -24,7 +24,7 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.3. + -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.8.0. -h, --help Show this help. diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 61691bfd..a0383362 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -15,7 +15,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} WAZUH_IMAGE_VERSION="4.8.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" -FILEBEAT_MODULE_VERSION="0.3" +FILEBEAT_MODULE_VERSION="0.4" # ----------------------------------------------------------------------------- From 09aeb68b14be4de82d77165268097232b30ebfec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 19 Dec 2023 10:45:21 -0300 Subject: [PATCH 22/72] New VD config update --- .../config/etc/cont-init.d/2-manager | 9 ++ .../config/wazuh_cluster/wazuh_manager.conf | 106 ++++-------------- .../config/wazuh_cluster/wazuh_worker.conf | 106 ++++-------------- .../config/wazuh_cluster/wazuh_manager.conf | 104 ++++------------- 4 files changed, 73 insertions(+), 252 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index 9e70ace9..8ddce84e 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -112,6 +112,12 @@ function_entrypoint_scripts() { fi } +function_configure_vulnerability_detection() { +if [ "$INDEXER_PASSWORD" != "" ]; then + >&2 echo "Configuring password." + sed -i "s|VDPass|'$INDEXER_PASSWORD'|g" /var/ossec/etc/ossec.conf +fi +} # Migrate data from /wazuh-migration volume function_wazuh_migration @@ -119,6 +125,9 @@ function_wazuh_migration # create API custom user function_create_custom_user +# configure Vulnerabilty detection +function_configure_vulnerability_detection + # run entrypoint scripts function_entrypoint_scripts diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 6c5d9ae7..1ec10630 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -95,91 +95,29 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - yes - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh1.indexer:9200 + https://wazuh2.indexer:9200 + https://wazuh3.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 341e6301..9d277622 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -95,91 +95,29 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh1.indexer:9200 + https://wazuh2.indexer:9200 + https://wazuh3.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 0cf738f3..9dd0990c 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -95,91 +95,27 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + From 2258605ec21e5b6fb4426ce7042b8a24cc373529 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 20 Dec 2023 04:28:33 -0300 Subject: [PATCH 23/72] delete single quotes for configurate vuln detection --- .env | 2 +- .../wazuh-manager/config/etc/cont-init.d/2-manager | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.env b/.env index 6b66d4a0..e4e7c63c 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.3.tar.gz WAZUH_UI_REVISION=1 diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index 8ddce84e..f0cf6ec3 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -115,7 +115,7 @@ function_entrypoint_scripts() { function_configure_vulnerability_detection() { if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - sed -i "s|VDPass|'$INDEXER_PASSWORD'|g" /var/ossec/etc/ossec.conf + sed -i "s|VDPass|$INDEXER_PASSWORD|g" /var/ossec/etc/ossec.conf fi } From 9b1ba35383b085d81e6d8ea7754859ce27cd30a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Wed, 20 Dec 2023 16:29:00 +0100 Subject: [PATCH 24/72] Changed Filebeat module version to 0.4 --- .env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.env b/.env index e4e7c63c..d8abf73e 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.3.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 From 99e708c1a98767de0a858300c11f766827b67e53 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 4 Jan 2024 11:48:27 -0300 Subject: [PATCH 25/72] Updated indexer-ism-init.sh execution and removed wazuh-template push from Filebeat --- build-docker-images/wazuh-indexer/config/ism-check.sh | 3 ++- build-docker-images/wazuh-manager/config/filebeat.yml | 2 -- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index 08900dc0..a913c7b0 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -3,6 +3,7 @@ MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25} MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"} MIN_DOC_COUNT=${MIN_DOC_COUNT:-600000000} ISM_PRIORITY=${ISM_PRIORITY:-50} +WAZUH_TEMPLATE=${WAZUH_TEMPLATE:-"/usr/share/wazuh-indexer/wazuh-template.json"} SERVER=`hostname` if [[ -n "$INDEXER_PASSWORD" ]]; then until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] @@ -10,5 +11,5 @@ if [[ -n "$INDEXER_PASSWORD" ]]; then echo "Wazuh indexer Security is not initiaized"; sleep 30 done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE -t $WAZUH_TEMPLATE fi \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index 8d1823af..be56e2b1 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -8,8 +8,6 @@ filebeat.modules: enabled: false setup.template.json.enabled: true -setup.template.json.path: '/etc/filebeat/wazuh-template.json' -setup.template.json.name: 'wazuh' setup.template.overwrite: true setup.ilm.enabled: false output.elasticsearch: From 892822fe293fb98d689c6017db04a51a10581239 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 4 Jan 2024 12:34:10 -0300 Subject: [PATCH 26/72] Update check test --- .github/workflows/push.yml | 41 +++++++++---------- .../wazuh-indexer/config/ism-check.sh | 2 +- 2 files changed, 21 insertions(+), 22 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 51077968..b9a8b215 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -124,6 +124,26 @@ jobs: exit 1 fi + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh + + - name: Check filebeat output + run: ./.github/single-node-filebeat-check.sh + - name: Check documents into wazuh-alerts index run: | docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" @@ -147,27 +167,6 @@ jobs: exit 1 fi - - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log - run: ./.github/single-node-log-check.sh - - - - name: Check filebeat output - run: ./.github/single-node-filebeat-check.sh - - name: Check Wazuh dashboard service URL run: | status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index a913c7b0..6aef3ee5 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -12,4 +12,4 @@ if [[ -n "$INDEXER_PASSWORD" ]]; then sleep 30 done bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE -t $WAZUH_TEMPLATE -fi \ No newline at end of file +fi From caddf2893a37f7474a056cb562fe3236f41025c6 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 4 Jan 2024 13:02:39 -0300 Subject: [PATCH 27/72] Testing with sleep --- .github/workflows/push.yml | 43 ++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index b9a8b215..f292275c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -124,28 +124,9 @@ jobs: exit 1 fi - - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log - run: ./.github/single-node-log-check.sh - - - name: Check filebeat output - run: ./.github/single-node-filebeat-check.sh - - name: Check documents into wazuh-alerts index run: | + sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 100 ]]; then echo "wazuh-alerts index documents: ${docs}" @@ -167,6 +148,27 @@ jobs: exit 1 fi + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh + + + - name: Check filebeat output + run: ./.github/single-node-filebeat-check.sh + - name: Check Wazuh dashboard service URL run: | status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') @@ -249,6 +251,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | + sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 100 ]]; then echo "wazuh-alerts index documents: ${docs}" From b2ef887f66c3ce4712971f862e471761dcd7f9d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 9 Jan 2024 10:47:19 -0300 Subject: [PATCH 28/72] Bump revision for 4.8.0-alpha2 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index ad87fa06..1188330c 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40800" +REVISION="40802" From adba797c5432d69ebf777dfed4e41f8c7b2b27ff Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 16 Jan 2024 12:40:17 -0300 Subject: [PATCH 29/72] add xz-utils install --- build-docker-images/wazuh-manager/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index a18bbe82..e9f22a0b 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -10,7 +10,7 @@ ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE -RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y +RUN apt-get update && apt install curl apt-transport-https lsb-release xz-utils gnupg -y COPY config/check_repository.sh / RUN chmod 775 /check_repository.sh From 114d6edff21c3ba2df275167c24c3f2be36bd96d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Mon, 29 Jan 2024 15:48:48 -0300 Subject: [PATCH 30/72] Indexer tag and wazuh-keystore updates --- .../wazuh-manager/config/etc/cont-init.d/2-manager | 3 ++- multi-node/config/wazuh_cluster/wazuh_manager.conf | 2 -- multi-node/config/wazuh_cluster/wazuh_worker.conf | 2 -- single-node/config/wazuh_cluster/wazuh_manager.conf | 2 -- 4 files changed, 2 insertions(+), 7 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index f0cf6ec3..dd14d74f 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -115,7 +115,8 @@ function_entrypoint_scripts() { function_configure_vulnerability_detection() { if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - sed -i "s|VDPass|$INDEXER_PASSWORD|g" /var/ossec/etc/ossec.conf + /var/ossec/bin/wazuh-keystore -f indexer -k user -v $INDEXER_USERNAME + /var/ossec/bin/wazuh-keystore -f indexer -k password -v $INDEXER_PASSWORD fi } diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 1ec10630..92e5662f 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -108,8 +108,6 @@ https://wazuh2.indexer:9200 https://wazuh3.indexer:9200 - admin - VDPass /etc/ssl/root-ca.pem diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 9d277622..b49aa071 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -108,8 +108,6 @@ https://wazuh2.indexer:9200 https://wazuh3.indexer:9200 - admin - VDPass /etc/ssl/root-ca.pem diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 9dd0990c..64da4d81 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -106,8 +106,6 @@ https://wazuh.indexer:9200 - admin - VDPass /etc/ssl/root-ca.pem From ec63264545aa70bfd14f4df04eb151cbba82f43e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Wed, 31 Jan 2024 09:23:50 -0300 Subject: [PATCH 31/72] Changed user for username in the wazuh-keystore command --- .../wazuh-manager/config/etc/cont-init.d/2-manager | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index dd14d74f..0bd90fd6 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -115,7 +115,7 @@ function_entrypoint_scripts() { function_configure_vulnerability_detection() { if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - /var/ossec/bin/wazuh-keystore -f indexer -k user -v $INDEXER_USERNAME + /var/ossec/bin/wazuh-keystore -f indexer -k username -v $INDEXER_USERNAME /var/ossec/bin/wazuh-keystore -f indexer -k password -v $INDEXER_PASSWORD fi } From 174ae3d14c1c5b400c70e9f1aa9ea259c5289538 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 5 Feb 2024 04:55:41 -0300 Subject: [PATCH 32/72] bump revision --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 1188330c..55b3e097 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40802" +REVISION="40803" From 057752d7bc86f43cdc1fe4a14a054066617a7149 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 14 Feb 2024 07:06:40 -0300 Subject: [PATCH 33/72] merge layers into Wazuh manager Dockerfile --- build-docker-images/wazuh-manager/Dockerfile | 30 ++++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index e9f22a0b..9fcefd5d 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,26 +9,31 @@ ARG FILEBEAT_TEMPLATE_BRANCH ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE +ARG S6_VERSION="v2.2.0.3" -RUN apt-get update && apt install curl apt-transport-https lsb-release xz-utils gnupg -y +RUN apt-get update && apt install curl apt-transport-https lsb-release xz-utils gnupg -y &&\ + apt autoremove && apt clean COPY config/check_repository.sh / +COPY config/filebeat_module.sh / +COPY config/permanent_data.env config/permanent_data.sh / + RUN chmod 775 /check_repository.sh RUN source /check_repository.sh RUN apt-get update && \ - apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} - -COPY config/filebeat_module.sh / -RUN chmod 775 /filebeat_module.sh -RUN source /filebeat_module.sh - -ARG S6_VERSION="v2.2.0.3" -RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ + apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} && \ + apt autoremove && apt clean && \ + chmod 775 /filebeat_module.sh && \ + source /filebeat_module.sh && \ + curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz + rm /tmp/s6-overlay-amd64.tar.gz && \ + chmod 755 /permanent_data.sh && \ + sync && /permanent_data.sh && \ + sync && rm /permanent_data.sh COPY config/etc/ /etc/ COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py @@ -43,11 +48,6 @@ RUN chmod go-w /etc/filebeat/wazuh-template.json # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 -COPY config/permanent_data.env config/permanent_data.sh / -RUN chmod 755 /permanent_data.sh && \ - sync && /permanent_data.sh && \ - sync && rm /permanent_data.sh - #Make mount directories for keep permissions RUN mkdir -p /var/ossec/var/multigroups && \ From d6cefe72884ef0c8e7ba5f43213203e3c38df0a2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 14 Feb 2024 11:52:50 -0300 Subject: [PATCH 34/72] add filebeat parameters for inyect template --- build-docker-images/wazuh-manager/config/filebeat.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index be56e2b1..c434a78c 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -9,6 +9,8 @@ filebeat.modules: setup.template.json.enabled: true setup.template.overwrite: true +setup.template.json.path: '/etc/filebeat/wazuh-template.json' +setup.template.json.name: 'wazuh' setup.ilm.enabled: false output.elasticsearch: hosts: ['https://wazuh.indexer:9200'] From 98037bf25c51994832bf58dad24a4d82d42a163c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Tue, 20 Feb 2024 10:33:29 +0100 Subject: [PATCH 35/72] Commands and dependencies adapted --- build-docker-images/wazuh-dashboard/Dockerfile | 9 ++++++--- build-docker-images/wazuh-indexer/Dockerfile | 9 +++++---- build-docker-images/wazuh-manager/Dockerfile | 11 +++++------ .../wazuh-manager/config/check_repository.sh | 14 +++++++------- .../wazuh-manager/config/filebeat_module.sh | 4 ++-- 5 files changed, 25 insertions(+), 22 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index d430ea82..542d46ca 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:jammy AS builder +FROM amazonlinux:2023.3.20240131.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -7,7 +7,7 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG WAZUH_UI_REVISION # Update and install dependencies -RUN apt-get update && apt install curl libcap2-bin xz-utils -y +RUN yum install curl-minimal libcap xz tar openssl -y # Create Install dir RUN mkdir -p $INSTALL_DIR @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/ # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM ubuntu:jammy +FROM amazonlinux:2023.3.20240131.0 # Set environment variables ENV USER="wazuh-dashboard" \ @@ -80,6 +80,9 @@ ENV PATTERN="" \ WAZUH_MONITORING_SHARDS="" \ WAZUH_MONITORING_REPLICAS="" +# Update and install dependencies +RUN yum install shadow-utils -y + # Create wazuh-dashboard user and group RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index abb95e22..c0eba57a 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,10 +1,10 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:jammy AS builder +FROM amazonlinux:2023.3.20240131.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -RUN apt-get update -y && apt-get install curl openssl xz-utils -y +RUN yum install curl-minimal openssl xz tar shadow-utils -y COPY config/opensearch.yml / @@ -27,15 +27,16 @@ RUN bash config.sh # # Copy wazuh-indexer from stage 0 # Add entrypoint + ################################################################################ -FROM ubuntu:jammy +FROM amazonlinux:2023.3.20240131.0 ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN apt-get update -y && apt-get install curl -y +RUN yum install curl-minimal shadow-utils -y RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 9fcefd5d..f4e277b1 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:jammy +FROM amazonlinux:2023.3.20240131.0 RUN rm /bin/sh && ln -s /bin/bash /bin/sh @@ -11,8 +11,8 @@ ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE ARG S6_VERSION="v2.2.0.3" -RUN apt-get update && apt install curl apt-transport-https lsb-release xz-utils gnupg -y &&\ - apt autoremove && apt clean +RUN yum install curl-minimal xz gnupg tar gzip -y &&\ + yum clean all COPY config/check_repository.sh / COPY config/filebeat_module.sh / @@ -21,9 +21,8 @@ COPY config/permanent_data.env config/permanent_data.sh / RUN chmod 775 /check_repository.sh RUN source /check_repository.sh -RUN apt-get update && \ - apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} && \ - apt autoremove && apt clean && \ +RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ + yum clean all && \ chmod 775 /filebeat_module.sh && \ source /filebeat_module.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index bd7ffea9..6c3748c5 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,7 +1,7 @@ ## variables -GPG_SIGN='[arch=amd64 signed-by=/etc/apt/keyrings/wazuh.gpg]' APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH -REPOSITORY="deb ${GPG_SIGN} https://packages.wazuh.com/4.x/apt/ stable main" +GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" +REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -13,18 +13,18 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" fi fi fi -curl ${APT_KEY} | gpg --dearmor -o /etc/apt/keyrings/wazuh.gpg -echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file +rpm --import "${APT_KEY}" +echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/filebeat_module.sh b/build-docker-images/wazuh-manager/config/filebeat_module.sh index 3ca1b183..e3647720 100644 --- a/build-docker-images/wazuh-manager/config/filebeat_module.sh +++ b/build-docker-images/wazuh-manager/config/filebeat_module.sh @@ -20,6 +20,6 @@ elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then fi fi -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\ -dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \ +curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\ +yum install -y ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \ curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module \ No newline at end of file From a4a9207dec2b6e64bbe1d9130f5418d0bac4d1cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Tue, 20 Feb 2024 12:23:41 +0100 Subject: [PATCH 36/72] Added findutils dependency to indexer --- build-docker-images/wazuh-indexer/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index c0eba57a..2dae543d 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -4,7 +4,7 @@ FROM amazonlinux:2023.3.20240131.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -RUN yum install curl-minimal openssl xz tar shadow-utils -y +RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y COPY config/opensearch.yml / From 33a55344d300009269451b362815a986429a8656 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 20 Feb 2024 12:01:22 -0300 Subject: [PATCH 37/72] rollback ISM --- build-docker-images/wazuh-indexer/Dockerfile | 6 +----- .../wazuh-indexer/config/entrypoint.sh | 2 -- .../wazuh-indexer/config/ism-check.sh | 15 --------------- multi-node/docker-compose.yml | 1 - single-node/docker-compose.yml | 3 +-- 5 files changed, 2 insertions(+), 25 deletions(-) delete mode 100644 build-docker-images/wazuh-indexer/config/ism-check.sh diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index abb95e22..985a3a05 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -35,8 +35,6 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN apt-get update -y && apt-get install curl -y - RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ @@ -54,9 +52,7 @@ COPY config/entrypoint.sh / COPY config/securityadmin.sh / -COPY config/ism-check.sh / - -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && chmod 700 /ism-check.sh +RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh RUN chown 1000:1000 /*.sh diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 2d3396d6..2acb4aa0 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -90,6 +90,4 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi -nohup /ism-check.sh & - run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh deleted file mode 100644 index 6aef3ee5..00000000 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25} -MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"} -MIN_DOC_COUNT=${MIN_DOC_COUNT:-600000000} -ISM_PRIORITY=${ISM_PRIORITY:-50} -WAZUH_TEMPLATE=${WAZUH_TEMPLATE:-"/usr/share/wazuh-indexer/wazuh-template.json"} -SERVER=`hostname` -if [[ -n "$INDEXER_PASSWORD" ]]; then - until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] - do - echo "Wazuh indexer Security is not initiaized"; - sleep 30 - done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE -t $WAZUH_TEMPLATE -fi diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 684d9813..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -89,7 +89,6 @@ services: environment: - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "bootstrap.memory_lock=true" - - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8627df27..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -52,8 +52,7 @@ services: ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m" - - 'INDEXER_PASSWORD=SecretPassword' + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" ulimits: memlock: soft: -1 From 4ba6e124b1a82058599614f5f1e417afce0ab79f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Tue, 20 Feb 2024 17:37:40 +0100 Subject: [PATCH 38/72] Updated dependencies --- build-docker-images/wazuh-indexer/Dockerfile | 2 +- build-docker-images/wazuh-manager/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 2dae543d..28ec68ba 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -36,7 +36,7 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN yum install curl-minimal shadow-utils -y +RUN yum install curl-minimal shadow-utils findutils hostname -y RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index f4e277b1..07658a5a 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -11,7 +11,7 @@ ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE ARG S6_VERSION="v2.2.0.3" -RUN yum install curl-minimal xz gnupg tar gzip -y &&\ +RUN yum install curl-minimal xz gnupg tar gzip openssl findutils -y &&\ yum clean all COPY config/check_repository.sh / From 53b9d71c23c250fe369e3138c1e0edb8ca5d9e67 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 21 Feb 2024 11:43:23 -0300 Subject: [PATCH 39/72] add maltiverse files into permanent exceptions --- build-docker-images/wazuh-manager/config/permanent_data.env | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 5d797624..b0c32449 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -23,6 +23,9 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" From 0d628f20cc0c275e8ac1e4bd41f985e58f7892e6 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 21 Feb 2024 11:57:29 -0300 Subject: [PATCH 40/72] move pagerduty exception --- build-docker-images/wazuh-manager/config/permanent_data.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index b0c32449..0e58b640 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -16,13 +16,13 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py" From 55f9fe3dede714c257d9c32586875b884846b22e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Wed, 21 Feb 2024 17:51:36 +0100 Subject: [PATCH 41/72] Added procps to Manager dockerfile --- build-docker-images/wazuh-manager/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 07658a5a..a0c57183 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -11,7 +11,7 @@ ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE ARG S6_VERSION="v2.2.0.3" -RUN yum install curl-minimal xz gnupg tar gzip openssl findutils -y &&\ +RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ yum clean all COPY config/check_repository.sh / From 6fef542ee2138c184f05ba6eb1ae9ac38b36df20 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 22 Feb 2024 10:12:02 -0300 Subject: [PATCH 42/72] add aws wodle files for permanent data excp --- .../wazuh-manager/config/permanent_data.env | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 0e58b640..1ca3a42e 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -56,6 +56,27 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws_tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/wazuh_integration.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/aws_bucket.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/cloudtrail.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/config.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/guardduty.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/load_balancers.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/server_access.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/umbrella.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/vpcflow.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/waf.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/aws_service.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/cloudwatchlogs.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/inspector.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/s3_log_handler.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_processor.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" From 467a405754ebe1bbeb22739b20e748aee90361b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 22 Feb 2024 17:51:47 +0100 Subject: [PATCH 43/72] Upgraded ownership files for Wazuh files --- .../wazuh-manager/config/etc/cont-init.d/0-wazuh-init | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index ea1ab5f0..dae0e1f0 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -184,8 +184,9 @@ set_rids_owner() { ############################################################################## set_correct_permOwner() { - find / -group 997 -exec chown :101 {} +; - find / -user 999 -exec chown 101 {} +; + find / -group 997 -exec chown :999 {} +; + find / -group 101 -exec chown :999 {} +; + find / -user 101 -exec chown 999 {} +; } ############################################################################## From f7e7a5a5fb2e795aa9dad3eceed2c59ed81c930f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Fri, 23 Feb 2024 10:41:54 +0100 Subject: [PATCH 44/72] Added 4.7.3 to `CHANGELOG.md` --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d0507b5a..f503ac56 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.8.0](https://github.com/wazuh/wazuh/blob/v4.8.0/CHANGELOG.md#v480) +## Wazuh Docker v4.7.3 +### Added + +- Update Wazuh to version [4.7.3](https://github.com/wazuh/wazuh/blob/v4.7.3/CHANGELOG.md#v473) + ## Wazuh Docker v4.7.2 ### Added From 8a574da9eca7cacc66427032db5ef34107d3351a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Fri, 23 Feb 2024 15:50:57 +0100 Subject: [PATCH 45/72] Bump revision to 40804 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 55b3e097..7d9d6f49 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40803" +REVISION="40804" From 992fa82f6d3550e33902d6621c1f72ecc16f514c Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 29 Feb 2024 11:11:59 -0300 Subject: [PATCH 46/72] update base and fix wazuh manager build --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ++-- .../wazuh-dashboard/config/dl_base.sh | 2 +- .../wazuh-dashboard/config/install_wazuh_app.sh | 2 +- build-docker-images/wazuh-indexer/Dockerfile | 4 ++-- build-docker-images/wazuh-indexer/config/config.sh | 2 +- build-docker-images/wazuh-manager/Dockerfile | 13 +++++++------ .../wazuh-manager/config/filebeat_module.sh | 2 +- 7 files changed, 15 insertions(+), 14 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 542d46ca..71b2d0e5 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240131.0 AS builder +FROM amazonlinux:2023.3.20240219.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/ # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM amazonlinux:2023.3.20240131.0 +FROM amazonlinux:2023.3.20240219.0 # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index 91a289e2..21b23421 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -1,5 +1,5 @@ REPOSITORY="packages.wazuh.com/4.x" -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index a9cea3a5..4e8cb199 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -2,7 +2,7 @@ WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CHECK_UPDATES=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CORE=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index cfda4b2d..bdce9fff 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240131.0 AS builder +FROM amazonlinux:2023.3.20240219.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -29,7 +29,7 @@ RUN bash config.sh # Add entrypoint ################################################################################ -FROM amazonlinux:2023.3.20240131.0 +FROM amazonlinux:2023.3.20240219.0 ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 0b4b3791..2768f157 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -23,7 +23,7 @@ rm -rf ${INSTALLATION_DIR}/ ## variables REPOSITORY="packages.wazuh.com/4.x" -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index a0c57183..42dea261 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240131.0 +FROM amazonlinux:2023.3.20240219.0 RUN rm /bin/sh && ln -s /bin/bash /bin/sh @@ -25,14 +25,12 @@ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ yum clean all && \ chmod 775 /filebeat_module.sh && \ source /filebeat_module.sh && \ + rm /filebeat_module.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz && \ - chmod 755 /permanent_data.sh && \ - sync && /permanent_data.sh && \ - sync && rm /permanent_data.sh + rm /tmp/s6-overlay-amd64.tar.gz COPY config/etc/ /etc/ COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py @@ -57,7 +55,10 @@ RUN mkdir -p /var/ossec/var/multigroups && \ chmod 770 /var/ossec/agentless && \ mkdir -p /var/ossec/active-response/bin && \ chown root:wazuh /var/ossec/active-response/bin && \ - chmod 770 /var/ossec/active-response/bin + chmod 770 /var/ossec/active-response/bin && \ + chmod 755 /permanent_data.sh && \ + sync && /permanent_data.sh && \ + sync && rm /permanent_data.sh # Services ports EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp diff --git a/build-docker-images/wazuh-manager/config/filebeat_module.sh b/build-docker-images/wazuh-manager/config/filebeat_module.sh index e3647720..000a69ef 100644 --- a/build-docker-images/wazuh-manager/config/filebeat_module.sh +++ b/build-docker-images/wazuh-manager/config/filebeat_module.sh @@ -1,5 +1,5 @@ REPOSITORY="packages.wazuh.com/4.x" -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) From 2e8c7f99b5bddf0f60d08cbb65924e24b66186a5 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 29 Feb 2024 13:03:50 -0300 Subject: [PATCH 47/72] fix goss test --- .github/.goss.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index ee5833ce..13055fc0 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.8.0-1 + - 4.8.0 port: tcp:1514: listening: true From d8780f0e37665bef9a25b5e5e5926fec5ff7f659 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Fri, 1 Mar 2024 10:14:50 -0300 Subject: [PATCH 48/72] Revision bump (4.8.0-beta3) --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 7d9d6f49..f68b7535 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40804" +REVISION="40805" From 96048c7bf3721651a86050db31525ba6fe9f5bf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Fri, 1 Mar 2024 14:25:28 -0300 Subject: [PATCH 49/72] Fix readme 4.7.3 --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7ab46a22..0e23557b 100644 --- a/README.md +++ b/README.md @@ -197,6 +197,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| | v4.8.0 | | | +| v4.7.3 | | | | v4.7.2 | | | | v4.7.1 | | | | v4.7.0 | | | From 6e7e8525bb5a1cad57d6766201b27e95e6feff75 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 4 Mar 2024 07:51:00 -0300 Subject: [PATCH 50/72] modify uid and giufor indexer and dashboard user and file permissions --- build-docker-images/wazuh-dashboard/Dockerfile | 18 +++++++++--------- build-docker-images/wazuh-indexer/Dockerfile | 18 +++++++++--------- .../wazuh-indexer/config/entrypoint.sh | 4 ++-- indexer-certs-creator/config/entrypoint.sh | 12 +----------- multi-node/docker-compose.yml | 4 ++-- single-node/docker-compose.yml | 2 +- 6 files changed, 24 insertions(+), 34 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 71b2d0e5..7568e5ec 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -28,12 +28,12 @@ RUN bash /install_wazuh_app.sh # Copy and set permissions to config files COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/ COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/ -RUN chown 101:101 $INSTALL_DIR/config/opensearch_dashboards.yml && chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml +RUN chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml # Create and set permissions to data directories -RUN mkdir -p $INSTALL_DIR/data/wazuh && chown -R 101:101 $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh -RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chown -R 101:101 $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config -RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs +RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh +RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config +RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs ################################################################################ # Build stage 1 (the current Wazuh dashboard image): @@ -84,9 +84,9 @@ ENV PATTERN="" \ RUN yum install shadow-utils -y # Create wazuh-dashboard user and group -RUN getent group $GROUP || groupadd -r -g 1000 $GROUP +RUN getent group $GROUP || groupadd -r -g 999 $GROUP RUN useradd --system \ - --uid 1000 \ + --uid 999 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ @@ -99,14 +99,14 @@ COPY config/entrypoint.sh / COPY config/wazuh_app_config.sh / RUN chmod 700 /entrypoint.sh RUN chmod 700 /wazuh_app_config.sh -RUN chown 1000:1000 /*.sh +RUN chown 999:999 /*.sh # Copy Install dir from builder to current image -COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR +COPY --from=builder --chown=999:999 $INSTALL_DIR $INSTALL_DIR # Create custom directory RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom -RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom +RUN chown 999:999 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom # Set workdir and user WORKDIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index bdce9fff..bb7d6dae 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -38,10 +38,10 @@ ENV USER="wazuh-indexer" \ RUN yum install curl-minimal shadow-utils findutils hostname -y -RUN getent group $GROUP || groupadd -r -g 1000 $GROUP +RUN getent group $GROUP || groupadd -r -g 999 $GROUP RUN useradd --system \ - --uid 1000 \ + --uid 999 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ @@ -57,19 +57,19 @@ COPY config/securityadmin.sh / RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh -RUN chown 1000:1000 /*.sh +RUN chown 999:999 /*.sh -COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer +COPY --from=builder --chown=999:999 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d -RUN chown -R 1000:1000 /usr/share/wazuh-indexer +RUN chown -R 999:999 /usr/share/wazuh-indexer -RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ - mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ - mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ +RUN mkdir -p /var/lib/wazuh-indexer && chown 999:999 /var/lib/wazuh-indexer && \ + mkdir -p /usr/share/wazuh-indexer/logs && chown 999:999 /usr/share/wazuh-indexer/logs && \ + mkdir -p /run/wazuh-indexer && chown 999:999 /run/wazuh-indexer && \ + mkdir -p /var/log/wazuh-indexer && chown 999:999 /var/log/wazuh-indexer && \ chmod 700 /usr/share/wazuh-indexer && \ chmod 600 /usr/share/wazuh-indexer/jvm.options && \ chmod 600 /usr/share/wazuh-indexer/opensearch.yml diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 2acb4aa0..ba244d4d 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -34,7 +34,7 @@ if [[ "$1" != "opensearchwrapper" ]]; then # `bin/opensearch -E x.y=z` would not work. set -- "opensearch" "${@:2}" # Use chroot to switch to UID 1000 / GID 0 - exec chroot --userspec=1000:0 / "$@" + exec chroot --userspec=999:0 / "$@" else # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?) exec "$@" @@ -79,7 +79,7 @@ fi if [[ "$(id -u)" == "0" ]]; then # If requested and running as root, mutate the ownership of bind-mounts if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then - chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs} + chown -R 999:0 /usr/share/wazuh-indexer/{data,logs} fi fi diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index d3e0534e..948fefa1 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -47,15 +47,5 @@ echo "Changing certificate permissions" chmod -R 500 /certificates chmod -R 400 /certificates/* echo "Setting UID indexer and dashboard" -chown 1000:1000 /certificates/* -echo "Setting UID for wazuh manager and worker" -cp /certificates/root-ca.pem /certificates/root-ca-manager.pem -cp /certificates/root-ca.key /certificates/root-ca-manager.key -chown 101:101 /certificates/root-ca-manager.pem -chown 101:101 /certificates/root-ca-manager.key +chown 999:999 /certificates/* -for i in ${node_names[@]}; -do - chown 101:101 "/certificates/${i}.pem" - chown 101:101 "/certificates/${i}-key.pem" -done diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..ac81cb63 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -39,7 +39,7 @@ services: - master-wazuh-wodles:/var/ossec/wodles - master-filebeat-etc:/etc/filebeat - master-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf @@ -75,7 +75,7 @@ services: - worker-wazuh-wodles:/var/ossec/wodles - worker-filebeat-etc:/etc/filebeat - worker-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 55e2261e..9e4d56fd 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -40,7 +40,7 @@ services: - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf From a826212051957f5ce70f1083b9663b86202781e1 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 4 Mar 2024 12:14:20 -0300 Subject: [PATCH 51/72] add upgrade functions into entrypoints --- build-docker-images/wazuh-dashboard/config/entrypoint.sh | 7 +++++++ build-docker-images/wazuh-indexer/config/entrypoint.sh | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 290f9fa8..2ec1285d 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -5,6 +5,11 @@ INSTALL_DIR=/usr/share/wazuh-dashboard DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}" DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" +set_correct_permOwner() { + find / -group 1000 -exec chown :999 {} +; + find / -user 1000 -exec chown 999 {} +; +} + # Create and configure Wazuh dashboard keystore yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ @@ -15,6 +20,8 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o # Start Wazuh dashboard ############################################################################## +set_correct_permOwner + /wazuh_app_config.sh $WAZUH_UI_REVISION /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index ba244d4d..48a9bef3 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -24,6 +24,11 @@ run_as_other_user_if_needed() { fi } +set_correct_permOwner() { + find / -group 1000 -exec chown :999 {} +; + find / -user 1000 -exec chown 999 {} +; +} + # Allow user specify custom CMD, maybe bin/opensearch itself # for example to directly specify `-E` style parameters for opensearch on k8s # or simply to run /bin/bash to check the image @@ -90,4 +95,6 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi +set_correct_permOwner + run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file From a7330464715c5d82bcfbe22d685bd766e9114ac2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 5 Mar 2024 10:08:25 -0300 Subject: [PATCH 52/72] change cert creator version --- multi-node/generate-indexer-certs.yml | 2 +- single-node/generate-indexer-certs.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml index a3398661..dbf2b079 100644 --- a/multi-node/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -3,7 +3,7 @@ version: '3' services: generator: - image: wazuh/wazuh-certs-generator:0.0.1 + image: wazuh/wazuh-certs-generator:0.0.2 hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml index d10151fd..3e0eb6fd 100644 --- a/single-node/generate-indexer-certs.yml +++ b/single-node/generate-indexer-certs.yml @@ -3,7 +3,7 @@ version: '3' services: generator: - image: wazuh/wazuh-certs-generator:0.0.1 + image: wazuh/wazuh-certs-generator:0.0.2 hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ From b4af946000d772461c9660eb208342c0c34dae2e Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 5 Mar 2024 11:41:43 -0300 Subject: [PATCH 53/72] delete chmod for upgrade --- build-docker-images/build-images.sh | 2 +- build-docker-images/wazuh-dashboard/config/entrypoint.sh | 7 ------- build-docker-images/wazuh-indexer/config/entrypoint.sh | 7 ------- .../wazuh-manager/config/check_repository.sh | 2 +- 4 files changed, 2 insertions(+), 16 deletions(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index a0383362..d43a8244 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,7 +1,7 @@ WAZUH_IMAGE_VERSION=4.8.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # Wazuh package generator diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 2ec1285d..290f9fa8 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -5,11 +5,6 @@ INSTALL_DIR=/usr/share/wazuh-dashboard DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}" DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" -set_correct_permOwner() { - find / -group 1000 -exec chown :999 {} +; - find / -user 1000 -exec chown 999 {} +; -} - # Create and configure Wazuh dashboard keystore yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ @@ -20,8 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o # Start Wazuh dashboard ############################################################################## -set_correct_permOwner - /wazuh_app_config.sh $WAZUH_UI_REVISION /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 48a9bef3..ba244d4d 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -24,11 +24,6 @@ run_as_other_user_if_needed() { fi } -set_correct_permOwner() { - find / -group 1000 -exec chown :999 {} +; - find / -user 1000 -exec chown 999 {} +; -} - # Allow user specify custom CMD, maybe bin/opensearch itself # for example to directly specify `-E` style parameters for opensearch on k8s # or simply to run /bin/bash to check the image @@ -95,6 +90,4 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi -set_correct_permOwner - run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index 6c3748c5..5323ec81 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -2,7 +2,7 @@ APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) From 73650d79b3e17fbec0dba3ffb960c6f58296bd02 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 6 Mar 2024 06:24:26 -0300 Subject: [PATCH 54/72] add exceptions --- build-docker-images/wazuh-manager/config/permanent_data.env | 2 ++ 1 file changed, 2 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 1ca3a42e..5439b89b 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -79,12 +79,14 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_proc PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/orm.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted From 387727d496ae4df003377a5ef173233fa70a42e6 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 11 Mar 2024 10:05:53 -0300 Subject: [PATCH 55/72] rollback uid and gid for Wazuh indexer and dashboard owner --- build-docker-images/wazuh-dashboard/Dockerfile | 10 +++++----- build-docker-images/wazuh-indexer/Dockerfile | 18 +++++++++--------- .../wazuh-indexer/config/entrypoint.sh | 4 ++-- indexer-certs-creator/config/entrypoint.sh | 13 ++++++++++++- 4 files changed, 28 insertions(+), 17 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 7568e5ec..14267326 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -84,9 +84,9 @@ ENV PATTERN="" \ RUN yum install shadow-utils -y # Create wazuh-dashboard user and group -RUN getent group $GROUP || groupadd -r -g 999 $GROUP +RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ - --uid 999 \ + --uid 1000 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ @@ -99,14 +99,14 @@ COPY config/entrypoint.sh / COPY config/wazuh_app_config.sh / RUN chmod 700 /entrypoint.sh RUN chmod 700 /wazuh_app_config.sh -RUN chown 999:999 /*.sh +RUN chown 1000:1000 /*.sh # Copy Install dir from builder to current image -COPY --from=builder --chown=999:999 $INSTALL_DIR $INSTALL_DIR +COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR # Create custom directory RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom -RUN chown 999:999 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom +RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom # Set workdir and user WORKDIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index bb7d6dae..bdce9fff 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -38,10 +38,10 @@ ENV USER="wazuh-indexer" \ RUN yum install curl-minimal shadow-utils findutils hostname -y -RUN getent group $GROUP || groupadd -r -g 999 $GROUP +RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ - --uid 999 \ + --uid 1000 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ @@ -57,19 +57,19 @@ COPY config/securityadmin.sh / RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh -RUN chown 999:999 /*.sh +RUN chown 1000:1000 /*.sh -COPY --from=builder --chown=999:999 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer +COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d -RUN chown -R 999:999 /usr/share/wazuh-indexer +RUN chown -R 1000:1000 /usr/share/wazuh-indexer -RUN mkdir -p /var/lib/wazuh-indexer && chown 999:999 /var/lib/wazuh-indexer && \ - mkdir -p /usr/share/wazuh-indexer/logs && chown 999:999 /usr/share/wazuh-indexer/logs && \ - mkdir -p /run/wazuh-indexer && chown 999:999 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 999:999 /var/log/wazuh-indexer && \ +RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ + mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ + mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ + mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ chmod 700 /usr/share/wazuh-indexer && \ chmod 600 /usr/share/wazuh-indexer/jvm.options && \ chmod 600 /usr/share/wazuh-indexer/opensearch.yml diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index ba244d4d..2acb4aa0 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -34,7 +34,7 @@ if [[ "$1" != "opensearchwrapper" ]]; then # `bin/opensearch -E x.y=z` would not work. set -- "opensearch" "${@:2}" # Use chroot to switch to UID 1000 / GID 0 - exec chroot --userspec=999:0 / "$@" + exec chroot --userspec=1000:0 / "$@" else # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?) exec "$@" @@ -79,7 +79,7 @@ fi if [[ "$(id -u)" == "0" ]]; then # If requested and running as root, mutate the ownership of bind-mounts if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then - chown -R 999:0 /usr/share/wazuh-indexer/{data,logs} + chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs} fi fi diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 948fefa1..c2dd3e1d 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -47,5 +47,16 @@ echo "Changing certificate permissions" chmod -R 500 /certificates chmod -R 400 /certificates/* echo "Setting UID indexer and dashboard" -chown 999:999 /certificates/* +chown 1000:1000 /certificates/* +echo "Setting UID for wazuh manager and worker" +cp /certificates/root-ca.pem /certificates/root-ca-manager.pem +cp /certificates/root-ca.key /certificates/root-ca-manager.key +chown 999:999 /certificates/root-ca-manager.pem +chown 999:999 /certificates/root-ca-manager.key + +for i in ${node_names[@]}; +do + chown 999:999 "/certificates/${i}.pem" + chown 999:999 "/certificates/${i}-key.pem" +done From 031db43568e95e4579e71eb4397e66b3b4fa3d28 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 11 Mar 2024 10:17:49 -0300 Subject: [PATCH 56/72] rollback root-ca filename --- multi-node/docker-compose.yml | 4 ++-- single-node/docker-compose.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index ac81cb63..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -39,7 +39,7 @@ services: - master-wazuh-wodles:/var/ossec/wodles - master-filebeat-etc:/etc/filebeat - master-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf @@ -75,7 +75,7 @@ services: - worker-wazuh-wodles:/var/ossec/wodles - worker-filebeat-etc:/etc/filebeat - worker-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 9e4d56fd..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -40,7 +40,7 @@ services: - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf From 89f3b0d600d8890a9917b5d1053a1ebdd4a4e555 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Tue, 12 Mar 2024 11:01:41 +0100 Subject: [PATCH 57/72] Bumped version to 40806 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index f68b7535..fd46cee1 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40805" +REVISION="40806" From 02ee94f312ecc7d79d643397545b06b3f8086d57 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 13 Mar 2024 11:58:52 -0300 Subject: [PATCH 58/72] update al2024 version --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ++-- build-docker-images/wazuh-indexer/Dockerfile | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 14267326..e2e0bfd7 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 AS builder +FROM amazonlinux:2023.3.20240304.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index bdce9fff..bd579225 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 AS builder +FROM amazonlinux:2023.3.20240304.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -29,7 +29,7 @@ RUN bash config.sh # Add entrypoint ################################################################################ -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 42dea261..70ccd447 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 RUN rm /bin/sh && ln -s /bin/bash /bin/sh From a8754c54bcda3d57186fdbcd2c03f872be7a925c Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 15 Mar 2024 11:29:46 -0300 Subject: [PATCH 59/72] update query about Wazuh manager cont names --- indexer-certs-creator/config/entrypoint.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index c2dd3e1d..5d5e5d6c 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -38,7 +38,7 @@ chmod 700 /$CERT_TOOL ## Execute cert tool and parsin cert.yml to set UID permissions source /$CERT_TOOL -A -nodes_server=$( cert_parseYaml /config.yml | grep nodes_server__name | sed 's/nodes_server__name=//' ) +nodes_server=$( cert_parseYaml /config.yml | grep -E "nodes[_]+server[_]+[0-9]+=" | sed -e 's/nodes__server__[0-9]=//' | sed 's/"//g' ) node_names=($nodes_server) echo "Moving created certificates to the destination directory" From 866ee4887125a35c417fbfc4dc56bfb96cf0df70 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 21 Mar 2024 07:00:57 -0300 Subject: [PATCH 60/72] delete syslog and dpkg log configuration --- multi-node/config/wazuh_cluster/wazuh_manager.conf | 5 ----- multi-node/config/wazuh_cluster/wazuh_worker.conf | 5 ----- 2 files changed, 10 deletions(-) diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 92e5662f..61d4721f 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -307,9 +307,4 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/dpkg.log - - diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index b49aa071..d1caecc9 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -307,9 +307,4 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/dpkg.log - - From cbdc152dda8d196770df1049ea61aaed4b1dd194 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 27 Mar 2024 14:25:31 -0300 Subject: [PATCH 61/72] clean disk and change way to wait Cluster start --- .github/workflows/push.yml | 50 +++++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 17 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index f292275c..0444cba7 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -128,7 +128,7 @@ jobs: run: | sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" - if [[ $docs -gt 100 ]]; then + if [[ $docs -gt 0 ]]; then echo "wazuh-alerts index documents: ${docs}" else echo "wazuh-alerts index documents: ${docs}" @@ -139,7 +139,7 @@ jobs: run: | qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" - if [[ $qty_templates -eq 3 ]]; then + if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" else @@ -162,10 +162,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check errors in ossec.log - run: ./.github/single-node-log-check.sh - - - name: Check filebeat output run: ./.github/single-node-filebeat-check.sh @@ -179,8 +175,8 @@ jobs: exit 1 fi - - name: Stop single node stack - run: docker-compose -f single-node/docker-compose.yml down + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh check-multi-node: runs-on: ubuntu-latest @@ -193,6 +189,14 @@ jobs: - name: Create enviroment variables run: cat .env > $GITHUB_ENV + - name: free disk space + run: | + sudo swapoff -a + sudo rm -f /swapfile + sudo apt clean + docker rmi $(docker image ls -aq) + df -h + - name: Retrieve saved Wazuh dashboard Docker image uses: actions/download-artifact@v3 with: @@ -213,6 +217,7 @@ jobs: docker load --input ./wazuh-manager.tar docker load --input ./wazuh-indexer.tar docker load --input ./wazuh-dashboard.tar + rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar - name: Create multi node certficates run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator @@ -222,7 +227,13 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 120 + until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l` -eq 1 ]] + do + echo 'Waiting for Wazuh indexer start' + free -m + df -h + sleep 10 + done status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s @@ -251,9 +262,15 @@ jobs: - name: Check documents into wazuh-alerts index run: | - sleep 120 + until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``) -gt 0 ]] + do + echo 'Waiting for Wazuh indexer events' + free -m + df -h + sleep 10 + done docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" - if [[ $docs -gt 100 ]]; then + if [[ $docs -gt 1 ]]; then echo "wazuh-alerts index documents: ${docs}" else echo "wazuh-alerts index documents: ${docs}" @@ -264,7 +281,7 @@ jobs: run: | qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" - if [[ $qty_templates -eq 3 ]]; then + if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" else @@ -294,10 +311,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check errors in ossec.log - run: ./.github/multi-node-log-check.sh - - - name: Check filebeat output run: ./.github/multi-node-filebeat-check.sh @@ -309,4 +322,7 @@ jobs: else echo "Wazuh dashboard status: ${status}" exit 1 - fi \ No newline at end of file + fi + + - name: Check errors in ossec.log + run: ./.github/multi-node-log-check.sh \ No newline at end of file From cbeb18c13fb4fede0a9bebea5ef48e2363c97c2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Fri, 5 Apr 2024 12:09:39 +0200 Subject: [PATCH 62/72] Bumped revision to 40807 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index fd46cee1..4a62951f 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40806" +REVISION="40807" From 92d6f870913980b5516bad27a5b19b75e760f588 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Carlos=20Anguita=20L=C3=B3pez?= Date: Wed, 10 Apr 2024 13:18:01 +0200 Subject: [PATCH 63/72] Changed Docker base image ocurrences from amazonlinux:2023.3.20240304.0 to amazonlinux:2023 --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ++-- build-docker-images/wazuh-indexer/Dockerfile | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index e2e0bfd7..51545c7c 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240304.0 AS builder +FROM amazonlinux:2023 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM amazonlinux:2023.3.20240304.0 +FROM amazonlinux:2023 # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index bd579225..d30b67ff 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240304.0 AS builder +FROM amazonlinux:2023 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -29,7 +29,7 @@ RUN bash config.sh # Add entrypoint ################################################################################ -FROM amazonlinux:2023.3.20240304.0 +FROM amazonlinux:2023 ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 70ccd447..ba4f27fa 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240304.0 +FROM amazonlinux:2023 RUN rm /bin/sh && ln -s /bin/bash /bin/sh From 353ea5976a2820ef66ba2e384a0cace955086c99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Fri, 19 Apr 2024 09:56:27 +0200 Subject: [PATCH 64/72] Bumped revision to 40808 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 4a62951f..d070c393 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40807" +REVISION="40808" From 650d2936c4fcb6cf40d538c4b065a525bd49ffdf Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 19 Apr 2024 05:19:41 -0300 Subject: [PATCH 65/72] add beta6 tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..e8cbbc45 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-beta6 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-beta6 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-beta6 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-beta6 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-beta6 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-beta6 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 55e2261e..13c49687 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-beta6 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-beta6 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-beta6 hostname: wazuh.dashboard restart: always ports: From 72421d608a5398fc31f5278d8ba96ac040d6b715 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 19 Apr 2024 05:50:57 -0300 Subject: [PATCH 66/72] revert beta6 changes --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index e8cbbc45..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0-beta6 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0-beta6 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0-beta6 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0-beta6 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0-beta6 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-beta6 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 13c49687..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0-beta6 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0-beta6 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-beta6 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: From 097af398df271c737066176270d35b3d57f85f80 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 3 May 2024 04:50:08 -0300 Subject: [PATCH 67/72] bump revision --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index d070c393..9f0e7ef4 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40808" +REVISION="40809" From ef98a5dd83d59e144e65978cae03a95d724b776d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 3 May 2024 05:13:12 -0300 Subject: [PATCH 68/72] change image tag for rc1 --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..1f5e5deb 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc1 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc1 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc1 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc1 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc1 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-rc1 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 55e2261e..4355ce8a 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc1 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc1 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-rc1 hostname: wazuh.dashboard restart: always ports: From 317643eabf778912f66ed3fb831cc630451d9de8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 3 May 2024 05:27:47 -0300 Subject: [PATCH 69/72] rollback image tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 1f5e5deb..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0-rc1 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0-rc1 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc1 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc1 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc1 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-rc1 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 4355ce8a..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0-rc1 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc1 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-rc1 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: From 902b1657195bec3f986bb31e54a1ac07c6c2d2d2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 May 2024 05:39:47 -0300 Subject: [PATCH 70/72] bump revision number --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 9f0e7ef4..14b97823 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.8.0" -REVISION="40809" +REVISION="40810" From efa179698edbff45c043fb2fcabec06f9bd2cf97 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 May 2024 05:57:49 -0300 Subject: [PATCH 71/72] commit image tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..b8a30ba7 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc2 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc2 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc2 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc2 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc2 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-rc2 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 55e2261e..94fe69ba 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0 + image: wazuh/wazuh-manager:4.8.0-rc2 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0 + image: wazuh/wazuh-indexer:4.8.0-rc2 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0 + image: wazuh/wazuh-dashboard:4.8.0-rc2 hostname: wazuh.dashboard restart: always ports: From de2f3995ec406ccb0ba9c20b5b8a00a52038960e Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 May 2024 06:09:28 -0300 Subject: [PATCH 72/72] rollback image tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index b8a30ba7..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.8.0-rc2 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.8.0-rc2 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc2 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc2 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc2 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-rc2 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 94fe69ba..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.8.0-rc2 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.8.0-rc2 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.8.0-rc2 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: