forked from wazuh/wazuh-docker
Security for Elastic Stack (#196)
This commit is contained in:
AlfonsoRBJ
committed by
Jesús Linares
Jesús Linares
parent
d98ab1b4f3
commit
065b5bb5cf
+17
-2
@@ -5,12 +5,25 @@ USER root
|
||||
|
||||
ADD https://packages-dev.wazuh.com/pre-release/app/kibana/wazuhapp-${WAZUH_APP_VERSION}.zip /tmp
|
||||
|
||||
# This CA is created for testing. Please set your own CA pem signed certificate.
|
||||
# command: $ docker build <kibana_directory> --build-arg SECURITY_CA_PEM_LOCATION=<CA_PEM_LOCATION>
|
||||
# ENV variables are necessary: SECURITY_CA_PEM
|
||||
# Sample:
|
||||
# ARG SECURITY_CA_PEM_LOCATION="config/server.TEST-CA-signed.pem"
|
||||
ARG SECURITY_CA_PEM_LOCATION=""
|
||||
|
||||
# CA for secure communication with Elastic
|
||||
ADD $SECURITY_CA_PEM_LOCATION /usr/share/kibana/config
|
||||
|
||||
RUN NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuhapp-${WAZUH_APP_VERSION}.zip &&\
|
||||
chown -R kibana:kibana /usr/share/kibana &&\
|
||||
rm -rf /tmp/*
|
||||
|
||||
RUN yum install openssl -y
|
||||
|
||||
COPY config/entrypoint.sh ./entrypoint.sh
|
||||
RUN chmod 755 ./entrypoint.sh
|
||||
RUN mkdir /entrypoint-scripts
|
||||
|
||||
USER kibana
|
||||
|
||||
@@ -53,9 +66,11 @@ ARG XPACK_UPTIME="false"
|
||||
|
||||
ARG CHANGE_WELCOME="true"
|
||||
|
||||
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
|
||||
COPY --chown=kibana:kibana ./config/10-wazuh_app_config.sh /entrypoint-scripts/10-wazuh_app_config.sh
|
||||
RUN chmod +x /entrypoint-scripts/10-wazuh_app_config.sh
|
||||
|
||||
RUN chmod +x ./wazuh_app_config.sh
|
||||
COPY --chown=kibana:kibana ./config/20-entrypoint.sh /entrypoint-scripts/20-entrypoint.sh
|
||||
RUN chmod +x /entrypoint-scripts/20-entrypoint.sh
|
||||
|
||||
COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
|
||||
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
KIBANA_USER=""
|
||||
KIBANA_PASS=""
|
||||
|
||||
if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
|
||||
KIBANA_USER=${SECURITY_KIBANA_USER}
|
||||
KIBANA_PASS=${SECURITY_KIBANA_PASS}
|
||||
else
|
||||
input=${SECURITY_CREDENTIALS_FILE}
|
||||
while IFS= read -r line
|
||||
do
|
||||
if [[ $line == *"KIBANA_PASSWORD"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
KIBANA_PASS=${arrIN[1]}
|
||||
elif [[ $line == *"KIBANA_USER"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
KIBANA_USER=${arrIN[1]}
|
||||
fi
|
||||
done < "$input"
|
||||
|
||||
fi
|
||||
|
||||
|
||||
if [ ${SECURITY_ENABLED} != "no" ]; then
|
||||
auth="-u ${KIBANA_USER}:${KIBANA_PASS} -k"
|
||||
elif [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then
|
||||
auth=""
|
||||
else
|
||||
auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
|
||||
fi
|
||||
|
||||
until curl -XGET $el_url ${auth}; do
|
||||
>&2 echo "Elastic is unavailable - sleeping"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $auth $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# If Secure access to Kibana is enabled, we must set the credentials.
|
||||
# We must create the ssl certificate.
|
||||
##############################################################################
|
||||
|
||||
if [[ $SECURITY_ENABLED == "yes" ]]; then
|
||||
|
||||
|
||||
# Create keystore
|
||||
/usr/share/kibana/bin/kibana-keystore create
|
||||
|
||||
echo "Setting security Kibana configuiration options."
|
||||
|
||||
echo "
|
||||
# Elasticsearch from/to Kibana
|
||||
elasticsearch.ssl.certificateAuthorities: [\"/usr/share/kibana/config/$SECURITY_CA_PEM\"]
|
||||
|
||||
server.ssl.enabled: true
|
||||
server.ssl.certificate: $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
|
||||
server.ssl.key: $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key
|
||||
" >> /usr/share/kibana/config/kibana.yml
|
||||
|
||||
echo "Create SSL directories."
|
||||
|
||||
mkdir -p $SECURITY_KIBANA_SSL_KEY_PATH $SECURITY_KIBANA_SSL_CERT_PATH
|
||||
CA_PATH="/usr/share/kibana/config"
|
||||
|
||||
echo "Creating SSL certificates."
|
||||
|
||||
pushd $CA_PATH
|
||||
|
||||
chown kibana: $CA_PATH/$SECURITY_CA_PEM
|
||||
chmod 400 $CA_PATH/$SECURITY_CA_PEM
|
||||
SECURITY_KEY_PASS=`openssl rand -base64 32`
|
||||
openssl req -batch -x509 -days 18250 -newkey rsa:2048 -keyout $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key -out $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem -passout pass:"$SECURITY_KEY_PASS" >/dev/null
|
||||
chown -R kibana: $CA_PATH/ssl
|
||||
chmod -R 770 $CA_PATH/ssl
|
||||
chmod 440 $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
|
||||
|
||||
popd
|
||||
echo "SSL certificates created."
|
||||
|
||||
# Add keys to keystore
|
||||
echo -e "$KIBANA_PASS" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.password --stdin
|
||||
echo -e "$SECURITY_KEY_PASS" | /usr/share/kibana/bin/kibana-keystore add server.ssl.keyPassphrase --stdin
|
||||
echo -e "$KIBANA_USER" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.username --stdin
|
||||
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Run more configuration scripts.
|
||||
##############################################################################
|
||||
|
||||
bash /usr/share/kibana/kibana_settings.sh &
|
||||
|
||||
/usr/local/bin/kibana-docker
|
||||
@@ -1,57 +1,8 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
|
||||
for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
|
||||
bash "$script"
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
if [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then
|
||||
auth=""
|
||||
else
|
||||
auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
|
||||
fi
|
||||
|
||||
until curl -XGET $el_url ${auth}; do
|
||||
>&2 echo "Elastic is unavailable - sleeping"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
|
||||
./wazuh_app_config.sh
|
||||
|
||||
sleep 5
|
||||
|
||||
./kibana_settings.sh &
|
||||
|
||||
/usr/local/bin/kibana-docker
|
||||
done
|
||||
@@ -6,8 +6,8 @@ WAZUH_MAJOR=3
|
||||
|
||||
##############################################################################
|
||||
# Wait for the Kibana API to start. It is necessary to do it in this container
|
||||
# because the others are running Elastic Stack and we can not interrupt them.
|
||||
#
|
||||
# because the others are running Elastic Stack and we can not interrupt them.
|
||||
#
|
||||
# The following actions are performed:
|
||||
#
|
||||
# Add the wazuh alerts index as default.
|
||||
@@ -20,7 +20,6 @@ WAZUH_MAJOR=3
|
||||
##############################################################################
|
||||
if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
|
||||
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
|
||||
|
||||
fi
|
||||
|
||||
if [ "$KIBANA_IP" != "" ]; then
|
||||
@@ -29,12 +28,43 @@ else
|
||||
kibana_ip="kibana"
|
||||
fi
|
||||
|
||||
while [[ "$(curl -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
|
||||
KIBANA_USER=""
|
||||
KIBANA_PASS=""
|
||||
|
||||
if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
|
||||
KIBANA_USER=${SECURITY_KIBANA_USER}
|
||||
KIBANA_PASS=${SECURITY_KIBANA_PASS}
|
||||
else
|
||||
input=${SECURITY_CREDENTIALS_FILE}
|
||||
while IFS= read -r line
|
||||
do
|
||||
if [[ $line == *"KIBANA_PASSWORD"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
KIBANA_PASS=${arrIN[1]}
|
||||
elif [[ $line == *"KIBANA_USER"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
KIBANA_USER=${arrIN[1]}
|
||||
fi
|
||||
done < "$input"
|
||||
|
||||
fi
|
||||
|
||||
|
||||
if [ ${SECURITY_ENABLED} != "no" ]; then
|
||||
auth="-u $KIBANA_USER:${KIBANA_PASS}"
|
||||
kibana_secure_ip="https://$kibana_ip"
|
||||
else
|
||||
auth=""
|
||||
kibana_secure_ip="http://$kibana_ip"
|
||||
fi
|
||||
|
||||
|
||||
while [[ "$(curl $auth -k -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_secure_ip:5601/status)" != "200" ]]; do
|
||||
echo "Waiting for Kibana API. Sleeping 5 seconds"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Prepare index selection.
|
||||
# Prepare index selection.
|
||||
echo "Kibana API is running"
|
||||
|
||||
default_index="/tmp/default_index.json"
|
||||
@@ -49,16 +79,23 @@ EOF
|
||||
|
||||
sleep 5
|
||||
# Add the wazuh alerts index as default.
|
||||
curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
|
||||
curl $auth -k -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
|
||||
rm -f ${default_index}
|
||||
|
||||
sleep 5
|
||||
# Configuring Kibana TimePicker.
|
||||
curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
|
||||
curl $auth -k -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
|
||||
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
|
||||
|
||||
sleep 5
|
||||
# Do not ask user to help providing usage statistics to Elastic
|
||||
curl -POST "http://$kibana_ip:5601/api/telemetry/v1/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
|
||||
curl $auth -k -POST "$kibana_secure_ip:5601/api/telemetry/v1/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
|
||||
|
||||
# Remove credentials file
|
||||
if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
|
||||
echo "Security credentials file not used. Nothing to do."
|
||||
else
|
||||
shred -zvu ${SECURITY_CREDENTIALS_FILE}
|
||||
fi
|
||||
|
||||
echo "End settings"
|
||||
|
||||
Reference in New Issue
Block a user