forked from wazuh/wazuh-docker
Security for Elastic Stack (#196)
This commit is contained in:
AlfonsoRBJ
committed by
Jesús Linares
Jesús Linares
parent
d98ab1b4f3
commit
065b5bb5cf
@@ -9,4 +9,29 @@ RUN rm -f /usr/share/logstash/pipeline/logstash.conf
|
||||
|
||||
COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
|
||||
# This CA is created for testing. Please set your own CA pem signed certificate.
|
||||
# command: $ docker build <logstash_directory> --build-arg SECURITY_CA_PEM_LOCATION=<CA_PEM_LOCATION> --build-arg SECURITY_CA_PEM_ARG=<CA_PEM_NAME>
|
||||
# ENV variables are necessary: SECURITY_CA_PEM
|
||||
# Sample:
|
||||
# ARG SECURITY_CA_PEM_LOCATION="config/server.TEST-CA-signed.pem"
|
||||
# ARG SECURITY_CA_PEM_ARG="server.TEST-CA-signed.pem"
|
||||
ARG SECURITY_CA_PEM_LOCATION=""
|
||||
ARG SECURITY_CA_PEM_ARG=""
|
||||
|
||||
# CA for secure communication with Elastic
|
||||
ADD $SECURITY_CA_PEM_LOCATION /usr/share/logstash/config
|
||||
|
||||
# Set permissions for CA
|
||||
USER root
|
||||
RUN if [[ "x$SECURITY_CA_PEM_LOCATION" == x ]] ; then echo Nothing to do ; else chown logstash: /usr/share/logstash/config/$SECURITY_CA_PEM_ARG ; fi
|
||||
RUN if [[ "x$SECURITY_CA_PEM_LOCATION" == x ]] ; then echo Nothing to do ; else chmod 400 /usr/share/logstash/config/$SECURITY_CA_PEM_ARG ; fi
|
||||
|
||||
# Add entrypoint scripts
|
||||
RUN mkdir /entrypoint-scripts
|
||||
RUN chmod -R 774 /entrypoint-scripts
|
||||
RUN chown -R logstash:logstash /entrypoint-scripts
|
||||
COPY --chown=logstash:logstash ./config/10-entrypoint.sh /entrypoint-scripts/10-entrypoint.sh
|
||||
RUN chmod +x /entrypoint-scripts/10-entrypoint.sh
|
||||
USER logstash
|
||||
|
||||
ENTRYPOINT /entrypoint.sh
|
||||
|
||||
@@ -41,5 +41,9 @@ output {
|
||||
hosts => ["elasticsearch:9200"]
|
||||
index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
|
||||
document_type => "wazuh"
|
||||
#user => service_logstash
|
||||
#password => service_logstash_internal_password
|
||||
#ssl => true
|
||||
#cacert => "/path/to/cert.pem"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,154 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
#
|
||||
# OSSEC container bootstrap. See the README for information of the environment
|
||||
# variables expected by this script.
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
LOGSTASH_USER=""
|
||||
LOGSTASH_PASS=""
|
||||
|
||||
if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
|
||||
LOGSTASH_USER=${SECURITY_LOGSTASH_USER}
|
||||
LOGSTASH_PASS=${SECURITY_LOGSTASH_PASS}
|
||||
else
|
||||
input=${SECURITY_CREDENTIALS_FILE}
|
||||
while IFS= read -r line
|
||||
do
|
||||
if [[ $line == *"LOGSTASH_PASSWORD"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
LOGSTASH_PASS=${arrIN[1]}
|
||||
elif [[ $line == *"LOGSTASH_USER"* ]]; then
|
||||
arrIN=(${line//:/ })
|
||||
LOGSTASH_USER=${arrIN[1]}
|
||||
fi
|
||||
done < "$input"
|
||||
|
||||
fi
|
||||
|
||||
if [ ${SECURITY_ENABLED} != "no" ]; then
|
||||
auth="-u ${LOGSTASH_USER}:${LOGSTASH_PASS} -k"
|
||||
elif [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then
|
||||
auth=""
|
||||
else
|
||||
auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
|
||||
fi
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Customize logstash output ip
|
||||
##############################################################################
|
||||
|
||||
if [ "$LOGSTASH_OUTPUT" != "" ]; then
|
||||
>&2 echo "Customize Logstash ouput ip."
|
||||
sed -i 's|elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's|http://elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/config/logstash.yml
|
||||
fi
|
||||
|
||||
until curl $auth -XGET $el_url; do
|
||||
>&2 echo "Elastic is unavailable - sleeping."
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Set Logstash password
|
||||
##############################################################################
|
||||
|
||||
##############################################################################
|
||||
# If Secure access to Kibana is enabled, we must set the credentials.
|
||||
##############################################################################
|
||||
|
||||
if [[ $SECURITY_ENABLED == "yes" ]]; then
|
||||
|
||||
## Create secure keystore
|
||||
SECURITY_RANDOM_PASS=`date +%s | sha256sum | base64 | head -c 32 ; echo`
|
||||
export LOGSTASH_KEYSTORE_PASS=$SECURITY_RANDOM_PASS
|
||||
/usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config create
|
||||
|
||||
## Settings for logstash.yml
|
||||
echo "
|
||||
# Required set the passwords
|
||||
xpack.monitoring.enabled: true
|
||||
xpack.monitoring.elasticsearch.username: \${LOGSTASH_KS_USER}
|
||||
xpack.monitoring.elasticsearch.password: \${LOGSTASH_KS_PASS}
|
||||
xpack.management.elasticsearch.username: \${LOGSTASH_KS_USER}
|
||||
xpack.management.elasticsearch.password: \${LOGSTASH_KS_PASS}
|
||||
" >> /usr/share/logstash/config/logstash.yml
|
||||
|
||||
## Settings for 01-wazuh.conf
|
||||
sed -i 's:#user => service_logstash:user => "${LOGSTASH_KS_USER}":g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's:#password => service_logstash_internal_password:password => "${LOGSTASH_KS_PASS}":g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's:#ssl => true:ssl => true:g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's:#cacert => "/path/to/cert.pem":cacert => "/usr/share/logstash/config/'$SECURITY_CA_PEM'":g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
|
||||
## Add keys to the keystore
|
||||
echo -e "$LOGSTASH_USER" | /usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config add LOGSTASH_KS_USER
|
||||
echo -e "$LOGSTASH_PASS" | /usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config add LOGSTASH_KS_PASS
|
||||
|
||||
|
||||
fi
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $auth $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Remove credentials file
|
||||
##############################################################################
|
||||
|
||||
if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
|
||||
echo "Security credentials file not used. Nothing to do."
|
||||
else
|
||||
shred -zvu ${SECURITY_CREDENTIALS_FILE}
|
||||
fi
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Map environment variables to entries in logstash.yml.
|
||||
# Note that this will mutate logstash.yml in place if any such settings are found.
|
||||
# This may be undesirable, especially if logstash.yml is bind-mounted from the
|
||||
# host system.
|
||||
##############################################################################
|
||||
|
||||
env2yaml /usr/share/logstash/config/logstash.yml
|
||||
|
||||
export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS"
|
||||
|
||||
if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then
|
||||
exec logstash "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
@@ -1,72 +1,8 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
#
|
||||
# OSSEC container bootstrap. See the README for information of the environment
|
||||
# variables expected by this script.
|
||||
#
|
||||
|
||||
set -e
|
||||
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
|
||||
for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
|
||||
bash "$script"
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Customize logstash output ip
|
||||
##############################################################################
|
||||
|
||||
if [ "$LOGSTASH_OUTPUT" != "" ]; then
|
||||
>&2 echo "Customize Logstash ouput ip."
|
||||
sed -i 's|elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's|http://elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/config/logstash.yml
|
||||
fi
|
||||
|
||||
until curl -XGET $el_url; do
|
||||
>&2 echo "Elastic is unavailable - sleeping."
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
##############################################################################
|
||||
# Map environment variables to entries in logstash.yml.
|
||||
# Note that this will mutate logstash.yml in place if any such settings are found.
|
||||
# This may be undesirable, especially if logstash.yml is bind-mounted from the
|
||||
# host system.
|
||||
##############################################################################
|
||||
|
||||
env2yaml /usr/share/logstash/config/logstash.yml
|
||||
|
||||
export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS"
|
||||
|
||||
if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then
|
||||
exec logstash "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
done
|
||||
Reference in New Issue
Block a user