From 09f87ef2330aeacba2385ba8fb5b69db5e19ab81 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 26 Jan 2022 17:15:08 -0300 Subject: [PATCH] Add Wazuh indexer cluster configuration --- docker-compose.yml | 2 +- ...er-verts.yml => generate-indexer-certs.yml | 0 kibana-odfe/Dockerfile | 2 +- production-cluster.yml | 71 ++++++++++--------- .../wazuh-indexer-node1.yml | 31 -------- .../wazuh-indexer-node2.yml | 31 -------- .../wazuh-indexer-node3.yml | 31 -------- production_cluster/kibana_ssl/cert.pem | 21 ++++++ production_cluster/kibana_ssl/key.pem | 28 ++++++++ production_cluster/nginx/ssl/cert.pem | 21 ++++++ production_cluster/nginx/ssl/key.pem | 28 ++++++++ .../wazuh_indexer_ssl_certs/certs.yml | 55 ++++++-------- .../wazuh_indexer_ssl_certs/certs2.yml | 35 +++++++++ wazuh-dashboard/Dockerfile | 2 +- wazuh-indexer/Dockerfile_centos | 2 +- wazuh-indexer/config/entrypoint.sh | 37 +++++++--- wazuh-odfe/Dockerfile | 6 +- wazuh-odfe/config/filebeat.yml | 2 +- 18 files changed, 227 insertions(+), 178 deletions(-) rename generate-indexer-verts.yml => generate-indexer-certs.yml (100%) delete mode 100644 production_cluster/elastic_opendistro/wazuh-indexer-node1.yml delete mode 100644 production_cluster/elastic_opendistro/wazuh-indexer-node2.yml delete mode 100644 production_cluster/elastic_opendistro/wazuh-indexer-node3.yml create mode 100644 production_cluster/kibana_ssl/cert.pem create mode 100644 production_cluster/kibana_ssl/key.pem create mode 100644 production_cluster/nginx/ssl/cert.pem create mode 100644 production_cluster/nginx/ssl/key.pem create mode 100644 production_cluster/wazuh_indexer_ssl_certs/certs2.yml diff --git a/docker-compose.yml b/docker-compose.yml index 231b375b..b7453803 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -31,7 +31,7 @@ services: elasticsearch: image: wazuh-indexer - hostname: elasticsearch + hostname: node1 restart: always ports: - "9700:9700" diff --git a/generate-indexer-verts.yml b/generate-indexer-certs.yml similarity index 100% rename from generate-indexer-verts.yml rename to generate-indexer-certs.yml diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 1d304341..3cad99ba 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.3.0 +ARG WAZUH_VERSION=4.2.5 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index 01e7eaa8..f1de638e 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -11,7 +11,7 @@ services: - "514:514/udp" - "55000:55000" environment: - - ELASTICSEARCH_URL=https://elasticsearch:9700 + - ELASTICSEARCH_URL=https://wazuh-indexer:9700 - ELASTIC_USERNAME=admin - ELASTIC_PASSWORD=SecretPassword - FILEBEAT_SSL_VERIFICATION_MODE=full @@ -42,7 +42,7 @@ services: hostname: wazuh-worker restart: always environment: - - ELASTICSEARCH_URL=https://elasticsearch:9700 + - ELASTICSEARCH_URL=https://wazuh-indexer:9700 - ELASTIC_USERNAME=admin - ELASTIC_PASSWORD=SecretPassword - FILEBEAT_SSL_VERIFICATION_MODE=full @@ -66,14 +66,15 @@ services: - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.key:/etc/ssl/filebeat.key - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf - elasticsearch: - image: wazuh/wazuh-indexer:4.3.0 - hostname: elasticsearch + wazuh-indexer: + image: wazuh-indexer + hostname: wazuh-indexer restart: always ports: - "9700:9700" environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" + - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "NODE_TYPE=master" ulimits: memlock: soft: -1 @@ -82,21 +83,22 @@ services: soft: 65536 hard: 65536 volumes: - - elastic-data-1:/var/lib/wazuh-indexer + - wazuh-indexer-data-1:/var/lib/wazuh-indexer - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/node1.key:/etc/wazuh-indexer/certs/node1.key - - ./production_cluster/wazuh_indexer_ssl_certs/node1.pem:/etc/wazuh-indexer/certs/node1.pem + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.key:/etc/wazuh-indexer/certs/wazuh-indexer.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.pem:/etc/wazuh-indexer/certs/wazuh-indexer.pem - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/etc/wazuh-indexer/certs/admin.pem - ./production_cluster/wazuh_indexer_ssl_certs/admin.key:/etc/wazuh-indexer/certs/admin.key - - ./production_cluster/elastic_opendistro/wazuh-indexer-node1.yml:/etc/wazuh-indexer/opensearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./production_cluster/wazuh-indexer/opnesearch-node1.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - elasticsearch-2: - image: wazuh/wazuh-indexer:4.3.0 - hostname: elasticsearch-2 + wazuh-indexer-2: + image: wazuh-indexer + hostname: wazuh-indexer-2 restart: always environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" + - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "NODE_TYPE=worker" ulimits: memlock: soft: -1 @@ -105,19 +107,20 @@ services: soft: 65536 hard: 65536 volumes: - - elastic-data-2:/var/lib/wazuh-indexer + - wazuh-indexer-data-2:/var/lib/wazuh-indexer - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/node2.key:/etc/wazuh-indexer/certs/node2.key - - ./production_cluster/wazuh_indexer_ssl_certs/node2.pem:/etc/wazuh-indexer/certs/node2.pem - - ./production_cluster/elastic_opendistro/wazuh-indexer-node2.yml:/etc/wazuh-indexer/elasticsearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.key:/etc/wazuh-indexer/certs/wazuh-indexer-2.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.pem:/etc/wazuh-indexer/certs/wazuh-indexer-2.pem + - ./production_cluster/wazuh-indexer/opnesearch-node2.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - elasticsearch-3: - image: wazuh/wazuh-indexer:4.3.0 - hostname: elasticsearch-3 + wazuh-indexer-3: + image: wazuh-indexer + hostname: wazuh-indexer-3 restart: always environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" + - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "NODE_TYPE=worker" ulimits: memlock: soft: -1 @@ -126,12 +129,12 @@ services: soft: 65536 hard: 65536 volumes: - - elastic-data-3:/var/lib/wazuh-indexer + - wazuh-indexer-data-3:/var/lib/wazuh-indexer - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/node3.key:/etc/wazuh-indexer/certs/node3.key - - ./production_cluster/wazuh_indexer_ssl_certs/node3.pem:/etc/wazuh-indexer/certs/node3.pem - - ./production_cluster/elastic_opendistro/wazuh-indexer-node3.yml:/etc/wazuh-indexer/elasticsearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.key:/etc/wazuh-indexer/certs/wazuh-indexer-3.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.pem:/etc/wazuh-indexer/certs/wazuh-indexer-3.pem + - ./production_cluster/wazuh-indexer/opnesearch-node3.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: image: wazuh/wazuh-dashboard:4.3.0 @@ -153,9 +156,9 @@ services: - ./production_cluster/kibana_ssl/key.pem:/etc/wazuh-dashboard/certs/key.pem depends_on: - - elasticsearch + - wazuh-indexer links: - - elasticsearch:elasticsearch + - wazuh-indexer:wazuh-indexer - wazuh-master:wazuh-master nginx: @@ -201,6 +204,6 @@ volumes: worker-ossec-wodles: worker-filebeat-etc: worker-filebeat-var: - elastic-data-1: - elastic-data-2: - elastic-data-3: + wazuh-indexer-data-1: + wazuh-indexer-data-2: + wazuh-indexer-data-3: diff --git a/production_cluster/elastic_opendistro/wazuh-indexer-node1.yml b/production_cluster/elastic_opendistro/wazuh-indexer-node1.yml deleted file mode 100644 index 39a2e0e0..00000000 --- a/production_cluster/elastic_opendistro/wazuh-indexer-node1.yml +++ /dev/null @@ -1,31 +0,0 @@ -network.host: elasticsearch -cluster.name: wazuh-cluster -node.name: elasticsearch -discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3 -cluster.initial_master_nodes: elasticsearch -bootstrap.memory_lock: true - -opendistro_security.ssl.transport.pemcert_filepath: node1.pem -opendistro_security.ssl.transport.pemkey_filepath: node1.key -opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -opendistro_security.ssl.transport.enforce_hostname_verification: false -opendistro_security.ssl.transport.resolve_hostname: false -opendistro_security.ssl.http.enabled: true -opendistro_security.ssl.http.pemcert_filepath: node1.pem -opendistro_security.ssl.http.pemkey_filepath: node1.key -opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem -opendistro_security.allow_default_init_securityindex: true -opendistro_security.nodes_dn: - - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] -opendistro_security.audit.type: internal_elasticsearch -opendistro_security.enable_snapshot_restore_privilege: true -opendistro_security.check_snapshot_restore_write_privileges: true -opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] -cluster.routing.allocation.disk.threshold_enabled: false -#opendistro_security.audit.config.disabled_rest_categories: NONE -#opendistro_security.audit.config.disabled_transport_categories: NONE -opendistro_security.audit.log_request_body: false diff --git a/production_cluster/elastic_opendistro/wazuh-indexer-node2.yml b/production_cluster/elastic_opendistro/wazuh-indexer-node2.yml deleted file mode 100644 index dfa227ec..00000000 --- a/production_cluster/elastic_opendistro/wazuh-indexer-node2.yml +++ /dev/null @@ -1,31 +0,0 @@ -network.host: elasticsearch-2 -cluster.name: wazuh-cluster -node.name: elasticsearch-2 -discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3 -cluster.initial_master_nodes: elasticsearch -bootstrap.memory_lock: true - -opendistro_security.ssl.transport.pemcert_filepath: node2.pem -opendistro_security.ssl.transport.pemkey_filepath: node2.key -opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -opendistro_security.ssl.transport.enforce_hostname_verification: false -opendistro_security.ssl.transport.resolve_hostname: false -opendistro_security.ssl.http.enabled: true -opendistro_security.ssl.http.pemcert_filepath: node2.pem -opendistro_security.ssl.http.pemkey_filepath: node2.key -opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem -opendistro_security.allow_default_init_securityindex: true -opendistro_security.nodes_dn: - - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] -opendistro_security.audit.type: internal_elasticsearch -opendistro_security.enable_snapshot_restore_privilege: true -opendistro_security.check_snapshot_restore_write_privileges: true -opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] -cluster.routing.allocation.disk.threshold_enabled: false -#opendistro_security.audit.config.disabled_rest_categories: NONE -#opendistro_security.audit.config.disabled_transport_categories: NONE -opendistro_security.audit.log_request_body: false diff --git a/production_cluster/elastic_opendistro/wazuh-indexer-node3.yml b/production_cluster/elastic_opendistro/wazuh-indexer-node3.yml deleted file mode 100644 index 20434d81..00000000 --- a/production_cluster/elastic_opendistro/wazuh-indexer-node3.yml +++ /dev/null @@ -1,31 +0,0 @@ -network.host: elasticsearch-3 -cluster.name: wazuh-cluster -node.name: elasticsearch-3 -discovery.seed_hosts: elasticsearch,elasticsearch-2,elasticsearch-3 -cluster.initial_master_nodes: elasticsearch -bootstrap.memory_lock: true - -opendistro_security.ssl.transport.pemcert_filepath: node3.pem -opendistro_security.ssl.transport.pemkey_filepath: node3.key -opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem -opendistro_security.ssl.transport.enforce_hostname_verification: false -opendistro_security.ssl.transport.resolve_hostname: false -opendistro_security.ssl.http.enabled: true -opendistro_security.ssl.http.pemcert_filepath: node3.pem -opendistro_security.ssl.http.pemkey_filepath: node3.key -opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem -opendistro_security.allow_default_init_securityindex: true -opendistro_security.nodes_dn: - - 'CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] -opendistro_security.audit.type: internal_elasticsearch -opendistro_security.enable_snapshot_restore_privilege: true -opendistro_security.check_snapshot_restore_write_privileges: true -opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] -cluster.routing.allocation.disk.threshold_enabled: false -#opendistro_security.audit.config.disabled_rest_categories: NONE -#opendistro_security.audit.config.disabled_transport_categories: NONE -opendistro_security.audit.log_request_body: false diff --git a/production_cluster/kibana_ssl/cert.pem b/production_cluster/kibana_ssl/cert.pem new file mode 100644 index 00000000..dab3fec7 --- /dev/null +++ b/production_cluster/kibana_ssl/cert.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDazCCAlOgAwIBAgIUeEaU6PZXSb2RQhzz6NQDsnXgPCYwDQYJKoZIhvcNAQEL +BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM +GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMjAxMjUxNTM4MjRaFw0yMzAx +MjUxNTM4MjRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw +HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQDKJlBieT/1IJkd4AoUja9eFy6Z+k1yskwRLdVHuYLL +EhbDhsOOnoB0Yg7XAylxbyvXvxeNC5uQJWrU5nDwf70cGNmIG29sDd9XXKmEj7lo +NffkHBD+/UQb9aodWVaTVnu81qB+jCwi/vThaslb7ycmC+wyPz+P3SZbhQKT3BTI +2vYNzznPcugs1qFhnA0Mn4DuY4daEkFDYXjxtxfE8rWZOr+bbhxjgdAp25KaA1Sz +k47DiodTxASOumODtR/j/CPm4W9oZQ0y+cAE+mYg8TmMz+kyPK1oW8mMsjUHK1/m +EiBCMX1rdOVFNQ3ia7aX+xJzH/7ZDJPg7tG0MbfUxv+7AgMBAAGjUzBRMB0GA1Ud +DgQWBBTwTfEThtctV2m1mXpoUE0o7fQgXzAfBgNVHSMEGDAWgBTwTfEThtctV2m1 +mXpoUE0o7fQgXzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCq +1JHCAZCKFyJh/Dx8vjvXIhPeOjNBWcx4Dl4mw+DlkNyAfX6xJprUy3f/hIuXhZcs +TvLjLi2IFcGk/lGUh1SIxyAmyz49rSm/B0rYWR+rBwrEFHZwYHegS/oGtLn1kwZz +kMn3WzLFMwBLoSOs5tT3i3E0EAuH/MsO9a61HJUKbWJGG9cv3OtcCSU6wb+lQyK5 +mTsI8kjVAuKmuzwl9S3I7TqXolhwodz9MAagmLcwSfAU8Ce7qTwwpBOz4YkOHqkH +JAZhYEcLbLKCh2mGtB84mdA2pHoxK8y/J05P85ENwcYooFD7gYcsHphkKKKszNmf +AArKqDwDGSRGfbq/3rOE +-----END CERTIFICATE----- diff --git a/production_cluster/kibana_ssl/key.pem b/production_cluster/kibana_ssl/key.pem new file mode 100644 index 00000000..393f6768 --- /dev/null +++ b/production_cluster/kibana_ssl/key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDKJlBieT/1IJkd +4AoUja9eFy6Z+k1yskwRLdVHuYLLEhbDhsOOnoB0Yg7XAylxbyvXvxeNC5uQJWrU +5nDwf70cGNmIG29sDd9XXKmEj7loNffkHBD+/UQb9aodWVaTVnu81qB+jCwi/vTh +aslb7ycmC+wyPz+P3SZbhQKT3BTI2vYNzznPcugs1qFhnA0Mn4DuY4daEkFDYXjx +txfE8rWZOr+bbhxjgdAp25KaA1Szk47DiodTxASOumODtR/j/CPm4W9oZQ0y+cAE ++mYg8TmMz+kyPK1oW8mMsjUHK1/mEiBCMX1rdOVFNQ3ia7aX+xJzH/7ZDJPg7tG0 +MbfUxv+7AgMBAAECggEBAI1K0F6z3vdHjJ4sDP+mtI9wZpsrL1zesHpFbdCPIpMr +loudsywJL0GplDPGuv3VNXC72Qs1tMrAzHX4h7Ihpp1v5QPUIUIGRDf8xWOpTW9A +YX6n+10uyp88S2XuHqwnA5/O6CjrcqIXUDQKfqlqdBOMu8+3E4dLjNblFhMg/coQ +ueGY8BV7bLIIBCxZV9Ca/DuQZQQXBRJjGDEcxWl+GBuWR81P9D5BITma+js9yZKw +yvZckvfObSyJ9nR5bsWPlybn3GrdGHeBwXvGXswDekwj9wsRVc00LcQ0BwrwCn7I +xjnB0XuoH4+T4OrIS08XQROzKalhUOZKwYilKEt78ikCgYEA+xX+z3QW5lVcDVIx +IIU2elZlr515NqSDBkFbdUSAlDQqPxyqQg3y110xymypdJwvh3DL3tuLyAswANKD +M3nj8U/hhKKcDjxiHutk/3R3sb+z/X6apS7nfWHn7X2G97Xv1GSp+Jxv+bZAQ+jP +k4fe3CB8JHu+V9My69XYBwx6468CgYEAzhsisB+Y0nKBIfoMoB752fFbPissycMI +QliFZsp8upIZ8dGeThubhuSMTAvL73rZpN3pJCrAwxKDvwf/sPIK2Q/ux8oB3rUr +jkTNM2D51VRNkcNbedg2LJETNzrqChH+J4ZeSMXHG7kkgJHfNiyMOwAzR0pFTtQC +tRDrF1j8i7UCgYA2NiuMEx6WoLt9TM+6m8iFZX4TCscPGzoG8bmTejTgytqMQd4o +4OYbxc1oTUnRGZ/ReHMsLO7jRDcbFliplpm2km64untDP5pX3q8x0K2/PQrZoqo1 +HAlzMt5mkoG/nhKoIwvn1679lXIOt4eJ7P4bPRBQuD8Cq2EFNmisLO+jlQKBgGeR +MykVd5GogEM2h0mexyZBJfxjbaolGu1b1g0FCxAlgmwFTWsqbEioZ+d+tgesz9kM +ua623Q4pK5K+zjl4JwNUAkTauX3TxANFh2ed/2y3ZBMu+7SKdQ6ICAPk0t4klHYA +Czi+SYMg0brZkjSCxiSPwTS9mX43AvVBfyDIUn9RAoGBAKfABXsKw34AI2M/Dhyh +2tpjW/luRWhzeO9pBDbe7jHOKqXSdFuRj0uniTiAHiK2ozL0xCXvG7b2l2rQQ6dn +cPCPagKSZmyFQcHxRr6QG+EGAbKa61eVWlGgEmp8jinv96V9eifgg+W+yH988PwC +e+liYHi4YGgobcnMDrIUdWrw +-----END PRIVATE KEY----- diff --git a/production_cluster/nginx/ssl/cert.pem b/production_cluster/nginx/ssl/cert.pem new file mode 100644 index 00000000..12d42e83 --- /dev/null +++ b/production_cluster/nginx/ssl/cert.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDazCCAlOgAwIBAgIULAht6hsQE8zjr2rgFMp7AGNsjWAwDQYJKoZIhvcNAQEL +BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM +GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMjAxMjUxNTM4MzNaFw0yMzAx +MjUxNTM4MzNaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw +HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQC/++0tPSSbcSvhVG1VSu+GdJEECzJYrmflmBU6s+PP +zQ4wvQSuZKlItQdOyJgoOfX1LZDfmoPvg4cmtaozJZyXqSOEj+Y2RXu+CB1SbonQ +PvWWPIGHS2LDWuVF3xgi0yvwiDcbydThjv4iQ9peVwG+6d2Ehg8lo6eENUsnqh2U +hn8mGg3mUx+AeGLE8lVQtyFG5ucjn5lobOGbobWVDddCOibCEnoyLXRHH5Z+PQ1d ++qCe8QHh7+y9HEo7Qy5HHuZgeAaDglUXrymNE9LvZ+yeeztt1LBsy8bQPqCJ5dS0 +e4DffxSURZqUFqMLsUDcIMZw1Gb1YNxeX9VzngVew4QRAgMBAAGjUzBRMB0GA1Ud +DgQWBBRGuAOx1cBaeCbgkVevNEQ6TnCOCzAfBgNVHSMEGDAWgBRGuAOx1cBaeCbg +kVevNEQ6TnCOCzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJ +S8e8tpUAkEB/zxdCF5R/RsFu0cpeBSma2hEd5o5vjuOCo1lX0Mjx3p16ZI6nlkGG +TByVQAQmvETyc2SY/TX9OqBzZIqqSs1mRQOJvF7kEBI6o3JDiURynd54uPKboO6Y +rsWAtFwcpzOF+zTUeCNFXPzCwivoKFvnxh2bUFX0WxxTBrR5scKR23BKoMAWeR+h +7cXsjd+wI8EhhVduJRvFV8m+rXPgBDHo446aAp0aDC8hEWhnWAIrJKIsmV06ZtKc +Kun1/kyNF8QloO4XNoY3DAKWmBW99PgV3gci535AZDMMCrDzZ4bcoqLMfXVR6odh +eumaeNEXCPMIb5+vAao3 +-----END CERTIFICATE----- diff --git a/production_cluster/nginx/ssl/key.pem b/production_cluster/nginx/ssl/key.pem new file mode 100644 index 00000000..0859b8fb --- /dev/null +++ b/production_cluster/nginx/ssl/key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC/++0tPSSbcSvh +VG1VSu+GdJEECzJYrmflmBU6s+PPzQ4wvQSuZKlItQdOyJgoOfX1LZDfmoPvg4cm +taozJZyXqSOEj+Y2RXu+CB1SbonQPvWWPIGHS2LDWuVF3xgi0yvwiDcbydThjv4i +Q9peVwG+6d2Ehg8lo6eENUsnqh2Uhn8mGg3mUx+AeGLE8lVQtyFG5ucjn5lobOGb +obWVDddCOibCEnoyLXRHH5Z+PQ1d+qCe8QHh7+y9HEo7Qy5HHuZgeAaDglUXrymN +E9LvZ+yeeztt1LBsy8bQPqCJ5dS0e4DffxSURZqUFqMLsUDcIMZw1Gb1YNxeX9Vz +ngVew4QRAgMBAAECggEAIp6hVGkUMtujmAyLcrgCnXJjvCDwwUEiByr3mRBbYluN +1YggUfpg9HWAjdpqZcad7cp7t3a7l/NV6csUmAiORmL/vqXcU6kP+WKpNvYr79uK +mb7rdKRJeQTpF0J1rcH6yHMnzOEGfG42saMeu6hg7jZp9b3e+WCbkqGxncN1dhTC +sNsHGGwlvfR0z7soAuVewysnJ5fckEP3mpHnEhegIz9LHeZvRbavpI1q/cgz2+FT +h1AAHXSio1dLEypHbTKw3uf+FA9Jpalbm6mBuY+7L0Lh5qkJ3sPdhQn6EfcDPY7O +YnsfAfY02g48ZsTbaRokPMDN95DWV0MmS4bMaUMlYQKBgQDtVJfC6ZOANtZCKFXO +/Rs20i9CYMXOp4m7qlfiKAezp5bh2uUlh49/BeAUJ45Hf5o+RleAhowmS3PTjy9t +vDBuU0m13K9b2e8KlFOSEkkwRhEChkHa3aTsIYgI1cXhTVIl9sRRHWLmFe0C5DEG +WQMjYL6POByAI8DNMdPv0aqe7QKBgQDPFiPODbRav0vabFl3E1R7ff2PpXSKgGj6 +Y/oeM+iAKwE6/9aHIqsDLaSMzAVXb0TMvEEjI77tIfGg3Azv/lfq3j4bXMEWVY6H +92JBDqagSxzzbFcqelyzEKLFBYG01MUEwOz8oNcIiQNndw8xakH04csBzHTMWUMb +3jUujDJxNQKBgQDNZN6KkzdSSSMY0mug3bAFu9WmrrXCaYBr57pzQY2Yz7tm79hM +qItptR3+k1UxT5+fsaTc2JTGN5qgR1UWtT183Zv3RmyFI5EbKM9CpYytuJXUB3lK +/3NR4Jsoekns+MvVi0DPqo0C74rVa8N56OMsZPfGXxtbUpXzf+IZtOzi6QKBgCKp +2BBzps7R2oaTQF54M9n/+uOClIFigS/4cDOCCNb7W9deX7B7ExkTGMoglHxQObnz +gQu6vgi/d8yvSNMbReggj1DRM9jjNVp5BE9TfnyyVgRBDE4l8UJf9H76Lv3v55Km +IIUg/x2Eobc97KMe4C93ZB3G9X4HKv6NMWW7Pe5JAoGBAJwsmcmyhgCmJ1F5dYj4 +kOZaiJrM8XNKdeIskzpyyfJRAbLWtClc2iZdOBP3YKnSYB5CyI16Padp60cDhVrX +5M1s/Uf8aJP+T/dtXPKH+Mug1Qbc5vBHKpEGaZNuvfbauTAH2B+QaoeVmEqNQg7T +lO5yoHbI38TYyvnY4YAmJ+N2 +-----END PRIVATE KEY----- diff --git a/production_cluster/wazuh_indexer_ssl_certs/certs.yml b/production_cluster/wazuh_indexer_ssl_certs/certs.yml index 486e4178..3325b392 100644 --- a/production_cluster/wazuh_indexer_ssl_certs/certs.yml +++ b/production_cluster/wazuh_indexer_ssl_certs/certs.yml @@ -1,35 +1,22 @@ -ca: - root: - dn: CN=root-ca,OU=CA,O=Example\, Inc.,DC=example,DC=com - pkPassword: none - keysize: 2048 - file: root-ca.pem - intermediate: - dn: CN=intermediate,OU=CA,O=Example\, Inc.,DC=example,DC=com - keysize: 2048 - validityDays: 3650 - pkPassword: intermediate-ca-password - file: intermediate-ca.pem - nodes: - - name: node1 - dn: CN=node1,OU=Ops,O=Example\, Inc.,DC=example,DC=com - dns: - - elasticsearch - - name: node2 - dn: CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com - dns: - - elasticsearch-2 - - name: node3 - dn: CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com - dns: - - elasticsearch-3 - - name: filebeat - dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com - dns: - - wazuh - -clients: - - name: admin - dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com - admin: true + # Elasticsearch server nodes + #wazuh-indexer: + - name: wazuh-indexer + ip: wazuh-indexer + - name: wazuh-indexer-2 + ip: wazuh-indexer-2 + - name: wazuh-indexer-3 + ip: wazuh-indexer-3 + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + #wazuh_servers: + - name: wazuh-master + ip: wazuh-master + #node_type: master + - name: wazuh-worker + ip: wazuh-worker + #node_type: worker + # Kibana node + #kibana: + - name: kibana + ip: kibana \ No newline at end of file diff --git a/production_cluster/wazuh_indexer_ssl_certs/certs2.yml b/production_cluster/wazuh_indexer_ssl_certs/certs2.yml new file mode 100644 index 00000000..07cf17af --- /dev/null +++ b/production_cluster/wazuh_indexer_ssl_certs/certs2.yml @@ -0,0 +1,35 @@ +ca: + root: + dn: CN=root-ca,OU=CA,O=Example\, Inc.,DC=example,DC=com + pkPassword: none + keysize: 2048 + file: root-ca.pem + intermediate: + dn: CN=intermediate,OU=CA,O=Example\, Inc.,DC=example,DC=com + keysize: 2048 + validityDays: 3650 + pkPassword: intermediate-ca-password + file: intermediate-ca.pem + +nodes: + - name: wazuh-indexer + dn: CN=wazuh-indexer,OU=Ops,O=Example\, Inc.,DC=example,DC=com + dns: + - wazuh-indexer + - name: wazuh-indexer-2 + dn: CN=wazuh-indexer-2,OU=Ops,O=Example\, Inc.,DC=example,DC=com + dns: + - wazuh-indexer-2 + - name: wazuh-indexer-3 + dn: CN=wazuh-indexer-3,OU=Ops,O=Example\, Inc.,DC=example,DC=com + dns: + - wazuh-indexer-3 + - name: filebeat + dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com + dns: + - wazuh + +clients: + - name: admin + dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com + admin: true \ No newline at end of file diff --git a/wazuh-dashboard/Dockerfile b/wazuh-dashboard/Dockerfile index 5dea97f0..97d72ab1 100644 --- a/wazuh-dashboard/Dockerfile +++ b/wazuh-dashboard/Dockerfile @@ -7,7 +7,7 @@ ARG WAZUH_VERSION=4.3.0-1 RUN apt-get update && apt install curl libcap2-bin -y #Download and install Wazuh Dashboard -RUN curl https://s3.amazonaws.com/warehouse.wazuh.com/stack/dashboard/stable/wazuh-dashboard_${WAZUH_VERSION}_amd64.deb --output wazuh-dashboard_${WAZUH_VERSION}_amd64.deb && \ +RUN curl https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/pre-release/apt/pool/main/w/wazuh-dashboard/wazuh-dashboard_${WAZUH_VERSION}_amd64.deb --output wazuh-dashboard_${WAZUH_VERSION}_amd64.deb && \ dpkg -i wazuh-dashboard_${WAZUH_VERSION}_amd64.deb && \ apt-get clean -y && rm -rf wazuh-dashboard_${WAZUH_VERSION}_amd64.deb diff --git a/wazuh-indexer/Dockerfile_centos b/wazuh-indexer/Dockerfile_centos index c3621dfa..9afb2fb9 100644 --- a/wazuh-indexer/Dockerfile_centos +++ b/wazuh-indexer/Dockerfile_centos @@ -9,7 +9,7 @@ USER root RUN yum install initscripts -y #Download and install Wazuh indexer -RUN curl https://s3.amazonaws.com/warehouse.wazuh.com/stack/indexer/stable/wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm --output wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm && \ +RUN curl https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/pre-release/yum/wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm --output wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm && \ rpm -i wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm && \ yum clean all && rm -rf /var/cache/yum && rm -rf wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm diff --git a/wazuh-indexer/config/entrypoint.sh b/wazuh-indexer/config/entrypoint.sh index 2708c7b5..60c3eabb 100644 --- a/wazuh-indexer/config/entrypoint.sh +++ b/wazuh-indexer/config/entrypoint.sh @@ -5,18 +5,37 @@ # Start Wazuh indexer ############################################################################## -rm -rf /var/lib/wazuh-indexer/* -service wazuh-indexer start -sleep 20 -echo "inicio ver hostname" -echo $HOSTNAME -echo "fin ver hostname" -export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer -export JAVA_HOME=/usr/share/wazuh-indexer/jdk -/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem + service wazuh-indexer start + sleep 5 + service wazuh-indexer status + sleep 5 + +if [ $NODE_TYPE == "worker" ] + then + echo "inicio ver node_type" + echo $NODE_TYPE + echo "fin ver node_type" + rm -rf /var/lib/wazuh-indexer/* + else + echo "inicio ver hostname" + echo $HOSTNAME + sleep 1 + echo "fin ver hostname" + echo "inicio ver node_type" + echo $NODE_TYPE + sleep 1 + echo "fin ver node_type" + export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer + export JAVA_HOME=/usr/share/wazuh-indexer/jdk + /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem + cat /var/log/wazuh-indexer/opensearch.log +fi + + + #export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -p 9800 -icl diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index 73cb6034..143e1e11 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.3.0-1 +ARG WAZUH_VERSION=4.2.5-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" @@ -14,7 +14,7 @@ COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo RUN yum --enablerepo=updates clean metadata && \ yum upgrade -y && \ - yum -y install openssl which expect openssh-clients && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \ + yum -y install openssl which expect openssh-clients && yum install wazuh-manager-${WAZUH_VERSION} -y && \ sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \ yum clean all && rm -rf /var/cache/yum @@ -40,7 +40,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e RUN chmod go-w /etc/filebeat/wazuh-template.json COPY config/etc/ /etc/ -COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py +COPY --chown=root:1000 config/create_user.py /var/ossec/framework/scripts/create_user.py # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 diff --git a/wazuh-odfe/config/filebeat.yml b/wazuh-odfe/config/filebeat.yml index 8a627bf9..5ecd1732 100644 --- a/wazuh-odfe/config/filebeat.yml +++ b/wazuh-odfe/config/filebeat.yml @@ -13,7 +13,7 @@ setup.template.json.name: 'wazuh' setup.template.overwrite: true setup.ilm.enabled: false output.elasticsearch: - hosts: ['https://elasticsearch:9200'] + hosts: ['https://elasticsearch:9700'] #username: #password: #ssl.verification_mode: