From 33a55344d300009269451b362815a986429a8656 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 20 Feb 2024 12:01:22 -0300 Subject: [PATCH 1/4] rollback ISM --- build-docker-images/wazuh-indexer/Dockerfile | 6 +----- .../wazuh-indexer/config/entrypoint.sh | 2 -- .../wazuh-indexer/config/ism-check.sh | 15 --------------- multi-node/docker-compose.yml | 1 - single-node/docker-compose.yml | 3 +-- 5 files changed, 2 insertions(+), 25 deletions(-) delete mode 100644 build-docker-images/wazuh-indexer/config/ism-check.sh diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index abb95e22..985a3a05 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -35,8 +35,6 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN apt-get update -y && apt-get install curl -y - RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ @@ -54,9 +52,7 @@ COPY config/entrypoint.sh / COPY config/securityadmin.sh / -COPY config/ism-check.sh / - -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && chmod 700 /ism-check.sh +RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh RUN chown 1000:1000 /*.sh diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 2d3396d6..2acb4aa0 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -90,6 +90,4 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi -nohup /ism-check.sh & - run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh deleted file mode 100644 index 6aef3ee5..00000000 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25} -MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"} -MIN_DOC_COUNT=${MIN_DOC_COUNT:-600000000} -ISM_PRIORITY=${ISM_PRIORITY:-50} -WAZUH_TEMPLATE=${WAZUH_TEMPLATE:-"/usr/share/wazuh-indexer/wazuh-template.json"} -SERVER=`hostname` -if [[ -n "$INDEXER_PASSWORD" ]]; then - until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] - do - echo "Wazuh indexer Security is not initiaized"; - sleep 30 - done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE -t $WAZUH_TEMPLATE -fi diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 684d9813..a72fd4f5 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -89,7 +89,6 @@ services: environment: - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "bootstrap.memory_lock=true" - - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8627df27..55e2261e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -52,8 +52,7 @@ services: ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m" - - 'INDEXER_PASSWORD=SecretPassword' + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" ulimits: memlock: soft: -1 From 53b9d71c23c250fe369e3138c1e0edb8ca5d9e67 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 21 Feb 2024 11:43:23 -0300 Subject: [PATCH 2/4] add maltiverse files into permanent exceptions --- build-docker-images/wazuh-manager/config/permanent_data.env | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 5d797624..b0c32449 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -23,6 +23,9 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" From 0d628f20cc0c275e8ac1e4bd41f985e58f7892e6 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 21 Feb 2024 11:57:29 -0300 Subject: [PATCH 3/4] move pagerduty exception --- build-docker-images/wazuh-manager/config/permanent_data.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index b0c32449..0e58b640 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -16,13 +16,13 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py" From 6fef542ee2138c184f05ba6eb1ae9ac38b36df20 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 22 Feb 2024 10:12:02 -0300 Subject: [PATCH 4/4] add aws wodle files for permanent data excp --- .../wazuh-manager/config/permanent_data.env | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 0e58b640..1ca3a42e 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -56,6 +56,27 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws_tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/wazuh_integration.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/aws_bucket.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/cloudtrail.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/config.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/guardduty.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/load_balancers.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/server_access.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/umbrella.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/vpcflow.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/waf.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/aws_service.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/cloudwatchlogs.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/inspector.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/__init__.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/s3_log_handler.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_processor.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"