diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 8fac0536..8813f1d4 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -145,8 +145,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_certs_tool: "https://packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh" - wazuh_config_yml: "https://packages-dev.wazuh.com/4.13/config.yml" + wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" + wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images diff --git a/.gitignore b/.gitignore index be72bfa3..0abf79b9 100644 --- a/.gitignore +++ b/.gitignore @@ -4,10 +4,8 @@ build-docker-images/artifacts_env.txt single-node/wazuh-certificates single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log -single-node/config.yml single-node/wazuh-certs-tool.sh multi-node/wazuh-certificates multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log -multi-node/config.yml multi-node/wazuh-certs-tool.sh \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 6460677a..79739ddb 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -1,60 +1,13 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. -set -x export DH_OPTIONS export NAME=wazuh-dashboard -export TARGET_DIR=${CURDIR}/debian/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Create certs directory -mkdir -p ${CONFIG_DIR}/certs - -# Copy Wazuh dashboard certs to install config dir -mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ -cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem -cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem - # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml chmod -R 500 ${CONFIG_DIR}/certs chmod -R 400 ${CONFIG_DIR}/certs/* - -set +x \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 5e8c44e2..ae16f38d 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -55,7 +55,7 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \ mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer + mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR @@ -72,4 +72,4 @@ EXPOSE 9200 ENTRYPOINT ["/entrypoint.sh"] # Dummy overridable parameter parsed by entrypoint -CMD ["opensearch"] \ No newline at end of file +CMD ["opensearch"] diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index ba218c5d..d2a842c5 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -1,6 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. -set -x export DH_OPTIONS export NAME=wazuh-indexer @@ -8,55 +7,9 @@ export NAME=wazuh-indexer # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -export LOG_DIR=/var/log/${NAME} -export LIB_DIR=/var/lib/${NAME} -export PID_DIR=/run/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config - -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR -mkdir -p ${CONFIG_DIR}/certs -mv /etc/wazuh-indexer/* ${CONFIG_DIR}/ -cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem -cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem - # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml @@ -65,5 +18,3 @@ sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-perfo chown -R ${USER}:${GROUP} ${CONFIG_DIR} chmod -R 500 ${CONFIG_DIR}/certs chmod -R 400 ${CONFIG_DIR}/certs/* - -set +x \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 251ff5ad..2c01bd80 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,10 +9,6 @@ ARG S6_VERSION="v2.2.0.3" ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm -ARG wazuh_certs_tool -ARG wazuh_config_yml - -COPY config/config.sh . RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ manager_url="${!URL_VAR}" && \ @@ -22,8 +18,6 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf install /wazuh-manager.rpm -y && \ rm -rf /wazuh-manager.rpm && \ dnf clean all && \ - chmod 755 /config.sh && \ - /config.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh deleted file mode 100644 index 211de49d..00000000 --- a/build-docker-images/wazuh-manager/config/config.sh +++ /dev/null @@ -1,40 +0,0 @@ -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -CERT_DIR=/etc/wazuh/certs -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -mkdir -p $CERT_DIR -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Copy Wazuh manager certs -cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem -cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index e9fea495..3b4a01ca 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -6,6 +6,10 @@ source /permanent_data.env WAZUH_INSTALL_PATH=/var/ossec WAZUH_CONFIG_MOUNT=/wazuh-config-mount +CERT_DIR=/etc/wazuh/certs +WAZUH_INDEXER_SSL_CA=$CERT_DIR/root-ca.pem +WAZUH_INDEXER_SSL_CERTIFICATE=$CERT_DIR/wazuh.pem +WAZUH_INDEXER_SSL_KEY=$CERT_DIR/wazuh-key.pem ############################################################################## # Aux functions @@ -194,6 +198,14 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ -e 'd }}' "$OSSEC_CONF"; rm -f "$TMP_HOSTS"; + + # -------------------------- + # Indexer SSL Configuration + # -------------------------- + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CA|" "$OSSEC_CONF" + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CERTIFICATE|" "$OSSEC_CONF" + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_KEY|" "$OSSEC_CONF" + fi # -------------------------- diff --git a/single-node/config.yml b/single-node/config.yml new file mode 100644 index 00000000..b8f678e3 --- /dev/null +++ b/single-node/config.yml @@ -0,0 +1,17 @@ +nodes: + # Wazuh indexer nodes + indexer: + - name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # If there is more than one Wazuh server + # node, each one must have a node_type + server: + - name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard nodes + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 505f0fc5..8a450f3b 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -20,6 +20,7 @@ services: - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 - WAZUH_NODE_NAME=manager - WAZUH_CLUSTER_NODES=wazuh.manager + - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui @@ -33,11 +34,11 @@ services: - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem + - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -67,13 +68,12 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: - - 443:5601 + - 443:443 environment: - - SERVER_PORT=5601 - SERVER_HOST=0.0.0.0 - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin