diff --git a/.goss.yaml b/.github/.goss.yaml similarity index 100% rename from .goss.yaml rename to .github/.goss.yaml diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3d74554e..4baac58a 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -28,4 +28,4 @@ jobs: run: dgoss run wazuh/wazuh-manager:4.3.0 env: GOSS_SLEEP: 30 - GOSS_FILE: .goss.yaml \ No newline at end of file + GOSS_FILE: .github/.goss.yaml \ No newline at end of file diff --git a/README.md b/README.md index 2ad15dc0..8419df5c 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ API_USERNAME="wazuh" # Wazuh API username API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements # (8+ length, uppercase, lowercase, specials chars) -INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL +INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL INDEXER_USERNAME=admin # Wazuh indexer Username INDEXER_PASSWORD=admin # Wazuh indexer Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) @@ -87,73 +87,102 @@ ADMIN_PRIVILEGES=true # App privileges ## Directory structure - ├── build-wazuh-images.yml + ├── build-docker-images + │   ├── docker-compose.yml + │   ├── wazuh-dashboard + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── opensearch_dashboards.yml + │   │   │   ├── wazuh_app_config.sh + │   │   │   └── wazuh.yml + │   │   └── Dockerfile + │   ├── wazuh-indexer + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── internal_users.yml + │   │   │   ├── opensearch.yml + │   │   │   ├── roles_mapping.yml + │   │   │   ├── roles.yml + │   │   │   └── securityadmin.sh + │   │   └── Dockerfile + │   └── wazuh-manager + │   ├── config + │   │   ├── create_user.py + │   │   ├── etc + │   │   │   ├── cont-init.d + │   │   │   │   ├── 0-wazuh-init + │   │   │   │   ├── 1-config-filebeat + │   │   │   │   └── 2-manager + │   │   │   └── services.d + │   │   │   ├── filebeat + │   │   │   │   ├── finish + │   │   │   │   └── run + │   │   │   └── ossec-logs + │   │   │   └── run + │   │   ├── filebeat.yml + │   │   ├── permanent_data.env + │   │   ├── permanent_data.sh + │   │   └── wazuh.repo + │   └── Dockerfile ├── CHANGELOG.md - ├── docker-compose.yml - ├── generate-indexer-certs.yml - ├── indexer_certs_creator - │ ├── config - │ │ └── entrypoint.sh - │ └── Dockerfile + ├── indexer-certs-creator + │   ├── config + │   │   └── entrypoint.sh + │   └── Dockerfile ├── LICENSE - ├── production_cluster - │ ├── nginx - │ │ ├── nginx.conf - │ │ └── ssl - │ │ └── generate-self-signed-cert.sh - │ ├── wazuh_cluster - │ │ ├── wazuh_manager.conf - │ │ └── wazuh_worker.conf - │ ├── wazuh_dashboard - │ │ ├── opensearch_dashboards.yml - │ │ └── wazuh.yml - │ ├── wazuh-indexer - │ │ ├── internal_users.yml - │ │ ├── wazuh1.indexer.yml - │ │ ├── wazuh2.indexer.yml - │ │ └── wazuh3.indexer.yml - │ └── wazuh_indexer_ssl_certs - │ └── certs.yml - ├── production-cluster.yml + ├── multi-node + │   ├── config + │   │   ├── nginx + │   │   │   └── nginx.conf + │   │   ├── wazuh_cluster + │   │   │   ├── wazuh_manager.conf + │   │   │   └── wazuh_worker.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   ├── wazuh1.indexer.yml + │   │   │   ├── wazuh2.indexer.yml + │   │   │   └── wazuh3.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   └── certs.yml + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   ├── Migration-to-Wazuh-4.3.md + │   └── volume-migrator.sh ├── README.md - ├── VERSION - ├── wazuh-dashboard - │ ├── config - │ │ ├── entrypoint.sh - │ │ ├── opensearch_dashboards.yml - │ │ ├── wazuh_app_config.sh - │ │ └── wazuh.yml - │ └── Dockerfile - ├── wazuh-indexer - │ ├── config - │ │ ├── config.sh - │ │ ├── config.yml - │ │ ├── entrypoint.sh - │ │ ├── internal_users.yml - │ │ ├── opensearch.yml - │ │ ├── roles_mapping.yml - │ │ ├── roles.yml - │ │ └── securityadmin.sh - │ └── Dockerfile - └── wazuh-manager - ├── config - │ ├── create_user.py - │ ├── etc - │ │ ├── cont-init.d - │ │ │ ├── 0-wazuh-init - │ │ │ ├── 1-config-filebeat - │ │ │ └── 2-manager - │ │ └── services.d - │ │ ├── filebeat - │ │ │ ├── finish - │ │ │ └── run - │ │ └── ossec-logs - │ │ └── run - │ ├── filebeat.yml - │ ├── permanent_data.env - │ ├── permanent_data.sh - │ └── wazuh.repo - └── Dockerfile + ├── single-node + │   ├── config + │   │   ├── wazuh_cluster + │   │   │   └── wazuh_manager.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   └── wazuh.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   ├── admin-key.pem + │   │   ├── admin.pem + │   │   ├── certs.yml + │   │   ├── root-ca.key + │   │   ├── root-ca.pem + │   │   ├── wazuh.dashboard-key.pem + │   │   ├── wazuh.dashboard.pem + │   │   ├── wazuh.indexer-key.pem + │   │   ├── wazuh.indexer.pem + │   │   ├── wazuh.manager-key.pem + │   │   └── wazuh.manager.pem + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   └── README.md + └── VERSION + ## Branches diff --git a/build-docker-images/README.md b/build-docker-images/README.md new file mode 100644 index 00000000..d7a09f6d --- /dev/null +++ b/build-docker-images/README.md @@ -0,0 +1,16 @@ +# Wazuh Docker Image Builder + +By executing this stack, the Docker images of Wazuh manager, indexer and dashboard are created. +This process can be used in case of any problem accessing the Docker images that are hosted on Docker Hub. + +To execute this process, the following command must be executed: + +``` +$ docker-compose up -d --build +``` + +Once the image creation process is finished, a Wazuh test stack will also be executed, which must be terminated with the following command: + +``` +$ docker-compose down +``` \ No newline at end of file diff --git a/build-wazuh-images.yml b/build-docker-images/docker-compose.yml similarity index 100% rename from build-wazuh-images.yml rename to build-docker-images/docker-compose.yml diff --git a/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile similarity index 100% rename from wazuh-dashboard/Dockerfile rename to build-docker-images/wazuh-dashboard/Dockerfile diff --git a/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh similarity index 100% rename from wazuh-dashboard/config/config.sh rename to build-docker-images/wazuh-dashboard/config/config.sh diff --git a/wazuh-dashboard/config/config.yml b/build-docker-images/wazuh-dashboard/config/config.yml similarity index 100% rename from wazuh-dashboard/config/config.yml rename to build-docker-images/wazuh-dashboard/config/config.yml diff --git a/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh similarity index 100% rename from wazuh-dashboard/config/entrypoint.sh rename to build-docker-images/wazuh-dashboard/config/entrypoint.sh diff --git a/wazuh-dashboard/config/opensearch_dashboards.yml b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml similarity index 100% rename from wazuh-dashboard/config/opensearch_dashboards.yml rename to build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml diff --git a/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml similarity index 100% rename from wazuh-dashboard/config/wazuh.yml rename to build-docker-images/wazuh-dashboard/config/wazuh.yml diff --git a/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh similarity index 100% rename from wazuh-dashboard/config/wazuh_app_config.sh rename to build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh diff --git a/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile similarity index 100% rename from wazuh-indexer/Dockerfile rename to build-docker-images/wazuh-indexer/Dockerfile diff --git a/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh similarity index 100% rename from wazuh-indexer/config/config.sh rename to build-docker-images/wazuh-indexer/config/config.sh diff --git a/wazuh-indexer/config/config.yml b/build-docker-images/wazuh-indexer/config/config.yml similarity index 100% rename from wazuh-indexer/config/config.yml rename to build-docker-images/wazuh-indexer/config/config.yml diff --git a/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh similarity index 100% rename from wazuh-indexer/config/entrypoint.sh rename to build-docker-images/wazuh-indexer/config/entrypoint.sh diff --git a/wazuh-indexer/config/internal_users.yml b/build-docker-images/wazuh-indexer/config/internal_users.yml similarity index 100% rename from wazuh-indexer/config/internal_users.yml rename to build-docker-images/wazuh-indexer/config/internal_users.yml diff --git a/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml similarity index 100% rename from wazuh-indexer/config/opensearch.yml rename to build-docker-images/wazuh-indexer/config/opensearch.yml diff --git a/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml similarity index 100% rename from wazuh-indexer/config/roles.yml rename to build-docker-images/wazuh-indexer/config/roles.yml diff --git a/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml similarity index 100% rename from wazuh-indexer/config/roles_mapping.yml rename to build-docker-images/wazuh-indexer/config/roles_mapping.yml diff --git a/wazuh-indexer/config/securityadmin.sh b/build-docker-images/wazuh-indexer/config/securityadmin.sh similarity index 100% rename from wazuh-indexer/config/securityadmin.sh rename to build-docker-images/wazuh-indexer/config/securityadmin.sh diff --git a/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile similarity index 100% rename from wazuh-manager/Dockerfile rename to build-docker-images/wazuh-manager/Dockerfile diff --git a/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py similarity index 100% rename from wazuh-manager/config/create_user.py rename to build-docker-images/wazuh-manager/config/create_user.py diff --git a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/0-wazuh-init rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init diff --git a/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/1-config-filebeat rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat diff --git a/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/2-manager rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager diff --git a/wazuh-manager/config/etc/services.d/filebeat/finish b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/finish rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish diff --git a/wazuh-manager/config/etc/services.d/filebeat/run b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/run rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run diff --git a/wazuh-manager/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run similarity index 100% rename from wazuh-manager/config/etc/services.d/ossec-logs/run rename to build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run diff --git a/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml similarity index 100% rename from wazuh-manager/config/filebeat.yml rename to build-docker-images/wazuh-manager/config/filebeat.yml diff --git a/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env similarity index 100% rename from wazuh-manager/config/permanent_data.env rename to build-docker-images/wazuh-manager/config/permanent_data.env diff --git a/wazuh-manager/config/permanent_data.sh b/build-docker-images/wazuh-manager/config/permanent_data.sh similarity index 100% rename from wazuh-manager/config/permanent_data.sh rename to build-docker-images/wazuh-manager/config/permanent_data.sh diff --git a/wazuh-manager/config/wazuh.repo b/build-docker-images/wazuh-manager/config/wazuh.repo similarity index 100% rename from wazuh-manager/config/wazuh.repo rename to build-docker-images/wazuh-manager/config/wazuh.repo diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index 41adabb5..00000000 --- a/docker-compose.yml +++ /dev/null @@ -1,75 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.manager: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none - volumes: - - wazuh_api_configuration:/var/ossec/api/configuration - - wazuh_etc:/var/ossec/etc - - wazuh_logs:/var/ossec/logs - - wazuh_queue:/var/ossec/queue - - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_integrations:/var/ossec/integrations - - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_agentless:/var/ossec/agentless - - wazuh_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - wazuh.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 - hostname: wazuh.dashboard - restart: always - ports: - - 443:443 - environment: - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - WAZUH_API_URL=https://wazuh.manager - depends_on: - - wazuh.indexer - links: - - wazuh.indexer:wazuh.indexer - - wazuh.manager:wazuh.manager - -volumes: - wazuh_api_configuration: - wazuh_etc: - wazuh_logs: - wazuh_queue: - wazuh_var_multigroups: - wazuh_integrations: - wazuh_active_response: - wazuh_agentless: - wazuh_wodles: - filebeat_etc: - filebeat_var: diff --git a/indexer_certs_creator/Dockerfile b/indexer-certs-creator/Dockerfile similarity index 100% rename from indexer_certs_creator/Dockerfile rename to indexer-certs-creator/Dockerfile diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md new file mode 100644 index 00000000..b7dbc565 --- /dev/null +++ b/indexer-certs-creator/README.md @@ -0,0 +1,9 @@ +# Certificate creation image build + +The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks. + +To create the image, the following command must be executed: + +``` +$ docker build -t wazuh/wazuh-certs-generator:0.0.1 . +``` diff --git a/indexer_certs_creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh similarity index 100% rename from indexer_certs_creator/config/entrypoint.sh rename to indexer-certs-creator/config/entrypoint.sh diff --git a/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.3.md similarity index 59% rename from Migration-to-Wazuh-4.3.md rename to multi-node/Migration-to-Wazuh-4.3.md index a4caa7a1..20351ca8 100644 --- a/Migration-to-Wazuh-4.3.md +++ b/multi-node/Migration-to-Wazuh-4.3.md @@ -1,328 +1,360 @@ -# Opendistro data migration to Wazuh indexer on docker. +# Opendistro data migration to Wazuh indexer on docker. This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2.5 to v4.3.0. +The example is migrating from v4.2 to v4.3. ## Procedure -Assuming that you have a v4.2.5 production deployment, perform the following steps. +Assuming that you have a v4.2 production deployment, perform the following steps. -**1. Stop 4.2.5 environment** +**1. Stop 4.2 environment** `docker-compose -f production-cluster.yml stop` -**2. List Elastic volumesStop 4.2.5 environment** +**2. List Elastic volumesStop 4.2 environment** `docker volume ls --filter name='wazuh-docker_elastic-data'` **3. Inspect Elastic volume** `docker volume inspect wazuh-docker_elastic-data-1` -**4. Run the volume create command:** create new Indexer and Wazuh Manager volumes using the `com.docker.compose.version` label value from the previous command. +**4. down the 4.2 environment.** +`docker-compose -f production-cluster.yml down` + +**5. Run the volume create command:** create new Indexer and Wazuh Manager volumes using the `com.docker.compose.version` label value from the previous command. ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=wazuh-indexer-data-1 \ - wazuh-docker_wazuh-indexer-data-1 + multi-node_wazuh-indexer-data-1 ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=wazuh-indexer-data-2 \ - wazuh-docker_wazuh-indexer-data-2 + multi-node_wazuh-indexer-data-2 ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=wazuh-indexer-data-3 \ - wazuh-docker_wazuh-indexer-data-3 + multi-node_wazuh-indexer-data-3 ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master_wazuh_api_configuration \ - wazuh-docker_master_wazuh_api_configuration + multi-node_master_wazuh_api_configuration ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master_wazuh_etc \ - wazuh-master_docker_wazuh_etc + multi-node_docker_wazuh_etc ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-logs \ - wazuh-docker_master-wazuh-logs + multi-node_master-wazuh-logs ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-queue \ - wazuh-docker_master-wazuh-queue + multi-node_master-wazuh-queue ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-var-multigroups \ - wazuh-docker_master-wazuh-var-multigroups + multi-node_master-wazuh-var-multigroups ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-integrations \ - wazuh-docker_master-wazuh-integrations + multi-node_master-wazuh-integrations ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-active-response \ - wazuh-docker_master-wazuh-active-response + multi-node_master-wazuh-active-response ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-agentless \ - wazuh-docker_master-wazuh-agentless + multi-node_master-wazuh-agentless ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-wazuh-wodles \ - wazuh-docker_master-wazuh-wodles + multi-node_master-wazuh-wodles ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-filebeat-etc \ - wazuh-docker_master-filebeat-etc + multi-node_master-filebeat-etc ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=master-filebeat-var \ - wazuh-docker_master-filebeat-var + multi-node_master-filebeat-var ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker_wazuh_api_configuration \ - wazuh-docker_worker_wazuh_api_configuration + multi-node_worker_wazuh_api_configuration ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker_wazuh_etc \ - wazuh-worker_docker_wazuh_etc + multi-node_worker-wazuh-etc ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-logs \ - wazuh-docker_worker-wazuh-logs + multi-node_worker-wazuh-logs ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-queue \ - wazuh-docker_worker-wazuh-queue + multi-node_worker-wazuh-queue ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-var-multigroups \ - wazuh-docker_worker-wazuh-var-multigroups + multi-node_worker-wazuh-var-multigroups ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-integrations \ - wazuh-docker_worker-wazuh-integrations + multi-node_worker-wazuh-integrations ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-active-response \ - wazuh-docker_worker-wazuh-active-response + multi-node_worker-wazuh-active-response ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-agentless \ - wazuh-docker_worker-wazuh-agentless + multi-node_worker-wazuh-agentless ``` ``` docker volume create \ - --label com.docker.compose.project=wazuh-docker \ + --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ --label com.docker.compose.volume=worker-wazuh-wodles \ - wazuh-docker_worker-wazuh-wodles + multi-node_worker-wazuh-wodles ``` -**5. Copy the volume content from Elastic to Wazuh indexer volumes and old Wazuh Manager content to new volumes.** +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + multi-node_worker-filebeat-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-var \ + multi-node_worker-filebeat-var +``` +**6. Copy the volume content from Elastic to Wazuh indexer volumes and old Wazuh Manager content to new volumes.** ``` docker container run --rm -it \ -v wazuh-docker_elastic-data-1:/from \ - -v wazuh-docker_wazuh-indexer-data-1:/to \ + -v multi-node_wazuh-indexer-data-1:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_elastic-data-2:/from \ - -v wazuh-docker_wazuh-indexer-data-2:/to \ + -v multi-node_wazuh-indexer-data-2:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_elastic-data-3:/from \ - -v wazuh-docker_wazuh-indexer-data-3:/to \ + -v multi-node_wazuh-indexer-data-3:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-api-configuration:/from \ - -v wazuh-docker_master-wazuh-api-configuration:/to \ + -v multi-node_master-wazuh-api-configuration:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-etc:/from \ - -v wazuh-docker_master-wazuh-etc:/to \ + -v multi-node_master-wazuh-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-logs:/from \ - -v wazuh-docker_master-wazuh-logs:/to \ + -v multi-node_master-wazuh-logs:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-queue:/from \ - -v wazuh-docker_master-wazuh-queue:/to \ + -v multi-node_master-wazuh-queue:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-var-multigroups:/from \ - -v wazuh-docker_master-wazuh-var-multigroups:/to \ + -v multi-node_master-wazuh-var-multigroups:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-integrations:/from \ - -v wazuh-docker_master-wazuh-integrations:/to \ + -v multi-node_master-wazuh-integrations:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-active-response:/from \ - -v wazuh-docker_master-wazuh-active-response:/to \ + -v multi-node_master-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-agentless:/from \ - -v wazuh-docker_master-wazuh-agentless:/to \ + -v multi-node_master-wazuh-agentless:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_ossec-wodles:/from \ - -v wazuh-docker_master-wazuh-wodles:/to \ + -v multi-node_master-wazuh-wodles:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_filebeat-etc:/from \ - -v wazuh-docker_master-filebeat-etc:/to \ + -v multi-node_master-filebeat-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_filebeat-var:/from \ - -v wazuh-docker_master-filebeat-var:/to \ + -v multi-node_master-filebeat-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-api-configuration:/from \ - -v wazuh-docker_worker-wazuh-api-configuration:/to \ + -v multi-node_worker-wazuh-api-configuration:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-etc:/from \ - -v wazuh-docker_worker-wazuh-etc:/to \ + -v multi-node_worker-wazuh-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-logs:/from \ - -v wazuh-docker_worker-wazuh-logs:/to \ + -v multi-node_worker-wazuh-logs:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-queue:/from \ - -v wazuh-docker_worker-wazuh-queue:/to \ + -v multi-node_worker-wazuh-queue:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-var-multigroups:/from \ - -v wazuh-docker_worker-wazuh-var-multigroups:/to \ + -v multi-node_worker-wazuh-var-multigroups:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-integrations:/from \ - -v wazuh-docker_worker-wazuh-integrations:/to \ + -v multi-node_worker-wazuh-integrations:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-active-response:/from \ - -v wazuh-docker_worker-wazuh-active-response:/to \ + -v multi-node_worker-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-agentless:/from \ - -v wazuh-docker_worker-wazuh-agentless:/to \ + -v multi-node_worker-wazuh-agentless:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-wodles:/from \ - -v wazuh-docker_worker-wazuh-wodles:/to \ + -v multi-node_worker-wazuh-wodles:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` -**6. Delete the 4.2.5 environment.** -`docker-compose -f production-cluster.yml down` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v multi-node_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v multi-node_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` + +**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker Version and project name as parameters.** + +Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node **7. Start the 4.3 environment.** ``` git checkout 4.3 +cd multi-node docker-compose -f generate-indexer-certs.yml run --rm generator -docker-compose -f production-cluster.yml up -d +docker-compose up -d ``` **8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file diff --git a/multi-node/README.md b/multi-node/README.md new file mode 100644 index 00000000..b646c5e0 --- /dev/null +++ b/multi-node/README.md @@ -0,0 +1,31 @@ +# Deploy Wazuh Docker in multi node configuration + +This deployment generates a Docker Compose stack with 2 Wazuh Manager container, 3 Wazuh Indexer container and 1 Wazuh Dashboard container. + +For the next deployment, the following steps must be performed: + +1) Increase max_map_count on your host (Linux) +``` +$ sysctl -w vm.max_map_count=262144 +``` + This command must be run with root permissions + + +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the stack with docker-compose: + + In Foregroud: +``` +$ docker-compose up +``` + + In Background: +``` +$ docker-compose up -d +``` + + +The stack takes about 1 minute to get up for the first time, since Wazuh Indexer must be started for the first time and the Indexes and Index Patterns must be generated. \ No newline at end of file diff --git a/production_cluster/nginx/nginx.conf b/multi-node/config/nginx/nginx.conf similarity index 100% rename from production_cluster/nginx/nginx.conf rename to multi-node/config/nginx/nginx.conf diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_manager.conf rename to multi-node/config/wazuh_cluster/wazuh_manager.conf index 8b6c33cb..fddb7fc6 100644 --- a/production_cluster/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_worker.conf rename to multi-node/config/wazuh_cluster/wazuh_worker.conf index a91e6e16..30670045 100644 --- a/production_cluster/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml similarity index 100% rename from production_cluster/wazuh_dashboard/opensearch_dashboards.yml rename to multi-node/config/wazuh_dashboard/opensearch_dashboards.yml diff --git a/production_cluster/wazuh_dashboard/wazuh.yml b/multi-node/config/wazuh_dashboard/wazuh.yml similarity index 100% rename from production_cluster/wazuh_dashboard/wazuh.yml rename to multi-node/config/wazuh_dashboard/wazuh.yml diff --git a/production_cluster/wazuh-indexer/internal_users.yml b/multi-node/config/wazuh_indexer/internal_users.yml similarity index 100% rename from production_cluster/wazuh-indexer/internal_users.yml rename to multi-node/config/wazuh_indexer/internal_users.yml diff --git a/production_cluster/wazuh-indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh1.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh1.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh2.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh2.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh3.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh3.indexer.yml diff --git a/production_cluster/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml similarity index 100% rename from production_cluster/wazuh_indexer_ssl_certs/certs.yml rename to multi-node/config/wazuh_indexer_ssl_certs/certs.yml diff --git a/production-cluster.yml b/multi-node/docker-compose.yml similarity index 57% rename from production-cluster.yml rename to multi-node/docker-compose.yml index 3a066717..7707f76b 100644 --- a/production-cluster.yml +++ b/multi-node/docker-compose.yml @@ -32,10 +32,10 @@ services: - master-wazuh-wodles:/var/ossec/wodles - master-filebeat-etc:/etc/filebeat - master-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: image: wazuh/wazuh-manager:4.3.0 @@ -61,10 +61,10 @@ services: - worker-wazuh-wodles:/var/ossec/wodles - worker-filebeat-etc:/etc/filebeat - worker-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -84,13 +84,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem - - ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh2.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -108,11 +108,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh3.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -130,11 +130,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.3.0 @@ -148,11 +148,11 @@ services: - API_USERNAME=acme-user - API_PASSWORD=MyS3cr37P450r.*- volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - - ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml depends_on: - wazuh1.indexer links: @@ -174,8 +174,7 @@ services: - wazuh.worker:wazuh.worker - wazuh.dashboard:wazuh.dashboard volumes: - - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro + - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro volumes: master-wazuh-api-configuration: diff --git a/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml similarity index 56% rename from generate-indexer-certs.yml rename to multi-node/generate-indexer-certs.yml index ce8a0174..c29c50d6 100644 --- a/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -6,5 +6,5 @@ services: image: wazuh/wazuh-certs-generator:0.0.1 hostname: wazuh-certs-generator volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml - - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh new file mode 100755 index 00000000..f11a1da6 --- /dev/null +++ b/multi-node/volume-migrator.sh @@ -0,0 +1,279 @@ +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + $2_wazuh-indexer-data-1 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + $2_wazuh-indexer-data-2 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + $2_wazuh-indexer-data-3 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_api_configuration \ + $2_master_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_etc \ + $2_docker_wazuh_etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-logs \ + $2_master-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-queue \ + $2_master-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-var-multigroups \ + $2_master-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-integrations \ + $2_master-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-active-response \ + $2_master-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-agentless \ + $2_master-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-wodles \ + $2_master-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-etc \ + $2_master-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-var \ + $2_master-filebeat-var + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_api_configuration \ + $2_worker_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_etc \ + $2_worker-wazuh-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-logs \ + $2_worker-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-queue \ + $2_worker-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-var-multigroups \ + $2_worker-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-integrations \ + $2_worker-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-active-response \ + $2_worker-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-agentless \ + $2_worker-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-wodles \ + $2_worker-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + $2_worker-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-var \ + $2_worker-filebeat-var + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v $2_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v $2_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v $2_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-api-configuration:/from \ + -v $2_master-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-etc:/from \ + -v $2_master-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-logs:/from \ + -v $2_master-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-queue:/from \ + -v $2_master-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-var-multigroups:/from \ + -v $2_master-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-integrations:/from \ + -v $2_master-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-active-response:/from \ + -v $2_master-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-agentless:/from \ + -v $2_master-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-wodles:/from \ + -v $2_master-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-etc:/from \ + -v $2_master-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-var:/from \ + -v $2_master-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-api-configuration:/from \ + -v $2_worker-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-etc:/from \ + -v $2_worker-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-logs:/from \ + -v $2_worker-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-queue:/from \ + -v $2_worker-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-var-multigroups:/from \ + -v $2_worker-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-integrations:/from \ + -v $2_worker-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-active-response:/from \ + -v $2_worker-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-agentless:/from \ + -v $2_worker-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-wodles:/from \ + -v $2_worker-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v $2_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" diff --git a/production_cluster/nginx/ssl/generate-self-signed-cert.sh b/production_cluster/nginx/ssl/generate-self-signed-cert.sh deleted file mode 100644 index 6fc8d08d..00000000 --- a/production_cluster/nginx/ssl/generate-self-signed-cert.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -cd $DIR - -if [ -s key.pem ] -then - echo "Certificate already exists" - exit -else - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem -fi \ No newline at end of file diff --git a/single-node/README.md b/single-node/README.md new file mode 100644 index 00000000..a89039e9 --- /dev/null +++ b/single-node/README.md @@ -0,0 +1,33 @@ +# Deploy Wazuh Docker in single node configuration + +This deployment generates a Docker Compose stack with 1 Wazuh Manager container, 1 Wazuh Indexer container and 1 Wazuh Dashboard container. + +In case of upgrading from 4.2, the deployment hosted in the multi-node directory should be reviewed + +For the next deployment, the following steps must be performed: + +1) Increase max_map_count on your host (Linux) +``` +$ sysctl -w vm.max_map_count=262144 +``` + This command must be run with root permissions + + +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the stack with docker-compose: + + In Foregroud: +``` +$ docker-compose up +``` + + In Background: +``` +$ docker-compose up -d +``` + + +The stack takes about 1 minute to get up for the first time, since Wazuh Indexer must be started for the first time and the Indexes and Index Patterns must be generated. \ No newline at end of file diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf new file mode 100644 index 00000000..aff1af9d --- /dev/null +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -0,0 +1,353 @@ + + + yes + yes + no + no + no + smtp.example.wazuh.com + wazuh@example.wazuh.com + recipient@example.wazuh.com + 12 + alerts.log + 10m + 0 + + + + 3 + 12 + + + + + plain + + + + secure + 1514 + tcp + 131072 + + + + + no + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt + + yes + + + + yes + 1800 + 1d + yes + + wodles/java + wodles/ciscat + + + + + yes + yes + /var/log/osquery/osqueryd.results.log + /etc/osquery/osquery.conf + yes + + + + + no + 1h + yes + yes + yes + yes + yes + yes + yes + + + + 10 + + + + + yes + yes + 12h + yes + + + + no + 5m + 6h + yes + + + + no + trusty + xenial + bionic + focal + 1h + + + + + no + stretch + buster + bullseye + 1h + + + + + no + 5 + 6 + 7 + 8 + 1h + + + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + + + + yes + 1h + + + + + yes + 2010 + 1h + + + + + + + no + + + 43200 + + yes + + + yes + + + no + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 1h + 10 + + + + + + 127.0.0.1 + ^localhost.localdomain$ + 10.0.0.106 + + + + disable-account + disable-account + yes + + + + restart-wazuh + restart-wazuh + + + + firewall-drop + firewall-drop + yes + + + + host-deny + host-deny + yes + + + + route-null + route-null + yes + + + + win_route-null + route-null.exe + yes + + + + netsh + netsh.exe + yes + + + + + + + command + df -P + 360 + + + + full_command + netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + netstat listening ports + 360 + + + + full_command + last -n 20 + 360 + + + + + ruleset/decoders + ruleset/rules + 0215-policy_rules.xml + etc/lists/audit-keys + etc/lists/amazon/aws-eventnames + etc/lists/security-eventchannel + + + etc/decoders + etc/rules + + + + yes + 1 + 64 + 15m + + + + + no + 1515 + no + yes + no + HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH + + no + etc/sslmanager.cert + etc/sslmanager.key + no + + + + wazuh + node01 + master + + 1516 + 0.0.0.0 + + NODE_IP + + no + yes + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..d56fe86b --- /dev/null +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 443 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global diff --git a/single-node/config/wazuh_dashboard/wazuh.yml b/single-node/config/wazuh_dashboard/wazuh.yml new file mode 100644 index 00000000..75ba953c --- /dev/null +++ b/single-node/config/wazuh_dashboard/wazuh.yml @@ -0,0 +1,7 @@ +hosts: + - 1513629884013: + url: "https://wazuh.manager" + port: 55000 + username: acme-user + password: MyS3cr37P450r.*- + run_as: false diff --git a/single-node/config/wazuh_indexer/internal_users.yml b/single-node/config/wazuh_indexer/internal_users.yml new file mode 100644 index 00000000..d9f05b34 --- /dev/null +++ b/single-node/config/wazuh_indexer/internal_users.yml @@ -0,0 +1,56 @@ +--- +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +_meta: + type: "internalusers" + config_version: 2 + +# Define your internal users here + +## Demo users + +admin: + hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" + reserved: true + backend_roles: + - "admin" + description: "Demo admin user" + +kibanaserver: + hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." + reserved: true + description: "Demo kibanaserver user" + +kibanaro: + hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" + reserved: false + backend_roles: + - "kibanauser" + - "readall" + attributes: + attribute1: "value1" + attribute2: "value2" + attribute3: "value3" + description: "Demo kibanaro user" + +logstash: + hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" + reserved: false + backend_roles: + - "logstash" + description: "Demo logstash user" + +readall: + hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" + reserved: false + backend_roles: + - "readall" + description: "Demo readall user" + +snapshotrestore: + hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" + reserved: false + backend_roles: + - "snapshotrestore" + description: "Demo snapshotrestore user" diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..ec3220ef --- /dev/null +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,27 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer +discovery.type: single-node +compatibility.override_main_response_version: true +plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false +plugins.security.audit.type: internal_opensearch +plugins.security.authcz.admin_dn: +- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml new file mode 100644 index 00000000..34059eeb --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/certs.yml @@ -0,0 +1,16 @@ +nodes: + # Wazuh indexer server nodes + indexer: + name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + name: wazuh.dashboard + ip: wazuh.dashboard \ No newline at end of file diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml new file mode 100644 index 00000000..356160ea --- /dev/null +++ b/single-node/docker-compose.yml @@ -0,0 +1,102 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh.manager: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh.indexer + restart: always + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: wazuh.dashboard + restart: always + ports: + - 443:443 + environment: + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=admin + - WAZUH_API_URL=https://wazuh.manager + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + depends_on: + - wazuh.indexer + links: + - wazuh.indexer:wazuh.indexer + - wazuh.manager:wazuh.manager + +volumes: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: + filebeat_etc: + filebeat_var: + wazuh-indexer-data: diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml new file mode 100644 index 00000000..c29c50d6 --- /dev/null +++ b/single-node/generate-indexer-certs.yml @@ -0,0 +1,10 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3' + +services: + generator: + image: wazuh/wazuh-certs-generator:0.0.1 + hostname: wazuh-certs-generator + volumes: + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file