From 1140e67c99082c98cded7183e9f591b4d3ca234b Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 14 Feb 2022 16:58:57 -0300 Subject: [PATCH] docker-compose.yml configuration fixes --- docker-compose.yml | 3 +- generate-indexer-certs.yml | 2 +- indexer_certs_creator/config/entrypoint.sh | 9 +- .../opensearch/certificate/config_aio.yml | 10 - .../opensearch/roles/internal_users.yml | 74 --- .../config/opensearch/roles/roles.yml | 163 ------- .../config/opensearch/roles/roles_mapping.yml | 71 --- .../install_functions/wazuh-cert-tool.sh | 433 ------------------ production-cluster.yml | 2 +- .../wazuh_indexer_ssl_certs/certs.yml | 0 wazuh-dashboard/Dockerfile | 4 +- wazuh-dashboard/config/entrypoint.sh | 2 +- wazuh-dashboard/config/wazuh_app_config.sh | 4 +- 13 files changed, 16 insertions(+), 761 deletions(-) delete mode 100755 indexer_certs_creator/config/unattended_installer/config/opensearch/certificate/config_aio.yml delete mode 100755 indexer_certs_creator/config/unattended_installer/config/opensearch/roles/internal_users.yml delete mode 100755 indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles.yml delete mode 100755 indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles_mapping.yml delete mode 100755 indexer_certs_creator/config/unattended_installer/install_functions/wazuh-cert-tool.sh mode change 100755 => 100644 production_cluster/wazuh_indexer_ssl_certs/certs.yml diff --git a/docker-compose.yml b/docker-compose.yml index 861ffd17..bc950aca 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -46,7 +46,7 @@ services: hard: 65536 wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 + image: wazuh/wazuh-dashboard-test:4.3.0 hostname: wazuh.dashboard restart: always ports: @@ -56,6 +56,7 @@ services: - ELASTICSEARCH_USERNAME=admin - ELASTICSEARCH_PASSWORD=admin - SERVER_SSL_ENABLED=false + - WAZUH_API_URL=https://wazuh.manager #volumes: # - ./production_cluster/wazuh_dashboard/dashboard.yml:/etc/wazuh-dashboard/dashboard.yml diff --git a/generate-indexer-certs.yml b/generate-indexer-certs.yml index 62386d62..b93dbfff 100644 --- a/generate-indexer-certs.yml +++ b/generate-indexer-certs.yml @@ -7,4 +7,4 @@ services: hostname: wazuh-certs-generator volumes: - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/unattended_installer/install_functions/config.yml - - ./production_cluster/wazuh_indexer_ssl_certs/:/unattended_installer/install_functions/certificates/ \ No newline at end of file + - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file diff --git a/indexer_certs_creator/config/entrypoint.sh b/indexer_certs_creator/config/entrypoint.sh index 5dbd5576..0e86ce61 100644 --- a/indexer_certs_creator/config/entrypoint.sh +++ b/indexer_certs_creator/config/entrypoint.sh @@ -2,10 +2,11 @@ # Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) ############################################################################## -# Start Wazuh indexer +# Creating Cluster certificates ############################################################################## /unattended_installer/install_functions/wazuh-cert-tool.sh -mkdir -p /unattended_installer/install_functions/certificates/ -cp /unattended_installer/install_functions/certs/* /unattended_installer/install_functions/certificates/ -chmod -R 664 /unattended_installer/install_functions/certificates/* +echo "Moving created certificates to destination directory" +cp /unattended_installer/install_functions/certs/* /certificates/ +echo "changing certificate permissions" +chmod -R 664 /certificates/* diff --git a/indexer_certs_creator/config/unattended_installer/config/opensearch/certificate/config_aio.yml b/indexer_certs_creator/config/unattended_installer/config/opensearch/certificate/config_aio.yml deleted file mode 100755 index 8c3e67a0..00000000 --- a/indexer_certs_creator/config/unattended_installer/config/opensearch/certificate/config_aio.yml +++ /dev/null @@ -1,10 +0,0 @@ -nodes: - elasticsearch: - name: elasticsearch - ip: 127.0.0.1 - wazuh_servers: - name: filebeat - ip: 127.0.0.1 - kibana: - name: kibana - ip: 127.0.0.1 diff --git a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/internal_users.yml b/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/internal_users.yml deleted file mode 100755 index 40fcb9cd..00000000 --- a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/internal_users.yml +++ /dev/null @@ -1,74 +0,0 @@ ---- -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -_meta: - type: "internalusers" - config_version: 2 - -# Define your internal users here - -## Demo users - -admin: - hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG" - reserved: true - backend_roles: - - "admin" - description: "Demo admin user" - -kibanaserver: - hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." - reserved: true - description: "Demo kibanaserver user" - -kibanaro: - hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" - reserved: false - backend_roles: - - "kibanauser" - - "readall" - attributes: - attribute1: "value1" - attribute2: "value2" - attribute3: "value3" - description: "Demo kibanaro user" - -logstash: - hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" - reserved: false - backend_roles: - - "logstash" - description: "Demo logstash user" - -readall: - hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" - reserved: false - backend_roles: - - "readall" - description: "Demo readall user" - -snapshotrestore: - hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" - reserved: false - backend_roles: - - "snapshotrestore" - description: "Demo snapshotrestore user" - -wazuh_admin: - hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu" - reserved: true - hidden: false - backend_roles: [] - attributes: {} - opendistro_security_roles: [] - static: false - -wazuh_user: - hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO" - reserved: true - hidden: false - backend_roles: [] - attributes: {} - opendistro_security_roles: [] - static: false \ No newline at end of file diff --git a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles.yml b/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles.yml deleted file mode 100755 index 3afa9ee4..00000000 --- a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles.yml +++ /dev/null @@ -1,163 +0,0 @@ -_meta: - type: "roles" - config_version: 2 - -# Restrict users so they can only view visualization and dashboard on kibana -kibana_read_only: - reserved: true - -# The security REST API access role is used to assign specific users access to change the security settings through the REST API. -security_rest_api_access: - reserved: true - -# Allows users to view monitors, destinations and alerts -alerting_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/alerting/alerts/get' - - 'cluster:admin/opendistro/alerting/destination/get' - - 'cluster:admin/opendistro/alerting/monitor/get' - - 'cluster:admin/opendistro/alerting/monitor/search' - -# Allows users to view and acknowledge alerts -alerting_ack_alerts: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/alerting/alerts/*' - -# Allows users to use all alerting functionality -alerting_full_access: - reserved: true - cluster_permissions: - - 'cluster_monitor' - - 'cluster:admin/opendistro/alerting/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices_monitor' - - 'indices:admin/aliases/get' - - 'indices:admin/mappings/get' - -# Allow users to read Anomaly Detection detectors and results -anomaly_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/ad/detector/info' - - 'cluster:admin/opendistro/ad/detector/search' - - 'cluster:admin/opendistro/ad/detectors/get' - - 'cluster:admin/opendistro/ad/result/search' - - 'cluster:admin/opendistro/ad/tasks/search' - -# Allows users to use all Anomaly Detection functionality -anomaly_full_access: - reserved: true - cluster_permissions: - - 'cluster_monitor' - - 'cluster:admin/opendistro/ad/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices_monitor' - - 'indices:admin/aliases/get' - - 'indices:admin/mappings/get' - -# Allows users to read Notebooks -notebooks_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/notebooks/list' - - 'cluster:admin/opendistro/notebooks/get' - -# Allows users to all Notebooks functionality -notebooks_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/notebooks/create' - - 'cluster:admin/opendistro/notebooks/update' - - 'cluster:admin/opendistro/notebooks/delete' - - 'cluster:admin/opendistro/notebooks/get' - - 'cluster:admin/opendistro/notebooks/list' - -# Allows users to read and download Reports -reports_instances_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to read and download Reports and Report-definitions -reports_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/definition/get' - - 'cluster:admin/opendistro/reports/definition/list' - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to all Reports functionality -reports_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/definition/create' - - 'cluster:admin/opendistro/reports/definition/update' - - 'cluster:admin/opendistro/reports/definition/on_demand' - - 'cluster:admin/opendistro/reports/definition/delete' - - 'cluster:admin/opendistro/reports/definition/get' - - 'cluster:admin/opendistro/reports/definition/list' - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to use all asynchronous-search functionality -asynchronous_search_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/asynchronous_search/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices:data/read/search*' - -# Allows users to read stored asynchronous-search results -asynchronous_search_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/asynchronous_search/get' - -wazuh_ui_user: - reserved: true - hidden: false - cluster_permissions: [] - index_permissions: - - index_patterns: - - "wazuh-*" - dls: "" - fls: [] - masked_fields: [] - allowed_actions: - - "read" - tenant_permissions: [] - static: false - -wazuh_ui_admin: - reserved: true - hidden: false - cluster_permissions: [] - index_permissions: - - index_patterns: - - "wazuh-*" - dls: "" - fls: [] - masked_fields: [] - allowed_actions: - - "read" - - "delete" - - "manage" - - "index" - tenant_permissions: [] - static: false \ No newline at end of file diff --git a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles_mapping.yml b/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles_mapping.yml deleted file mode 100755 index 7d8429cb..00000000 --- a/indexer_certs_creator/config/unattended_installer/config/opensearch/roles/roles_mapping.yml +++ /dev/null @@ -1,71 +0,0 @@ ---- -# In this file users, backendroles and hosts can be mapped to Open Distro Security roles. -# Permissions for Opendistro roles are configured in roles.yml - -_meta: - type: "rolesmapping" - config_version: 2 - -# Define your roles mapping here - -## Demo roles mapping - -all_access: - reserved: false - backend_roles: - - "admin" - description: "Maps admin to all_access" - -own_index: - reserved: false - users: - - "*" - description: "Allow full access to an index named like the username" - -logstash: - reserved: false - backend_roles: - - "logstash" - -kibana_user: - reserved: false - backend_roles: - - "kibanauser" - users: - - "wazuh_user" - - "wazuh_admin" - description: "Maps kibanauser to kibana_user" - -readall: - reserved: false - backend_roles: - - "readall" - -manage_snapshots: - reserved: false - backend_roles: - - "snapshotrestore" - -kibana_server: - reserved: true - users: - - "kibanaserver" - -wazuh_ui_admin: - reserved: true - hidden: false - backend_roles: [] - hosts: [] - users: - - "wazuh_admin" - - "kibanaserver" - and_backend_roles: [] - -wazuh_ui_user: - reserved: true - hidden: false - backend_roles: [] - hosts: [] - users: - - "wazuh_user" - and_backend_roles: [] \ No newline at end of file diff --git a/indexer_certs_creator/config/unattended_installer/install_functions/wazuh-cert-tool.sh b/indexer_certs_creator/config/unattended_installer/install_functions/wazuh-cert-tool.sh deleted file mode 100755 index 1c7f7c23..00000000 --- a/indexer_certs_creator/config/unattended_installer/install_functions/wazuh-cert-tool.sh +++ /dev/null @@ -1,433 +0,0 @@ -#!/bin/bash - -# Program to generate the certificates necessary for Wazuh installation -# Copyright (C) 2015, Wazuh Inc. -# -# This program is a free software; you can redistribute it -# and/or modify it under the terms of the GNU General Public -# License (version 2) as published by the FSF - Free Software -# Foundation. - -if [ -z "${base_path}" ]; then - base_path="$(dirname "$(readlink -f "$0")")" - config_file="${base_path}/config.yml" -fi - -if [[ -z "${logfile}" ]]; then - logfile="/var/log/wazuh-cert-tool.log" -fi - -debug_cert=">> ${logfile} 2>&1" - -function cleanFiles() { - - eval "rm -f ${base_path}/certs/*.csr ${debug_cert}" - eval "rm -f ${base_path}/certs/*.srl ${debug_cert}" - eval "rm -f ${base_path}/certs/*.conf ${debug_cert}" - eval "rm -f ${base_path}/certs/admin-key-temp.pem ${debug_cert}" - -} - -function checkOpenSSL() { - if [ -z "$(command -v openssl)" ]; then - logger_cert -e "OpenSSL not installed." - exit 1 - fi -} - -function logger_cert() { - now=$(date +'%d/%m/%Y %H:%M:%S') - mtype="INFO:" - debugLogger= - disableHeader= - if [ -n "${1}" ]; then - while [ -n "${1}" ]; do - case ${1} in - "-e") - mtype="ERROR:" - shift 1 - ;; - "-w") - mtype="WARNING:" - shift 1 - ;; - "-dh") - disableHeader=1 - shift 1 - ;; - "-d") - debugLogger=1 - shift 1 - ;; - *) - message="${1}" - shift 1 - ;; - esac - done - fi - - if [ -z "${debugLogger}" ] || ( [ -n "${debugLogger}" ] && [ -n "${debugEnabled}" ] ); then - if [ -n "${disableHeader}" ]; then - echo "${message}" | tee -a ${logfile} - else - echo "${now} ${mtype} ${message}" | tee -a ${logfile} - fi - fi -} - -function generateAdmincertificate() { - - eval "openssl genrsa -out ${base_path}/certs/admin-key-temp.pem 2048 ${debug_cert}" - eval "openssl pkcs8 -inform PEM -outform PEM -in ${base_path}/certs/admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out ${base_path}/certs/admin-key.pem ${debug_cert}" - eval "openssl req -new -key ${base_path}/certs/admin-key.pem -out ${base_path}/certs/admin.csr -batch -subj '/C=US/L=California/O=Wazuh/OU=Docu/CN=admin' ${debug_cert}" - eval "openssl x509 -days 3650 -req -in ${base_path}/certs/admin.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -sha256 -out ${base_path}/certs/admin.pem ${debug_cert}" - -} - -function generateCertificateconfiguration() { - - cat > "${base_path}/certs/${1}.conf" <<- EOF - [ req ] - prompt = no - default_bits = 2048 - default_md = sha256 - distinguished_name = req_distinguished_name - x509_extensions = v3_req - - [req_distinguished_name] - C = US - L = California - O = Wazuh - OU = Docu - CN = cname - - [ v3_req ] - authorityKeyIdentifier=keyid,issuer - basicConstraints = CA:FALSE - keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment - subjectAltName = @alt_names - - [alt_names] - IP.1 = cip - EOF - - conf="$(awk '{sub("CN = cname", "CN = '${1}'")}1' "${base_path}/certs/${1}.conf")" - echo "${conf}" > "${base_path}/certs/${1}.conf" - - isIP=$(echo "${2}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$") - isDNS=$(echo "${2}" | grep -P "^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$" ) - - if [[ -n "${isIP}" ]]; then - conf="$(awk '{sub("IP.1 = cip", "IP.1 = '${2}'")}1' "${base_path}/certs/${1}.conf")" - echo "${conf}" > "${base_path}/certs/${1}.conf" - elif [[ -n "${isDNS}" ]]; then - conf="$(awk '{sub("CN = cname", "CN = '${2}'")}1' "${base_path}/certs/${1}.conf")" - echo "${conf}" > "${base_path}/certs/${1}.conf" - conf="$(awk '{sub("IP.1 = cip", "DNS.1 = '${2}'")}1' "${base_path}/certs/${1}.conf")" - echo "${conf}" > "${base_path}/certs/${1}.conf" - else - logger_cert -e "The given information does not match with an IP address or a DNS." - exit 1 - fi - -} - -function generateElasticsearchcertificates() { - - if [ ${#elasticsearch_node_names[@]} -gt 0 ]; then - logger_cert "Creating the Elasticsearch certificates." - - for i in "${!elasticsearch_node_names[@]}"; do - generateCertificateconfiguration "${elasticsearch_node_names[i]}" "${elasticsearch_node_ips[i]}" - eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${elasticsearch_node_names[i]}-key.pem -out ${base_path}/certs/${elasticsearch_node_names[i]}.csr -config ${base_path}/certs/${elasticsearch_node_names[i]}.conf -days 3650 ${debug_cert}" - eval "openssl x509 -req -in ${base_path}/certs/${elasticsearch_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${elasticsearch_node_names[i]}.pem -extfile ${base_path}/certs/${elasticsearch_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}" - eval "chmod 444 ${base_path}/certs/${elasticsearch_node_names[i]}-key.pem ${debug_cert}" - done - fi - -} - -function generateFilebeatcertificates() { - - if [ ${#wazuh_servers_node_names[@]} -gt 0 ]; then - logger_cert "Creating the Wazuh server certificates." - - for i in "${!wazuh_servers_node_names[@]}"; do - generateCertificateconfiguration "${wazuh_servers_node_names[i]}" "${wazuh_servers_node_ips[i]}" - eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${wazuh_servers_node_names[i]}-key.pem -out ${base_path}/certs/${wazuh_servers_node_names[i]}.csr -config ${base_path}/certs/${wazuh_servers_node_names[i]}.conf -days 3650 ${debug_cert}" - eval "openssl x509 -req -in ${base_path}/certs/${wazuh_servers_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${wazuh_servers_node_names[i]}.pem -extfile ${base_path}/certs/${wazuh_servers_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}" - done - fi - -} - -function generateKibanacertificates() { - - if [ ${#kibana_node_names[@]} -gt 0 ]; then - logger_cert "Creating the Kibana certificate." - - for i in "${!kibana_node_names[@]}"; do - generateCertificateconfiguration "${kibana_node_names[i]}" "${kibana_node_ips[i]}" - eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${kibana_node_names[i]}-key.pem -out ${base_path}/certs/${kibana_node_names[i]}.csr -config ${base_path}/certs/${kibana_node_names[i]}.conf -days 3650 ${debug_cert}" - eval "openssl x509 -req -in ${base_path}/certs/${kibana_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${kibana_node_names[i]}.pem -extfile ${base_path}/certs/${kibana_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}" - eval "chmod 444 ${base_path}/certs/${kibana_node_names[i]}-key.pem ${debug_cert}" - done - fi - -} - -function generateRootCAcertificate() { - - logger_cert "Creating the root certificate." - - eval "openssl req -x509 -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/root-ca.key -out ${base_path}/certs/root-ca.pem -batch -subj '/OU=Docu/O=Wazuh/L=California/' -days 3650 ${debug_cert}" - -} - -function getHelp() { - - echo -e "" - echo -e "NAME" - echo -e " wazuh-cert-tool.sh - Manages the creation of certificates of the Wazuh components." - echo -e "" - echo -e "SYNOPSIS" - echo -e " wazuh-cert-tool.sh [OPTIONS]" - echo -e "" - echo -e "DESCRIPTION" - echo -e " -a, --admin-certificates" - echo -e " Creates the admin certificates." - echo -e "" - echo -e " -ca, --root-ca-certificates" - echo -e " Creates the root-ca certificates." - echo -e "" - echo -e " -e, --elasticsearch-certificates" - echo -e " Creates the Elasticsearch certificates." - echo -e "" - echo -e " -k, --kibana-certificates" - echo -e " Creates the Kibana certificates." - echo -e "" - echo -e " -v, --verbose" - echo -e " Enables verbose mode." - echo -e "" - echo -e " -w, --wazuh-certificates" - echo -e " Creates the Wazuh server certificates." - - exit 1 - -} - -function main() { - - if [ "$EUID" -ne 0 ]; then - logger_cert -e "This script must be run as root." - exit 1 - fi - - checkOpenSSL - - if [[ -d ${base_path}/certs ]]; then - logger_cert -e "Folder ${base_path}/certs already exists. Please, remove the /certs folder to create new certificates." - exit 1 - else - mkdir "${base_path}/certs" - fi - - if [ -n "${1}" ]; then - while [ -n "${1}" ] - do - case "${1}" in - "-a"|"--admin-certificates") - cadmin=1 - shift 1 - ;; - "-ca"|"--root-ca-certificate") - ca=1 - shift 1 - ;; - "-e"|"--elasticsearch-certificates") - celasticsearch=1 - shift 1 - ;; - "-w"|"--wazuh-certificates") - cwazuh=1 - shift 1 - ;; - "-k"|"--kibana-certificates") - ckibana=1 - shift 1 - ;; - "-v"|"--verbose") - debugEnabled=1 - shift 1 - ;; - "-h"|"--help") - getHelp - ;; - *) - getHelp - esac - done - - readConfig - - if [ -n "${debugEnabled}" ]; then - debug_cert="2>&1 | tee -a ${logfile}" - fi - - if [[ -n "${cadmin}" ]]; then - generateAdmincertificate - logger_cert "Admin certificates created." - fi - - if [[ -n "${ca}" ]]; then - generateRootCAcertificate - logger_cert "Authority certificates created." - fi - - if [[ -n "${celasticsearch}" ]]; then - generateElasticsearchcertificates - logger_cert "Elasticsearch certificates created." - fi - - if [[ -n "${cwazuh}" ]]; then - generateFilebeatcertificates - logger_cert "Wazuh server certificates created." - fi - - if [[ -n "${ckibana}" ]]; then - generateKibanacertificates - logger_cert "Kibana certificates created." - fi - - else - readConfig - generateRootCAcertificate - generateAdmincertificate - generateElasticsearchcertificates - generateFilebeatcertificates - generateKibanacertificates - cleanFiles - fi - -} - -function parse_yaml() { - - local prefix=${2} - local s='[[:space:]]*' - local w='[a-zA-Z0-9_]*' - local fs=$(echo @|tr @ '\034') - sed -ne "s|^\($s\):|\1|" \ - -e "s|^\($s\)\($w\)$s:$s[\"']\(.*\)[\"']$s\$|\1$fs\2$fs\3|p" \ - -e "s|^\($s\)\($w\)$s:$s\(.*\)$s\$|\1$fs\2$fs\3|p" ${1} | - awk -F$fs '{ - indent = length($1)/2; - vname[indent] = $2; - for (i in vname) {if (i > indent) {delete vname[i]}} - if (length($3) > 0) { - vn=""; for (i=0; i> $kibana_config_file +cat << EOF > $kibana_config_file hosts: - 1513629884013: url: $wazuh_url @@ -16,3 +16,5 @@ hosts: username: $api_username password: $api_password EOF + +