forked from wazuh/wazuh-docker
docker-compose.yml configuration fixes
This commit is contained in:
vcerenu
+2
-1
@@ -46,7 +46,7 @@ services:
|
|||||||
hard: 65536
|
hard: 65536
|
||||||
|
|
||||||
wazuh.dashboard:
|
wazuh.dashboard:
|
||||||
image: wazuh/wazuh-dashboard:4.3.0
|
image: wazuh/wazuh-dashboard-test:4.3.0
|
||||||
hostname: wazuh.dashboard
|
hostname: wazuh.dashboard
|
||||||
restart: always
|
restart: always
|
||||||
ports:
|
ports:
|
||||||
@@ -56,6 +56,7 @@ services:
|
|||||||
- ELASTICSEARCH_USERNAME=admin
|
- ELASTICSEARCH_USERNAME=admin
|
||||||
- ELASTICSEARCH_PASSWORD=admin
|
- ELASTICSEARCH_PASSWORD=admin
|
||||||
- SERVER_SSL_ENABLED=false
|
- SERVER_SSL_ENABLED=false
|
||||||
|
- WAZUH_API_URL=https://wazuh.manager
|
||||||
#volumes:
|
#volumes:
|
||||||
# - ./production_cluster/wazuh_dashboard/dashboard.yml:/etc/wazuh-dashboard/dashboard.yml
|
# - ./production_cluster/wazuh_dashboard/dashboard.yml:/etc/wazuh-dashboard/dashboard.yml
|
||||||
|
|
||||||
|
|||||||
@@ -7,4 +7,4 @@ services:
|
|||||||
hostname: wazuh-certs-generator
|
hostname: wazuh-certs-generator
|
||||||
volumes:
|
volumes:
|
||||||
- ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/unattended_installer/install_functions/config.yml
|
- ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/unattended_installer/install_functions/config.yml
|
||||||
- ./production_cluster/wazuh_indexer_ssl_certs/:/unattended_installer/install_functions/certificates/
|
- ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/
|
||||||
@@ -2,10 +2,11 @@
|
|||||||
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||||
|
|
||||||
##############################################################################
|
##############################################################################
|
||||||
# Start Wazuh indexer
|
# Creating Cluster certificates
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
/unattended_installer/install_functions/wazuh-cert-tool.sh
|
/unattended_installer/install_functions/wazuh-cert-tool.sh
|
||||||
mkdir -p /unattended_installer/install_functions/certificates/
|
echo "Moving created certificates to destination directory"
|
||||||
cp /unattended_installer/install_functions/certs/* /unattended_installer/install_functions/certificates/
|
cp /unattended_installer/install_functions/certs/* /certificates/
|
||||||
chmod -R 664 /unattended_installer/install_functions/certificates/*
|
echo "changing certificate permissions"
|
||||||
|
chmod -R 664 /certificates/*
|
||||||
|
|||||||
-10
@@ -1,10 +0,0 @@
|
|||||||
nodes:
|
|
||||||
elasticsearch:
|
|
||||||
name: elasticsearch
|
|
||||||
ip: 127.0.0.1
|
|
||||||
wazuh_servers:
|
|
||||||
name: filebeat
|
|
||||||
ip: 127.0.0.1
|
|
||||||
kibana:
|
|
||||||
name: kibana
|
|
||||||
ip: 127.0.0.1
|
|
||||||
-74
@@ -1,74 +0,0 @@
|
|||||||
---
|
|
||||||
# This is the internal user database
|
|
||||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
|
||||||
|
|
||||||
_meta:
|
|
||||||
type: "internalusers"
|
|
||||||
config_version: 2
|
|
||||||
|
|
||||||
# Define your internal users here
|
|
||||||
|
|
||||||
## Demo users
|
|
||||||
|
|
||||||
admin:
|
|
||||||
hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
|
|
||||||
reserved: true
|
|
||||||
backend_roles:
|
|
||||||
- "admin"
|
|
||||||
description: "Demo admin user"
|
|
||||||
|
|
||||||
kibanaserver:
|
|
||||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
|
||||||
reserved: true
|
|
||||||
description: "Demo kibanaserver user"
|
|
||||||
|
|
||||||
kibanaro:
|
|
||||||
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "kibanauser"
|
|
||||||
- "readall"
|
|
||||||
attributes:
|
|
||||||
attribute1: "value1"
|
|
||||||
attribute2: "value2"
|
|
||||||
attribute3: "value3"
|
|
||||||
description: "Demo kibanaro user"
|
|
||||||
|
|
||||||
logstash:
|
|
||||||
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "logstash"
|
|
||||||
description: "Demo logstash user"
|
|
||||||
|
|
||||||
readall:
|
|
||||||
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "readall"
|
|
||||||
description: "Demo readall user"
|
|
||||||
|
|
||||||
snapshotrestore:
|
|
||||||
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "snapshotrestore"
|
|
||||||
description: "Demo snapshotrestore user"
|
|
||||||
|
|
||||||
wazuh_admin:
|
|
||||||
hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu"
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
backend_roles: []
|
|
||||||
attributes: {}
|
|
||||||
opendistro_security_roles: []
|
|
||||||
static: false
|
|
||||||
|
|
||||||
wazuh_user:
|
|
||||||
hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO"
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
backend_roles: []
|
|
||||||
attributes: {}
|
|
||||||
opendistro_security_roles: []
|
|
||||||
static: false
|
|
||||||
@@ -1,163 +0,0 @@
|
|||||||
_meta:
|
|
||||||
type: "roles"
|
|
||||||
config_version: 2
|
|
||||||
|
|
||||||
# Restrict users so they can only view visualization and dashboard on kibana
|
|
||||||
kibana_read_only:
|
|
||||||
reserved: true
|
|
||||||
|
|
||||||
# The security REST API access role is used to assign specific users access to change the security settings through the REST API.
|
|
||||||
security_rest_api_access:
|
|
||||||
reserved: true
|
|
||||||
|
|
||||||
# Allows users to view monitors, destinations and alerts
|
|
||||||
alerting_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/alerting/alerts/get'
|
|
||||||
- 'cluster:admin/opendistro/alerting/destination/get'
|
|
||||||
- 'cluster:admin/opendistro/alerting/monitor/get'
|
|
||||||
- 'cluster:admin/opendistro/alerting/monitor/search'
|
|
||||||
|
|
||||||
# Allows users to view and acknowledge alerts
|
|
||||||
alerting_ack_alerts:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/alerting/alerts/*'
|
|
||||||
|
|
||||||
# Allows users to use all alerting functionality
|
|
||||||
alerting_full_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster_monitor'
|
|
||||||
- 'cluster:admin/opendistro/alerting/*'
|
|
||||||
index_permissions:
|
|
||||||
- index_patterns:
|
|
||||||
- '*'
|
|
||||||
allowed_actions:
|
|
||||||
- 'indices_monitor'
|
|
||||||
- 'indices:admin/aliases/get'
|
|
||||||
- 'indices:admin/mappings/get'
|
|
||||||
|
|
||||||
# Allow users to read Anomaly Detection detectors and results
|
|
||||||
anomaly_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/ad/detector/info'
|
|
||||||
- 'cluster:admin/opendistro/ad/detector/search'
|
|
||||||
- 'cluster:admin/opendistro/ad/detectors/get'
|
|
||||||
- 'cluster:admin/opendistro/ad/result/search'
|
|
||||||
- 'cluster:admin/opendistro/ad/tasks/search'
|
|
||||||
|
|
||||||
# Allows users to use all Anomaly Detection functionality
|
|
||||||
anomaly_full_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster_monitor'
|
|
||||||
- 'cluster:admin/opendistro/ad/*'
|
|
||||||
index_permissions:
|
|
||||||
- index_patterns:
|
|
||||||
- '*'
|
|
||||||
allowed_actions:
|
|
||||||
- 'indices_monitor'
|
|
||||||
- 'indices:admin/aliases/get'
|
|
||||||
- 'indices:admin/mappings/get'
|
|
||||||
|
|
||||||
# Allows users to read Notebooks
|
|
||||||
notebooks_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/notebooks/list'
|
|
||||||
- 'cluster:admin/opendistro/notebooks/get'
|
|
||||||
|
|
||||||
# Allows users to all Notebooks functionality
|
|
||||||
notebooks_full_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/notebooks/create'
|
|
||||||
- 'cluster:admin/opendistro/notebooks/update'
|
|
||||||
- 'cluster:admin/opendistro/notebooks/delete'
|
|
||||||
- 'cluster:admin/opendistro/notebooks/get'
|
|
||||||
- 'cluster:admin/opendistro/notebooks/list'
|
|
||||||
|
|
||||||
# Allows users to read and download Reports
|
|
||||||
reports_instances_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/list'
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/get'
|
|
||||||
- 'cluster:admin/opendistro/reports/menu/download'
|
|
||||||
|
|
||||||
# Allows users to read and download Reports and Report-definitions
|
|
||||||
reports_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/get'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/list'
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/list'
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/get'
|
|
||||||
- 'cluster:admin/opendistro/reports/menu/download'
|
|
||||||
|
|
||||||
# Allows users to all Reports functionality
|
|
||||||
reports_full_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/create'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/update'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/on_demand'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/delete'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/get'
|
|
||||||
- 'cluster:admin/opendistro/reports/definition/list'
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/list'
|
|
||||||
- 'cluster:admin/opendistro/reports/instance/get'
|
|
||||||
- 'cluster:admin/opendistro/reports/menu/download'
|
|
||||||
|
|
||||||
# Allows users to use all asynchronous-search functionality
|
|
||||||
asynchronous_search_full_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/asynchronous_search/*'
|
|
||||||
index_permissions:
|
|
||||||
- index_patterns:
|
|
||||||
- '*'
|
|
||||||
allowed_actions:
|
|
||||||
- 'indices:data/read/search*'
|
|
||||||
|
|
||||||
# Allows users to read stored asynchronous-search results
|
|
||||||
asynchronous_search_read_access:
|
|
||||||
reserved: true
|
|
||||||
cluster_permissions:
|
|
||||||
- 'cluster:admin/opendistro/asynchronous_search/get'
|
|
||||||
|
|
||||||
wazuh_ui_user:
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
cluster_permissions: []
|
|
||||||
index_permissions:
|
|
||||||
- index_patterns:
|
|
||||||
- "wazuh-*"
|
|
||||||
dls: ""
|
|
||||||
fls: []
|
|
||||||
masked_fields: []
|
|
||||||
allowed_actions:
|
|
||||||
- "read"
|
|
||||||
tenant_permissions: []
|
|
||||||
static: false
|
|
||||||
|
|
||||||
wazuh_ui_admin:
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
cluster_permissions: []
|
|
||||||
index_permissions:
|
|
||||||
- index_patterns:
|
|
||||||
- "wazuh-*"
|
|
||||||
dls: ""
|
|
||||||
fls: []
|
|
||||||
masked_fields: []
|
|
||||||
allowed_actions:
|
|
||||||
- "read"
|
|
||||||
- "delete"
|
|
||||||
- "manage"
|
|
||||||
- "index"
|
|
||||||
tenant_permissions: []
|
|
||||||
static: false
|
|
||||||
-71
@@ -1,71 +0,0 @@
|
|||||||
---
|
|
||||||
# In this file users, backendroles and hosts can be mapped to Open Distro Security roles.
|
|
||||||
# Permissions for Opendistro roles are configured in roles.yml
|
|
||||||
|
|
||||||
_meta:
|
|
||||||
type: "rolesmapping"
|
|
||||||
config_version: 2
|
|
||||||
|
|
||||||
# Define your roles mapping here
|
|
||||||
|
|
||||||
## Demo roles mapping
|
|
||||||
|
|
||||||
all_access:
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "admin"
|
|
||||||
description: "Maps admin to all_access"
|
|
||||||
|
|
||||||
own_index:
|
|
||||||
reserved: false
|
|
||||||
users:
|
|
||||||
- "*"
|
|
||||||
description: "Allow full access to an index named like the username"
|
|
||||||
|
|
||||||
logstash:
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "logstash"
|
|
||||||
|
|
||||||
kibana_user:
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "kibanauser"
|
|
||||||
users:
|
|
||||||
- "wazuh_user"
|
|
||||||
- "wazuh_admin"
|
|
||||||
description: "Maps kibanauser to kibana_user"
|
|
||||||
|
|
||||||
readall:
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "readall"
|
|
||||||
|
|
||||||
manage_snapshots:
|
|
||||||
reserved: false
|
|
||||||
backend_roles:
|
|
||||||
- "snapshotrestore"
|
|
||||||
|
|
||||||
kibana_server:
|
|
||||||
reserved: true
|
|
||||||
users:
|
|
||||||
- "kibanaserver"
|
|
||||||
|
|
||||||
wazuh_ui_admin:
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
backend_roles: []
|
|
||||||
hosts: []
|
|
||||||
users:
|
|
||||||
- "wazuh_admin"
|
|
||||||
- "kibanaserver"
|
|
||||||
and_backend_roles: []
|
|
||||||
|
|
||||||
wazuh_ui_user:
|
|
||||||
reserved: true
|
|
||||||
hidden: false
|
|
||||||
backend_roles: []
|
|
||||||
hosts: []
|
|
||||||
users:
|
|
||||||
- "wazuh_user"
|
|
||||||
and_backend_roles: []
|
|
||||||
-433
@@ -1,433 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
# Program to generate the certificates necessary for Wazuh installation
|
|
||||||
# Copyright (C) 2015, Wazuh Inc.
|
|
||||||
#
|
|
||||||
# This program is a free software; you can redistribute it
|
|
||||||
# and/or modify it under the terms of the GNU General Public
|
|
||||||
# License (version 2) as published by the FSF - Free Software
|
|
||||||
# Foundation.
|
|
||||||
|
|
||||||
if [ -z "${base_path}" ]; then
|
|
||||||
base_path="$(dirname "$(readlink -f "$0")")"
|
|
||||||
config_file="${base_path}/config.yml"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z "${logfile}" ]]; then
|
|
||||||
logfile="/var/log/wazuh-cert-tool.log"
|
|
||||||
fi
|
|
||||||
|
|
||||||
debug_cert=">> ${logfile} 2>&1"
|
|
||||||
|
|
||||||
function cleanFiles() {
|
|
||||||
|
|
||||||
eval "rm -f ${base_path}/certs/*.csr ${debug_cert}"
|
|
||||||
eval "rm -f ${base_path}/certs/*.srl ${debug_cert}"
|
|
||||||
eval "rm -f ${base_path}/certs/*.conf ${debug_cert}"
|
|
||||||
eval "rm -f ${base_path}/certs/admin-key-temp.pem ${debug_cert}"
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function checkOpenSSL() {
|
|
||||||
if [ -z "$(command -v openssl)" ]; then
|
|
||||||
logger_cert -e "OpenSSL not installed."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function logger_cert() {
|
|
||||||
now=$(date +'%d/%m/%Y %H:%M:%S')
|
|
||||||
mtype="INFO:"
|
|
||||||
debugLogger=
|
|
||||||
disableHeader=
|
|
||||||
if [ -n "${1}" ]; then
|
|
||||||
while [ -n "${1}" ]; do
|
|
||||||
case ${1} in
|
|
||||||
"-e")
|
|
||||||
mtype="ERROR:"
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-w")
|
|
||||||
mtype="WARNING:"
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-dh")
|
|
||||||
disableHeader=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-d")
|
|
||||||
debugLogger=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
message="${1}"
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -z "${debugLogger}" ] || ( [ -n "${debugLogger}" ] && [ -n "${debugEnabled}" ] ); then
|
|
||||||
if [ -n "${disableHeader}" ]; then
|
|
||||||
echo "${message}" | tee -a ${logfile}
|
|
||||||
else
|
|
||||||
echo "${now} ${mtype} ${message}" | tee -a ${logfile}
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateAdmincertificate() {
|
|
||||||
|
|
||||||
eval "openssl genrsa -out ${base_path}/certs/admin-key-temp.pem 2048 ${debug_cert}"
|
|
||||||
eval "openssl pkcs8 -inform PEM -outform PEM -in ${base_path}/certs/admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out ${base_path}/certs/admin-key.pem ${debug_cert}"
|
|
||||||
eval "openssl req -new -key ${base_path}/certs/admin-key.pem -out ${base_path}/certs/admin.csr -batch -subj '/C=US/L=California/O=Wazuh/OU=Docu/CN=admin' ${debug_cert}"
|
|
||||||
eval "openssl x509 -days 3650 -req -in ${base_path}/certs/admin.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -sha256 -out ${base_path}/certs/admin.pem ${debug_cert}"
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateCertificateconfiguration() {
|
|
||||||
|
|
||||||
cat > "${base_path}/certs/${1}.conf" <<- EOF
|
|
||||||
[ req ]
|
|
||||||
prompt = no
|
|
||||||
default_bits = 2048
|
|
||||||
default_md = sha256
|
|
||||||
distinguished_name = req_distinguished_name
|
|
||||||
x509_extensions = v3_req
|
|
||||||
|
|
||||||
[req_distinguished_name]
|
|
||||||
C = US
|
|
||||||
L = California
|
|
||||||
O = Wazuh
|
|
||||||
OU = Docu
|
|
||||||
CN = cname
|
|
||||||
|
|
||||||
[ v3_req ]
|
|
||||||
authorityKeyIdentifier=keyid,issuer
|
|
||||||
basicConstraints = CA:FALSE
|
|
||||||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
|
|
||||||
subjectAltName = @alt_names
|
|
||||||
|
|
||||||
[alt_names]
|
|
||||||
IP.1 = cip
|
|
||||||
EOF
|
|
||||||
|
|
||||||
conf="$(awk '{sub("CN = cname", "CN = '${1}'")}1' "${base_path}/certs/${1}.conf")"
|
|
||||||
echo "${conf}" > "${base_path}/certs/${1}.conf"
|
|
||||||
|
|
||||||
isIP=$(echo "${2}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$")
|
|
||||||
isDNS=$(echo "${2}" | grep -P "^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$" )
|
|
||||||
|
|
||||||
if [[ -n "${isIP}" ]]; then
|
|
||||||
conf="$(awk '{sub("IP.1 = cip", "IP.1 = '${2}'")}1' "${base_path}/certs/${1}.conf")"
|
|
||||||
echo "${conf}" > "${base_path}/certs/${1}.conf"
|
|
||||||
elif [[ -n "${isDNS}" ]]; then
|
|
||||||
conf="$(awk '{sub("CN = cname", "CN = '${2}'")}1' "${base_path}/certs/${1}.conf")"
|
|
||||||
echo "${conf}" > "${base_path}/certs/${1}.conf"
|
|
||||||
conf="$(awk '{sub("IP.1 = cip", "DNS.1 = '${2}'")}1' "${base_path}/certs/${1}.conf")"
|
|
||||||
echo "${conf}" > "${base_path}/certs/${1}.conf"
|
|
||||||
else
|
|
||||||
logger_cert -e "The given information does not match with an IP address or a DNS."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateElasticsearchcertificates() {
|
|
||||||
|
|
||||||
if [ ${#elasticsearch_node_names[@]} -gt 0 ]; then
|
|
||||||
logger_cert "Creating the Elasticsearch certificates."
|
|
||||||
|
|
||||||
for i in "${!elasticsearch_node_names[@]}"; do
|
|
||||||
generateCertificateconfiguration "${elasticsearch_node_names[i]}" "${elasticsearch_node_ips[i]}"
|
|
||||||
eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${elasticsearch_node_names[i]}-key.pem -out ${base_path}/certs/${elasticsearch_node_names[i]}.csr -config ${base_path}/certs/${elasticsearch_node_names[i]}.conf -days 3650 ${debug_cert}"
|
|
||||||
eval "openssl x509 -req -in ${base_path}/certs/${elasticsearch_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${elasticsearch_node_names[i]}.pem -extfile ${base_path}/certs/${elasticsearch_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}"
|
|
||||||
eval "chmod 444 ${base_path}/certs/${elasticsearch_node_names[i]}-key.pem ${debug_cert}"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateFilebeatcertificates() {
|
|
||||||
|
|
||||||
if [ ${#wazuh_servers_node_names[@]} -gt 0 ]; then
|
|
||||||
logger_cert "Creating the Wazuh server certificates."
|
|
||||||
|
|
||||||
for i in "${!wazuh_servers_node_names[@]}"; do
|
|
||||||
generateCertificateconfiguration "${wazuh_servers_node_names[i]}" "${wazuh_servers_node_ips[i]}"
|
|
||||||
eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${wazuh_servers_node_names[i]}-key.pem -out ${base_path}/certs/${wazuh_servers_node_names[i]}.csr -config ${base_path}/certs/${wazuh_servers_node_names[i]}.conf -days 3650 ${debug_cert}"
|
|
||||||
eval "openssl x509 -req -in ${base_path}/certs/${wazuh_servers_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${wazuh_servers_node_names[i]}.pem -extfile ${base_path}/certs/${wazuh_servers_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateKibanacertificates() {
|
|
||||||
|
|
||||||
if [ ${#kibana_node_names[@]} -gt 0 ]; then
|
|
||||||
logger_cert "Creating the Kibana certificate."
|
|
||||||
|
|
||||||
for i in "${!kibana_node_names[@]}"; do
|
|
||||||
generateCertificateconfiguration "${kibana_node_names[i]}" "${kibana_node_ips[i]}"
|
|
||||||
eval "openssl req -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/${kibana_node_names[i]}-key.pem -out ${base_path}/certs/${kibana_node_names[i]}.csr -config ${base_path}/certs/${kibana_node_names[i]}.conf -days 3650 ${debug_cert}"
|
|
||||||
eval "openssl x509 -req -in ${base_path}/certs/${kibana_node_names[i]}.csr -CA ${base_path}/certs/root-ca.pem -CAkey ${base_path}/certs/root-ca.key -CAcreateserial -out ${base_path}/certs/${kibana_node_names[i]}.pem -extfile ${base_path}/certs/${kibana_node_names[i]}.conf -extensions v3_req -days 3650 ${debug_cert}"
|
|
||||||
eval "chmod 444 ${base_path}/certs/${kibana_node_names[i]}-key.pem ${debug_cert}"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function generateRootCAcertificate() {
|
|
||||||
|
|
||||||
logger_cert "Creating the root certificate."
|
|
||||||
|
|
||||||
eval "openssl req -x509 -new -nodes -newkey rsa:2048 -keyout ${base_path}/certs/root-ca.key -out ${base_path}/certs/root-ca.pem -batch -subj '/OU=Docu/O=Wazuh/L=California/' -days 3650 ${debug_cert}"
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function getHelp() {
|
|
||||||
|
|
||||||
echo -e ""
|
|
||||||
echo -e "NAME"
|
|
||||||
echo -e " wazuh-cert-tool.sh - Manages the creation of certificates of the Wazuh components."
|
|
||||||
echo -e ""
|
|
||||||
echo -e "SYNOPSIS"
|
|
||||||
echo -e " wazuh-cert-tool.sh [OPTIONS]"
|
|
||||||
echo -e ""
|
|
||||||
echo -e "DESCRIPTION"
|
|
||||||
echo -e " -a, --admin-certificates"
|
|
||||||
echo -e " Creates the admin certificates."
|
|
||||||
echo -e ""
|
|
||||||
echo -e " -ca, --root-ca-certificates"
|
|
||||||
echo -e " Creates the root-ca certificates."
|
|
||||||
echo -e ""
|
|
||||||
echo -e " -e, --elasticsearch-certificates"
|
|
||||||
echo -e " Creates the Elasticsearch certificates."
|
|
||||||
echo -e ""
|
|
||||||
echo -e " -k, --kibana-certificates"
|
|
||||||
echo -e " Creates the Kibana certificates."
|
|
||||||
echo -e ""
|
|
||||||
echo -e " -v, --verbose"
|
|
||||||
echo -e " Enables verbose mode."
|
|
||||||
echo -e ""
|
|
||||||
echo -e " -w, --wazuh-certificates"
|
|
||||||
echo -e " Creates the Wazuh server certificates."
|
|
||||||
|
|
||||||
exit 1
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function main() {
|
|
||||||
|
|
||||||
if [ "$EUID" -ne 0 ]; then
|
|
||||||
logger_cert -e "This script must be run as root."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
checkOpenSSL
|
|
||||||
|
|
||||||
if [[ -d ${base_path}/certs ]]; then
|
|
||||||
logger_cert -e "Folder ${base_path}/certs already exists. Please, remove the /certs folder to create new certificates."
|
|
||||||
exit 1
|
|
||||||
else
|
|
||||||
mkdir "${base_path}/certs"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -n "${1}" ]; then
|
|
||||||
while [ -n "${1}" ]
|
|
||||||
do
|
|
||||||
case "${1}" in
|
|
||||||
"-a"|"--admin-certificates")
|
|
||||||
cadmin=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-ca"|"--root-ca-certificate")
|
|
||||||
ca=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-e"|"--elasticsearch-certificates")
|
|
||||||
celasticsearch=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-w"|"--wazuh-certificates")
|
|
||||||
cwazuh=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-k"|"--kibana-certificates")
|
|
||||||
ckibana=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-v"|"--verbose")
|
|
||||||
debugEnabled=1
|
|
||||||
shift 1
|
|
||||||
;;
|
|
||||||
"-h"|"--help")
|
|
||||||
getHelp
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
getHelp
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
readConfig
|
|
||||||
|
|
||||||
if [ -n "${debugEnabled}" ]; then
|
|
||||||
debug_cert="2>&1 | tee -a ${logfile}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -n "${cadmin}" ]]; then
|
|
||||||
generateAdmincertificate
|
|
||||||
logger_cert "Admin certificates created."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -n "${ca}" ]]; then
|
|
||||||
generateRootCAcertificate
|
|
||||||
logger_cert "Authority certificates created."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -n "${celasticsearch}" ]]; then
|
|
||||||
generateElasticsearchcertificates
|
|
||||||
logger_cert "Elasticsearch certificates created."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -n "${cwazuh}" ]]; then
|
|
||||||
generateFilebeatcertificates
|
|
||||||
logger_cert "Wazuh server certificates created."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -n "${ckibana}" ]]; then
|
|
||||||
generateKibanacertificates
|
|
||||||
logger_cert "Kibana certificates created."
|
|
||||||
fi
|
|
||||||
|
|
||||||
else
|
|
||||||
readConfig
|
|
||||||
generateRootCAcertificate
|
|
||||||
generateAdmincertificate
|
|
||||||
generateElasticsearchcertificates
|
|
||||||
generateFilebeatcertificates
|
|
||||||
generateKibanacertificates
|
|
||||||
cleanFiles
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function parse_yaml() {
|
|
||||||
|
|
||||||
local prefix=${2}
|
|
||||||
local s='[[:space:]]*'
|
|
||||||
local w='[a-zA-Z0-9_]*'
|
|
||||||
local fs=$(echo @|tr @ '\034')
|
|
||||||
sed -ne "s|^\($s\):|\1|" \
|
|
||||||
-e "s|^\($s\)\($w\)$s:$s[\"']\(.*\)[\"']$s\$|\1$fs\2$fs\3|p" \
|
|
||||||
-e "s|^\($s\)\($w\)$s:$s\(.*\)$s\$|\1$fs\2$fs\3|p" ${1} |
|
|
||||||
awk -F$fs '{
|
|
||||||
indent = length($1)/2;
|
|
||||||
vname[indent] = $2;
|
|
||||||
for (i in vname) {if (i > indent) {delete vname[i]}}
|
|
||||||
if (length($3) > 0) {
|
|
||||||
vn=""; for (i=0; i<indent; i++) {vn=(vn)(vname[i])("_")}
|
|
||||||
printf("%s%s%s=\"%s\"\n", "'$prefix'",vn, $2, $3);
|
|
||||||
}
|
|
||||||
}'
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
function readConfig() {
|
|
||||||
|
|
||||||
if [ -f "${config_file}" ]; then
|
|
||||||
if [ ! -s "${config_file}" ]; then
|
|
||||||
logger_cert -e "File ${config_file} is empty"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
eval "$(parse_yaml "${config_file}")"
|
|
||||||
eval "elasticsearch_node_names=( $(parse_yaml "${config_file}" | grep nodes_elasticsearch_name | sed 's/nodes_elasticsearch_name=//') )"
|
|
||||||
eval "wazuh_servers_node_names=( $(parse_yaml "${config_file}" | grep nodes_wazuh_servers_name | sed 's/nodes_wazuh_servers_name=//') )"
|
|
||||||
eval "kibana_node_names=( $(parse_yaml "${config_file}" | grep nodes_kibana_name | sed 's/nodes_kibana_name=//') )"
|
|
||||||
|
|
||||||
eval "elasticsearch_node_ips=( $(parse_yaml "${config_file}" | grep nodes_elasticsearch_ip | sed 's/nodes_elasticsearch_ip=//') )"
|
|
||||||
eval "wazuh_servers_node_ips=( $(parse_yaml "${config_file}" | grep nodes_wazuh_servers_ip | sed 's/nodes_wazuh_servers_ip=//') )"
|
|
||||||
eval "kibana_node_ips=( $(parse_yaml "${config_file}" | grep nodes_kibana_ip | sed 's/nodes_kibana_ip=//') )"
|
|
||||||
|
|
||||||
eval "wazuh_servers_node_types=( $(parse_yaml "${config_file}" | grep nodes_wazuh_servers_node_type | sed 's/nodes_wazuh_servers_node_type=//') )"
|
|
||||||
|
|
||||||
unique_names=($(echo "${elasticsearch_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_names[@]}" -ne "${#elasticsearch_node_names[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Elasticsearch node names."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
unique_ips=($(echo "${elasticsearch_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_ips[@]}" -ne "${#elasticsearch_node_ips[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Elasticsearch node ips."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
unique_names=($(echo "${wazuh_servers_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_names[@]}" -ne "${#wazuh_servers_node_names[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Wazuh server node names."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
unique_ips=($(echo "${wazuh_servers_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_ips[@]}" -ne "${#wazuh_servers_node_ips[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Wazuh server node ips."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
unique_names=($(echo "${kibana_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_names[@]}" -ne "${#kibana_node_names[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Kibana node names."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
unique_ips=($(echo "${kibana_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
|
||||||
if [ "${#unique_ips[@]}" -ne "${#kibana_node_ips[@]}" ]; then
|
|
||||||
logger_cert -e "Duplicated Kibana node ips."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "${#wazuh_servers_node_names[@]}" -ne "${#wazuh_servers_node_ips[@]}" ]; then
|
|
||||||
logger_cert -e "Different number of Wazuh server node names and IPs."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
for i in "${wazuh_servers_node_types[@]}"; do
|
|
||||||
if ! echo "$i" | grep -ioq master && ! echo "$i" | grep -ioq worker; then
|
|
||||||
logger_cert -e "Incorrect node_type $i must be master or worker"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "${#wazuh_servers_node_names[@]}" -le 1 ]; then
|
|
||||||
if [ "${#wazuh_servers_node_types[@]}" -ne 0 ]; then
|
|
||||||
logger_cert -e "The tag node_type can only be used with more than one Wazuh server."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
elif [ "${#wazuh_servers_node_names[@]}" -gt "${#wazuh_servers_node_types[@]}" ]; then
|
|
||||||
logger_cert -e "The tag node_type needs to be specified for all Wazuh server nodes."
|
|
||||||
exit 1
|
|
||||||
elif [ "${#wazuh_servers_node_names[@]}" -lt "${#wazuh_servers_node_types[@]}" ]; then
|
|
||||||
logger_cert -e "Found extra node_type tags."
|
|
||||||
exit 1
|
|
||||||
elif [ $(grep -io master <<< ${wazuh_servers_node_types[*]} | wc -l) -ne 1 ]; then
|
|
||||||
logger_cert -e "Wazuh cluster needs a single master node."
|
|
||||||
exit 1
|
|
||||||
elif [ $(grep -io worker <<< ${wazuh_servers_node_types[*]} | wc -l) -ne $(( ${#wazuh_servers_node_types[@]} - 1 )) ]; then
|
|
||||||
logger_cert -e "Incorrect number of workers."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "${#kibana_node_names[@]}" -ne "${#kibana_node_ips[@]}" ]; then
|
|
||||||
logger_cert -e "Different number of Kibana node names and IPs."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
else
|
|
||||||
logger_cert -e "No configuration file found. ${config_file}."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
main $@
|
|
||||||
@@ -152,7 +152,7 @@ services:
|
|||||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/etc/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/etc/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-dashboard/certs/root-ca.pem
|
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-dashboard/certs/root-ca.pem
|
||||||
- ./production_cluster/wazuh_dashboard/dashboard.yml:/etc/wazuh-dashboard/dashboard.yml
|
- ./production_cluster/wazuh_dashboard/dashboard.yml:/etc/wazuh-dashboard/dashboard.yml
|
||||||
- ./production_cluster/wazuh_dashboard/wazuh:/usr/share/wazuh-dashboard/data/wazuh
|
#- ./production_cluster/wazuh_dashboard/wazuh:/usr/share/wazuh-dashboard/data/wazuh
|
||||||
depends_on:
|
depends_on:
|
||||||
- wazuh1.indexer
|
- wazuh1.indexer
|
||||||
links:
|
links:
|
||||||
|
|||||||
Executable → Regular
@@ -25,7 +25,9 @@ RUN chmod 700 /wazuh_app_config.sh
|
|||||||
|
|
||||||
RUN chown 101:101 /etc/wazuh-dashboard/dashboard.yml && chmod 664 /etc/wazuh-dashboard/dashboard.yml
|
RUN chown 101:101 /etc/wazuh-dashboard/dashboard.yml && chmod 664 /etc/wazuh-dashboard/dashboard.yml
|
||||||
|
|
||||||
RUN chown -R 101:101 /usr/share/wazuh-dashboard/data/wazuh && chmod -R 775 /usr/share/wazuh-dashboard/data/wazuh
|
RUN mkdir -p /usr/share/wazuh-dashboard/data/wazuh/config && chown -R 101:101 /usr/share/wazuh-dashboard/data/wazuh/config && chmod -R 775 /usr/share/wazuh-dashboard/data/wazuh/config
|
||||||
|
|
||||||
|
RUN mkdir -p /usr/share/wazuh-dashboard/data/wazuh/logs && chown -R 101:101 /usr/share/wazuh-dashboard/data/wazuh/logs && chmod -R 775 /usr/share/wazuh-dashboard/data/wazuh/logs
|
||||||
|
|
||||||
# Services ports
|
# Services ports
|
||||||
EXPOSE 5601
|
EXPOSE 5601
|
||||||
|
|||||||
@@ -5,6 +5,6 @@
|
|||||||
# Start Wazuh dashboard
|
# Start Wazuh dashboard
|
||||||
##############################################################################
|
##############################################################################
|
||||||
|
|
||||||
#/wazuh_app_config.sh
|
/wazuh_app_config.sh
|
||||||
|
|
||||||
runuser wazuh-dashboard --shell="/bin/bash" --command="/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /etc/wazuh-dashboard/dashboard.yml"
|
runuser wazuh-dashboard --shell="/bin/bash" --command="/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /etc/wazuh-dashboard/dashboard.yml"
|
||||||
|
|||||||
@@ -8,7 +8,7 @@ api_password="${API_PASSWORD:-wazuh-wui}"
|
|||||||
|
|
||||||
kibana_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml"
|
kibana_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml"
|
||||||
|
|
||||||
cat << EOF >> $kibana_config_file
|
cat << EOF > $kibana_config_file
|
||||||
hosts:
|
hosts:
|
||||||
- 1513629884013:
|
- 1513629884013:
|
||||||
url: $wazuh_url
|
url: $wazuh_url
|
||||||
@@ -16,3 +16,5 @@ hosts:
|
|||||||
username: $api_username
|
username: $api_username
|
||||||
password: $api_password
|
password: $api_password
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user