diff --git a/.env b/.env index 2e783ae2..e028f206 100755 --- a/.env +++ b/.env @@ -1,4 +1,3 @@ WAZUH_VERSION=5.0.0 WAZUH_IMAGE_VERSION=5.0.0 WAZUH_REGISTRY=docker.io -IMAGE_TAG=5.0.0 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index a5a1c9c7..4354ab1d 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -1,26 +1,26 @@ file: - /var/ossec/bin/wazuh-control: + /var/wazuh-manager/bin/wazuh-control: exists: true mode: "0750" owner: root group: root filetype: file contains: [] - /var/ossec/etc/ossec.conf: + /var/wazuh-manager/etc/wazuh-manager.conf: exists: true mode: "0660" owner: root - group: wazuh + group: wazuh-manager filetype: file contains: [] - /var/ossec/etc/sslmanager.cert: + /var/wazuh-manager/etc/sslmanager.cert: exists: true mode: "0644" owner: root group: root filetype: file contains: [] - /var/ossec/etc/sslmanager.key: + /var/wazuh-manager/etc/sslmanager.key: exists: true mode: "0600" owner: root @@ -28,12 +28,12 @@ file: filetype: file contains: [] user: - wazuh: + wazuh-manager: exists: true groups: - - wazuh - home: /var/ossec + - wazuh-manager + home: /var/wazuh-manager shell: /sbin/nologin group: - wazuh: - exists: true \ No newline at end of file + wazuh-manager: + exists: true diff --git a/.github/multi-node-log-check.sh b/.github/multi-node-log-check.sh index bfa1649a..9ff2724f 100755 --- a/.github/multi-node-log-check.sh +++ b/.github/multi-node-log-check.sh @@ -1,16 +1,16 @@ -log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT") if [[ -z "$log1" ]]; then - echo "No errors in master ossec.log" + echo "No errors in master wazuh-manager.log" else - echo "Errors in master ossec.log:" + echo "Errors in master wazuh-manager.log:" echo "${log1}" exit 1 fi -log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT") if [[ -z "${log2}" ]]; then - echo "No errors in worker ossec.log" + echo "No errors in worker wazuh-manager.log" else - echo "Errors in worker ossec.log:" + echo "Errors in worker wazuh-manager.log:" echo "${log2}" exit 1 -fi \ No newline at end of file +fi diff --git a/.github/single-node-log-check.sh b/.github/single-node-log-check.sh index 806e9238..081ef482 100755 --- a/.github/single-node-log-check.sh +++ b/.github/single-node-log-check.sh @@ -1,8 +1,8 @@ -log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT") if [[ -z "$log" ]]; then - echo "No errors in ossec.log" + echo "No errors in wazuh-manager.log" else - echo "Errors in ossec.log:" + echo "Errors in wazuh-manager.log:" echo "${log}" exit 1 -fi \ No newline at end of file +fi diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 0d32e3c6..ae2e4617 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -46,7 +46,7 @@ jobs: runs-on: ubuntu-22.04 env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: - name: Check out code @@ -83,7 +83,7 @@ jobs: env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} INDEXER_USERNAME: admin INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui @@ -128,9 +128,9 @@ jobs: - name: wazuh.indexer ip: wazuh.indexer - # Wazuh server nodes + # Wazuh manager nodes # Use node_type only with more than one Wazuh manager - server: + manager: - name: wazuh.manager ip: wazuh.manager @@ -159,98 +159,90 @@ jobs: fi - name: Start single node stack + id: start_single_node_stack run: docker compose up -d working-directory: ./single-node - name: Check Wazuh indexer start + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: | - for i in {1..20}; do - echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") - if echo "$RESPONSE" | grep -qE "green|yellow"; then - echo "Cluster Online" - echo "$RESPONSE" - exit 0 - fi - echo "Waiting for cluster to be online" - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done - [ $i -lt 20 ] && sleep 60 - done - status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" - if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s - else - curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s - exit 1 - fi + for i in {1..20}; do + echo "Checking Wazuh indexer health (Attempt $i/20)" + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" + exit 0 + fi + echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + [ $i -lt 20 ] && sleep 60 + done + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + else + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + exit 1 + fi - name: Check Wazuh indexer nodes + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: | - nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" - if [[ $nodes -eq 1 ]]; then + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" echo "Wazuh indexer nodes: ${nodes}" - else - echo "Wazuh indexer nodes: ${nodes}" - fi - - - name: Check documents into wazuh-states index - run: | - for i in {1..20}; do - echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") - DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') - if [[ "$DOCS" -gt 0 ]]; then - echo "wazuh-states index has documents: ${DOCS}" - exit 0 - fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" - [ $i -lt 20 ] && sleep 60 - done - echo "Error: No documents found in wazuh-states after 20 attempts." - echo "Last response: $RESPONSE" - exit 1 - name: Check Wazuh templates + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: | - qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" - templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" - if [[ $qty_templates -gt 3 ]]; then - echo "wazuh templates:" - echo "${templates}" - else - echo "wazuh templates:" - echo "${templates}" - exit 1 - fi + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + if [[ $qty_templates -gt 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi - name: Check Wazuh manager start - run: | + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} + run: | for NODE in "${{ env.MANAGER_NODES }}"; do + ok=false for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then + if [[ $services -gt 7 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" + ok=true + break else curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi done + if [[ "$ok" != "true" ]]; then + echo "Error: Wazuh Manager $NODE did not reach expected running services threshold" + exit 1 + fi done - + - name: Check Wazuh dashboard service URL + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" @@ -270,9 +262,11 @@ jobs: exit 1 - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - name: Edit Wazuh agent docker-compose file + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} shell: bash env: WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} @@ -287,17 +281,21 @@ jobs: fi - name: Start Wazuh agent + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: docker compose up -d working-directory: ./wazuh-agent - name: Check Wazuh agent enrollment + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: | + enrolled=false for i in {1..5}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" if [[ $agents -gt 1 ]]; then echo "Wazuh agents: ${agents}" echo "OK" + enrolled=true break else curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" @@ -305,27 +303,51 @@ jobs: [ $i -lt 5 ] && sleep 10 fi done + if [[ "$enrolled" != "true" ]]; then + echo "Error: Wazuh agent enrollment did not reach expected active agents threshold" + exit 1 + fi - - name: Check errors in ossec.log for Wazuh manager + - name: Check errors in wazuh-manager.log for Wazuh manager + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} run: ./.github/single-node-log-check.sh - + + - name: Check documents into wazuh-states index + if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }} + run: | + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 20 ] && sleep 60 + done + echo "Error: No documents found in wazuh-states after 20 attempts." + echo "Last response: $RESPONSE" + exit 1 + - name: Docker logs if: always() + continue-on-error: true run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done working-directory: ./single-node check-multi-node: name: Check multi node on ${{ matrix.os }} - runs-on: ${{ matrix.os }} + runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-22.04, ubuntu-22.04-arm] @@ -334,7 +356,7 @@ jobs: env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} INDEXER_USERNAME: admin INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui @@ -383,9 +405,9 @@ jobs: - name: wazuh3.indexer ip: wazuh3.indexer - # Wazuh server nodes + # Wazuh manager nodes # Use node_type only with more than one Wazuh manager - server: + manager: - name: wazuh.master ip: wazuh.master node_type: master @@ -416,89 +438,85 @@ jobs: fi - name: Start multi node stack + id: start_multi_node_stack run: docker compose up -d working-directory: ./multi-node - name: Check Wazuh indexer start - run: | - for i in {1..20}; do - echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") - if echo "$RESPONSE" | grep -qE "green|yellow"; then - echo "Cluster Online" - echo "$RESPONSE" - exit 0 - fi - echo "Waiting for cluster to be online" - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done - [ $i -lt 20 ] && sleep 60 - done - status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" - if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s - else - curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s - exit 1 - fi - - - name: Check Wazuh indexer nodes - run: | - nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" - if [[ $nodes -eq 3 ]]; then - echo "Wazuh indexer nodes: ${nodes}" - else - echo "Wazuh indexer nodes: ${nodes}" - fi - - - name: Check documents into wazuh-states index + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: | for i in {1..20}; do - echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") - DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') - if [[ "$DOCS" -gt 0 ]]; then - echo "wazuh-states index has documents: ${DOCS}" + echo "Checking Wazuh indexer health (Attempt $i/20)" + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" exit 0 fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done [ $i -lt 20 ] && sleep 60 done - echo "Error: No documents found in wazuh-states after 20 attempts." - echo "Last response: $RESPONSE" - exit 1 + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + else + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + exit 1 + fi + + - name: Check Wazuh indexer nodes + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} + run: | + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" + if [[ $nodes -eq 3 ]]; then + echo "Wazuh indexer nodes: ${nodes}" + else + echo "Wazuh indexer nodes: ${nodes}" + exit 1 + fi - name: Check Wazuh templates + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: | - qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" - if [[ $qty_templates -gt 3 ]]; then - echo "wazuh templates:" - echo "${templates}" - else - echo "wazuh templates:" - echo "${templates}" - exit 1 - fi + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" + if [[ $qty_templates -gt 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi - name: Check Wazuh manager start - run: | + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} + run: | IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}" for NODE in "${NODES[@]}"; do + if [[ "$NODE" == "master" ]]; then + THRESHOLD=8 + else + THRESHOLD=7 + fi + ok=false for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then + if [[ $services -ge $THRESHOLD ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" + ok=true break else curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items @@ -506,9 +524,14 @@ jobs: [ $i -lt 20 ] && sleep 30 fi done + if [[ "$ok" != "true" ]]; then + echo "Error: Wazuh Manager $NODE did not reach expected running services threshold" + exit 1 + fi done - name: Check Wazuh dashboard service URL + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" @@ -528,9 +551,11 @@ jobs: exit 1 - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - name: Edit Wazuh agent docker-compose file + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} shell: bash env: WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} @@ -545,16 +570,20 @@ jobs: fi - name: Start Wazuh agent + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: docker compose -f wazuh-agent/docker-compose.yml up -d - name: Check Wazuh agent enrollment + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: | + enrolled=false for i in {1..5}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" if [[ $agents -gt 1 ]]; then echo "Wazuh agents: ${agents}" echo "OK" + enrolled=true break else curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" @@ -562,20 +591,44 @@ jobs: [ $i -lt 5 ] && sleep 10 fi done + if [[ "$enrolled" != "true" ]]; then + echo "Error: Wazuh agent enrollment did not reach expected active agents threshold" + exit 1 + fi - - name: Check errors in ossec.log for Wazuh manager + - name: Check errors in wazuh-manager.log for Wazuh manager + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} run: ./.github/multi-node-log-check.sh - + + - name: Check documents into wazuh-states index + if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }} + run: | + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 20 ] && sleep 60 + done + echo "Error: No documents found in wazuh-states after 20 attempts." + echo "Last response: $RESPONSE" + exit 1 + - name: Docker logs if: always() + continue-on-error: true run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done - working-directory: ./single-node + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + working-directory: ./multi-node diff --git a/CHANGELOG.md b/CHANGELOG.md index 8954812a..b93f5a0f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file. ### Changed +- Move index documents test ([#2221](https://github.com/wazuh/wazuh-docker/pull/2221)) +- Separate Agent/Manager - Docker - Adapt image build process ([#2220](https://github.com/wazuh/wazuh-docker/pull/2220)) - Remove revision input ([#2217](https://github.com/wazuh/wazuh-docker/pull/2217)) - Improve build script and workflow component revisions handling ([#2212](https://github.com/wazuh/wazuh-docker/pull/2212)) - Add missing documentation sections in the repository ([#2215](https://github.com/wazuh/wazuh-docker/pull/2215)) diff --git a/README.md b/README.md index bcd5f817..70a7071d 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ ## Description -The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh server, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search. +The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh manager, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search. ## Capabilities diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index ba7feaa2..707123b3 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -22,13 +22,12 @@ services: - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin volumes: - - wazuh_api_configuration:/var/ossec/api/configuration - - wazuh_etc:/var/ossec/etc - - wazuh_logs:/var/ossec/logs - - wazuh_queue:/var/ossec/queue - - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_wodles:/var/ossec/wodles + - wazuh_api_configuration:/var/wazuh-manager/api/configuration + - wazuh_etc:/var/wazuh-manager/etc + - wazuh_logs:/var/wazuh-manager/logs + - wazuh_queue:/var/wazuh-manager/queue + - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups + - wazuh_active_response:/var/wazuh-manager/active-response/bin wazuh.agent: build: @@ -97,5 +96,4 @@ volumes: wazuh_queue: wazuh_var_multigroups: wazuh_active_response: - wazuh_wodles: diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 92621c5b..d4ff3e83 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -24,12 +24,11 @@ RUN URL_VAR="wazuh_manager_${TARGETARCH}_rpm" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ - rm -f /var/ossec/etc/sslmanager.key && \ - rm -f /var/ossec/etc/sslmanager.cert + rm -f /var/wazuh-manager/etc/sslmanager.key && \ + rm -f /var/wazuh-manager/etc/sslmanager.cert COPY config/etc/ /etc/ -COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py - +COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 @@ -37,12 +36,12 @@ COPY config/permanent_data.env config/permanent_data.sh / #Make mount directories for keep permissions -RUN mkdir -p /var/ossec/var/multigroups && \ - chown root:wazuh /var/ossec/var/multigroups && \ - chmod 770 /var/ossec/var/multigroups && \ - mkdir -p /var/ossec/active-response/bin && \ - chown root:wazuh /var/ossec/active-response/bin && \ - chmod 770 /var/ossec/active-response/bin && \ +RUN mkdir -p /var/wazuh-manager/var/multigroups && \ + chown root:wazuh-manager /var/wazuh-manager/var/multigroups && \ + chmod 770 /var/wazuh-manager/var/multigroups && \ + mkdir -p /var/wazuh-manager/active-response/bin && \ + chown root:wazuh-manager /var/wazuh-manager/active-response/bin && \ + chmod 770 /var/wazuh-manager/active-response/bin && \ chmod 755 /permanent_data.sh && \ sync && /permanent_data.sh && \ sync && rm /permanent_data.sh diff --git a/build-docker-images/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py index 3bb6bb6c..f1417298 100644 --- a/build-docker-images/wazuh-manager/config/create_user.py +++ b/build-docker-images/wazuh-manager/config/create_user.py @@ -8,7 +8,7 @@ import os # Set framework path sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") -USER_FILE_PATH = "/var/ossec/api/configuration/admin.json" +USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json" SPECIAL_CHARS = "@$!%*?&-_" diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 4e06e49e..b44406df 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -4,7 +4,7 @@ # Variables source /permanent_data.env -WAZUH_INSTALL_PATH=/var/ossec +WAZUH_INSTALL_PATH=/var/wazuh-manager WAZUH_CONFIG_MOUNT=/wazuh-config-mount ############################################################################## @@ -119,7 +119,7 @@ remove_data_files() { # Create certificates: Manager ############################################################################## -create_ossec_key_cert() { +create_wazuh_key_cert() { print "Creating wazuh-authd key and cert" exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096" exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/" @@ -129,9 +129,9 @@ create_ossec_key_cert() { # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect # destination files permissions # -# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at -# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will -# replace the ossec.conf file in /var/ossec/data/etc with yours. +# For example, to mount the file /var/wazuh-manager/data/etc/wazuh-manager.conf, mount it at +# $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf in your container and this code will +# replace the wazuh-manager.conf file in /var/wazuh-manager/data/etc with yours. ############################################################################## mount_files() { @@ -150,23 +150,23 @@ mount_files() { # container start. # # To use this: -# 1. Create your own ossec.conf file -# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name -# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf +# 1. Create your own wazuh-manager.conf file +# 2. In your wazuh-manager.conf file, set to_be_replaced_by_hostname as your node_name +# 3. Mount your custom wazuh-manager.conf file at $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf ############################################################################## set_custom_hostname() { - sed -i 's/to_be_replaced_by_hostname<\/node_name>/'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf + sed -i 's/to_be_replaced_by_hostname<\/node_name>/'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf } -function_configure_ossec_conf() { -OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf" +function_configure_wazuh_manager_conf() { +WAZUH_MANAGER_CONF="${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf" # -------------------------- -# Defaults based on OSSEC_CONF +# Defaults based on WAZUH_MANAGER_CONF # -------------------------- if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then - WAZUH_CLUSTER_KEY=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1) + WAZUH_CLUSTER_KEY=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/key>.*/\1/p' "$WAZUH_MANAGER_CONF" | head -n1) fi # Node type logic @@ -193,7 +193,7 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then echo " " } > "$TMP_HOSTS"; sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ - -e 'd }}' "$OSSEC_CONF"; + -e 'd }}' "$WAZUH_MANAGER_CONF"; rm -f "$TMP_HOSTS"; fi @@ -201,22 +201,22 @@ fi # -------------------------- # Cluster: node_name # -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_NAME|" "$OSSEC_CONF" +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_NAME|" "$WAZUH_MANAGER_CONF" # -------------------------- # Cluster: node_type # -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_TYPE|" "$OSSEC_CONF" +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_TYPE|" "$WAZUH_MANAGER_CONF" # -------------------------- # Cluster: key # -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$OSSEC_CONF" +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$WAZUH_MANAGER_CONF" # -------------------------- # Cluster: bind_addr # -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_BIND_ADDR|" "$OSSEC_CONF" +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_BIND_ADDR|" "$WAZUH_MANAGER_CONF" # -------------------------- # Cluster: nodes list @@ -231,7 +231,7 @@ if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then echo " " } > "$TMP_NODES"; sed -i -e '//,/<\/cluster>/{ //,/<\/nodes>/{ //r '"$TMP_NODES" \ - -e 'd }}' "$OSSEC_CONF"; + -e 'd }}' "$WAZUH_MANAGER_CONF"; rm -f "$TMP_NODES"; fi @@ -244,11 +244,11 @@ echo "Wazuh manager config modified successfully." ############################################################################## configure_permissions() { - chown -R wazuh:wazuh /var/ossec/queue/rids + chown -R wazuh-manager:wazuh-manager /var/wazuh-manager/queue/rids } ############################################################################## -# Change any ossec user/group to wazuh user/group +# Change any legacy user/group to wazuh-manager user/group ############################################################################## set_correct_permOwner() { @@ -262,7 +262,7 @@ set_correct_permOwner() { ############################################################################## main() { - # Mount permanent data (i.e. ossec.conf) + # Mount permanent data (i.e. wazuh-manager.conf) mount_permanent_data # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) @@ -271,7 +271,7 @@ main() { # Apply correct permission and ownership set_correct_permOwner - # Rename files stored in permanent data (i.e. queue/ossec) + # Rename files stored in permanent data (i.e. queue/wazuh-manager) move_data_files # Remove some files in permanent_data (i.e. .template.db) @@ -280,7 +280,7 @@ main() { # Create wazuh-authd key and cert if not present if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ] then - create_ossec_key_cert + create_wazuh_key_cert fi # Mount selected files (WAZUH_CONFIG_MOUNT) to container @@ -289,9 +289,8 @@ main() { # Allow setting custom hostname set_custom_hostname - # Configure ossec.conf based on environment variables - function_configure_ossec_conf - + # Configure wazuh-manager.conf based on environment variables + function_configure_wazuh_manager_conf # Delete temporary data folder rm -rf ${WAZUH_INSTALL_PATH}/data_tmp diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager index ebd08eb1..d8944a82 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager @@ -3,7 +3,7 @@ ############################################################################## # Migration sequence # Detect if there is a mounted volume on /wazuh-migration and copy the data -# to /var/ossec, finally it will create a flag ".migration-completed" inside +# to /var/wazuh-manager, finally it will create a flag ".migration-completed" inside # the mounted volume ############################################################################## @@ -35,34 +35,33 @@ function_wazuh_migration(){ return fi - \cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf - chown root:wazuh /var/ossec/etc/ossec.conf - chmod 640 /var/ossec/etc/ossec.conf + \cp -f /wazuh-migration/data/etc/wazuh-manager.conf /var/wazuh-manager/etc/wazuh-manager.conf + chown root:wazuh-manager /var/wazuh-manager/etc/wazuh-manager.conf + chmod 640 /var/wazuh-manager/etc/wazuh-manager.conf - \cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys - chown wazuh:wazuh /var/ossec/etc/client.keys - chmod 640 /var/ossec/etc/client.keys + \cp -f /wazuh-migration/data/etc/client.keys /var/wazuh-manager/etc/client.keys + chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/client.keys + chmod 640 /var/wazuh-manager/etc/client.keys - \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert - \cp -f /wazuh-migration/data/etc/sslmanager.key /var/ossec/etc/sslmanager.key - chown root:root /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key - chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key + \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.cert + \cp -f /wazuh-migration/data/etc/sslmanager.key /var/wazuh-manager/etc/sslmanager.key + chown root:root /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key + chmod 640 /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key - \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf - chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf - chmod 660 /var/ossec/etc/shared/default/agent.conf + \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/wazuh-manager/etc/shared/default/agent.conf + chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/shared/default/agent.conf + chmod 660 /var/wazuh-manager/etc/shared/default/agent.conf - \cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/ - chown wazuh:wazuh /var/ossec/etc/decoders/* - chmod 660 /var/ossec/etc/decoders/* + \cp -f /wazuh-migration/data/etc/decoders/* /var/wazuh-manager/etc/decoders/ + chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/decoders/* + chmod 660 /var/wazuh-manager/etc/decoders/* + \cp -f /wazuh-migration/data/etc/rules/* /var/wazuh-manager/etc/rules/ + chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/rules/* + chmod 660 /var/wazuh-manager/etc/rules/* - \cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/ - chown wazuh:wazuh /var/ossec/etc/rules/* - chmod 660 /var/ossec/etc/rules/* - - \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db - chown wazuh:wazuh /var/ossec/queue/db/global.db - chmod 640 /var/ossec/queue/db/global.db + \cp -f /wazuh-migration/global.db /var/wazuh-manager/queue/db/global.db + chown wazuh-manager:wazuh-manager /var/wazuh-manager/queue/db/global.db + chmod 640 /var/wazuh-manager/queue/db/global.db # mark volume as migrated touch /wazuh-migration/.migration-completed @@ -76,7 +75,7 @@ function_wazuh_migration(){ function_create_custom_user() { if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then - cat << EOF > /var/ossec/api/configuration/admin.json + cat << EOF > /var/wazuh-manager/api/configuration/admin.json { "username": "$API_USERNAME", "password": "$API_PASSWORD" @@ -84,9 +83,9 @@ function_create_custom_user() { EOF # create or customize API user - if /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/create_user.py; then + if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then # remove json if exit code is 0 - rm /var/ossec/api/configuration/admin.json + rm /var/wazuh-manager/api/configuration/admin.json else echored "There was an error configuring the API user" # terminate container to avoid unpredictable behavior @@ -109,8 +108,8 @@ function_entrypoint_scripts() { function_configure_vulnerability_detection() { if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - echo "$INDEXER_USERNAME" | /var/ossec/bin/wazuh-keystore -f indexer -k username - echo "$INDEXER_PASSWORD" | /var/ossec/bin/wazuh-keystore -f indexer -k password + echo "$INDEXER_USERNAME" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k username + echo "$INDEXER_PASSWORD" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k password fi } @@ -127,4 +126,4 @@ function_configure_vulnerability_detection function_entrypoint_scripts # Start Wazuh -/var/ossec/bin/wazuh-control start +/var/wazuh-manager/bin/wazuh-control start diff --git a/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run deleted file mode 100644 index e96cba8f..00000000 --- a/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh - -# dumping ossec.log to standard output -exec tail -F /var/ossec/logs/ossec.log diff --git a/build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run b/build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run new file mode 100644 index 00000000..bdecb254 --- /dev/null +++ b/build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run @@ -0,0 +1,4 @@ +#!/usr/bin/with-contenv sh + +# dumping wazuh-manager.log to standard output +exec tail -F /var/wazuh-manager/logs/wazuh-manager.log diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index ae0527a3..5b34c009 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -1,85 +1,41 @@ # Permanent data mounted in volumes i=0 -PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" -PERMANENT_DATA[((i++))]="/var/ossec/etc" -PERMANENT_DATA[((i++))]="/var/ossec/logs" -PERMANENT_DATA[((i++))]="/var/ossec/queue" -PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" -PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" -PERMANENT_DATA[((i++))]="/var/ossec/wodles" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/api/configuration" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups" +PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin" export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws_tools.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/wazuh_integration.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/aws_bucket.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/cloudtrail.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/config.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/guardduty.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/load_balancers.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/server_access.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/umbrella.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/vpcflow.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/waf.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/aws_service.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/cloudwatchlogs.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/inspector.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/s3_log_handler.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_processor.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/orm.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/utils.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_utils.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/__init__.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/analytics.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/graph.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/storage.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null" + export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 -PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" +PERMANENT_DATA_DEL[((i++))]="/var/wazuh-manager/queue/db/.template.db" export PERMANENT_DATA_DEL i=0 -PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" -PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" +PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/logs/ossec /var/wazuh-manager/logs/wazuh" +PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/queue/ossec /var/wazuh-manager/queue/sockets" export PERMANENT_DATA_MOVE diff --git a/build-docker-images/wazuh-manager/config/permanent_data.sh b/build-docker-images/wazuh-manager/config/permanent_data.sh index 89e5f8f3..858f799c 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.sh +++ b/build-docker-images/wazuh-manager/config/permanent_data.sh @@ -4,7 +4,7 @@ # Variables source /permanent_data.env -WAZUH_INSTALL_PATH=/var/ossec +WAZUH_INSTALL_PATH=/var/wazuh-manager DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp mkdir ${DATA_TMP_PATH} diff --git a/docs/README.md b/docs/README.md index 5753e69f..ca4852b9 100644 --- a/docs/README.md +++ b/docs/README.md @@ -60,7 +60,7 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit │   │   │   │   ├── 0-wazuh-init │   │   │   │   └── 2-manager │   │   │   └── services.d - │   │   │   └── ossec-logs + │   │   │   └── wazuh-manager-logs │   │   │   └── run │   │   ├── permanent_data.env │   │   └── permanent_data.sh diff --git a/docs/ref/configuration/configuration-files.md b/docs/ref/configuration/configuration-files.md index dbabf037..0f591f6d 100644 --- a/docs/ref/configuration/configuration-files.md +++ b/docs/ref/configuration/configuration-files.md @@ -2,8 +2,8 @@ ### 1. Wazuh Manager Configuration -* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more. - * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) . +* **`wazuh-manager.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more. + * **Customization**: Mount a custom `wazuh-manager.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/wazuh-manager` (e.g., the file `/var/wazuh-manager/etc/wazuh-manager.conf` must be mounted at `/wazuh-mount-point/etc/wazuh-manager.conf`) . ### 2. Wazuh Indexer Configuration diff --git a/docs/ref/configuration/configuration.md b/docs/ref/configuration/configuration.md index 636884d7..8d7d8cbd 100644 --- a/docs/ref/configuration/configuration.md +++ b/docs/ref/configuration/configuration.md @@ -11,7 +11,7 @@ Configuring Wazuh components within a Docker environment typically involves seve * These are often used for setting up initial passwords, component versions, cluster names, or basic operational parameters. 2. **[Configuration Files](configuration-files.md)**: - * Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `ossec.conf`, `opensearch.yml`, `opensearch_dashboards.yml`). + * Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `wazuh-manager.conf`, `opensearch.yml`, `opensearch_dashboards.yml`). * To customize these, you typically mount your custom configuration files into the containers, replacing or supplementing the defaults. This is managed using Docker volumes in your `docker-compose.yml`. 3. **Docker Compose File (`docker-compose.yml`)**: diff --git a/docs/ref/getting-started/deployment/multi-node.md b/docs/ref/getting-started/deployment/multi-node.md index 066627c7..34a956ac 100644 --- a/docs/ref/getting-started/deployment/multi-node.md +++ b/docs/ref/getting-started/deployment/multi-node.md @@ -38,9 +38,9 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines - name: wazuh3.indexer ip: wazuh3.indexer - # Wazuh server nodes + # Wazuh manager nodes # Use node_type only with more than one Wazuh manager - server: + manager: - name: wazuh.master ip: wazuh.master node_type: master diff --git a/docs/ref/getting-started/deployment/single-node.md b/docs/ref/getting-started/deployment/single-node.md index 42c9fcef..92d426f5 100644 --- a/docs/ref/getting-started/deployment/single-node.md +++ b/docs/ref/getting-started/deployment/single-node.md @@ -34,9 +34,9 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a - name: wazuh.indexer ip: wazuh.indexer - # Wazuh server nodes + # Wazuh manager nodes # Use node_type only with more than one Wazuh manager - server: + manager: - name: wazuh.manager ip: wazuh.manager diff --git a/docs/ref/glossary.md b/docs/ref/glossary.md index c716700b..c63c0e65 100644 --- a/docs/ref/glossary.md +++ b/docs/ref/glossary.md @@ -60,7 +60,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their **O** -- **`ossec.conf`**: The main configuration file for the Wazuh Manager and Wazuh Agent. +- **`ossec.conf`**: The main configuration file for the Wazuh Agent. **R** @@ -84,6 +84,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their - **Wazuh Dashboard**: See Dashboard. - **Wazuh Indexer**: See Indexer. - **Wazuh Manager**: See Manager. +- **`wazuh-manager.conf`**: The main configuration file for the Wazuh Manager. --- This glossary provides a starting point. For more detailed definitions or terms not listed here, please refer to the official Wazuh and Docker documentation. diff --git a/multi-node/Migration-to-Wazuh-4.4.md b/multi-node/Migration-to-Wazuh-4.4.md index aaa057f8..71f5b3c6 100644 --- a/multi-node/Migration-to-Wazuh-4.4.md +++ b/multi-node/Migration-to-Wazuh-4.4.md @@ -87,13 +87,6 @@ docker volume create \ multi-node_master-wazuh-active-response ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-wodles \ - multi-node_master-wazuh-wodles -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -150,13 +143,6 @@ docker volume create \ multi-node_worker-wazuh-active-response ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-wodles \ - multi-node_worker-wazuh-wodles -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -226,12 +212,6 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_ossec-wodles:/from \ - -v multi-node_master-wazuh-wodles:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker-etc:/from \ -v multi-node_master-etc:/to \ @@ -280,12 +260,6 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-wodles:/from \ - -v multi-node_worker-wazuh-wodles:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker_worker-etc:/from \ -v multi-node_worker-wazuh-etc:/to \ diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 2e69f4d0..1b2d972f 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -27,16 +27,15 @@ services: - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: - - master-wazuh-api-configuration:/var/ossec/api/configuration - - master-wazuh-etc:/var/ossec/etc - - master-wazuh-logs:/var/ossec/logs - - master-wazuh-queue:/var/ossec/queue - - master-wazuh-var-multigroups:/var/ossec/var/multigroups - - master-wazuh-active-response:/var/ossec/active-response/bin - - master-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem + - master-wazuh-api-configuration:/var/wazuh-manager/api/configuration + - master-wazuh-etc:/var/wazuh-manager/etc + - master-wazuh-logs:/var/wazuh-manager/logs + - master-wazuh-queue:/var/wazuh-manager/queue + - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups + - master-wazuh-active-response:/var/wazuh-manager/active-response/bin + - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/server.pem + - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/server-key.pem wazuh.worker: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker @@ -60,16 +59,15 @@ services: - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: - - worker-wazuh-api-configuration:/var/ossec/api/configuration - - worker-wazuh-etc:/var/ossec/etc - - worker-wazuh-logs:/var/ossec/logs - - worker-wazuh-queue:/var/ossec/queue - - worker-wazuh-var-multigroups:/var/ossec/var/multigroups - - worker-wazuh-active-response:/var/ossec/active-response/bin - - worker-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem - - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem + - worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration + - worker-wazuh-etc:/var/wazuh-manager/etc + - worker-wazuh-logs:/var/wazuh-manager/logs + - worker-wazuh-queue:/var/wazuh-manager/queue + - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups + - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin + - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/server.pem + - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/server-key.pem wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -218,14 +216,12 @@ volumes: master-wazuh-queue: master-wazuh-var-multigroups: master-wazuh-active-response: - master-wazuh-wodles: worker-wazuh-api-configuration: worker-wazuh-etc: worker-wazuh-logs: worker-wazuh-queue: worker-wazuh-var-multigroups: worker-wazuh-active-response: - worker-wazuh-wodles: wazuh-indexer-data-1: wazuh-indexer-data-2: wazuh-indexer-data-3: diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh index 196c81ed..757065c2 100755 --- a/multi-node/volume-migrator.sh +++ b/multi-node/volume-migrator.sh @@ -52,12 +52,6 @@ docker volume create \ --label com.docker.compose.volume=master-wazuh-active-response \ $2_master-wazuh-active-response -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-wodles \ - $2_master-wazuh-wodles - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ @@ -106,12 +100,6 @@ docker volume create \ --label com.docker.compose.volume=worker-wazuh-active-response \ $2_worker-wazuh-active-response -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-wodles \ - $2_worker-wazuh-wodles - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ @@ -174,11 +162,6 @@ docker container run --rm -it \ -v $2_master-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_ossec-wodles:/from \ - -v $2_master-wazuh-wodles:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker-etc:/from \ -v $2_master-wazuh-etc:/to \ @@ -219,11 +202,6 @@ docker container run --rm -it \ -v $2_worker-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-wodles:/from \ - -v $2_worker-wazuh-wodles:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker_worker-etc:/from \ -v $2_worker-wazuh-etc:/to \ diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 6c74802c..ae7334ca 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -27,16 +27,15 @@ services: - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: - - wazuh_api_configuration:/var/ossec/api/configuration - - wazuh_etc:/var/ossec/etc - - wazuh_logs:/var/ossec/logs - - wazuh_queue:/var/ossec/queue - - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem + - wazuh_api_configuration:/var/wazuh-manager/api/configuration + - wazuh_etc:/var/wazuh-manager/etc + - wazuh_logs:/var/wazuh-manager/logs + - wazuh_queue:/var/wazuh-manager/queue + - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups + - wazuh_active_response:/var/wazuh-manager/active-response/bin + - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/server.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/server-key.pem wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 @@ -109,7 +108,6 @@ volumes: wazuh_queue: wazuh_var_multigroups: wazuh_active_response: - wazuh_wodles: wazuh-indexer-data: wazuh-dashboard-config: wazuh-dashboard-custom: