yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #2220 from wazuh/enhancement/2206-adapt-image-build

Browse Source 
Separate Agent/Manager - Docker - Adapt image build process
This commit is contained in:
Victor Ereñú
2026-02-19 10:44:48 -03:00
committed by GitHub
parent 40c88305bc
commit 175faaed8d
26 changed files with 367 additions and 415 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env
-1
View File
@@ -1,4 +1,3 @@
WAZUH_VERSION=5.0.0 WAZUH_VERSION=5.0.0
WAZUH_IMAGE_VERSION=5.0.0 WAZUH_IMAGE_VERSION=5.0.0
WAZUH_REGISTRY=docker.io WAZUH_REGISTRY=docker.io
IMAGE_TAG=5.0.0
.github/.goss.yaml
+10 -10
View File
@@ -1,26 +1,26 @@
file: file:
/var/ossec/bin/wazuh-control: /var/wazuh-manager/bin/wazuh-control:
exists: true exists: true
mode: "0750" mode: "0750"
owner: root owner: root
group: root group: root
filetype: file filetype: file
contains: [] contains: []
/var/ossec/etc/ossec.conf: /var/wazuh-manager/etc/wazuh-manager.conf:
exists: true exists: true
mode: "0660" mode: "0660"
owner: root owner: root
group: wazuh group: wazuh-manager
filetype: file filetype: file
contains: [] contains: []
/var/ossec/etc/sslmanager.cert: /var/wazuh-manager/etc/sslmanager.cert:
exists: true exists: true
mode: "0644" mode: "0644"
owner: root owner: root
group: root group: root
filetype: file filetype: file
contains: [] contains: []
/var/ossec/etc/sslmanager.key: /var/wazuh-manager/etc/sslmanager.key:
exists: true exists: true
mode: "0600" mode: "0600"
owner: root owner: root
@@ -28,12 +28,12 @@ file:
filetype: file filetype: file
contains: [] contains: []
user: user:
wazuh: wazuh-manager:
exists: true exists: true
groups: groups:
- wazuh - wazuh-manager
home: /var/ossec home: /var/wazuh-manager
shell: /sbin/nologin shell: /sbin/nologin
group: group:
wazuh: wazuh-manager:
exists: true exists: true
.github/multi-node-log-check.sh
+7 -7
View File
@@ -1,16 +1,16 @@
log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "$log1" ]]; then if [[ -z "$log1" ]]; then
echo "No errors in master ossec.log" echo "No errors in master wazuh-manager.log"
else else
echo "Errors in master ossec.log:" echo "Errors in master wazuh-manager.log:"
echo "${log1}" echo "${log1}"
exit 1 exit 1
fi fi
log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "${log2}" ]]; then if [[ -z "${log2}" ]]; then
echo "No errors in worker ossec.log" echo "No errors in worker wazuh-manager.log"
else else
echo "Errors in worker ossec.log:" echo "Errors in worker wazuh-manager.log:"
echo "${log2}" echo "${log2}"
exit 1 exit 1
fi fi
.github/single-node-log-check.sh
+4 -4
View File
@@ -1,8 +1,8 @@
log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/wazuh-manager/logs/wazuh-manager.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "$log" ]]; then if [[ -z "$log" ]]; then
echo "No errors in ossec.log" echo "No errors in wazuh-manager.log"
else else
echo "Errors in ossec.log:" echo "Errors in wazuh-manager.log:"
echo "${log}" echo "${log}"
exit 1 exit 1
fi fi
.github/workflows/5_pr_check.yml
+204 -151
View File
@@ -46,7 +46,7 @@ jobs:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
env: env:
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
steps: steps:
- name: Check out code - name: Check out code
@@ -83,7 +83,7 @@ jobs:
env: env:
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin INDEXER_PASSWORD: admin
API_USERNAME: wazuh-wui API_USERNAME: wazuh-wui
@@ -128,9 +128,9 @@ jobs:
- name: wazuh.indexer - name: wazuh.indexer
ip: wazuh.indexer ip: wazuh.indexer
# Wazuh server nodes # Wazuh manager nodes
# Use node_type only with more than one Wazuh manager # Use node_type only with more than one Wazuh manager
server: manager:
- name: wazuh.manager - name: wazuh.manager
ip: wazuh.manager ip: wazuh.manager
@@ -159,98 +159,90 @@ jobs:
fi fi
- name: Start single node stack - name: Start single node stack
id: start_single_node_stack
run: docker compose up -d run: docker compose up -d
working-directory: ./single-node working-directory: ./single-node
- name: Check Wazuh indexer start - name: Check Wazuh indexer start
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: | run: |
for i in {1..20}; do for i in {1..20}; do
echo "Checking Wazuh indexer health (Attempt $i/20)" echo "Checking Wazuh indexer health (Attempt $i/20)"
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
if echo "$RESPONSE" | grep -qE "green|yellow"; then if echo "$RESPONSE" | grep -qE "green|yellow"; then
echo "Cluster Online" echo "Cluster Online"
echo "$RESPONSE" echo "$RESPONSE"
exit 0 exit 0
fi fi
echo "Waiting for cluster to be online" echo "Waiting for cluster to be online"
for CONTAINER_NAME in $INDEXER_CONTAINERS; do for CONTAINER_NAME in $INDEXER_CONTAINERS; do
echo "" echo ""
echo "=========================================================" echo "========================================================="
echo "Container logs for $CONTAINER_NAME" echo "Container logs for $CONTAINER_NAME"
echo "=========================================================" echo "========================================================="
docker logs --tail 30 "$CONTAINER_NAME" docker logs --tail 30 "$CONTAINER_NAME"
echo "---------------------------------------------------------" echo "---------------------------------------------------------"
done done
[ $i -lt 20 ] && sleep 60 [ $i -lt 20 ] && sleep 60
done done
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`"
if [[ $status_index_green -eq $status_index ]]; then if [[ $status_index_green -eq $status_index ]]; then
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
else else
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
exit 1 exit 1
fi fi
- name: Check Wazuh indexer nodes - name: Check Wazuh indexer nodes
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: | run: |
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
if [[ $nodes -eq 1 ]]; then
echo "Wazuh indexer nodes: ${nodes}" echo "Wazuh indexer nodes: ${nodes}"
else
echo "Wazuh indexer nodes: ${nodes}"
fi
- name: Check documents into wazuh-states index
run: |
for i in {1..20}; do
echo "Checking documents in wazuh-states (Attempt $i/20)..."
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
if [[ "$DOCS" -gt 0 ]]; then
echo "wazuh-states index has documents: ${DOCS}"
exit 0
fi
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
[ $i -lt 20 ] && sleep 60
done
echo "Error: No documents found in wazuh-states after 20 attempts."
echo "Last response: $RESPONSE"
exit 1
- name: Check Wazuh templates - name: Check Wazuh templates
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: | run: |
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
if [[ $qty_templates -gt 3 ]]; then if [[ $qty_templates -gt 3 ]]; then
echo "wazuh templates:" echo "wazuh templates:"
echo "${templates}" echo "${templates}"
else else
echo "wazuh templates:" echo "wazuh templates:"
echo "${templates}" echo "${templates}"
exit 1 exit 1
fi fi
- name: Check Wazuh manager start - name: Check Wazuh manager start
run: | if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: |
for NODE in "${{ env.MANAGER_NODES }}"; do for NODE in "${{ env.MANAGER_NODES }}"; do
ok=false
for i in {1..20}; do for i in {1..20}; do
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
if [[ $services -gt 9 ]]; then if [[ $services -gt 7 ]]; then
echo "Wazuh Manager $NODE Services: ${services}" echo "Wazuh Manager $NODE Services: ${services}"
echo "OK" echo "OK"
ok=true
break
else else
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
[ $i -lt 20 ] && sleep 30 [ $i -lt 20 ] && sleep 30
fi fi
done done
if [[ "$ok" != "true" ]]; then
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
exit 1
fi
done done
- name: Check Wazuh dashboard service URL - name: Check Wazuh dashboard service URL
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: | run: |
for i in {1..20}; do for i in {1..20}; do
echo "Checking Wazuh dashboard (Attempt $i/20)" echo "Checking Wazuh dashboard (Attempt $i/20)"
@@ -270,9 +262,11 @@ jobs:
exit 1 exit 1
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Edit Wazuh agent docker-compose file - name: Edit Wazuh agent docker-compose file
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
shell: bash shell: bash
env: env:
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
@@ -287,17 +281,21 @@ jobs:
fi fi
- name: Start Wazuh agent - name: Start Wazuh agent
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: docker compose up -d run: docker compose up -d
working-directory: ./wazuh-agent working-directory: ./wazuh-agent
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: | run: |
enrolled=false
for i in {1..5}; do for i in {1..5}; do
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
if [[ $agents -gt 1 ]]; then if [[ $agents -gt 1 ]]; then
echo "Wazuh agents: ${agents}" echo "Wazuh agents: ${agents}"
echo "OK" echo "OK"
enrolled=true
break break
else else
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
@@ -305,27 +303,51 @@ jobs:
[ $i -lt 5 ] && sleep 10 [ $i -lt 5 ] && sleep 10
fi fi
done done
if [[ "$enrolled" != "true" ]]; then
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
exit 1
fi
- name: Check errors in ossec.log for Wazuh manager - name: Check errors in wazuh-manager.log for Wazuh manager
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: ./.github/single-node-log-check.sh run: ./.github/single-node-log-check.sh
- name: Check documents into wazuh-states index
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
run: |
for i in {1..20}; do
echo "Checking documents in wazuh-states (Attempt $i/20)..."
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
if [[ "$DOCS" -gt 0 ]]; then
echo "wazuh-states index has documents: ${DOCS}"
exit 0
fi
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
[ $i -lt 20 ] && sleep 60
done
echo "Error: No documents found in wazuh-states after 20 attempts."
echo "Last response: $RESPONSE"
exit 1
- name: Docker logs - name: Docker logs
if: always() if: always()
continue-on-error: true
run: | run: |
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
for CONTAINER_NAME in $INDEXER_CONTAINERS; do for CONTAINER_NAME in $INDEXER_CONTAINERS; do
echo "" echo ""
echo "=========================================================" echo "========================================================="
echo "Container logs for $CONTAINER_NAME" echo "Container logs for $CONTAINER_NAME"
echo "=========================================================" echo "========================================================="
docker logs "$CONTAINER_NAME" docker logs "$CONTAINER_NAME"
echo "---------------------------------------------------------" echo "---------------------------------------------------------"
done done
working-directory: ./single-node working-directory: ./single-node
check-multi-node: check-multi-node:
name: Check multi node on ${{ matrix.os }} name: Check multi node on ${{ matrix.os }}
runs-on: ${{ matrix.os }} runs-on: ${{ matrix.os }}
strategy: strategy:
matrix: matrix:
os: [ubuntu-22.04, ubuntu-22.04-arm] os: [ubuntu-22.04, ubuntu-22.04-arm]
@@ -334,7 +356,7 @@ jobs:
env: env:
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin INDEXER_PASSWORD: admin
API_USERNAME: wazuh-wui API_USERNAME: wazuh-wui
@@ -383,9 +405,9 @@ jobs:
- name: wazuh3.indexer - name: wazuh3.indexer
ip: wazuh3.indexer ip: wazuh3.indexer
# Wazuh server nodes # Wazuh manager nodes
# Use node_type only with more than one Wazuh manager # Use node_type only with more than one Wazuh manager
server: manager:
- name: wazuh.master - name: wazuh.master
ip: wazuh.master ip: wazuh.master
node_type: master node_type: master
@@ -416,89 +438,85 @@ jobs:
fi fi
- name: Start multi node stack - name: Start multi node stack
id: start_multi_node_stack
run: docker compose up -d run: docker compose up -d
working-directory: ./multi-node working-directory: ./multi-node
- name: Check Wazuh indexer start - name: Check Wazuh indexer start
run: | if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
for i in {1..20}; do
echo "Checking Wazuh indexer health (Attempt $i/20)"
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
if echo "$RESPONSE" | grep -qE "green|yellow"; then
echo "Cluster Online"
echo "$RESPONSE"
exit 0
fi
echo "Waiting for cluster to be online"
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
echo ""
echo "========================================================="
echo "Container logs for $CONTAINER_NAME"
echo "========================================================="
docker logs --tail 30 "$CONTAINER_NAME"
echo "---------------------------------------------------------"
done
[ $i -lt 20 ] && sleep 60
done
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
if [[ $status_index_green -eq $status_index ]]; then
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
else
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
exit 1
fi
- name: Check Wazuh indexer nodes
run: |
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
if [[ $nodes -eq 3 ]]; then
echo "Wazuh indexer nodes: ${nodes}"
else
echo "Wazuh indexer nodes: ${nodes}"
fi
- name: Check documents into wazuh-states index
run: | run: |
for i in {1..20}; do for i in {1..20}; do
echo "Checking documents in wazuh-states (Attempt $i/20)..." echo "Checking Wazuh indexer health (Attempt $i/20)"
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
if [[ "$DOCS" -gt 0 ]]; then if echo "$RESPONSE" | grep -qE "green|yellow"; then
echo "wazuh-states index has documents: ${DOCS}" echo "Cluster Online"
echo "$RESPONSE"
exit 0 exit 0
fi fi
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" echo "Waiting for cluster to be online"
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
echo ""
echo "========================================================="
echo "Container logs for $CONTAINER_NAME"
echo "========================================================="
docker logs --tail 30 "$CONTAINER_NAME"
echo "---------------------------------------------------------"
done
[ $i -lt 20 ] && sleep 60 [ $i -lt 20 ] && sleep 60
done done
echo "Error: No documents found in wazuh-states after 20 attempts." status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
echo "Last response: $RESPONSE" status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
exit 1 if [[ $status_index_green -eq $status_index ]]; then
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
else
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
exit 1
fi
- name: Check Wazuh indexer nodes
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: |
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
if [[ $nodes -eq 3 ]]; then
echo "Wazuh indexer nodes: ${nodes}"
else
echo "Wazuh indexer nodes: ${nodes}"
exit 1
fi
- name: Check Wazuh templates - name: Check Wazuh templates
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: | run: |
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`"
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`"
if [[ $qty_templates -gt 3 ]]; then if [[ $qty_templates -gt 3 ]]; then
echo "wazuh templates:" echo "wazuh templates:"
echo "${templates}" echo "${templates}"
else else
echo "wazuh templates:" echo "wazuh templates:"
echo "${templates}" echo "${templates}"
exit 1 exit 1
fi fi
- name: Check Wazuh manager start - name: Check Wazuh manager start
run: | if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: |
IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}" IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}"
for NODE in "${NODES[@]}"; do for NODE in "${NODES[@]}"; do
if [[ "$NODE" == "master" ]]; then
THRESHOLD=8
else
THRESHOLD=7
fi
ok=false
for i in {1..20}; do for i in {1..20}; do
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
if [[ $services -gt 9 ]]; then if [[ $services -ge $THRESHOLD ]]; then
echo "Wazuh Manager $NODE Services: ${services}" echo "Wazuh Manager $NODE Services: ${services}"
echo "OK" echo "OK"
ok=true
break break
else else
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
@@ -506,9 +524,14 @@ jobs:
[ $i -lt 20 ] && sleep 30 [ $i -lt 20 ] && sleep 30
fi fi
done done
if [[ "$ok" != "true" ]]; then
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
exit 1
fi
done done
- name: Check Wazuh dashboard service URL - name: Check Wazuh dashboard service URL
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: | run: |
for i in {1..20}; do for i in {1..20}; do
echo "Checking Wazuh dashboard (Attempt $i/20)" echo "Checking Wazuh dashboard (Attempt $i/20)"
@@ -528,9 +551,11 @@ jobs:
exit 1 exit 1
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
- name: Edit Wazuh agent docker-compose file - name: Edit Wazuh agent docker-compose file
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
shell: bash shell: bash
env: env:
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
@@ -545,16 +570,20 @@ jobs:
fi fi
- name: Start Wazuh agent - name: Start Wazuh agent
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: docker compose -f wazuh-agent/docker-compose.yml up -d run: docker compose -f wazuh-agent/docker-compose.yml up -d
- name: Check Wazuh agent enrollment - name: Check Wazuh agent enrollment
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: | run: |
enrolled=false
for i in {1..5}; do for i in {1..5}; do
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true")
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
if [[ $agents -gt 1 ]]; then if [[ $agents -gt 1 ]]; then
echo "Wazuh agents: ${agents}" echo "Wazuh agents: ${agents}"
echo "OK" echo "OK"
enrolled=true
break break
else else
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
@@ -562,20 +591,44 @@ jobs:
[ $i -lt 5 ] && sleep 10 [ $i -lt 5 ] && sleep 10
fi fi
done done
if [[ "$enrolled" != "true" ]]; then
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
exit 1
fi
- name: Check errors in ossec.log for Wazuh manager - name: Check errors in wazuh-manager.log for Wazuh manager
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: ./.github/multi-node-log-check.sh run: ./.github/multi-node-log-check.sh
- name: Check documents into wazuh-states index
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
run: |
for i in {1..20}; do
echo "Checking documents in wazuh-states (Attempt $i/20)..."
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
if [[ "$DOCS" -gt 0 ]]; then
echo "wazuh-states index has documents: ${DOCS}"
exit 0
fi
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
[ $i -lt 20 ] && sleep 60
done
echo "Error: No documents found in wazuh-states after 20 attempts."
echo "Last response: $RESPONSE"
exit 1
- name: Docker logs - name: Docker logs
if: always() if: always()
continue-on-error: true
run: | run: |
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
for CONTAINER_NAME in $INDEXER_CONTAINERS; do for CONTAINER_NAME in $INDEXER_CONTAINERS; do
echo "" echo ""
echo "=========================================================" echo "========================================================="
echo "Container logs for $CONTAINER_NAME" echo "Container logs for $CONTAINER_NAME"
echo "=========================================================" echo "========================================================="
docker logs "$CONTAINER_NAME" docker logs "$CONTAINER_NAME"
echo "---------------------------------------------------------" echo "---------------------------------------------------------"
done done
working-directory: ./single-node working-directory: ./multi-node
CHANGELOG.md
+2
View File
@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file.
### Changed ### Changed
- Move index documents test ([#2221](https://github.com/wazuh/wazuh-docker/pull/2221))
- Separate Agent/Manager - Docker - Adapt image build process ([#2220](https://github.com/wazuh/wazuh-docker/pull/2220))
- Remove revision input ([#2217](https://github.com/wazuh/wazuh-docker/pull/2217)) - Remove revision input ([#2217](https://github.com/wazuh/wazuh-docker/pull/2217))
- Improve build script and workflow component revisions handling ([#2212](https://github.com/wazuh/wazuh-docker/pull/2212)) - Improve build script and workflow component revisions handling ([#2212](https://github.com/wazuh/wazuh-docker/pull/2212))
- Add missing documentation sections in the repository ([#2215](https://github.com/wazuh/wazuh-docker/pull/2215)) - Add missing documentation sections in the repository ([#2215](https://github.com/wazuh/wazuh-docker/pull/2215))
README.md
+1 -1
View File
@@ -5,7 +5,7 @@
## Description ## Description
The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh server, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search. The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cybersecurity platform using Docker containers. This setup enables easy installation and orchestration of the full Wazuh stack, including the Wazuh manager, dashboard (based on OpenSearch Dashboards), and OpenSearch for indexing and search.
## Capabilities ## Capabilities
build-docker-images/build-images.yml
+6 -8
View File
@@ -22,13 +22,12 @@ services:
- INDEXER_USERNAME=admin - INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin - INDEXER_PASSWORD=admin
volumes: volumes:
- wazuh_api_configuration:/var/ossec/api/configuration - wazuh_api_configuration:/var/wazuh-manager/api/configuration
- wazuh_etc:/var/ossec/etc - wazuh_etc:/var/wazuh-manager/etc
- wazuh_logs:/var/ossec/logs - wazuh_logs:/var/wazuh-manager/logs
- wazuh_queue:/var/ossec/queue - wazuh_queue:/var/wazuh-manager/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
- wazuh_active_response:/var/ossec/active-response/bin - wazuh_active_response:/var/wazuh-manager/active-response/bin
- wazuh_wodles:/var/ossec/wodles
wazuh.agent: wazuh.agent:
build: build:
@@ -97,5 +96,4 @@ volumes:
wazuh_queue: wazuh_queue:
wazuh_var_multigroups: wazuh_var_multigroups:
wazuh_active_response: wazuh_active_response:
wazuh_wodles:
build-docker-images/wazuh-manager/Dockerfile
+9 -10
View File
@@ -24,12 +24,11 @@ RUN URL_VAR="wazuh_manager_${TARGETARCH}_rpm" && \
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \
rm -f /var/ossec/etc/sslmanager.key && \ rm -f /var/wazuh-manager/etc/sslmanager.key && \
rm -f /var/ossec/etc/sslmanager.cert rm -f /var/wazuh-manager/etc/sslmanager.cert
COPY config/etc/ /etc/ COPY config/etc/ /etc/
COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py
# Prepare permanent data # Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547 # Sync calls are due to https://github.com/docker/docker/issues/9547
@@ -37,12 +36,12 @@ COPY config/permanent_data.env config/permanent_data.sh /
#Make mount directories for keep permissions #Make mount directories for keep permissions
RUN mkdir -p /var/ossec/var/multigroups && \ RUN mkdir -p /var/wazuh-manager/var/multigroups && \
chown root:wazuh /var/ossec/var/multigroups && \ chown root:wazuh-manager /var/wazuh-manager/var/multigroups && \
chmod 770 /var/ossec/var/multigroups && \ chmod 770 /var/wazuh-manager/var/multigroups && \
mkdir -p /var/ossec/active-response/bin && \ mkdir -p /var/wazuh-manager/active-response/bin && \
chown root:wazuh /var/ossec/active-response/bin && \ chown root:wazuh-manager /var/wazuh-manager/active-response/bin && \
chmod 770 /var/ossec/active-response/bin && \ chmod 770 /var/wazuh-manager/active-response/bin && \
chmod 755 /permanent_data.sh && \ chmod 755 /permanent_data.sh && \
sync && /permanent_data.sh && \ sync && /permanent_data.sh && \
sync && rm /permanent_data.sh sync && rm /permanent_data.sh
build-docker-images/wazuh-manager/config/create_user.py
+1 -1
View File
@@ -8,7 +8,7 @@ import os
# Set framework path # Set framework path
sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
USER_FILE_PATH = "/var/ossec/api/configuration/admin.json" USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json"
SPECIAL_CHARS = "@$!%*?&-_" SPECIAL_CHARS = "@$!%*?&-_"
build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+26 -27
View File
@@ -4,7 +4,7 @@
# Variables # Variables
source /permanent_data.env source /permanent_data.env
WAZUH_INSTALL_PATH=/var/ossec WAZUH_INSTALL_PATH=/var/wazuh-manager
WAZUH_CONFIG_MOUNT=/wazuh-config-mount WAZUH_CONFIG_MOUNT=/wazuh-config-mount
############################################################################## ##############################################################################
@@ -119,7 +119,7 @@ remove_data_files() {
# Create certificates: Manager # Create certificates: Manager
############################################################################## ##############################################################################
create_ossec_key_cert() { create_wazuh_key_cert() {
print "Creating wazuh-authd key and cert" print "Creating wazuh-authd key and cert"
exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096" exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/" exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
@@ -129,9 +129,9 @@ create_ossec_key_cert() {
# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
# destination files permissions # destination files permissions
# #
# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at # For example, to mount the file /var/wazuh-manager/data/etc/wazuh-manager.conf, mount it at
# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will # $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf in your container and this code will
# replace the ossec.conf file in /var/ossec/data/etc with yours. # replace the wazuh-manager.conf file in /var/wazuh-manager/data/etc with yours.
############################################################################## ##############################################################################
mount_files() { mount_files() {
@@ -150,23 +150,23 @@ mount_files() {
# container start. # container start.
# #
# To use this: # To use this:
# 1. Create your own ossec.conf file # 1. Create your own wazuh-manager.conf file
# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name # 2. In your wazuh-manager.conf file, set to_be_replaced_by_hostname as your node_name
# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf # 3. Mount your custom wazuh-manager.conf file at $WAZUH_CONFIG_MOUNT/etc/wazuh-manager.conf
############################################################################## ##############################################################################
set_custom_hostname() { set_custom_hostname() {
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf
} }
function_configure_ossec_conf() { function_configure_wazuh_manager_conf() {
OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf" WAZUH_MANAGER_CONF="${WAZUH_INSTALL_PATH}/etc/wazuh-manager.conf"
# -------------------------- # --------------------------
# Defaults based on OSSEC_CONF # Defaults based on WAZUH_MANAGER_CONF
# -------------------------- # --------------------------
if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then
WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1) WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$WAZUH_MANAGER_CONF" | head -n1)
fi fi
# Node type logic # Node type logic
@@ -193,7 +193,7 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
echo " </hosts>" echo " </hosts>"
} > "$TMP_HOSTS"; } > "$TMP_HOSTS";
sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \ sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
-e 'd }}' "$OSSEC_CONF"; -e 'd }}' "$WAZUH_MANAGER_CONF";
rm -f "$TMP_HOSTS"; rm -f "$TMP_HOSTS";
fi fi
@@ -201,22 +201,22 @@ fi
# -------------------------- # --------------------------
# Cluster: node_name # Cluster: node_name
# -------------------------- # --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$OSSEC_CONF" sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$WAZUH_MANAGER_CONF"
# -------------------------- # --------------------------
# Cluster: node_type # Cluster: node_type
# -------------------------- # --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$OSSEC_CONF" sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$WAZUH_MANAGER_CONF"
# -------------------------- # --------------------------
# Cluster: key # Cluster: key
# -------------------------- # --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$OSSEC_CONF" sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$WAZUH_MANAGER_CONF"
# -------------------------- # --------------------------
# Cluster: bind_addr # Cluster: bind_addr
# -------------------------- # --------------------------
sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$OSSEC_CONF" sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$WAZUH_MANAGER_CONF"
# -------------------------- # --------------------------
# Cluster: nodes list # Cluster: nodes list
@@ -231,7 +231,7 @@ if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then
echo " </nodes>" echo " </nodes>"
} > "$TMP_NODES"; } > "$TMP_NODES";
sed -i -e '/<cluster>/,/<\/cluster>/{ /<nodes>/,/<\/nodes>/{ /<nodes>/r '"$TMP_NODES" \ sed -i -e '/<cluster>/,/<\/cluster>/{ /<nodes>/,/<\/nodes>/{ /<nodes>/r '"$TMP_NODES" \
-e 'd }}' "$OSSEC_CONF"; -e 'd }}' "$WAZUH_MANAGER_CONF";
rm -f "$TMP_NODES"; rm -f "$TMP_NODES";
fi fi
@@ -244,11 +244,11 @@ echo "Wazuh manager config modified successfully."
############################################################################## ##############################################################################
configure_permissions() { configure_permissions() {
chown -R wazuh:wazuh /var/ossec/queue/rids chown -R wazuh-manager:wazuh-manager /var/wazuh-manager/queue/rids
} }
############################################################################## ##############################################################################
# Change any ossec user/group to wazuh user/group # Change any legacy user/group to wazuh-manager user/group
############################################################################## ##############################################################################
set_correct_permOwner() { set_correct_permOwner() {
@@ -262,7 +262,7 @@ set_correct_permOwner() {
############################################################################## ##############################################################################
main() { main() {
# Mount permanent data (i.e. ossec.conf) # Mount permanent data (i.e. wazuh-manager.conf)
mount_permanent_data mount_permanent_data
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
@@ -271,7 +271,7 @@ main() {
# Apply correct permission and ownership # Apply correct permission and ownership
set_correct_permOwner set_correct_permOwner
# Rename files stored in permanent data (i.e. queue/ossec) # Rename files stored in permanent data (i.e. queue/wazuh-manager)
move_data_files move_data_files
# Remove some files in permanent_data (i.e. .template.db) # Remove some files in permanent_data (i.e. .template.db)
@@ -280,7 +280,7 @@ main() {
# Create wazuh-authd key and cert if not present # Create wazuh-authd key and cert if not present
if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ] if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
then then
create_ossec_key_cert create_wazuh_key_cert
fi fi
# Mount selected files (WAZUH_CONFIG_MOUNT) to container # Mount selected files (WAZUH_CONFIG_MOUNT) to container
@@ -289,9 +289,8 @@ main() {
# Allow setting custom hostname # Allow setting custom hostname
set_custom_hostname set_custom_hostname
# Configure ossec.conf based on environment variables # Configure wazuh-manager.conf based on environment variables
function_configure_ossec_conf function_configure_wazuh_manager_conf
# Delete temporary data folder # Delete temporary data folder
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
+29 -30
View File
@@ -3,7 +3,7 @@
############################################################################## ##############################################################################
# Migration sequence # Migration sequence
# Detect if there is a mounted volume on /wazuh-migration and copy the data # Detect if there is a mounted volume on /wazuh-migration and copy the data
# to /var/ossec, finally it will create a flag ".migration-completed" inside # to /var/wazuh-manager, finally it will create a flag ".migration-completed" inside
# the mounted volume # the mounted volume
############################################################################## ##############################################################################
@@ -35,34 +35,33 @@ function_wazuh_migration(){
return return
fi fi
\cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf \cp -f /wazuh-migration/data/etc/wazuh-manager.conf /var/wazuh-manager/etc/wazuh-manager.conf
chown root:wazuh /var/ossec/etc/ossec.conf chown root:wazuh-manager /var/wazuh-manager/etc/wazuh-manager.conf
chmod 640 /var/ossec/etc/ossec.conf chmod 640 /var/wazuh-manager/etc/wazuh-manager.conf
\cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys \cp -f /wazuh-migration/data/etc/client.keys /var/wazuh-manager/etc/client.keys
chown wazuh:wazuh /var/ossec/etc/client.keys chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/client.keys
chmod 640 /var/ossec/etc/client.keys chmod 640 /var/wazuh-manager/etc/client.keys
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.cert
\cp -f /wazuh-migration/data/etc/sslmanager.key /var/ossec/etc/sslmanager.key \cp -f /wazuh-migration/data/etc/sslmanager.key /var/wazuh-manager/etc/sslmanager.key
chown root:root /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key chown root:root /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key chmod 640 /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/wazuh-manager/etc/shared/default/agent.conf
chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/shared/default/agent.conf
chmod 660 /var/ossec/etc/shared/default/agent.conf chmod 660 /var/wazuh-manager/etc/shared/default/agent.conf
\cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/ \cp -f /wazuh-migration/data/etc/decoders/* /var/wazuh-manager/etc/decoders/
chown wazuh:wazuh /var/ossec/etc/decoders/* chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/decoders/*
chmod 660 /var/ossec/etc/decoders/* chmod 660 /var/wazuh-manager/etc/decoders/*
\cp -f /wazuh-migration/data/etc/rules/* /var/wazuh-manager/etc/rules/
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/rules/*
chmod 660 /var/wazuh-manager/etc/rules/*
\cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/ \cp -f /wazuh-migration/global.db /var/wazuh-manager/queue/db/global.db
chown wazuh:wazuh /var/ossec/etc/rules/* chown wazuh-manager:wazuh-manager /var/wazuh-manager/queue/db/global.db
chmod 660 /var/ossec/etc/rules/* chmod 640 /var/wazuh-manager/queue/db/global.db
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
chown wazuh:wazuh /var/ossec/queue/db/global.db
chmod 640 /var/ossec/queue/db/global.db
# mark volume as migrated # mark volume as migrated
touch /wazuh-migration/.migration-completed touch /wazuh-migration/.migration-completed
@@ -76,7 +75,7 @@ function_wazuh_migration(){
function_create_custom_user() { function_create_custom_user() {
if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
cat << EOF > /var/ossec/api/configuration/admin.json cat << EOF > /var/wazuh-manager/api/configuration/admin.json
{ {
"username": "$API_USERNAME", "username": "$API_USERNAME",
"password": "$API_PASSWORD" "password": "$API_PASSWORD"
@@ -84,9 +83,9 @@ function_create_custom_user() {
EOF EOF
# create or customize API user # create or customize API user
if /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/create_user.py; then if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then
# remove json if exit code is 0 # remove json if exit code is 0
rm /var/ossec/api/configuration/admin.json rm /var/wazuh-manager/api/configuration/admin.json
else else
echored "There was an error configuring the API user" echored "There was an error configuring the API user"
# terminate container to avoid unpredictable behavior # terminate container to avoid unpredictable behavior
@@ -109,8 +108,8 @@ function_entrypoint_scripts() {
function_configure_vulnerability_detection() { function_configure_vulnerability_detection() {
if [ "$INDEXER_PASSWORD" != "" ]; then if [ "$INDEXER_PASSWORD" != "" ]; then
>&2 echo "Configuring password." >&2 echo "Configuring password."
echo "$INDEXER_USERNAME" | /var/ossec/bin/wazuh-keystore -f indexer -k username echo "$INDEXER_USERNAME" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k username
echo "$INDEXER_PASSWORD" | /var/ossec/bin/wazuh-keystore -f indexer -k password echo "$INDEXER_PASSWORD" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k password
fi fi
} }
@@ -127,4 +126,4 @@ function_configure_vulnerability_detection
function_entrypoint_scripts function_entrypoint_scripts
# Start Wazuh # Start Wazuh
/var/ossec/bin/wazuh-control start /var/wazuh-manager/bin/wazuh-control start
build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run
-4
View File
@@ -1,4 +0,0 @@
#!/usr/bin/with-contenv sh
# dumping ossec.log to standard output
exec tail -F /var/ossec/logs/ossec.log
build-docker-images/wazuh-manager/config/etc/services.d/wazuh-manager-logs/run
+4
View File
@@ -0,0 +1,4 @@
#!/usr/bin/with-contenv sh
# dumping wazuh-manager.log to standard output
exec tail -F /var/wazuh-manager/logs/wazuh-manager.log
build-docker-images/wazuh-manager/config/permanent_data.env
+26 -70
View File
@@ -1,85 +1,41 @@
# Permanent data mounted in volumes # Permanent data mounted in volumes
i=0 i=0
PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/wazuh-manager/api/configuration"
PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/wazuh-manager/etc"
PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/wazuh-manager/logs"
PERMANENT_DATA[((i++))]="/var/ossec/queue" PERMANENT_DATA[((i++))]="/var/wazuh-manager/queue"
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/wazuh-manager/var/multigroups"
PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" PERMANENT_DATA[((i++))]="/var/wazuh-manager/active-response/bin"
PERMANENT_DATA[((i++))]="/var/ossec/wodles"
export PERMANENT_DATA export PERMANENT_DATA
# Files mounted in a volume that should not be permanent # Files mounted in a volume that should not be permanent
i=0 i=0
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/etc/internal_options.conf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/default-firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/disable-account"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewalld-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/host-deny"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ip-customblock"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/ipfw"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/kaspersky"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/npf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/wazuh-slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/pf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart-wazuh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/restart.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" PERMANENT_DATA_EXCP[((i++))]="/var/wazuh-manager/active-response/bin/route-null"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws_tools.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/wazuh_integration.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/aws_bucket.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/cloudtrail.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/config.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/guardduty.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/load_balancers.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/server_access.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/umbrella.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/vpcflow.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/buckets_s3/waf.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/aws_service.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/cloudwatchlogs.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/services/inspector.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/s3_log_handler.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_processor.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/orm.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/db/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/__init__.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/analytics.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/graph.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure_services/storage.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
export PERMANENT_DATA_EXCP export PERMANENT_DATA_EXCP
# Files mounted in a volume that should be deleted # Files mounted in a volume that should be deleted
i=0 i=0
PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" PERMANENT_DATA_DEL[((i++))]="/var/wazuh-manager/queue/db/.template.db"
export PERMANENT_DATA_DEL export PERMANENT_DATA_DEL
i=0 i=0
PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/logs/ossec /var/wazuh-manager/logs/wazuh"
PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" PERMANENT_DATA_MOVE[((i++))]="/var/wazuh-manager/queue/ossec /var/wazuh-manager/queue/sockets"
export PERMANENT_DATA_MOVE export PERMANENT_DATA_MOVE
build-docker-images/wazuh-manager/config/permanent_data.sh
+1 -1
View File
@@ -4,7 +4,7 @@
# Variables # Variables
source /permanent_data.env source /permanent_data.env
WAZUH_INSTALL_PATH=/var/ossec WAZUH_INSTALL_PATH=/var/wazuh-manager
DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp
mkdir ${DATA_TMP_PATH} mkdir ${DATA_TMP_PATH}
docs/README.md
+1 -1
View File
@@ -60,7 +60,7 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit
│   │   │   │   ├── 0-wazuh-init │   │   │   │   ├── 0-wazuh-init
│   │   │   │   └── 2-manager │   │   │   │   └── 2-manager
│   │   │   └── services.d │   │   │   └── services.d
│   │   │   └── ossec-logs │   │   │   └── wazuh-manager-logs
│   │   │   └── run │   │   │   └── run
│   │   ├── permanent_data.env │   │   ├── permanent_data.env
│   │   └── permanent_data.sh │   │   └── permanent_data.sh
docs/ref/configuration/configuration-files.md
+2 -2
View File
@@ -2,8 +2,8 @@
### 1. Wazuh Manager Configuration ### 1. Wazuh Manager Configuration
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more. * **`wazuh-manager.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
* **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) . * **Customization**: Mount a custom `wazuh-manager.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/wazuh-manager` (e.g., the file `/var/wazuh-manager/etc/wazuh-manager.conf` must be mounted at `/wazuh-mount-point/etc/wazuh-manager.conf`) .
### 2. Wazuh Indexer Configuration ### 2. Wazuh Indexer Configuration
docs/ref/configuration/configuration.md
+1 -1
View File
@@ -11,7 +11,7 @@ Configuring Wazuh components within a Docker environment typically involves seve
* These are often used for setting up initial passwords, component versions, cluster names, or basic operational parameters. * These are often used for setting up initial passwords, component versions, cluster names, or basic operational parameters.
2. **[Configuration Files](configuration-files.md)**: 2. **[Configuration Files](configuration-files.md)**:
* Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `ossec.conf`, `opensearch.yml`, `opensearch_dashboards.yml`). * Core Wazuh components (manager, indexer, dashboard) rely on their traditional configuration files (e.g., `wazuh-manager.conf`, `opensearch.yml`, `opensearch_dashboards.yml`).
* To customize these, you typically mount your custom configuration files into the containers, replacing or supplementing the defaults. This is managed using Docker volumes in your `docker-compose.yml`. * To customize these, you typically mount your custom configuration files into the containers, replacing or supplementing the defaults. This is managed using Docker volumes in your `docker-compose.yml`.
3. **Docker Compose File (`docker-compose.yml`)**: 3. **Docker Compose File (`docker-compose.yml`)**:
docs/ref/getting-started/deployment/multi-node.md
+2 -2
View File
@@ -38,9 +38,9 @@ This deployment utilizes the `multi-node/docker-compose.yml` file, which defines
- name: wazuh3.indexer - name: wazuh3.indexer
ip: wazuh3.indexer ip: wazuh3.indexer
# Wazuh server nodes # Wazuh manager nodes
# Use node_type only with more than one Wazuh manager # Use node_type only with more than one Wazuh manager
server: manager:
- name: wazuh.master - name: wazuh.master
ip: wazuh.master ip: wazuh.master
node_type: master node_type: master
docs/ref/getting-started/deployment/single-node.md
+2 -2
View File
@@ -34,9 +34,9 @@ This deployment uses the `single-node/docker-compose.yml` file, which defines a
- name: wazuh.indexer - name: wazuh.indexer
ip: wazuh.indexer ip: wazuh.indexer
# Wazuh server nodes # Wazuh manager nodes
# Use node_type only with more than one Wazuh manager # Use node_type only with more than one Wazuh manager
server: manager:
- name: wazuh.manager - name: wazuh.manager
ip: wazuh.manager ip: wazuh.manager
docs/ref/glossary.md
+2 -1
View File
@@ -60,7 +60,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
**O** **O**
- **`ossec.conf`**: The main configuration file for the Wazuh Manager and Wazuh Agent. - **`ossec.conf`**: The main configuration file for the Wazuh Agent.
**R** **R**
@@ -84,6 +84,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
- **Wazuh Dashboard**: See Dashboard. - **Wazuh Dashboard**: See Dashboard.
- **Wazuh Indexer**: See Indexer. - **Wazuh Indexer**: See Indexer.
- **Wazuh Manager**: See Manager. - **Wazuh Manager**: See Manager.
- **`wazuh-manager.conf`**: The main configuration file for the Wazuh Manager.
--- ---
This glossary provides a starting point. For more detailed definitions or terms not listed here, please refer to the official Wazuh and Docker documentation. This glossary provides a starting point. For more detailed definitions or terms not listed here, please refer to the official Wazuh and Docker documentation.
multi-node/Migration-to-Wazuh-4.4.md
-26
View File
@@ -87,13 +87,6 @@ docker volume create \
multi-node_master-wazuh-active-response multi-node_master-wazuh-active-response
``` ```
``` ```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-wodles \
multi-node_master-wazuh-wodles
```
```
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
@@ -150,13 +143,6 @@ docker volume create \
multi-node_worker-wazuh-active-response multi-node_worker-wazuh-active-response
``` ```
``` ```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-wodles \
multi-node_worker-wazuh-wodles
```
```
docker volume create \ docker volume create \
--label com.docker.compose.project=multi-node \ --label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \ --label com.docker.compose.version=1.25.0 \
@@ -226,12 +212,6 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
``` ```
docker container run --rm -it \
-v wazuh-docker_ossec-wodles:/from \
-v multi-node_master-wazuh-wodles:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker-etc:/from \ -v wazuh-docker-etc:/from \
-v multi-node_master-etc:/to \ -v multi-node_master-etc:/to \
@@ -280,12 +260,6 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
``` ```
``` ```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-wodles:/from \
-v multi-node_worker-wazuh-wodles:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-etc:/from \ -v wazuh-docker_worker-etc:/from \
-v multi-node_worker-wazuh-etc:/to \ -v multi-node_worker-wazuh-etc:/to \
multi-node/docker-compose.yml
+18 -22
View File
@@ -27,16 +27,15 @@ services:
- API_USERNAME=wazuh-wui - API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*- - API_PASSWORD=MyS3cr37P450r.*-
volumes: volumes:
- master-wazuh-api-configuration:/var/ossec/api/configuration - master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- master-wazuh-etc:/var/ossec/etc - master-wazuh-etc:/var/wazuh-manager/etc
- master-wazuh-logs:/var/ossec/logs - master-wazuh-logs:/var/wazuh-manager/logs
- master-wazuh-queue:/var/ossec/queue - master-wazuh-queue:/var/wazuh-manager/queue
- master-wazuh-var-multigroups:/var/ossec/var/multigroups - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-active-response:/var/wazuh-manager/active-response/bin
- master-wazuh-wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.master.pem:/var/wazuh-manager/etc/certs/server.pem
- ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
- ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem
wazuh.worker: wazuh.worker:
image: wazuh/wazuh-manager:5.0.0 image: wazuh/wazuh-manager:5.0.0
hostname: wazuh.worker hostname: wazuh.worker
@@ -60,16 +59,15 @@ services:
- API_USERNAME=wazuh-wui - API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*- - API_PASSWORD=MyS3cr37P450r.*-
volumes: volumes:
- worker-wazuh-api-configuration:/var/ossec/api/configuration - worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- worker-wazuh-etc:/var/ossec/etc - worker-wazuh-etc:/var/wazuh-manager/etc
- worker-wazuh-logs:/var/ossec/logs - worker-wazuh-logs:/var/wazuh-manager/logs
- worker-wazuh-queue:/var/ossec/queue - worker-wazuh-queue:/var/wazuh-manager/queue
- worker-wazuh-var-multigroups:/var/ossec/var/multigroups - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-active-response:/var/wazuh-manager/active-response/bin
- worker-wazuh-wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.worker.pem:/var/wazuh-manager/etc/certs/server.pem
- ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
- ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem
wazuh1.indexer: wazuh1.indexer:
image: wazuh/wazuh-indexer:5.0.0 image: wazuh/wazuh-indexer:5.0.0
@@ -218,14 +216,12 @@ volumes:
master-wazuh-queue: master-wazuh-queue:
master-wazuh-var-multigroups: master-wazuh-var-multigroups:
master-wazuh-active-response: master-wazuh-active-response:
master-wazuh-wodles:
worker-wazuh-api-configuration: worker-wazuh-api-configuration:
worker-wazuh-etc: worker-wazuh-etc:
worker-wazuh-logs: worker-wazuh-logs:
worker-wazuh-queue: worker-wazuh-queue:
worker-wazuh-var-multigroups: worker-wazuh-var-multigroups:
worker-wazuh-active-response: worker-wazuh-active-response:
worker-wazuh-wodles:
wazuh-indexer-data-1: wazuh-indexer-data-1:
wazuh-indexer-data-2: wazuh-indexer-data-2:
wazuh-indexer-data-3: wazuh-indexer-data-3:
multi-node/volume-migrator.sh
-22
View File
@@ -52,12 +52,6 @@ docker volume create \
--label com.docker.compose.volume=master-wazuh-active-response \ --label com.docker.compose.volume=master-wazuh-active-response \
$2_master-wazuh-active-response $2_master-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-wodles \
$2_master-wazuh-wodles
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
@@ -106,12 +100,6 @@ docker volume create \
--label com.docker.compose.volume=worker-wazuh-active-response \ --label com.docker.compose.volume=worker-wazuh-active-response \
$2_worker-wazuh-active-response $2_worker-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-wodles \
$2_worker-wazuh-wodles
docker volume create \ docker volume create \
--label com.docker.compose.project=$2 \ --label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \ --label com.docker.compose.version=$1 \
@@ -174,11 +162,6 @@ docker container run --rm -it \
-v $2_master-wazuh-active-response:/to \ -v $2_master-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-wodles:/from \
-v $2_master-wazuh-wodles:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker-etc:/from \ -v wazuh-docker-etc:/from \
-v $2_master-wazuh-etc:/to \ -v $2_master-wazuh-etc:/to \
@@ -219,11 +202,6 @@ docker container run --rm -it \
-v $2_worker-wazuh-active-response:/to \ -v $2_worker-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to" alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-wodles:/from \
-v $2_worker-wazuh-wodles:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \ docker container run --rm -it \
-v wazuh-docker_worker-etc:/from \ -v wazuh-docker_worker-etc:/from \
-v $2_worker-wazuh-etc:/to \ -v $2_worker-wazuh-etc:/to \
single-node/docker-compose.yml
+9 -11
View File
@@ -27,16 +27,15 @@ services:
- API_USERNAME=wazuh-wui - API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*- - API_PASSWORD=MyS3cr37P450r.*-
volumes: volumes:
- wazuh_api_configuration:/var/ossec/api/configuration - wazuh_api_configuration:/var/wazuh-manager/api/configuration
- wazuh_etc:/var/ossec/etc - wazuh_etc:/var/wazuh-manager/etc
- wazuh_logs:/var/ossec/logs - wazuh_logs:/var/wazuh-manager/logs
- wazuh_queue:/var/ossec/queue - wazuh_queue:/var/wazuh-manager/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
- wazuh_active_response:/var/ossec/active-response/bin - wazuh_active_response:/var/wazuh-manager/active-response/bin
- wazuh_wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem - ./wazuh-certificates/wazuh.manager.pem:/var/wazuh-manager/etc/certs/server.pem
- ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/server-key.pem
- ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem
wazuh.indexer: wazuh.indexer:
image: wazuh/wazuh-indexer:5.0.0 image: wazuh/wazuh-indexer:5.0.0
@@ -109,7 +108,6 @@ volumes:
wazuh_queue: wazuh_queue:
wazuh_var_multigroups: wazuh_var_multigroups:
wazuh_active_response: wazuh_active_response:
wazuh_wodles:
wazuh-indexer-data: wazuh-indexer-data:
wazuh-dashboard-config: wazuh-dashboard-config:
wazuh-dashboard-custom: wazuh-dashboard-custom: