From bb85a9aef252db69bfeb8c7327e18506bf6cae08 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 15 Dec 2020 13:23:34 +0100
Subject: [PATCH 01/53] Update script name
---
wazuh-odfe/config/etc/cont-init.d/2-manager | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager
index 4419011a..8ff310eb 100644
--- a/wazuh-odfe/config/etc/cont-init.d/2-manager
+++ b/wazuh-odfe/config/etc/cont-init.d/2-manager
@@ -110,4 +110,4 @@ function_wazuh_migration
function_create_custom_user
# Start Wazuh
-/var/ossec/bin/ossec-control start
+/var/ossec/bin/wazuh-control start
From 0da4a86f074f57c691a9c57869bcd2af119544b6 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 15 Dec 2020 15:21:02 +0100
Subject: [PATCH 02/53] Update references to authd
---
production_cluster/wazuh_cluster/wazuh_manager.conf | 10 +++++-----
production_cluster/wazuh_cluster/wazuh_worker.conf | 10 +++++-----
wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 4 ++--
3 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/production_cluster/wazuh_cluster/wazuh_manager.conf
index 740321bb..d6e4f5ec 100644
--- a/production_cluster/wazuh_cluster/wazuh_manager.conf
+++ b/production_cluster/wazuh_cluster/wazuh_manager.conf
@@ -94,7 +94,7 @@
6h
yes
-
+
no
trusty
@@ -104,7 +104,7 @@
1h
-
+
no
stretch
@@ -112,7 +112,7 @@
1h
-
+
no
5
@@ -307,7 +307,7 @@
etc/rules
-
+
no
1515
@@ -346,4 +346,4 @@
syslog
/var/ossec/logs/active-responses.log
-
+
diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/production_cluster/wazuh_cluster/wazuh_worker.conf
index 59462183..e202e849 100644
--- a/production_cluster/wazuh_cluster/wazuh_worker.conf
+++ b/production_cluster/wazuh_cluster/wazuh_worker.conf
@@ -94,7 +94,7 @@
6h
yes
-
+
no
trusty
@@ -104,7 +104,7 @@
1h
-
+
no
stretch
@@ -112,7 +112,7 @@
1h
-
+
no
5
@@ -307,7 +307,7 @@
etc/rules
-
+
no
1515
@@ -346,4 +346,4 @@
syslog
/var/ossec/logs/active-responses.log
-
+
diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
index 68538c10..fedd795a 100644
--- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
+++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
@@ -94,7 +94,7 @@ remove_data_files() {
##############################################################################
create_ossec_key_cert() {
- print "Creating ossec-authd key and cert"
+ print "Creating wazuh-authd key and cert"
exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
}
@@ -161,7 +161,7 @@ main() {
# Remove some files in permanent_data (i.e. .template.db)
remove_data_files
- # Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
+ # Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
if [ $AUTO_ENROLLMENT_ENABLED == true ]
then
if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
From 94c0307f008026987dcd4062ec7936332e3bcb7a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 18 Dec 2020 18:14:38 +0100
Subject: [PATCH 03/53] Add goss verifications
---
.goss.yaml | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 81 insertions(+)
create mode 100644 .goss.yaml
diff --git a/.goss.yaml b/.goss.yaml
new file mode 100644
index 00000000..b2f5864d
--- /dev/null
+++ b/.goss.yaml
@@ -0,0 +1,81 @@
+file:
+ /etc/filebeat/filebeat.yml:
+ exists: true
+ mode: "0644"
+ owner: root
+ group: root
+ filetype: file
+ contains: []
+ /var/ossec/bin/ossec-control:
+ exists: true
+ mode: "0750"
+ owner: root
+ group: root
+ filetype: file
+ contains: []
+ /var/ossec/etc/ossec.conf:
+ exists: true
+ mode: "0660"
+ owner: root
+ group: ossec
+ filetype: file
+ contains: []
+package:
+ filebeat:
+ installed: true
+ versions:
+ - 7.9.1
+ wazuh-manager:
+ installed: true
+ versions:
+ - 4.0.3
+port:
+ tcp:1514:
+ listening: true
+ ip:
+ - 0.0.0.0
+ tcp:1515:
+ listening: true
+ ip:
+ - 0.0.0.0
+ tcp:55000:
+ listening: true
+ ip:
+ - 0.0.0.0
+user:
+ ossec:
+ exists: true
+ groups:
+ - ossec
+ home: /var/ossec
+ shell: /sbin/nologin
+ ossecm:
+ exists: true
+ groups:
+ - ossec
+ home: /var/ossec
+ shell: /sbin/nologin
+ ossecr:
+ exists: true
+ groups:
+ - ossec
+ home: /var/ossec
+ shell: /sbin/nologin
+group:
+ ossec:
+ exists: true
+process:
+ filebeat:
+ running: true
+ ossec-analysisd:
+ running: true
+ ossec-authd:
+ running: true
+ ossec-syscheckd:
+ running: true
+ s6-supervise:
+ running: true
+ wazuh-db:
+ running: true
+ wazuh-modulesd:
+ running: true
From 5109a35e6a4bf3c6971f620954271461c7aea031 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 18 Dec 2020 18:15:11 +0100
Subject: [PATCH 04/53] Add Goss Actions
---
.github/workflows/push.yml | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ec83402f..ca68f3fa 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -6,9 +6,25 @@ jobs:
build-stack:
runs-on: ubuntu-latest
steps:
+
- name: Check out code
uses: actions/checkout@v2
+
- name: Build the docker-compose stack
run: docker-compose -f build-from-sources.yml up -d --build
+
- name: Check running containers
run: docker ps -a
+
+ - name: Shutdown the stack
+ run: docker-compose -f build-from-sources.yml kill
+
+ - name: Install Goss
+ uses: e1himself/goss-installation-action@v1.0.3
+ with:
+ version: v0.3.16
+
+ - name: Execute Goss tests
+ run: dgoss run wazuh/wazuh-odfe:dev-version
+ env:
+ GOSS_FILE: .goss.yaml
From ae1611e07cc674a8cfc3b65fa2c530164ca08e0a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 18 Dec 2020 18:18:35 +0100
Subject: [PATCH 05/53] Fix yaml syntax
---
.github/workflows/push.yml | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ca68f3fa..e3fa3448 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -20,11 +20,11 @@ jobs:
run: docker-compose -f build-from-sources.yml kill
- name: Install Goss
- uses: e1himself/goss-installation-action@v1.0.3
- with:
- version: v0.3.16
+ uses: e1himself/goss-installation-action@v1.0.3
+ with:
+ version: v0.3.16
- name: Execute Goss tests
- run: dgoss run wazuh/wazuh-odfe:dev-version
- env:
- GOSS_FILE: .goss.yaml
+ run: dgoss run wazuh/wazuh-odfe:dev-version
+ env:
+ GOSS_FILE: .goss.yaml
From 1460c07b92ee0aec31679b364c729c95783ed767 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 18 Dec 2020 18:27:47 +0100
Subject: [PATCH 06/53] Include GOSS_SLEEP
---
.github/workflows/push.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index e3fa3448..bf899155 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -27,4 +27,5 @@ jobs:
- name: Execute Goss tests
run: dgoss run wazuh/wazuh-odfe:dev-version
env:
+ GOSS_SLEEP: 30
GOSS_FILE: .goss.yaml
From 20ebf9b467ac5b725cc8271d64f515ecbfc58f0b Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 7 Jan 2021 13:36:55 +0100
Subject: [PATCH 07/53] Port all tests from Ansible repo
---
.goss.yaml | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/.goss.yaml b/.goss.yaml
index b2f5864d..cabb680b 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -13,6 +13,13 @@ file:
group: root
filetype: file
contains: []
+ /var/ossec/etc/lists/audit-keys:
+ exists: true
+ mode: "0660"
+ owner: ossec
+ group: ossec
+ filetype: file
+ contains: []
/var/ossec/etc/ossec.conf:
exists: true
mode: "0660"
@@ -20,6 +27,27 @@ file:
group: ossec
filetype: file
contains: []
+ /var/ossec/etc/rules/local_rules.xml:
+ exists: true
+ mode: "0660"
+ owner: ossec
+ group: ossec
+ filetype: file
+ contains: []
+ /var/ossec/etc/sslmanager.cert:
+ exists: true
+ mode: "0640"
+ owner: root
+ group: root
+ filetype: file
+ contains: []
+ /var/ossec/etc/sslmanager.key:
+ exists: true
+ mode: "0640"
+ owner: root
+ group: root
+ filetype: file
+ contains: []
package:
filebeat:
installed: true
@@ -71,6 +99,12 @@ process:
running: true
ossec-authd:
running: true
+ ossec-execd:
+ running: true
+ ossec-monitord:
+ running: true
+ ossec-remoted:
+ running: true
ossec-syscheckd:
running: true
s6-supervise:
From 1441e570a8adb5e2334308f85ce4037cd4c99ece Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 7 Jan 2021 16:10:24 +0100
Subject: [PATCH 08/53] Add Goss tests for Kibana image
---
.goss.kibana.yaml | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
create mode 100644 .goss.kibana.yaml
diff --git a/.goss.kibana.yaml b/.goss.kibana.yaml
new file mode 100644
index 00000000..24503b7e
--- /dev/null
+++ b/.goss.kibana.yaml
@@ -0,0 +1,25 @@
+file:
+ /usr/share/kibana/config/kibana.yml:
+ exists: true
+ mode: "0664"
+ owner: kibana
+ group: root
+ filetype: file
+ contains: []
+ /usr/share/kibana/optimize/wazuh/config/wazuh.yml:
+ exists: true
+ mode: "0644"
+ owner: kibana
+ group: kibana
+ filetype: file
+ contains: []
+user:
+ kibana:
+ exists: true
+ groups:
+ - kibana
+ home: /usr/share/kibana
+ shell: /bin/bash
+group:
+ kibana:
+ exists: true
From 01563af39a552a802f36d57f07bae67a387ae908 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 7 Jan 2021 16:11:49 +0100
Subject: [PATCH 09/53] Execute tests for kibana image
---
.github/workflows/push.yml | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index bf899155..4637f903 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -24,8 +24,13 @@ jobs:
with:
version: v0.3.16
- - name: Execute Goss tests
+ - name: Execute Goss tests (wazuh-odfe)
run: dgoss run wazuh/wazuh-odfe:dev-version
env:
GOSS_SLEEP: 30
GOSS_FILE: .goss.yaml
+
+ - name: Execute Goss tests (wazuh-kibana-odfe)
+ run: dgoss run wazuh/wazuh-kibana-odfe:dev-version
+ env:
+ GOSS_FILE: .goss.kibana.yaml
From 6228d3077d871d4790e585c3634421d682d728e6 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 7 Jan 2021 16:44:18 +0100
Subject: [PATCH 10/53] Add tests for Kibana customizations
---
.goss.kibana.yaml | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/.goss.kibana.yaml b/.goss.kibana.yaml
index 24503b7e..b5c0ea6b 100644
--- a/.goss.kibana.yaml
+++ b/.goss.kibana.yaml
@@ -6,6 +6,27 @@ file:
group: root
filetype: file
contains: []
+ /usr/share/kibana/optimize/bundles/light_theme.style.css:
+ exists: true
+ mode: "0664"
+ owner: kibana
+ group: root
+ filetype: file
+ contains: []
+ /usr/share/kibana/optimize/bundles/wazuh_logo_circle.svg:
+ exists: true
+ mode: "0644"
+ owner: kibana
+ group: root
+ filetype: file
+ contains: []
+ /usr/share/kibana/optimize/bundles/wazuh_wazuh_bg.svg:
+ exists: true
+ mode: "0644"
+ owner: kibana
+ group: root
+ filetype: file
+ contains: []
/usr/share/kibana/optimize/wazuh/config/wazuh.yml:
exists: true
mode: "0644"
@@ -13,6 +34,13 @@ file:
group: kibana
filetype: file
contains: []
+ /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs:
+ exists: true
+ mode: "0664"
+ owner: kibana
+ group: root
+ filetype: file
+ contains: []
user:
kibana:
exists: true
From 1eb94b82ee5e4f0ff17daacfda69f137f16fd2d4 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 11 Jan 2021 11:58:46 +0100
Subject: [PATCH 11/53] Bump versions
---
CHANGELOG.md | 7 +++++++
README.md | 2 ++
VERSION | 4 ++--
docker-compose.yml | 4 ++--
kibana-odfe/Dockerfile | 2 +-
production-cluster.yml | 6 +++---
wazuh-odfe/Dockerfile | 2 +-
7 files changed, 18 insertions(+), 9 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa23b9e4..de44c469 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.0.4_1.11.0
+
+### Added
+
+- Update to Wazuh version 4.0.4
+
+
## Wazuh Docker v4.0.3_1.11.0
### Added
diff --git a/README.md b/README.md
index 49d8a5d0..583bff91 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,8 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE |
|---------------|---------|
+| v4.0.4 | 1.11.0 |
+|---------------|---------|
| v4.0.3 | 1.11.0 |
|---------------|---------|
| v4.0.2 | 1.11.0 |
diff --git a/VERSION b/VERSION
index 8ce8bfc8..7563f1f1 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.0.3_1.11.0"
-REVISION="40300"
+WAZUH-DOCKER_VERSION="4.0.4_1.11.0"
+REVISION="40400"
diff --git a/docker-compose.yml b/docker-compose.yml
index 1b65f92c..7bab601d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.0.3_1.11.0
+ image: wazuh/wazuh-odfe:4.0.4_1.11.0
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.0.3_1.11.0
+ image: wazuh/wazuh-kibana-odfe:4.0.4_1.11.0
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index 48a9e293..0cff8b2e 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.11.0
USER kibana
ARG ELASTIC_VERSION=7.9.1
-ARG WAZUH_VERSION=4.0.3
+ARG WAZUH_VERSION=4.0.4
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index 3c3bb0d6..334444f1 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.0.3_1.11.0
+ image: wazuh/wazuh-odfe:4.0.4_1.11.0
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.0.3_1.11.0
+ image: wazuh/wazuh-odfe:4.0.4_1.11.0
hostname: wazuh-worker
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.0.3_1.11.0
+ image: wazuh/wazuh-kibana-odfe:4.0.4_1.11.0
hostname: kibana
restart: always
ports:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 8daabe71..c317bdff 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM centos:7
ARG FILEBEAT_VERSION=7.9.1
-ARG WAZUH_VERSION=4.0.3-1
+ARG WAZUH_VERSION=4.0.4-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
From 504d5b8cc4c4e39c88ec64d0b2dce2c4856435d5 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 11 Jan 2021 13:05:17 +0100
Subject: [PATCH 12/53] Bump year
---
LICENSE | 2 +-
README.md | 2 +-
build-from-sources.yml | 2 +-
docker-compose.yml | 2 +-
generate-opendistro-certs.yml | 2 +-
kibana-odfe/Dockerfile | 2 +-
kibana-odfe/config/entrypoint.sh | 2 +-
kibana-odfe/config/kibana_settings.sh | 2 +-
kibana-odfe/config/wazuh.yml | 2 +-
kibana-odfe/config/wazuh_app_config.sh | 2 +-
kibana-odfe/config/welcome_wazuh.sh | 2 +-
production-cluster.yml | 2 +-
wazuh-odfe/Dockerfile | 2 +-
wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 2 +-
wazuh-odfe/config/etc/cont-init.d/1-config-filebeat | 2 +-
wazuh-odfe/config/permanent_data.sh | 2 +-
16 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/LICENSE b/LICENSE
index 40f5e6c3..51ab7d2f 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,5 +1,5 @@
- Portions Copyright (C) 2020 Wazuh, Inc.
+ Portions Copyright (C) 2021 Wazuh, Inc.
Based on work Copyright (C) 2003 - 2013 Trend Micro, Inc.
This program is a free software; you can redistribute it and/or modify
diff --git a/README.md b/README.md
index 583bff91..257810a5 100644
--- a/README.md
+++ b/README.md
@@ -176,7 +176,7 @@ We thank you them and everyone else who has contributed to this project.
## License and copyright
-Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
## Web references
diff --git a/build-from-sources.yml b/build-from-sources.yml
index db1c042a..49120850 100644
--- a/build-from-sources.yml
+++ b/build-from-sources.yml
@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3.7'
services:
diff --git a/docker-compose.yml b/docker-compose.yml
index 7bab601d..12686ea3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3.7'
services:
diff --git a/generate-opendistro-certs.yml b/generate-opendistro-certs.yml
index 4c83507a..cd23e310 100644
--- a/generate-opendistro-certs.yml
+++ b/generate-opendistro-certs.yml
@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3'
services:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index 0cff8b2e..de07eac0 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
FROM amazon/opendistro-for-elasticsearch-kibana:1.11.0
USER kibana
ARG ELASTIC_VERSION=7.9.1
diff --git a/kibana-odfe/config/entrypoint.sh b/kibana-odfe/config/entrypoint.sh
index f2c017f1..f96672fb 100644
--- a/kibana-odfe/config/entrypoint.sh
+++ b/kibana-odfe/config/entrypoint.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
set -e
diff --git a/kibana-odfe/config/kibana_settings.sh b/kibana-odfe/config/kibana_settings.sh
index b0c56e4d..4bc39a5f 100644
--- a/kibana-odfe/config/kibana_settings.sh
+++ b/kibana-odfe/config/kibana_settings.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
WAZUH_MAJOR=4
diff --git a/kibana-odfe/config/wazuh.yml b/kibana-odfe/config/wazuh.yml
index 6c52d526..3b074c61 100644
--- a/kibana-odfe/config/wazuh.yml
+++ b/kibana-odfe/config/wazuh.yml
@@ -1,7 +1,7 @@
---
#
# Wazuh app - App configuration file
-# Copyright (C) 2015-2020 Wazuh, Inc.
+# Copyright (C) 2015-2021 Wazuh, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
diff --git a/kibana-odfe/config/wazuh_app_config.sh b/kibana-odfe/config/wazuh_app_config.sh
index 7ff90337..c08980a5 100644
--- a/kibana-odfe/config/wazuh_app_config.sh
+++ b/kibana-odfe/config/wazuh_app_config.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
wazuh_url="${WAZUH_API_URL:-https://wazuh}"
wazuh_port="${API_PORT:-55000}"
diff --git a/kibana-odfe/config/welcome_wazuh.sh b/kibana-odfe/config/welcome_wazuh.sh
index 74ae2eef..50b1d56e 100644
--- a/kibana-odfe/config/welcome_wazuh.sh
+++ b/kibana-odfe/config/welcome_wazuh.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
if [[ $CHANGE_WELCOME == "true" ]]
then
diff --git a/production-cluster.yml b/production-cluster.yml
index 334444f1..f6b30281 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3.7'
services:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index c317bdff..01df48b5 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
FROM centos:7
ARG FILEBEAT_VERSION=7.9.1
diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
index fedd795a..b45dced5 100644
--- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
+++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
@@ -1,5 +1,5 @@
#!/usr/bin/with-contenv bash
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
# Variables
source /permanent_data.env
diff --git a/wazuh-odfe/config/etc/cont-init.d/1-config-filebeat b/wazuh-odfe/config/etc/cont-init.d/1-config-filebeat
index ce033aa5..b77a550d 100644
--- a/wazuh-odfe/config/etc/cont-init.d/1-config-filebeat
+++ b/wazuh-odfe/config/etc/cont-init.d/1-config-filebeat
@@ -1,5 +1,5 @@
#!/usr/bin/with-contenv bash
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
set -e
diff --git a/wazuh-odfe/config/permanent_data.sh b/wazuh-odfe/config/permanent_data.sh
index 7dfaa647..600af0f1 100644
--- a/wazuh-odfe/config/permanent_data.sh
+++ b/wazuh-odfe/config/permanent_data.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
# Variables
source /permanent_data.env
From 2b5c950c48a10001e810461482aa8f2723d9c6b5 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 15 Jan 2021 09:58:05 +0100
Subject: [PATCH 13/53] Bump goss test
---
.goss.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.goss.yaml b/.goss.yaml
index cabb680b..1d84c367 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.0.3
+ - 4.0.4
port:
tcp:1514:
listening: true
From 9656c348a22b553374c78443344cabea0f78eb49 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 15 Jan 2021 15:29:43 +0100
Subject: [PATCH 14/53] Add link to changelog
---
CHANGELOG.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index de44c469..4ad21a86 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
### Added
-- Update to Wazuh version 4.0.4
+- Update to Wazuh version [4.0.4](https://github.com/wazuh/wazuh/blob/v4.0.4/CHANGELOG.md#v404)
## Wazuh Docker v4.0.3_1.11.0
From bb8cbc6d1519bd777a6160ab60ece6fd0e90750b Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 22 Jan 2021 17:53:43 +0100
Subject: [PATCH 15/53] Bump s6-overlay version
---
wazuh-odfe/Dockerfile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 01df48b5..eb606609 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -21,7 +21,7 @@ RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-os
RUN curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
-ARG S6_VERSION="v2.1.0.2"
+ARG S6_VERSION="v2.2.0.1"
RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \
tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
From cdf31d7a085ecf5694b1e353603e301e2cdcfb34 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 3 Feb 2021 11:32:07 +0100
Subject: [PATCH 16/53] Re-enable entrypoint scripts
---
wazuh-odfe/config/etc/cont-init.d/2-manager | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager
index 8ff310eb..58807682 100644
--- a/wazuh-odfe/config/etc/cont-init.d/2-manager
+++ b/wazuh-odfe/config/etc/cont-init.d/2-manager
@@ -102,6 +102,16 @@ EOF
fi
}
+function_entrypoint_scripts() {
+ # It will run every .sh script located in entrypoint-scripts folder in lexicographical order
+ if [ -d "/entrypoint-scripts/" ]
+ then
+ for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
+ bash "$script"
+ done
+ fi
+}
+
# Migrate data from /wazuh-migration volume
function_wazuh_migration
@@ -109,5 +119,8 @@ function_wazuh_migration
# create API custom user
function_create_custom_user
+# run entrypoint scripts
+function_entrypoint_scripts
+
# Start Wazuh
/var/ossec/bin/wazuh-control start
From 59ccbbee8e0e7c2831367831721971b754626d84 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 23 Nov 2020 18:57:31 +0100
Subject: [PATCH 17/53] Use an ARG to select filebeat channel
---
wazuh-odfe/Dockerfile | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index eb606609..d9dbc63f 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -1,6 +1,7 @@
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
FROM centos:7
+ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.9.1
ARG WAZUH_VERSION=4.0.4-1
ARG TEMPLATE_VERSION="master"
@@ -16,8 +17,8 @@ RUN yum --enablerepo=updates clean metadata && \
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \
yum clean all && rm -rf /var/cache/yum
-RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm &&\
- rpm -i filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-oss-${FILEBEAT_VERSION}-x86_64.rpm
+RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\
+ rpm -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm
RUN curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
From 24b2c4bc4bf09c608df3fda90617ccf1cfc9a5f7 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 1 Dec 2020 18:23:36 +0100
Subject: [PATCH 18/53] Backport kibana-xpack image to v4
---
kibana/Dockerfile | 65 ++++++++++++
kibana/config/entrypoint.sh | 60 +++++++++++
kibana/config/kibana_settings.sh | 82 +++++++++++++++
kibana/config/wazuh.yml | 162 ++++++++++++++++++++++++++++++
kibana/config/wazuh_app_config.sh | 64 ++++++++++++
kibana/config/xpack_config.sh | 35 +++++++
6 files changed, 468 insertions(+)
create mode 100644 kibana/Dockerfile
create mode 100644 kibana/config/entrypoint.sh
create mode 100644 kibana/config/kibana_settings.sh
create mode 100644 kibana/config/wazuh.yml
create mode 100644 kibana/config/wazuh_app_config.sh
create mode 100644 kibana/config/xpack_config.sh
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
new file mode 100644
index 00000000..20245926
--- /dev/null
+++ b/kibana/Dockerfile
@@ -0,0 +1,65 @@
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+ARG KIBANA_IMAGE=docker.elastic.co/kibana/kibana:7.9.3
+FROM ${KIBANA_IMAGE}
+USER kibana
+ARG ELASTIC_VERSION=7.9.3
+ARG WAZUH_VERSION=4.0.3
+ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
+
+WORKDIR /usr/share/kibana
+RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip
+
+ENV PATTERN="" \
+ CHECKS_PATTERN="" \
+ CHECKS_TEMPLATE="" \
+ CHECKS_API="" \
+ CHECKS_SETUP="" \
+ EXTENSIONS_PCI="" \
+ EXTENSIONS_GDPR="" \
+ EXTENSIONS_HIPAA="" \
+ EXTENSIONS_NIST="" \
+ EXTENSIONS_TSC="" \
+ EXTENSIONS_AUDIT="" \
+ EXTENSIONS_OSCAP="" \
+ EXTENSIONS_CISCAT="" \
+ EXTENSIONS_AWS="" \
+ EXTENSIONS_GCP="" \
+ EXTENSIONS_VIRUSTOTAL="" \
+ EXTENSIONS_OSQUERY="" \
+ EXTENSIONS_DOCKER="" \
+ APP_TIMEOUT="" \
+ API_SELECTOR="" \
+ IP_SELECTOR="" \
+ IP_IGNORE="" \
+ WAZUH_MONITORING_ENABLED="" \
+ WAZUH_MONITORING_FREQUENCY="" \
+ WAZUH_MONITORING_SHARDS="" \
+ WAZUH_MONITORING_REPLICAS="" \
+ ADMIN_PRIVILEGES="" \
+ XPACK_CANVAS="true" \
+ XPACK_LOGS="true" \
+ XPACK_INFRA="true" \
+ XPACK_ML="true" \
+ XPACK_DEVTOOLS="true" \
+ XPACK_MONITORING="true" \
+ XPACK_APM="true"
+
+WORKDIR /
+USER kibana
+RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
+
+COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh
+RUN chmod 755 ./entrypoint.sh
+
+COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/optimize/wazuh/config/wazuh.yml
+COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
+RUN chmod +x ./wazuh_app_config.sh
+
+COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
+RUN chmod +x ./kibana_settings.sh
+
+COPY --chown=kibana:kibana ./config/xpack_config.sh ./
+RUN chmod +x ./xpack_config.sh
+RUN ./xpack_config.sh
+
+ENTRYPOINT ./entrypoint.sh
diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
new file mode 100644
index 00000000..885fb7d6
--- /dev/null
+++ b/kibana/config/entrypoint.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+set -e
+
+##############################################################################
+# Waiting for elasticsearch
+##############################################################################
+
+if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
+ export el_url="http://elasticsearch:9200"
+else
+ export el_url="${ELASTICSEARCH_URL}"
+fi
+
+if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
+ auth=""
+else
+ auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
+fi
+
+until curl -XGET $el_url ${auth}; do
+ >&2 echo "Elastic is unavailable - sleeping"
+ sleep 5
+done
+
+sleep 2
+
+>&2 echo "Elasticsearch is up."
+
+
+##############################################################################
+# Waiting for wazuh alerts template
+##############################################################################
+
+strlen=0
+
+while [[ $strlen -eq 0 ]]
+do
+ template=$(curl ${auth} $el_url/_cat/templates/wazuh -s)
+ strlen=${#template}
+ >&2 echo "Wazuh alerts template not loaded - sleeping."
+ sleep 2
+done
+
+sleep 2
+
+>&2 echo "Wazuh alerts template is loaded."
+
+./xpack_config.sh
+
+./wazuh_app_config.sh
+
+sleep 5
+
+./kibana_settings.sh &
+
+sleep 2
+
+/usr/local/bin/kibana-docker
diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh
new file mode 100644
index 00000000..137d5d47
--- /dev/null
+++ b/kibana/config/kibana_settings.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+WAZUH_MAJOR=4
+
+##############################################################################
+# Wait for the Kibana API to start. It is necessary to do it in this container
+# because the others are running Elastic Stack and we can not interrupt them.
+#
+# The following actions are performed:
+#
+# Add the wazuh alerts index as default.
+# Set the Discover time interval to 24 hours instead of 15 minutes.
+# Do not ask user to help providing usage statistics to Elastic.
+##############################################################################
+
+##############################################################################
+# Customize elasticsearch ip
+##############################################################################
+sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml
+
+# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
+if [ "$KIBANA_INDEX" != "" ]; then
+ if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
+ sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml
+ fi
+ echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
+fi
+
+if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
+ if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then
+ sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml
+ fi
+ echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml
+fi
+
+if [ "$KIBANA_IP" != "" ]; then
+ kibana_ip="$KIBANA_IP"
+else
+ kibana_ip="kibana"
+fi
+
+# Add auth headers if required
+if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
+ curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
+fi
+
+while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' kibana:5601/status)" != "200" ]]; do
+ echo "Waiting for Kibana API. Sleeping 5 seconds"
+ sleep 5
+done
+
+
+
+# Prepare index selection.
+echo "Kibana API is running"
+
+default_index="/tmp/default_index.json"
+
+cat > ${default_index} << EOF
+{
+ "changes": {
+ "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*"
+ }
+}
+EOF
+
+sleep 5
+# Add the wazuh alerts index as default.
+curl ${auth} -POST -k https://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+rm -f ${default_index}
+
+sleep 5
+# Configuring Kibana TimePicker.
+curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
+
+sleep 5
+# Do not ask user to help providing usage statistics to Elastic
+curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
+
+echo "End settings"
diff --git a/kibana/config/wazuh.yml b/kibana/config/wazuh.yml
new file mode 100644
index 00000000..6c52d526
--- /dev/null
+++ b/kibana/config/wazuh.yml
@@ -0,0 +1,162 @@
+---
+#
+# Wazuh app - App configuration file
+# Copyright (C) 2015-2020 Wazuh, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# Find more information about this on the LICENSE file.
+#
+# ======================== Wazuh app configuration file ========================
+#
+# Please check the documentation for more information on configuration options:
+# https://documentation.wazuh.com/current/installation-guide/index.html
+#
+# Also, you can check our repository:
+# https://github.com/wazuh/wazuh-kibana-app
+#
+# ------------------------------- Index patterns -------------------------------
+#
+# Default index pattern to use.
+#pattern: wazuh-alerts-*
+#
+# ----------------------------------- Checks -----------------------------------
+#
+# Defines which checks must to be consider by the healthcheck
+# step once the Wazuh app starts. Values must to be true or false.
+#checks.pattern : true
+#checks.template: true
+#checks.api : true
+#checks.setup : true
+#checks.metaFields: true
+#
+# --------------------------------- Extensions ---------------------------------
+#
+# Defines which extensions should be activated when you add a new API entry.
+# You can change them after Wazuh app starts.
+# Values must to be true or false.
+#extensions.pci : true
+#extensions.gdpr : true
+#extensions.hipaa : true
+#extensions.nist : true
+#extensions.tsc : true
+#extensions.audit : true
+#extensions.oscap : false
+#extensions.ciscat : false
+#extensions.aws : false
+#extensions.gcp : false
+#extensions.virustotal: false
+#extensions.osquery : false
+#extensions.docker : false
+#
+# ---------------------------------- Time out ----------------------------------
+#
+# Defines maximum timeout to be used on the Wazuh app requests.
+# It will be ignored if it is bellow 1500.
+# It means milliseconds before we consider a request as failed.
+# Default: 20000
+#timeout: 20000
+#
+# -------------------------------- API selector --------------------------------
+#
+# Defines if the user is allowed to change the selected
+# API directly from the Wazuh app top menu.
+# Default: true
+#api.selector: true
+#
+# --------------------------- Index pattern selector ---------------------------
+#
+# Defines if the user is allowed to change the selected
+# index pattern directly from the Wazuh app top menu.
+# Default: true
+#ip.selector: true
+#
+# List of index patterns to be ignored
+#ip.ignore: []
+#
+# -------------------------------- X-Pack RBAC ---------------------------------
+#
+# Custom setting to enable/disable built-in X-Pack RBAC security capabilities.
+# Default: enabled
+#xpack.rbac.enabled: true
+#
+# ------------------------------ wazuh-monitoring ------------------------------
+#
+# Custom setting to enable/disable wazuh-monitoring indices.
+# Values: true, false, worker
+# If worker is given as value, the app will show the Agents status
+# visualization but won't insert data on wazuh-monitoring indices.
+# Default: true
+#wazuh.monitoring.enabled: true
+#
+# Custom setting to set the frequency for wazuh-monitoring indices cron task.
+# Default: 900 (s)
+#wazuh.monitoring.frequency: 900
+#
+# Configure wazuh-monitoring-* indices shards and replicas.
+#wazuh.monitoring.shards: 2
+#wazuh.monitoring.replicas: 0
+#
+# Configure wazuh-monitoring-* indices custom creation interval.
+# Values: h (hourly), d (daily), w (weekly), m (monthly)
+# Default: d
+#wazuh.monitoring.creation: d
+#
+# Default index pattern to use for Wazuh monitoring
+#wazuh.monitoring.pattern: wazuh-monitoring-*
+#
+# --------------------------------- wazuh-cron ----------------------------------
+#
+# Customize the index prefix of predefined jobs
+# This change is not retroactive, if you change it new indexes will be created
+# cron.prefix: test
+#
+# ------------------------------ wazuh-statistics -------------------------------
+#
+# Custom setting to enable/disable statistics tasks.
+#cron.statistics.status: true
+#
+# Enter the ID of the APIs you want to save data from, leave this empty to run
+# the task on all configured APIs
+#cron.statistics.apis: []
+#
+# Define the frequency of task execution using cron schedule expressions
+#cron.statistics.interval: 0 0 * * * *
+#
+# Define the name of the index in which the documents are to be saved.
+#cron.statistics.index.name: statistics
+#
+# Define the interval in which the index will be created
+#cron.statistics.index.creation: w
+#
+# ------------------------------- App privileges --------------------------------
+#admin: true
+#
+# ---------------------------- Hide manager alerts ------------------------------
+# Hide the alerts of the manager in all dashboards and discover
+#hideManagerAlerts: false
+#
+# ------------------------------- App logging level -----------------------------
+# Set the logging level for the Wazuh App log files.
+# Default value: info
+# Allowed values: info, debug
+#logs.level: info
+#
+# -------------------------------- Enrollment DNS -------------------------------
+# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
+# Default value: ''
+#enrollment.dns: ''
+#
+#-------------------------------- API entries -----------------------------------
+#The following configuration is the default structure to define an API entry.
+#
+#hosts:
+# - :
+# url: http(s)://
+# port:
+# username:
+# password:
+
diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh
new file mode 100644
index 00000000..7ff90337
--- /dev/null
+++ b/kibana/config/wazuh_app_config.sh
@@ -0,0 +1,64 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+wazuh_url="${WAZUH_API_URL:-https://wazuh}"
+wazuh_port="${API_PORT:-55000}"
+api_username="${API_USERNAME:-wazuh-wui}"
+api_password="${API_PASSWORD:-wazuh-wui}"
+
+kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
+
+declare -A CONFIG_MAP=(
+ [pattern]=$PATTERN
+ [checks.pattern]=$CHECKS_PATTERN
+ [checks.template]=$CHECKS_TEMPLATE
+ [checks.api]=$CHECKS_API
+ [checks.setup]=$CHECKS_SETUP
+ [extensions.pci]=$EXTENSIONS_PCI
+ [extensions.gdpr]=$EXTENSIONS_GDPR
+ [extensions.hipaa]=$EXTENSIONS_HIPAA
+ [extensions.nist]=$EXTENSIONS_NIST
+ [extensions.tsc]=$EXTENSIONS_TSC
+ [extensions.audit]=$EXTENSIONS_AUDIT
+ [extensions.oscap]=$EXTENSIONS_OSCAP
+ [extensions.ciscat]=$EXTENSIONS_CISCAT
+ [extensions.aws]=$EXTENSIONS_AWS
+ [extensions.gcp]=$EXTENSIONS_GCP
+ [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
+ [extensions.osquery]=$EXTENSIONS_OSQUERY
+ [extensions.docker]=$EXTENSIONS_DOCKER
+ [timeout]=$APP_TIMEOUT
+ [api.selector]=$API_SELECTOR
+ [ip.selector]=$IP_SELECTOR
+ [ip.ignore]=$IP_IGNORE
+ [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
+ [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
+ [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
+ [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
+ [admin]=$ADMIN_PRIVILEGES
+)
+
+for i in "${!CONFIG_MAP[@]}"
+do
+ if [ "${CONFIG_MAP[$i]}" != "" ]; then
+ sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
+ fi
+done
+
+CONFIG_CODE=$(curl ${auth} -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013)
+
+grep -q 1513629884013 $kibana_config_file
+_config_exists=$?
+
+if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
+cat << EOF >> $kibana_config_file
+hosts:
+ - 1513629884013:
+ url: $wazuh_url
+ port: $wazuh_port
+ username: $api_username
+ password: $api_password
+EOF
+else
+ echo "Wazuh APP already configured"
+fi
diff --git a/kibana/config/xpack_config.sh b/kibana/config/xpack_config.sh
new file mode 100644
index 00000000..fedfad4e
--- /dev/null
+++ b/kibana/config/xpack_config.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+
+kibana_config_file="/usr/share/kibana/config/kibana.yml"
+if grep -Fq "#xpack features" "$kibana_config_file";
+then
+ declare -A CONFIG_MAP=(
+ [xpack.apm.ui.enabled]=$XPACK_APM
+ [xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS
+ [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS
+ [xpack.ml.enabled]=$XPACK_ML
+ [xpack.canvas.enabled]=$XPACK_CANVAS
+ [xpack.infra.enabled]=$XPACK_INFRA
+ [xpack.monitoring.enabled]=$XPACK_MONITORING
+ [console.enabled]=$XPACK_DEVTOOLS
+ )
+ for i in "${!CONFIG_MAP[@]}"
+ do
+ if [ "${CONFIG_MAP[$i]}" != "" ]; then
+ sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
+ fi
+ done
+else
+ echo "
+#xpack features
+xpack.apm.ui.enabled: $XPACK_APM
+xpack.grokdebugger.enabled: $XPACK_DEVTOOLS
+xpack.searchprofiler.enabled: $XPACK_DEVTOOLS
+xpack.ml.enabled: $XPACK_ML
+xpack.canvas.enabled: $XPACK_CANVAS
+xpack.infra.enabled: $XPACK_INFRA
+xpack.monitoring.enabled: $XPACK_MONITORING
+console.enabled: $XPACK_DEVTOOLS
+" >> $kibana_config_file
+fi
From 31dbb7fc209b34c186db71b0684f84da6cd3bf15 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 1 Dec 2020 18:29:17 +0100
Subject: [PATCH 19/53] Remove useless ARG
---
kibana/Dockerfile | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 20245926..2be788d4 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -1,6 +1,5 @@
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
-ARG KIBANA_IMAGE=docker.elastic.co/kibana/kibana:7.9.3
-FROM ${KIBANA_IMAGE}
+FROM docker.elastic.co/kibana/kibana:7.9.3
USER kibana
ARG ELASTIC_VERSION=7.9.3
ARG WAZUH_VERSION=4.0.3
From ffb4395da068b9b84d6d5269e784c61e4579ccc3 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 2 Dec 2020 17:49:49 +0100
Subject: [PATCH 20/53] Set Wazuh app as default route
---
kibana/Dockerfile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 2be788d4..4e8a3033 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -50,6 +50,8 @@ RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --opti
COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh
RUN chmod 755 ./entrypoint.sh
+RUN printf "\nserver.defaultRoute: /app/wazuh\n" >> /usr/share/kibana/config/kibana.yml
+
COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/optimize/wazuh/config/wazuh.yml
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
RUN chmod +x ./wazuh_app_config.sh
From c53a0f86f6b8db1a82110d1c505a6755dd1b9cbc Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 2 Dec 2020 17:50:34 +0100
Subject: [PATCH 21/53] Remove duplicated xpack_config exec
---
kibana/Dockerfile | 1 -
1 file changed, 1 deletion(-)
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 4e8a3033..813705c4 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -61,6 +61,5 @@ RUN chmod +x ./kibana_settings.sh
COPY --chown=kibana:kibana ./config/xpack_config.sh ./
RUN chmod +x ./xpack_config.sh
-RUN ./xpack_config.sh
ENTRYPOINT ./entrypoint.sh
From 3428f982f3ce476e93ce245a0fc5d7d480e211d1 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 3 Dec 2020 18:23:45 +0100
Subject: [PATCH 22/53] Add sample compose for xpack variant
---
xpack-compose.yml | 85 +++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 85 insertions(+)
create mode 100644 xpack-compose.yml
diff --git a/xpack-compose.yml b/xpack-compose.yml
new file mode 100644
index 00000000..42faafa3
--- /dev/null
+++ b/xpack-compose.yml
@@ -0,0 +1,85 @@
+# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+version: '3.7'
+
+services:
+ wazuh:
+ build:
+ context: wazuh-odfe/
+ args:
+ - FILEBEAT_CHANNEL=filebeat
+ - FILEBEAT_VERSION=7.9.3
+ image: wazuh/wazuh:4.0.3_7.9.3_dev
+ hostname: wazuh-manager
+ restart: always
+ ports:
+ - "1514:1514"
+ - "1515:1515"
+ - "514:514/udp"
+ - "55000:55000"
+ environment:
+ - ELASTICSEARCH_URL=http://elasticsearch:9200
+ - ELASTIC_USERNAME=admin
+ - ELASTIC_PASSWORD=admin
+ - FILEBEAT_SSL_VERIFICATION_MODE=none
+ volumes:
+ - ossec_api_configuration:/var/ossec/api/configuration
+ - ossec_etc:/var/ossec/etc
+ - ossec_logs:/var/ossec/logs
+ - ossec_queue:/var/ossec/queue
+ - ossec_var_multigroups:/var/ossec/var/multigroups
+ - ossec_integrations:/var/ossec/integrations
+ - ossec_active_response:/var/ossec/active-response/bin
+ - ossec_agentless:/var/ossec/agentless
+ - ossec_wodles:/var/ossec/wodles
+ - filebeat_etc:/etc/filebeat
+ - filebeat_var:/var/lib/filebeat
+
+ elasticsearch:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ hostname: elasticsearch
+ restart: always
+ ports:
+ - "9200:9200"
+ environment:
+ - discovery.type=single-node
+ - cluster.name=wazuh-cluster
+ - network.host=0.0.0.0
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+
+ kibana:
+ build: kibana/
+ image: wazuh/wazuh-kibana:4.0.3_7.9.3_dev
+ hostname: kibana
+ restart: always
+ ports:
+ - 5601:5601
+ environment:
+ - ELASTICSEARCH_USERNAME=admin
+ - ELASTICSEARCH_PASSWORD=admin
+ - ELASTICSEARCH_URL=http://elasticsearch:9200
+ depends_on:
+ - elasticsearch
+ links:
+ - elasticsearch:elasticsearch
+ - wazuh:wazuh
+
+volumes:
+ ossec_api_configuration:
+ ossec_etc:
+ ossec_logs:
+ ossec_queue:
+ ossec_var_multigroups:
+ ossec_integrations:
+ ossec_active_response:
+ ossec_agentless:
+ ossec_wodles:
+ filebeat_etc:
+ filebeat_var:
From 09153da5932bfa69997a4e45867afadbdb4cbafc Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 29 Jan 2021 13:12:49 +0100
Subject: [PATCH 23/53] Bump to 4.0.4
---
kibana/Dockerfile | 4 ++--
xpack-compose.yml | 6 +++---
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 813705c4..69ad44fa 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -1,8 +1,8 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
FROM docker.elastic.co/kibana/kibana:7.9.3
USER kibana
ARG ELASTIC_VERSION=7.9.3
-ARG WAZUH_VERSION=4.0.3
+ARG WAZUH_VERSION=4.0.4
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 42faafa3..fbbc20c3 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3.7'
services:
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.9.3
- image: wazuh/wazuh:4.0.3_7.9.3_dev
+ image: wazuh/wazuh:4.0.4_7.9.3_dev
hostname: wazuh-manager
restart: always
ports:
@@ -56,7 +56,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.0.3_7.9.3_dev
+ image: wazuh/wazuh-kibana:4.0.4_7.9.3_dev
hostname: kibana
restart: always
ports:
From f848aa96007ece9d16c22cb66480e2182f52389d Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 29 Jan 2021 13:13:29 +0100
Subject: [PATCH 24/53] Bump copyright
---
kibana/config/entrypoint.sh | 2 +-
kibana/config/kibana_settings.sh | 2 +-
kibana/config/wazuh.yml | 2 +-
kibana/config/wazuh_app_config.sh | 2 +-
kibana/config/xpack_config.sh | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index 885fb7d6..b0e7ad56 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
set -e
diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh
index 137d5d47..9b6a5768 100644
--- a/kibana/config/kibana_settings.sh
+++ b/kibana/config/kibana_settings.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
WAZUH_MAJOR=4
diff --git a/kibana/config/wazuh.yml b/kibana/config/wazuh.yml
index 6c52d526..3b074c61 100644
--- a/kibana/config/wazuh.yml
+++ b/kibana/config/wazuh.yml
@@ -1,7 +1,7 @@
---
#
# Wazuh app - App configuration file
-# Copyright (C) 2015-2020 Wazuh, Inc.
+# Copyright (C) 2015-2021 Wazuh, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh
index 7ff90337..c08980a5 100644
--- a/kibana/config/wazuh_app_config.sh
+++ b/kibana/config/wazuh_app_config.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
wazuh_url="${WAZUH_API_URL:-https://wazuh}"
wazuh_port="${API_PORT:-55000}"
diff --git a/kibana/config/xpack_config.sh b/kibana/config/xpack_config.sh
index fedfad4e..afc593e9 100644
--- a/kibana/config/xpack_config.sh
+++ b/kibana/config/xpack_config.sh
@@ -1,5 +1,5 @@
#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
kibana_config_file="/usr/share/kibana/config/kibana.yml"
if grep -Fq "#xpack features" "$kibana_config_file";
From 75034895ce8a4ed3274c57d49405d47078d22ae7 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 2 Feb 2021 18:57:16 +0100
Subject: [PATCH 25/53] Fix curl auth params
---
kibana/config/entrypoint.sh | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh
index b0e7ad56..2edeaaf2 100644
--- a/kibana/config/entrypoint.sh
+++ b/kibana/config/entrypoint.sh
@@ -13,10 +13,10 @@ else
export el_url="${ELASTICSEARCH_URL}"
fi
-if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
- auth=""
+if [[ ${ENABLED_SECURITY} == "false" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
+ export auth=""
else
- auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
+ export auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} -k"
fi
until curl -XGET $el_url ${auth}; do
From 5d43a0acf8907c22bdcca99069baaa6de764a06b Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 2 Feb 2021 18:59:46 +0100
Subject: [PATCH 26/53] Use kibana_proto
---
kibana/config/kibana_settings.sh | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh
index 9b6a5768..5163d3cc 100644
--- a/kibana/config/kibana_settings.sh
+++ b/kibana/config/kibana_settings.sh
@@ -27,7 +27,10 @@ if [ "$KIBANA_INDEX" != "" ]; then
echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
fi
+kibana_proto="http"
+
if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
+ kibana_proto="https"
if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then
sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml
fi
@@ -45,7 +48,7 @@ if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; t
curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
fi
-while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' kibana:5601/status)" != "200" ]]; do
+while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' -k $kibana_proto://127.0.0.1:5601/status)" != "200" ]]; do
echo "Waiting for Kibana API. Sleeping 5 seconds"
sleep 5
done
@@ -67,16 +70,16 @@ EOF
sleep 5
# Add the wazuh alerts index as default.
-curl ${auth} -POST -k https://127.0.0.1:5601/api/kibana/settings -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
+curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
rm -f ${default_index}
sleep 5
# Configuring Kibana TimePicker.
-curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
+curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
sleep 5
# Do not ask user to help providing usage statistics to Elastic
-curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
+curl -POST "$kibana_proto://127.0.0.1:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
echo "End settings"
From 15d65820ae6158d973329d6a1a4203b64a8d9c7d Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 2 Feb 2021 19:00:06 +0100
Subject: [PATCH 27/53] Remove kibana_ip
---
kibana/config/kibana_settings.sh | 6 ------
1 file changed, 6 deletions(-)
diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh
index 5163d3cc..b883b31b 100644
--- a/kibana/config/kibana_settings.sh
+++ b/kibana/config/kibana_settings.sh
@@ -37,12 +37,6 @@ if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml
fi
-if [ "$KIBANA_IP" != "" ]; then
- kibana_ip="$KIBANA_IP"
-else
- kibana_ip="kibana"
-fi
-
# Add auth headers if required
if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
From b45f09fff59c676da69c55c09cb70c662002da3f Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 4 Feb 2021 18:25:39 +0100
Subject: [PATCH 28/53] Update xpack-compose
---
xpack-compose.yml | 125 ++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 116 insertions(+), 9 deletions(-)
diff --git a/xpack-compose.yml b/xpack-compose.yml
index fbbc20c3..52025636 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -17,10 +17,13 @@ services:
- "514:514/udp"
- "55000:55000"
environment:
- - ELASTICSEARCH_URL=http://elasticsearch:9200
- - ELASTIC_USERNAME=admin
- - ELASTIC_PASSWORD=admin
+ - ELASTICSEARCH_URL=https://elasticsearch:9200
+ - ELASTIC_USERNAME=elastic
+ - ELASTIC_PASSWORD=SecretPassword
- FILEBEAT_SSL_VERIFICATION_MODE=none
+ - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt
+ - SSL_CERTIFICATE=/etc/ssl/wazuh.crt
+ - SSL_KEY=/etc/ssl/wazuh.key
volumes:
- ossec_api_configuration:/var/ossec/api/configuration
- ossec_etc:/var/ossec/etc
@@ -33,6 +36,10 @@ services:
- ossec_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
+ - ./xpack/ca/ca.crt:/etc/ssl/ca.crt
+ - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt
+ - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key
+
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
@@ -41,11 +48,24 @@ services:
ports:
- "9200:9200"
environment:
- - discovery.type=single-node
- cluster.name=wazuh-cluster
- - network.host=0.0.0.0
+ - node.name=elasticsearch
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
- bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
ulimits:
memlock:
soft: -1
@@ -53,6 +73,82 @@ services:
nofile:
soft: 65536
hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+ elasticsearch2:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ hostname: elasticsearch2
+ restart: always
+ environment:
+ - cluster.name=wazuh-cluster
+ - node.name=elasticsearch2
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+ elasticsearch3:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ hostname: elasticsearch3
+ restart: always
+ environment:
+ - cluster.name=wazuh-cluster
+ - node.name=elasticsearch3
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+
kibana:
build: kibana/
@@ -60,11 +156,22 @@ services:
hostname: kibana
restart: always
ports:
- - 5601:5601
+ - 443:5601
environment:
- - ELASTICSEARCH_USERNAME=admin
- - ELASTICSEARCH_PASSWORD=admin
- - ELASTICSEARCH_URL=http://elasticsearch:9200
+ - SERVERNAME=localhost
+ - ELASTICSEARCH_USERNAME=elastic
+ - ELASTICSEARCH_PASSWORD=SecretPassword
+ - ELASTICSEARCH_URL=https://elasticsearch:9200
+ - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
+ - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt
+ - SERVER_SSL_ENABLED=true
+ - XPACK_SECURITY_ENABLED=true
+ - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key
+ - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt
+ - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key
+ - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt
depends_on:
- elasticsearch
links:
From 6d231cea90a86a0e549987f11c606ce159244a43 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 4 Feb 2021 18:26:04 +0100
Subject: [PATCH 29/53] Add generate-elasticsearch-certs.yml and instances.yml
---
generate-elasticsearch-certs.yml | 17 ++++++++++++++++
xpack/instances.yml | 35 ++++++++++++++++++++++++++++++++
2 files changed, 52 insertions(+)
create mode 100644 generate-elasticsearch-certs.yml
create mode 100644 xpack/instances.yml
diff --git a/generate-elasticsearch-certs.yml b/generate-elasticsearch-certs.yml
new file mode 100644
index 00000000..194696f6
--- /dev/null
+++ b/generate-elasticsearch-certs.yml
@@ -0,0 +1,17 @@
+version: '2.2'
+
+services:
+ create_certs:
+ container_name: create_certs
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ command: >
+ bash -c '
+ if [[ ! -f config/certificates/bundle.zip ]]; then
+ bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out config/certificates/bundle.zip;
+ unzip config/certificates/bundle.zip -d config/certificates/;
+ fi;
+ chown -R 1000:0 /certs
+ '
+ user: "0"
+ working_dir: /usr/share/elasticsearch
+ volumes: ['./xpack:/usr/share/elasticsearch/config/certificates']
diff --git a/xpack/instances.yml b/xpack/instances.yml
new file mode 100644
index 00000000..a6a61904
--- /dev/null
+++ b/xpack/instances.yml
@@ -0,0 +1,35 @@
+instances:
+ - name: elasticsearch
+ dns:
+ - elasticsearch
+ - localhost
+ ip:
+ - 127.0.0.1
+
+ - name: elasticsearch2
+ dns:
+ - elasticsearch2
+ - localhost
+ ip:
+ - 127.0.0.1
+
+ - name: elasticsearch3
+ dns:
+ - elasticsearch3
+ - localhost
+ ip:
+ - 127.0.0.1
+
+ - name: kibana
+ dns:
+ - kibana
+ - localhost
+ ip:
+ - 127.0.0.1
+
+ - name: wazuh
+ dns:
+ - wazuh
+ - localhost
+ ip:
+ - 127.0.0.1
\ No newline at end of file
From a4646f388af90a6174feddb6c4cd65503dcbec98 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Thu, 4 Feb 2021 18:33:04 +0100
Subject: [PATCH 30/53] Rename cert generator container name
---
generate-elasticsearch-certs.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/generate-elasticsearch-certs.yml b/generate-elasticsearch-certs.yml
index 194696f6..f2e3b8cf 100644
--- a/generate-elasticsearch-certs.yml
+++ b/generate-elasticsearch-certs.yml
@@ -1,8 +1,8 @@
version: '2.2'
services:
- create_certs:
- container_name: create_certs
+ generator:
+ container_name: generator
image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
command: >
bash -c '
From 249c1adb8c78c1fbea54af1dc12bd88a612779cd Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Fri, 5 Feb 2021 16:13:48 +0100
Subject: [PATCH 31/53] Remove dev tag from version
---
xpack-compose.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 52025636..ad4720ae 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.9.3
- image: wazuh/wazuh:4.0.4_7.9.3_dev
+ image: wazuh/wazuh:4.0.4_7.9.3
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.0.4_7.9.3_dev
+ image: wazuh/wazuh-kibana:4.0.4_7.9.3
hostname: kibana
restart: always
ports:
From 4cc0eeea2e3a517720965904ec81d8a6fb1ad44a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 15 Feb 2021 18:02:24 +0100
Subject: [PATCH 32/53] Add goss binary for health checks
---
wazuh-odfe/Dockerfile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index d9dbc63f..c855dd07 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -22,6 +22,8 @@ RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_
RUN curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
+RUN curl -L https://github.com/aelsabbahy/goss/releases/latest/download/goss-linux-amd64 -o /usr/local/bin/goss && chmod +rx /usr/local/bin/goss
+
ARG S6_VERSION="v2.2.0.1"
RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \
From 6b2780e221990e716b85809f08b3ac364c8ab15d Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 16 Feb 2021 17:09:09 +0100
Subject: [PATCH 33/53] Update version
---
VERSION | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/VERSION b/VERSION
index 7563f1f1..37c74115 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.0.4_1.11.0"
-REVISION="40400"
+WAZUH-DOCKER_VERSION="4.1.0"
+REVISION="41000"
From 2f683e43c6a41bad94160364f508b69a2d7e145b Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 16 Feb 2021 17:09:28 +0100
Subject: [PATCH 34/53] Bump odfe version
---
build-from-sources.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/build-from-sources.yml b/build-from-sources.yml
index 49120850..14e21304 100644
--- a/build-from-sources.yml
+++ b/build-from-sources.yml
@@ -31,7 +31,7 @@ services:
- filebeat_var:/var/lib/filebeat
elasticsearch:
- image: amazon/opendistro-for-elasticsearch:1.11.0
+ image: amazon/opendistro-for-elasticsearch:1.12.0
hostname: elasticsearch
restart: always
ports:
From 574a0147eab5b07245b4b5323e7d8cf7454a0225 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 16 Feb 2021 17:16:55 +0100
Subject: [PATCH 35/53] Update compatibility matrix
---
README.md | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/README.md b/README.md
index 257810a5..b559095d 100644
--- a/README.md
+++ b/README.md
@@ -148,22 +148,24 @@ ADMIN_PRIVILEGES=true # App privileges
* `4.0` branch on correspond to the latest Wazuh-Docker stable version.
* `master` branch contains the latest code, be aware of possible bugs on this branch.
-* `Wazuh.Version_ElasticStack.Version` (for example 3.13.1_7.8.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
+* `Wazuh.Version` (for example 3.13.1_7.8.0 or 4.1.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
## Compatibility Matrix
-| Wazuh version | ODFE |
-|---------------|---------|
-| v4.0.4 | 1.11.0 |
-|---------------|---------|
-| v4.0.3 | 1.11.0 |
-|---------------|---------|
-| v4.0.2 | 1.11.0 |
-|---------------|---------|
-| v4.0.1 | 1.11.0 |
-|---------------|---------|
-| v4.0.0 | 1.10.1 |
+| Wazuh version | ODFE | XPACK |
+|---------------|---------|--------|
+| v4.1.0 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
+| v4.0.4 | 1.11.0 | |
+|---------------|---------|--------|
+| v4.0.3 | 1.11.0 | |
+|---------------|---------|--------|
+| v4.0.2 | 1.11.0 | |
+|---------------|---------|--------|
+| v4.0.1 | 1.11.0 | |
+|---------------|---------|--------|
+| v4.0.0 | 1.10.1 | |
## Credits and Thank you
From 7ddc4daed1a15f2950a3e1f70cb1e71690983854 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 16 Feb 2021 17:17:54 +0100
Subject: [PATCH 36/53] Bump versions
---
wazuh-odfe/Dockerfile | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index c855dd07..fe308504 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -2,8 +2,8 @@
FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
-ARG FILEBEAT_VERSION=7.9.1
-ARG WAZUH_VERSION=4.0.4-1
+ARG FILEBEAT_VERSION=7.10.0
+ARG WAZUH_VERSION=4.1.0-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
@@ -24,7 +24,7 @@ RUN curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | t
RUN curl -L https://github.com/aelsabbahy/goss/releases/latest/download/goss-linux-amd64 -o /usr/local/bin/goss && chmod +rx /usr/local/bin/goss
-ARG S6_VERSION="v2.2.0.1"
+ARG S6_VERSION="v2.2.0.3"
RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \
tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
From fceb9f0e07fa1c0929b6c54a7c13c7d529cc3ff0 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Tue, 16 Feb 2021 17:19:08 +0100
Subject: [PATCH 37/53] Bump versions and update path
---
kibana-odfe/Dockerfile | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index de07eac0..bebc0480 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -1,8 +1,8 @@
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-FROM amazon/opendistro-for-elasticsearch-kibana:1.11.0
+FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0
USER kibana
-ARG ELASTIC_VERSION=7.9.1
-ARG WAZUH_VERSION=4.0.4
+ARG ELASTIC_VERSION=7.10.0
+ARG WAZUH_VERSION=4.1.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
@@ -42,7 +42,6 @@ ENV PATTERN="" \
ADMIN_PRIVILEGES=""
USER kibana
-RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
COPY ./config/custom_welcome /tmp/custom_welcome
COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
@@ -50,7 +49,7 @@ RUN chmod +x ./welcome_wazuh.sh
ARG CHANGE_WELCOME="true"
RUN ./welcome_wazuh.sh
-COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/optimize/wazuh/config/wazuh.yml
+COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
RUN chmod +x ./wazuh_app_config.sh
From f23f7fafabb7c4c1fe8ab27889c7e4b3a66998b0 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 14:07:55 +0100
Subject: [PATCH 38/53] Update paths
---
kibana-odfe/config/wazuh_app_config.sh | 2 +-
kibana-odfe/config/welcome_wazuh.sh | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/kibana-odfe/config/wazuh_app_config.sh b/kibana-odfe/config/wazuh_app_config.sh
index c08980a5..fddf93b4 100644
--- a/kibana-odfe/config/wazuh_app_config.sh
+++ b/kibana-odfe/config/wazuh_app_config.sh
@@ -6,7 +6,7 @@ wazuh_port="${API_PORT:-55000}"
api_username="${API_USERNAME:-wazuh-wui}"
api_password="${API_PASSWORD:-wazuh-wui}"
-kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
+kibana_config_file="/usr/share/kibana/data/wazuh/config/wazuh.yml"
declare -A CONFIG_MAP=(
[pattern]=$PATTERN
diff --git a/kibana-odfe/config/welcome_wazuh.sh b/kibana-odfe/config/welcome_wazuh.sh
index 50b1d56e..b0bcfc70 100644
--- a/kibana-odfe/config/welcome_wazuh.sh
+++ b/kibana-odfe/config/welcome_wazuh.sh
@@ -8,7 +8,7 @@ then
echo "Set custom welcome styles"
cp -f /tmp/custom_welcome/template.js.hbs /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs
- cp -f /tmp/custom_welcome/light_theme.style.css /usr/share/kibana/optimize/bundles/light_theme.style.css
- cp -f /tmp/custom_welcome/*svg /usr/share/kibana/optimize/bundles/
+ cp -f /tmp/custom_welcome/light_theme.style.css /usr/share/kibana/src/core/server/core_app/assets/legacy_light_theme.css
+ cp -f /tmp/custom_welcome/*svg /usr/share/kibana/src/core/server/core_app/assets/
fi
From b76adb084d704c693fa2a82b2f5c1bdfc1231c8a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 14:43:59 +0100
Subject: [PATCH 39/53] Bump xpack images
---
xpack-compose.yml | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/xpack-compose.yml b/xpack-compose.yml
index ad4720ae..528fc299 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -7,8 +7,8 @@ services:
context: wazuh-odfe/
args:
- FILEBEAT_CHANNEL=filebeat
- - FILEBEAT_VERSION=7.9.3
- image: wazuh/wazuh:4.0.4_7.9.3
+ - FILEBEAT_VERSION=7.10.2
+ image: wazuh/wazuh:4.1.0_7.10.2
hostname: wazuh-manager
restart: always
ports:
@@ -42,7 +42,7 @@ services:
elasticsearch:
- image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
hostname: elasticsearch
restart: always
ports:
@@ -79,7 +79,7 @@ services:
- ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
elasticsearch2:
- image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
hostname: elasticsearch2
restart: always
environment:
@@ -114,7 +114,7 @@ services:
- ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
elasticsearch3:
- image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
hostname: elasticsearch3
restart: always
environment:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.0.4_7.9.3
+ image: wazuh/wazuh-kibana:4.1.0_7.10.2
hostname: kibana
restart: always
ports:
From 63a32590b0c8f48801783b2c0e61dfcb2f8594a0 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 14:44:09 +0100
Subject: [PATCH 40/53] Bump odfe images
---
docker-compose.yml | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/docker-compose.yml b/docker-compose.yml
index 12686ea3..35656427 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.0.4_1.11.0
+ image: wazuh/wazuh-odfe:4.1.0
hostname: wazuh-manager
restart: always
ports:
@@ -30,7 +30,7 @@ services:
- filebeat_var:/var/lib/filebeat
elasticsearch:
- image: amazon/opendistro-for-elasticsearch:1.11.0
+ image: amazon/opendistro-for-elasticsearch:1.12.0
hostname: elasticsearch
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.0.4_1.11.0
+ image: wazuh/wazuh-kibana-odfe:4.1.0
hostname: kibana
restart: always
ports:
From c0a65c4ba6fd72ed48abbfa4866ef1b5c7310c92 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 14:53:52 +0100
Subject: [PATCH 41/53] Update Goss tests
---
.goss.kibana.yaml | 8 ++++----
.goss.yaml | 4 ++--
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/.goss.kibana.yaml b/.goss.kibana.yaml
index b5c0ea6b..8a29ce3c 100644
--- a/.goss.kibana.yaml
+++ b/.goss.kibana.yaml
@@ -6,28 +6,28 @@ file:
group: root
filetype: file
contains: []
- /usr/share/kibana/optimize/bundles/light_theme.style.css:
+ /usr/share/kibana/src/core/server/core_app/assets/legacy_light_theme.css:
exists: true
mode: "0664"
owner: kibana
group: root
filetype: file
contains: []
- /usr/share/kibana/optimize/bundles/wazuh_logo_circle.svg:
+ /usr/share/kibana/src/core/server/core_app/assets/wazuh_logo_circle.svg:
exists: true
mode: "0644"
owner: kibana
group: root
filetype: file
contains: []
- /usr/share/kibana/optimize/bundles/wazuh_wazuh_bg.svg:
+ /usr/share/kibana/src/core/server/core_app/assets/wazuh_wazuh_bg.svg:
exists: true
mode: "0644"
owner: kibana
group: root
filetype: file
contains: []
- /usr/share/kibana/optimize/wazuh/config/wazuh.yml:
+ /usr/share/kibana/data/wazuh/config/wazuh.yml:
exists: true
mode: "0644"
owner: kibana
diff --git a/.goss.yaml b/.goss.yaml
index 1d84c367..7901f2cb 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -52,11 +52,11 @@ package:
filebeat:
installed: true
versions:
- - 7.9.1
+ - 7.10.0
wazuh-manager:
installed: true
versions:
- - 4.0.4
+ - 4.1.0
port:
tcp:1514:
listening: true
From 01f8dfc46e528b8522262e29062b114e06531d26 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 14:54:04 +0100
Subject: [PATCH 42/53] Update xpack compose
---
xpack-compose.yml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 528fc299..465bc646 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- image: wazuh/wazuh:4.1.0_7.10.2
+ image: wazuh/wazuh:4.1.0
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.1.0_7.10.2
+ image: wazuh/wazuh-kibana:4.1.0
hostname: kibana
restart: always
ports:
From 21f37d6765a5e02e5cbe393f541189c7f8e52294 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 15:41:47 +0100
Subject: [PATCH 43/53] Update changelog
---
CHANGELOG.md | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ad21a86..2c5c4037 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.1.0
+
+- Update Wazuh to version [4.1.0](https://github.com/wazuh/wazuh/blob/v4.1.0/CHANGELOG.md#v410)
+- Update ODFE compatibility to version 1.12.0
+- Add support for Elasticsearch (xpack) images once again (7.10.2) ([@xr09](https://github.com/xr09)) [#409](https://github.com/wazuh/wazuh-docker/pull/409)
+- Re-enable entrypoint scripts ([@xr09](https://github.com/xr09)) [#435](https://github.com/wazuh/wazuh-docker/pull/435)
+- Add Goss binary for healthchecks ([@xr09](https://github.com/xr09)) [$441](https://github.com/wazuh/wazuh-docker/pull/441)
+- Update s6-overlay to latest version
## Wazuh Docker v4.0.4_1.11.0
From ad9aa18966e26a5944a708eaa96d04535bbe7c74 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 15:51:45 +0100
Subject: [PATCH 44/53] Bump images on prod cluster
---
production-cluster.yml | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/production-cluster.yml b/production-cluster.yml
index f6b30281..c214c6ae 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.0.4_1.11.0
+ image: wazuh/wazuh-odfe:4.1.0
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.0.4_1.11.0
+ image: wazuh/wazuh-odfe:4.1.0
hostname: wazuh-worker
restart: always
environment:
@@ -67,7 +67,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
elasticsearch:
- image: amazon/opendistro-for-elasticsearch:1.11.0
+ image: amazon/opendistro-for-elasticsearch:1.12.0
hostname: elasticsearch
restart: always
ports:
@@ -90,7 +90,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
elasticsearch-2:
- image: amazon/opendistro-for-elasticsearch:1.11.0
+ image: amazon/opendistro-for-elasticsearch:1.12.0
hostname: elasticsearch-2
restart: always
environment:
@@ -111,7 +111,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
elasticsearch-3:
- image: amazon/opendistro-for-elasticsearch:1.11.0
+ image: amazon/opendistro-for-elasticsearch:1.12.0
hostname: elasticsearch-3
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.0.4_1.11.0
+ image: wazuh/wazuh-kibana-odfe:4.1.0
hostname: kibana
restart: always
ports:
From 02965be924153e01c6d174ad309aca48fc9e7c9f Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 16:31:49 +0100
Subject: [PATCH 45/53] Fix changelog
---
CHANGELOG.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c5c4037..0ced89db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
# Change Log
All notable changes to this project will be documented in this file.
## Wazuh Docker v4.1.0
+### Added
- Update Wazuh to version [4.1.0](https://github.com/wazuh/wazuh/blob/v4.1.0/CHANGELOG.md#v410)
- Update ODFE compatibility to version 1.12.0
From ed5f8c081636b72376731fdbb914874b34525c55 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 16:39:44 +0100
Subject: [PATCH 46/53] Fix elastic version
---
generate-elasticsearch-certs.yml | 2 +-
kibana/Dockerfile | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/generate-elasticsearch-certs.yml b/generate-elasticsearch-certs.yml
index f2e3b8cf..e777e881 100644
--- a/generate-elasticsearch-certs.yml
+++ b/generate-elasticsearch-certs.yml
@@ -3,7 +3,7 @@ version: '2.2'
services:
generator:
container_name: generator
- image: docker.elastic.co/elasticsearch/elasticsearch:7.9.3
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
command: >
bash -c '
if [[ ! -f config/certificates/bundle.zip ]]; then
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 69ad44fa..75de7a92 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -1,8 +1,8 @@
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana:7.9.3
+FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
-ARG ELASTIC_VERSION=7.9.3
-ARG WAZUH_VERSION=4.0.4
+ARG ELASTIC_VERSION=7.10.2
+ARG WAZUH_VERSION=4.1.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
From 8a93c8fe3ae87515c536c9a43837ac0d452dc6a6 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 17:40:19 +0100
Subject: [PATCH 47/53] Fix curl ssl check
---
kibana/config/kibana_settings.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh
index b883b31b..f62054f1 100644
--- a/kibana/config/kibana_settings.sh
+++ b/kibana/config/kibana_settings.sh
@@ -74,6 +74,6 @@ curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "C
sleep 5
# Do not ask user to help providing usage statistics to Elastic
-curl -POST "$kibana_proto://127.0.0.1:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
+curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
echo "End settings"
From 5fa1d1eeb6092ec9fceded89aa6d03dd697b73c2 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 17:45:05 +0100
Subject: [PATCH 48/53] Update kibana xpack paths
---
kibana/Dockerfile | 3 +--
kibana/config/wazuh_app_config.sh | 2 +-
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 75de7a92..f1be86dd 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -45,14 +45,13 @@ ENV PATTERN="" \
WORKDIR /
USER kibana
-RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh
RUN chmod 755 ./entrypoint.sh
RUN printf "\nserver.defaultRoute: /app/wazuh\n" >> /usr/share/kibana/config/kibana.yml
-COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/optimize/wazuh/config/wazuh.yml
+COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
RUN chmod +x ./wazuh_app_config.sh
diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh
index c08980a5..fddf93b4 100644
--- a/kibana/config/wazuh_app_config.sh
+++ b/kibana/config/wazuh_app_config.sh
@@ -6,7 +6,7 @@ wazuh_port="${API_PORT:-55000}"
api_username="${API_USERNAME:-wazuh-wui}"
api_password="${API_PASSWORD:-wazuh-wui}"
-kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
+kibana_config_file="/usr/share/kibana/data/wazuh/config/wazuh.yml"
declare -A CONFIG_MAP=(
[pattern]=$PATTERN
From c14606813809c9741f124bf8564f44bb5dc417e5 Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Wed, 17 Feb 2021 17:54:09 +0100
Subject: [PATCH 49/53] Add xpack-from-sources
---
xpack-compose.yml | 6 --
xpack-from-sources.yml | 192 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 192 insertions(+), 6 deletions(-)
create mode 100644 xpack-from-sources.yml
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 465bc646..da4c2290 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,11 +3,6 @@ version: '3.7'
services:
wazuh:
- build:
- context: wazuh-odfe/
- args:
- - FILEBEAT_CHANNEL=filebeat
- - FILEBEAT_VERSION=7.10.2
image: wazuh/wazuh:4.1.0
hostname: wazuh-manager
restart: always
@@ -151,7 +146,6 @@ services:
kibana:
- build: kibana/
image: wazuh/wazuh-kibana:4.1.0
hostname: kibana
restart: always
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
new file mode 100644
index 00000000..465bc646
--- /dev/null
+++ b/xpack-from-sources.yml
@@ -0,0 +1,192 @@
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+version: '3.7'
+
+services:
+ wazuh:
+ build:
+ context: wazuh-odfe/
+ args:
+ - FILEBEAT_CHANNEL=filebeat
+ - FILEBEAT_VERSION=7.10.2
+ image: wazuh/wazuh:4.1.0
+ hostname: wazuh-manager
+ restart: always
+ ports:
+ - "1514:1514"
+ - "1515:1515"
+ - "514:514/udp"
+ - "55000:55000"
+ environment:
+ - ELASTICSEARCH_URL=https://elasticsearch:9200
+ - ELASTIC_USERNAME=elastic
+ - ELASTIC_PASSWORD=SecretPassword
+ - FILEBEAT_SSL_VERIFICATION_MODE=none
+ - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt
+ - SSL_CERTIFICATE=/etc/ssl/wazuh.crt
+ - SSL_KEY=/etc/ssl/wazuh.key
+ volumes:
+ - ossec_api_configuration:/var/ossec/api/configuration
+ - ossec_etc:/var/ossec/etc
+ - ossec_logs:/var/ossec/logs
+ - ossec_queue:/var/ossec/queue
+ - ossec_var_multigroups:/var/ossec/var/multigroups
+ - ossec_integrations:/var/ossec/integrations
+ - ossec_active_response:/var/ossec/active-response/bin
+ - ossec_agentless:/var/ossec/agentless
+ - ossec_wodles:/var/ossec/wodles
+ - filebeat_etc:/etc/filebeat
+ - filebeat_var:/var/lib/filebeat
+ - ./xpack/ca/ca.crt:/etc/ssl/ca.crt
+ - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt
+ - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key
+
+
+ elasticsearch:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
+ hostname: elasticsearch
+ restart: always
+ ports:
+ - "9200:9200"
+ environment:
+ - cluster.name=wazuh-cluster
+ - node.name=elasticsearch
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+ elasticsearch2:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
+ hostname: elasticsearch2
+ restart: always
+ environment:
+ - cluster.name=wazuh-cluster
+ - node.name=elasticsearch2
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+ elasticsearch3:
+ image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
+ hostname: elasticsearch3
+ restart: always
+ environment:
+ - cluster.name=wazuh-cluster
+ - node.name=elasticsearch3
+ - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3
+ - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3
+ - ELASTIC_PASSWORD=SecretPassword
+ - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+ - bootstrap.memory_lock=true
+ - xpack.license.self_generated.type=basic
+ - xpack.security.enabled=true
+ - xpack.security.http.ssl.enabled=true
+ - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ - xpack.security.transport.ssl.enabled=true
+ - xpack.security.transport.ssl.verification_mode=certificate
+ - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt
+ - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key
+ - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt
+ ulimits:
+ memlock:
+ soft: -1
+ hard: -1
+ nofile:
+ soft: 65536
+ hard: 65536
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt
+ - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key
+ - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt
+
+
+
+ kibana:
+ build: kibana/
+ image: wazuh/wazuh-kibana:4.1.0
+ hostname: kibana
+ restart: always
+ ports:
+ - 443:5601
+ environment:
+ - SERVERNAME=localhost
+ - ELASTICSEARCH_USERNAME=elastic
+ - ELASTICSEARCH_PASSWORD=SecretPassword
+ - ELASTICSEARCH_URL=https://elasticsearch:9200
+ - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
+ - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt
+ - SERVER_SSL_ENABLED=true
+ - XPACK_SECURITY_ENABLED=true
+ - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key
+ - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt
+ volumes:
+ - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt
+ - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key
+ - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt
+ depends_on:
+ - elasticsearch
+ links:
+ - elasticsearch:elasticsearch
+ - wazuh:wazuh
+
+volumes:
+ ossec_api_configuration:
+ ossec_etc:
+ ossec_logs:
+ ossec_queue:
+ ossec_var_multigroups:
+ ossec_integrations:
+ ossec_active_response:
+ ossec_agentless:
+ ossec_wodles:
+ filebeat_etc:
+ filebeat_var:
From 67fd91da9b58210785fd74ad7054035f94aa717a Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <1380243+xr09@users.noreply.github.com>
Date: Mon, 22 Feb 2021 12:31:59 +0100
Subject: [PATCH 50/53] Bump to 4.1.1
---
.goss.yaml | 2 +-
CHANGELOG.md | 6 ++++++
README.md | 2 ++
VERSION | 4 ++--
docker-compose.yml | 4 ++--
kibana-odfe/Dockerfile | 2 +-
kibana/Dockerfile | 2 +-
production-cluster.yml | 6 +++---
wazuh-odfe/Dockerfile | 2 +-
xpack-compose.yml | 4 ++--
xpack-from-sources.yml | 4 ++--
11 files changed, 23 insertions(+), 15 deletions(-)
diff --git a/.goss.yaml b/.goss.yaml
index 7901f2cb..2b78a8fa 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.1.0
+ - 4.1.1
port:
tcp:1514:
listening: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ced89db..4ebeb27d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
# Change Log
All notable changes to this project will be documented in this file.
+
+## Wazuh Docker v4.1.1
+### Added
+
+- Update Wazuh to version [4.1.1](https://github.com/wazuh/wazuh/blob/v4.1.1/CHANGELOG.md#v411)
+
## Wazuh Docker v4.1.0
### Added
diff --git a/README.md b/README.md
index b559095d..9b68bd2b 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,8 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.1.1 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
| v4.1.0 | 1.12.0 | 7.10.2 |
|---------------|---------|--------|
| v4.0.4 | 1.11.0 | |
diff --git a/VERSION b/VERSION
index 37c74115..648c321b 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.1.0"
-REVISION="41000"
+WAZUH-DOCKER_VERSION="4.1.1"
+REVISION="41100"
diff --git a/docker-compose.yml b/docker-compose.yml
index 35656427..435819f0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.1.0
+ image: wazuh/wazuh-odfe:4.1.1
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.0
+ image: wazuh/wazuh-kibana-odfe:4.1.1
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index bebc0480..be721de6 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0
USER kibana
ARG ELASTIC_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.0
+ARG WAZUH_VERSION=4.1.1
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index f1be86dd..4abf6e1c 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.1.0
+ARG WAZUH_VERSION=4.1.1
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index c214c6ae..dda505a8 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.1.0
+ image: wazuh/wazuh-odfe:4.1.1
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.1.0
+ image: wazuh/wazuh-odfe:4.1.1
hostname: wazuh-worker
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.0
+ image: wazuh/wazuh-kibana-odfe:4.1.1
hostname: kibana
restart: always
ports:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index fe308504..5a717e7f 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.0-1
+ARG WAZUH_VERSION=4.1.1-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index da4c2290..a439aaff 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.1.0
+ image: wazuh/wazuh:4.1.1
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.1.0
+ image: wazuh/wazuh-kibana:4.1.1
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index 465bc646..ce456f16 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- image: wazuh/wazuh:4.1.0
+ image: wazuh/wazuh:4.1.1
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.1.0
+ image: wazuh/wazuh-kibana:4.1.1
hostname: kibana
restart: always
ports:
From 10a02f88faacef18c62d59ff12be1447c5cda892 Mon Sep 17 00:00:00 2001
From: Victor Moreno Jimenez
Date: Tue, 23 Mar 2021 16:03:39 +0100
Subject: [PATCH 51/53] Bump to 4.1.3
---
.goss.yaml | 2 +-
CHANGELOG.md | 10 ++++++++++
README.md | 4 ++++
VERSION | 2 +-
docker-compose.yml | 4 ++--
kibana-odfe/Dockerfile | 2 +-
kibana/Dockerfile | 2 +-
production-cluster.yml | 6 +++---
wazuh-odfe/Dockerfile | 2 +-
xpack-compose.yml | 4 ++--
xpack-from-sources.yml | 4 ++--
11 files changed, 28 insertions(+), 14 deletions(-)
diff --git a/.goss.yaml b/.goss.yaml
index 2b78a8fa..e5ba827d 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.1.1
+ - 4.1.3
port:
tcp:1514:
listening: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ebeb27d..91f3d422 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,16 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.1.3
+### Added
+
+- Update Wazuh to version [4.1.3](https://github.com/wazuh/wazuh/blob/v4.1.3/CHANGELOG.md#v413)
+
+## Wazuh Docker v4.1.2
+### Added
+
+- Update Wazuh to version [4.1.2](https://github.com/wazuh/wazuh/blob/v4.1.2/CHANGELOG.md#v412)
+
## Wazuh Docker v4.1.1
### Added
diff --git a/README.md b/README.md
index 9b68bd2b..dfeacf7a 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,10 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.1.3 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
+| v4.1.2 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
| v4.1.1 | 1.12.0 | 7.10.2 |
|---------------|---------|--------|
| v4.1.0 | 1.12.0 | 7.10.2 |
diff --git a/VERSION b/VERSION
index 648c321b..cc64d984 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.1.1"
+WAZUH-DOCKER_VERSION="4.1.3"
REVISION="41100"
diff --git a/docker-compose.yml b/docker-compose.yml
index 435819f0..0d100f80 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.1.1
+ image: wazuh/wazuh-odfe:4.1.3
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.1
+ image: wazuh/wazuh-kibana-odfe:4.1.3
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index be721de6..b08355a8 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0
USER kibana
ARG ELASTIC_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.1
+ARG WAZUH_VERSION=4.1.3
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 4abf6e1c..8627ab0f 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.1.1
+ARG WAZUH_VERSION=4.1.3
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index dda505a8..67576a64 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.1.1
+ image: wazuh/wazuh-odfe:4.1.3
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.1.1
+ image: wazuh/wazuh-odfe:4.1.3
hostname: wazuh-worker
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.1
+ image: wazuh/wazuh-kibana-odfe:4.1.3
hostname: kibana
restart: always
ports:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 5a717e7f..9f9c4c7c 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.1-1
+ARG WAZUH_VERSION=4.1.3-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index a439aaff..41895392 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.1.1
+ image: wazuh/wazuh:4.1.3
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.1.1
+ image: wazuh/wazuh-kibana:4.1.3
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index ce456f16..8e47c761 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- image: wazuh/wazuh:4.1.1
+ image: wazuh/wazuh:4.1.3
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.1.1
+ image: wazuh/wazuh-kibana:4.1.3
hostname: kibana
restart: always
ports:
From 1dad6eb83ec2bc51cbb076a5fc1c49550875f7f4 Mon Sep 17 00:00:00 2001
From: Victor Moreno Jimenez
Date: Fri, 26 Mar 2021 08:59:23 +0100
Subject: [PATCH 52/53] Bump to v4.1.4
---
.goss.yaml | 2 +-
CHANGELOG.md | 5 +++++
README.md | 2 ++
VERSION | 2 +-
docker-compose.yml | 4 ++--
kibana-odfe/Dockerfile | 2 +-
kibana/Dockerfile | 2 +-
production-cluster.yml | 6 +++---
wazuh-odfe/Dockerfile | 2 +-
xpack-compose.yml | 4 ++--
xpack-from-sources.yml | 4 ++--
11 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/.goss.yaml b/.goss.yaml
index e5ba827d..b5f3796b 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.1.3
+ - 4.1.4
port:
tcp:1514:
listening: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 91f3d422..4180c4b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.1.4
+### Added
+
+- Update Wazuh to version [4.1.4](https://github.com/wazuh/wazuh/blob/v4.1.4/CHANGELOG.md#v414)
+
## Wazuh Docker v4.1.3
### Added
diff --git a/README.md b/README.md
index dfeacf7a..1d8d45dc 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,8 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.1.4 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
| v4.1.3 | 1.12.0 | 7.10.2 |
|---------------|---------|--------|
| v4.1.2 | 1.12.0 | 7.10.2 |
diff --git a/VERSION b/VERSION
index cc64d984..9400c683 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.1.3"
+WAZUH-DOCKER_VERSION="4.1.4"
REVISION="41100"
diff --git a/docker-compose.yml b/docker-compose.yml
index 0d100f80..afda5fb5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.1.3
+ image: wazuh/wazuh-odfe:4.1.4
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.3
+ image: wazuh/wazuh-kibana-odfe:4.1.4
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index b08355a8..c5801882 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0
USER kibana
ARG ELASTIC_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.3
+ARG WAZUH_VERSION=4.1.4
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 8627ab0f..56a5c4de 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.1.3
+ARG WAZUH_VERSION=4.1.4
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index 67576a64..b68cbded 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.1.3
+ image: wazuh/wazuh-odfe:4.1.4
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.1.3
+ image: wazuh/wazuh-odfe:4.1.4
hostname: wazuh-worker
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.3
+ image: wazuh/wazuh-kibana-odfe:4.1.4
hostname: kibana
restart: always
ports:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 9f9c4c7c..00da5b88 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.3-1
+ARG WAZUH_VERSION=4.1.4-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 41895392..4271df4a 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.1.3
+ image: wazuh/wazuh:4.1.4
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.1.3
+ image: wazuh/wazuh-kibana:4.1.4
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index 8e47c761..309bf500 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- image: wazuh/wazuh:4.1.3
+ image: wazuh/wazuh:4.1.4
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.1.3
+ image: wazuh/wazuh-kibana:4.1.4
hostname: kibana
restart: always
ports:
From 3c1175b0a021e5960a947a6bf542eaf0dfba6997 Mon Sep 17 00:00:00 2001
From: VictorMorenoJimenez
Date: Tue, 13 Apr 2021 16:39:14 +0200
Subject: [PATCH 53/53] Bump to v4.2.0
---
.goss.yaml | 2 +-
CHANGELOG.md | 5 +++++
README.md | 2 ++
VERSION | 2 +-
docker-compose.yml | 4 ++--
kibana-odfe/Dockerfile | 2 +-
kibana/Dockerfile | 2 +-
production-cluster.yml | 6 +++---
wazuh-odfe/Dockerfile | 2 +-
xpack-compose.yml | 4 ++--
xpack-from-sources.yml | 4 ++--
11 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/.goss.yaml b/.goss.yaml
index b5f3796b..a0380493 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.1.4
+ - 4.2.0
port:
tcp:1514:
listening: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4180c4b7..edd03a8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.2.0
+### Added
+
+- Update Wazuh to version [4.2.0](https://github.com/wazuh/wazuh/blob/v4.2.0/CHANGELOG.md#v420)
+
## Wazuh Docker v4.1.4
### Added
diff --git a/README.md b/README.md
index 1d8d45dc..8ff10da5 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,8 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.2.0 | 1.12.0 | 7.10.2 |
+|---------------|---------|--------|
| v4.1.4 | 1.12.0 | 7.10.2 |
|---------------|---------|--------|
| v4.1.3 | 1.12.0 | 7.10.2 |
diff --git a/VERSION b/VERSION
index 9400c683..156da5c1 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.1.4"
+WAZUH-DOCKER_VERSION="4.2.0"
REVISION="41100"
diff --git a/docker-compose.yml b/docker-compose.yml
index afda5fb5..73d7b57c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.1.4
+ image: wazuh/wazuh-odfe:4.2.0
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.4
+ image: wazuh/wazuh-kibana-odfe:4.2.0
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index c5801882..b919d9bf 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0
USER kibana
ARG ELASTIC_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.4
+ARG WAZUH_VERSION=4.2.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 56a5c4de..2124b225 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.1.4
+ARG WAZUH_VERSION=4.2.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index b68cbded..b739bab7 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.1.4
+ image: wazuh/wazuh-odfe:4.2.0
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.1.4
+ image: wazuh/wazuh-odfe:4.2.0
hostname: wazuh-worker
restart: always
environment:
@@ -132,7 +132,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.1.4
+ image: wazuh/wazuh-kibana-odfe:4.2.0
hostname: kibana
restart: always
ports:
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 00da5b88..37723a8d 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.0
-ARG WAZUH_VERSION=4.1.4-1
+ARG WAZUH_VERSION=4.2.0-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 4271df4a..77017087 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.1.4
+ image: wazuh/wazuh:4.2.0
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.1.4
+ image: wazuh/wazuh-kibana:4.2.0
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index 309bf500..6265ecb7 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- image: wazuh/wazuh:4.1.4
+ image: wazuh/wazuh:4.2.0
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.1.4
+ image: wazuh/wazuh-kibana:4.2.0
hostname: kibana
restart: always
ports: