diff --git a/.goss.yaml b/.github/.goss.yaml similarity index 100% rename from .goss.yaml rename to .github/.goss.yaml diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3d74554e..4baac58a 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -28,4 +28,4 @@ jobs: run: dgoss run wazuh/wazuh-manager:4.3.0 env: GOSS_SLEEP: 30 - GOSS_FILE: .goss.yaml \ No newline at end of file + GOSS_FILE: .github/.goss.yaml \ No newline at end of file diff --git a/Migration-to-indexer-dashboard.md b/Migration-to-indexer-dashboard.md deleted file mode 100644 index cc38fb9c..00000000 --- a/Migration-to-indexer-dashboard.md +++ /dev/null @@ -1,69 +0,0 @@ -# Opendistro data migration to Wazuh indexer on docker. -This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2.5 to v4.3.0. - -## Procedure -Assuming that you have a v4.2.5 production deployment, perform the following steps. - -**1. Stop 4.2.5 environment** -`docker-compose -f production-cluster.yml stop` - -**2. List Elastic volumesStop 4.2.5 environment** -`docker volume ls --filter name='wazuh-docker_elastic-data'` - -**3. Inspect Elastic volume** -`docker volume inspect wazuh-docker_elastic-data-1` - -**4. Run the volume create command:** create 3 new Indexer volumes using the `com.docker.compose.version` label value from the previous command. -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-1 \ - wazuh-docker_wazuh-indexer-data-1 -``` -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-2 \ - wazuh-docker_wazuh-indexer-data-2 -``` -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-3 \ - wazuh-docker_wazuh-indexer-data-3 -``` - -**5. Copy the volume content from Elastic to Wazuh indexer volumes.** -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-1:/from \ - -v wazuh-docker_wazuh-indexer-data-1:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-2:/from \ - -v wazuh-docker_wazuh-indexer-data-2:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-3:/from \ - -v wazuh-docker_wazuh-indexer-data-3:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` - -**6. Delete the 4.2.5 environment.** -`docker-compose -f production-cluster.yml down` - -**7. Start the 4.3 environment.** -``` -git checkout 4.3 -docker-compose -f production-cluster.yml up -d -``` - -**8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file diff --git a/README.md b/README.md index 3fa14934..8419df5c 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ API_USERNAME="wazuh" # Wazuh API username API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements # (8+ length, uppercase, lowercase, specials chars) -INDEXER_URL=https://wazuh1.indexer:9200 # Wazuh indexer URL +INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL INDEXER_USERNAME=admin # Wazuh indexer Username INDEXER_PASSWORD=admin # Wazuh indexer Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) @@ -87,73 +87,102 @@ ADMIN_PRIVILEGES=true # App privileges ## Directory structure - ├── build-wazuh-images.yml + ├── build-docker-images + │   ├── docker-compose.yml + │   ├── wazuh-dashboard + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── opensearch_dashboards.yml + │   │   │   ├── wazuh_app_config.sh + │   │   │   └── wazuh.yml + │   │   └── Dockerfile + │   ├── wazuh-indexer + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── internal_users.yml + │   │   │   ├── opensearch.yml + │   │   │   ├── roles_mapping.yml + │   │   │   ├── roles.yml + │   │   │   └── securityadmin.sh + │   │   └── Dockerfile + │   └── wazuh-manager + │   ├── config + │   │   ├── create_user.py + │   │   ├── etc + │   │   │   ├── cont-init.d + │   │   │   │   ├── 0-wazuh-init + │   │   │   │   ├── 1-config-filebeat + │   │   │   │   └── 2-manager + │   │   │   └── services.d + │   │   │   ├── filebeat + │   │   │   │   ├── finish + │   │   │   │   └── run + │   │   │   └── ossec-logs + │   │   │   └── run + │   │   ├── filebeat.yml + │   │   ├── permanent_data.env + │   │   ├── permanent_data.sh + │   │   └── wazuh.repo + │   └── Dockerfile ├── CHANGELOG.md - ├── docker-compose.yml - ├── generate-indexer-certs.yml - ├── indexer_certs_creator - │ ├── config - │ │ └── entrypoint.sh - │ └── Dockerfile + ├── indexer-certs-creator + │   ├── config + │   │   └── entrypoint.sh + │   └── Dockerfile ├── LICENSE - ├── production_cluster - │ ├── nginx - │ │ ├── nginx.conf - │ │ └── ssl - │ │ └── generate-self-signed-cert.sh - │ ├── wazuh_cluster - │ │ ├── wazuh_manager.conf - │ │ └── wazuh_worker.conf - │ ├── wazuh_dashboard - │ │ ├── opensearch_dashboards.yml - │ │ └── wazuh.yml - │ ├── wazuh-indexer - │ │ ├── internal_users.yml - │ │ ├── wazuh1.indexer.yml - │ │ ├── wazuh2.indexer.yml - │ │ └── wazuh3.indexer.yml - │ └── wazuh_indexer_ssl_certs - │ └── certs.yml - ├── production-cluster.yml + ├── multi-node + │   ├── config + │   │   ├── nginx + │   │   │   └── nginx.conf + │   │   ├── wazuh_cluster + │   │   │   ├── wazuh_manager.conf + │   │   │   └── wazuh_worker.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   ├── wazuh1.indexer.yml + │   │   │   ├── wazuh2.indexer.yml + │   │   │   └── wazuh3.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   └── certs.yml + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   ├── Migration-to-Wazuh-4.3.md + │   └── volume-migrator.sh ├── README.md - ├── VERSION - ├── wazuh-dashboard - │ ├── config - │ │ ├── entrypoint.sh - │ │ ├── opensearch_dashboards.yml - │ │ ├── wazuh_app_config.sh - │ │ └── wazuh.yml - │ └── Dockerfile - ├── wazuh-indexer - │ ├── config - │ │ ├── config.sh - │ │ ├── config.yml - │ │ ├── entrypoint.sh - │ │ ├── internal_users.yml - │ │ ├── opensearch.yml - │ │ ├── roles_mapping.yml - │ │ ├── roles.yml - │ │ └── securityadmin.sh - │ └── Dockerfile - └── wazuh-manager - ├── config - │ ├── create_user.py - │ ├── etc - │ │ ├── cont-init.d - │ │ │ ├── 0-wazuh-init - │ │ │ ├── 1-config-filebeat - │ │ │ └── 2-manager - │ │ └── services.d - │ │ ├── filebeat - │ │ │ ├── finish - │ │ │ └── run - │ │ └── ossec-logs - │ │ └── run - │ ├── filebeat.yml - │ ├── permanent_data.env - │ ├── permanent_data.sh - │ └── wazuh.repo - └── Dockerfile + ├── single-node + │   ├── config + │   │   ├── wazuh_cluster + │   │   │   └── wazuh_manager.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   └── wazuh.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   ├── admin-key.pem + │   │   ├── admin.pem + │   │   ├── certs.yml + │   │   ├── root-ca.key + │   │   ├── root-ca.pem + │   │   ├── wazuh.dashboard-key.pem + │   │   ├── wazuh.dashboard.pem + │   │   ├── wazuh.indexer-key.pem + │   │   ├── wazuh.indexer.pem + │   │   ├── wazuh.manager-key.pem + │   │   └── wazuh.manager.pem + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   └── README.md + └── VERSION + ## Branches diff --git a/build-docker-images/README.md b/build-docker-images/README.md new file mode 100644 index 00000000..5839ac52 --- /dev/null +++ b/build-docker-images/README.md @@ -0,0 +1,13 @@ +# Wazuh Docker Image Builder + +This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command: + +``` +$ docker-compose up -d --build +``` + +Once the image creation process is finished, a Wazuh single-node environment will be spinned up. It can be terminated with the following command: + +``` +$ docker-compose down +``` diff --git a/build-wazuh-images.yml b/build-docker-images/docker-compose.yml similarity index 62% rename from build-wazuh-images.yml rename to build-docker-images/docker-compose.yml index e6ec7ed7..0d9b9524 100644 --- a/build-wazuh-images.yml +++ b/build-docker-images/docker-compose.yml @@ -13,27 +13,27 @@ services: - "514:514/udp" - "55000:55000" environment: - - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_URL=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - FILEBEAT_SSL_VERIFICATION_MODE=none volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - wazuh1.indexer: + wazuh.indexer: build: wazuh-indexer/ image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer + hostname: wazuh.indexer restart: always ports: - "9200:9200" @@ -60,20 +60,20 @@ services: - SERVER_SSL_ENABLED=false - WAZUH_API_URL=https://wazuh.manager depends_on: - - wazuh1.indexer + - wazuh.indexer links: - - wazuh1.indexer:wazuh1.indexer + - wazuh.indexer:wazuh.indexer - wazuh.manager:wazuh.manager volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: filebeat_etc: filebeat_var: diff --git a/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile similarity index 100% rename from wazuh-dashboard/Dockerfile rename to build-docker-images/wazuh-dashboard/Dockerfile diff --git a/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh similarity index 100% rename from wazuh-dashboard/config/config.sh rename to build-docker-images/wazuh-dashboard/config/config.sh diff --git a/wazuh-dashboard/config/config.yml b/build-docker-images/wazuh-dashboard/config/config.yml similarity index 100% rename from wazuh-dashboard/config/config.yml rename to build-docker-images/wazuh-dashboard/config/config.yml diff --git a/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh similarity index 100% rename from wazuh-dashboard/config/entrypoint.sh rename to build-docker-images/wazuh-dashboard/config/entrypoint.sh diff --git a/wazuh-dashboard/config/opensearch_dashboards.yml b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml similarity index 93% rename from wazuh-dashboard/config/opensearch_dashboards.yml rename to build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml index f7d70cce..bf8dc374 100644 --- a/wazuh-dashboard/config/opensearch_dashboards.yml +++ b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml @@ -1,6 +1,6 @@ server.host: 0.0.0.0 server.port: 443 -opensearch.hosts: https://wazuh1.indexer:9200 +opensearch.hosts: https://wazuh.indexer:9200 opensearch.ssl.verificationMode: none opensearch.requestHeadersWhitelist: [ authorization,securitytenant ] opensearch_security.multitenancy.enabled: true diff --git a/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml similarity index 100% rename from wazuh-dashboard/config/wazuh.yml rename to build-docker-images/wazuh-dashboard/config/wazuh.yml diff --git a/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh similarity index 100% rename from wazuh-dashboard/config/wazuh_app_config.sh rename to build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh diff --git a/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile similarity index 100% rename from wazuh-indexer/Dockerfile rename to build-docker-images/wazuh-indexer/Dockerfile diff --git a/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh similarity index 100% rename from wazuh-indexer/config/config.sh rename to build-docker-images/wazuh-indexer/config/config.sh diff --git a/wazuh-indexer/config/config.yml b/build-docker-images/wazuh-indexer/config/config.yml similarity index 100% rename from wazuh-indexer/config/config.yml rename to build-docker-images/wazuh-indexer/config/config.yml diff --git a/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh similarity index 100% rename from wazuh-indexer/config/entrypoint.sh rename to build-docker-images/wazuh-indexer/config/entrypoint.sh diff --git a/wazuh-indexer/config/internal_users.yml b/build-docker-images/wazuh-indexer/config/internal_users.yml similarity index 100% rename from wazuh-indexer/config/internal_users.yml rename to build-docker-images/wazuh-indexer/config/internal_users.yml diff --git a/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml similarity index 98% rename from wazuh-indexer/config/opensearch.yml rename to build-docker-images/wazuh-indexer/config/opensearch.yml index 915fe5a2..922e86e5 100644 --- a/wazuh-indexer/config/opensearch.yml +++ b/build-docker-images/wazuh-indexer/config/opensearch.yml @@ -1,5 +1,5 @@ network.host: "0.0.0.0" -node.name: "wazuh1.indexer" +node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node diff --git a/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml similarity index 100% rename from wazuh-indexer/config/roles.yml rename to build-docker-images/wazuh-indexer/config/roles.yml diff --git a/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml similarity index 100% rename from wazuh-indexer/config/roles_mapping.yml rename to build-docker-images/wazuh-indexer/config/roles_mapping.yml diff --git a/wazuh-indexer/config/securityadmin.sh b/build-docker-images/wazuh-indexer/config/securityadmin.sh similarity index 100% rename from wazuh-indexer/config/securityadmin.sh rename to build-docker-images/wazuh-indexer/config/securityadmin.sh diff --git a/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile similarity index 100% rename from wazuh-manager/Dockerfile rename to build-docker-images/wazuh-manager/Dockerfile diff --git a/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py similarity index 100% rename from wazuh-manager/config/create_user.py rename to build-docker-images/wazuh-manager/config/create_user.py diff --git a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/0-wazuh-init rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init diff --git a/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/1-config-filebeat rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat diff --git a/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/2-manager rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager diff --git a/wazuh-manager/config/etc/services.d/filebeat/finish b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/finish rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish diff --git a/wazuh-manager/config/etc/services.d/filebeat/run b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/run rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run diff --git a/wazuh-manager/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run similarity index 100% rename from wazuh-manager/config/etc/services.d/ossec-logs/run rename to build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run diff --git a/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml similarity index 91% rename from wazuh-manager/config/filebeat.yml rename to build-docker-images/wazuh-manager/config/filebeat.yml index 37003366..e9874fb4 100644 --- a/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -13,7 +13,7 @@ setup.template.json.name: 'wazuh' setup.template.overwrite: true setup.ilm.enabled: false output.elasticsearch: - hosts: ['https://wazuh1.indexer:9200'] + hosts: ['https://wazuh.indexer:9200'] #username: #password: #ssl.verification_mode: diff --git a/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env similarity index 100% rename from wazuh-manager/config/permanent_data.env rename to build-docker-images/wazuh-manager/config/permanent_data.env diff --git a/wazuh-manager/config/permanent_data.sh b/build-docker-images/wazuh-manager/config/permanent_data.sh similarity index 100% rename from wazuh-manager/config/permanent_data.sh rename to build-docker-images/wazuh-manager/config/permanent_data.sh diff --git a/wazuh-manager/config/wazuh.repo b/build-docker-images/wazuh-manager/config/wazuh.repo similarity index 100% rename from wazuh-manager/config/wazuh.repo rename to build-docker-images/wazuh-manager/config/wazuh.repo diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index 49515e47..00000000 --- a/docker-compose.yml +++ /dev/null @@ -1,75 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.manager: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none - volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 - hostname: wazuh.dashboard - restart: always - ports: - - 443:443 - environment: - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - WAZUH_API_URL=https://wazuh.manager - depends_on: - - wazuh1.indexer - links: - - wazuh1.indexer:wazuh1.indexer - - wazuh.manager:wazuh.manager - -volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: - filebeat_etc: - filebeat_var: diff --git a/indexer_certs_creator/Dockerfile b/indexer-certs-creator/Dockerfile similarity index 100% rename from indexer_certs_creator/Dockerfile rename to indexer-certs-creator/Dockerfile diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md new file mode 100644 index 00000000..b7dbc565 --- /dev/null +++ b/indexer-certs-creator/README.md @@ -0,0 +1,9 @@ +# Certificate creation image build + +The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks. + +To create the image, the following command must be executed: + +``` +$ docker build -t wazuh/wazuh-certs-generator:0.0.1 . +``` diff --git a/indexer_certs_creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh similarity index 100% rename from indexer_certs_creator/config/entrypoint.sh rename to indexer-certs-creator/config/entrypoint.sh diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.3.md new file mode 100644 index 00000000..5b884743 --- /dev/null +++ b/multi-node/Migration-to-Wazuh-4.3.md @@ -0,0 +1,360 @@ +# Opendistro data migration to Wazuh indexer on docker. +This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. +The example is migrating from v4.2 to v4.3. + +## Procedure +Assuming that you have a v4.2 production deployment, perform the following steps. + +**1. Stop 4.2 environment** +`docker-compose -f production-cluster.yml stop` + +**2. List elasticsearch volumes** +`docker volume ls --filter name='wazuh-docker_elastic-data'` + +**3. Inspect elasticsearch volume** +`docker volume inspect wazuh-docker_elastic-data-1` + +**4. Spin down the 4.2 environment.** +`docker-compose -f production-cluster.yml down` + +**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command. +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + multi-node_wazuh-indexer-data-1 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + multi-node_wazuh-indexer-data-2 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + multi-node_wazuh-indexer-data-3 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master_wazuh_api_configuration \ + multi-node_master_wazuh_api_configuration +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master_wazuh_etc \ + multi-node_docker_wazuh_etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-logs \ + multi-node_master-wazuh-logs +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-queue \ + multi-node_master-wazuh-queue +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-var-multigroups \ + multi-node_master-wazuh-var-multigroups +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-integrations \ + multi-node_master-wazuh-integrations +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-active-response \ + multi-node_master-wazuh-active-response +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-agentless \ + multi-node_master-wazuh-agentless +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-wodles \ + multi-node_master-wazuh-wodles +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-filebeat-etc \ + multi-node_master-filebeat-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-filebeat-var \ + multi-node_master-filebeat-var +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker_wazuh_api_configuration \ + multi-node_worker_wazuh_api_configuration +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker_wazuh_etc \ + multi-node_worker-wazuh-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-logs \ + multi-node_worker-wazuh-logs +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-queue \ + multi-node_worker-wazuh-queue +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-var-multigroups \ + multi-node_worker-wazuh-var-multigroups +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-integrations \ + multi-node_worker-wazuh-integrations +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-active-response \ + multi-node_worker-wazuh-active-response +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-agentless \ + multi-node_worker-wazuh-agentless +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-wodles \ + multi-node_worker-wazuh-wodles +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + multi-node_worker-filebeat-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-var \ + multi-node_worker-filebeat-var +``` +**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.** +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v multi-node_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v multi-node_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v multi-node_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-api-configuration:/from \ + -v multi-node_master-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-etc:/from \ + -v multi-node_master-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-logs:/from \ + -v multi-node_master-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-queue:/from \ + -v multi-node_master-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-var-multigroups:/from \ + -v multi-node_master-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-integrations:/from \ + -v multi-node_master-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-active-response:/from \ + -v multi-node_master-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-agentless:/from \ + -v multi-node_master-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-wodles:/from \ + -v multi-node_master-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_filebeat-etc:/from \ + -v multi-node_master-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_filebeat-var:/from \ + -v multi-node_master-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-api-configuration:/from \ + -v multi-node_worker-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-etc:/from \ + -v multi-node_worker-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-logs:/from \ + -v multi-node_worker-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-queue:/from \ + -v multi-node_worker-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-var-multigroups:/from \ + -v multi-node_worker-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-integrations:/from \ + -v multi-node_worker-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-active-response:/from \ + -v multi-node_worker-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-agentless:/from \ + -v multi-node_worker-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-wodles:/from \ + -v multi-node_worker-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v multi-node_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v multi-node_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` + +**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.** + +Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node + +**7. Start the 4.3 environment.** +``` +git checkout 4.3 +cd multi-node +docker-compose -f generate-indexer-certs.yml run --rm generator +docker-compose up -d +``` + +**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data. diff --git a/multi-node/README.md b/multi-node/README.md new file mode 100644 index 00000000..c1e8b998 --- /dev/null +++ b/multi-node/README.md @@ -0,0 +1,26 @@ +# Deploy Wazuh Docker in multi node configuration + +This deployment is defined in the `docker-compose.yml` file with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps: + +1) Increase max_map_count on your host (Linux). This command must be run with root permissions: +``` +$ sysctl -w vm.max_map_count=262144 +``` +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the environment with docker-compose: + +- In the foregroud: +``` +$ docker-compose up +``` + +- In the background: +``` +$ docker-compose up -d +``` + + +The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated. diff --git a/production_cluster/nginx/nginx.conf b/multi-node/config/nginx/nginx.conf similarity index 59% rename from production_cluster/nginx/nginx.conf rename to multi-node/config/nginx/nginx.conf index b2103bb0..92deb263 100644 --- a/production_cluster/nginx/nginx.conf +++ b/multi-node/config/nginx/nginx.conf @@ -28,27 +28,6 @@ http { server_tokens off; gzip on; - # Dashboard UI - server { - listen 80; - listen [::]:80; - return 301 https://$host:443$request_uri; - } - - server { - listen 443 default_server ssl http2; - listen [::]:443 ssl http2; - ssl_certificate /etc/nginx/ssl/cert.pem; - ssl_certificate_key /etc/nginx/ssl/key.pem; - location / { - proxy_pass https://wazuh.dashboard:443/; - proxy_ssl_verify off; - proxy_buffer_size 128k; - proxy_buffers 4 256k; - proxy_busy_buffers_size 256k; - } - } - } diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_manager.conf rename to multi-node/config/wazuh_cluster/wazuh_manager.conf index 8b6c33cb..fddb7fc6 100644 --- a/production_cluster/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_worker.conf rename to multi-node/config/wazuh_cluster/wazuh_worker.conf index a91e6e16..30670045 100644 --- a/production_cluster/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml similarity index 100% rename from production_cluster/wazuh_dashboard/opensearch_dashboards.yml rename to multi-node/config/wazuh_dashboard/opensearch_dashboards.yml diff --git a/production_cluster/wazuh_dashboard/wazuh.yml b/multi-node/config/wazuh_dashboard/wazuh.yml similarity index 100% rename from production_cluster/wazuh_dashboard/wazuh.yml rename to multi-node/config/wazuh_dashboard/wazuh.yml diff --git a/production_cluster/wazuh-indexer/internal_users.yml b/multi-node/config/wazuh_indexer/internal_users.yml similarity index 100% rename from production_cluster/wazuh-indexer/internal_users.yml rename to multi-node/config/wazuh_indexer/internal_users.yml diff --git a/production_cluster/wazuh-indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh1.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh1.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh2.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh2.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh3.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh3.indexer.yml diff --git a/production_cluster/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml similarity index 100% rename from production_cluster/wazuh_indexer_ssl_certs/certs.yml rename to multi-node/config/wazuh_indexer_ssl_certs/certs.yml diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml new file mode 100644 index 00000000..7707f76b --- /dev/null +++ b/multi-node/docker-compose.yml @@ -0,0 +1,204 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh.master: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.master + restart: always + ports: + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - master-wazuh-api-configuration:/var/ossec/api/configuration + - master-wazuh-etc:/var/ossec/etc + - master-wazuh-logs:/var/ossec/logs + - master-wazuh-queue:/var/ossec/queue + - master-wazuh-var-multigroups:/var/ossec/var/multigroups + - master-wazuh-integrations:/var/ossec/integrations + - master-wazuh-active-response:/var/ossec/active-response/bin + - master-wazuh-agentless:/var/ossec/agentless + - master-wazuh-wodles:/var/ossec/wodles + - master-filebeat-etc:/etc/filebeat + - master-filebeat-var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh.worker: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.worker + restart: always + environment: + - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + volumes: + - worker-wazuh-api-configuration:/var/ossec/api/configuration + - worker-wazuh-etc:/var/ossec/etc + - worker-wazuh-logs:/var/ossec/logs + - worker-wazuh-queue:/var/ossec/queue + - worker-wazuh-var-multigroups:/var/ossec/var/multigroups + - worker-wazuh-integrations:/var/ossec/integrations + - worker-wazuh-active-response:/var/ossec/active-response/bin + - worker-wazuh-agentless:/var/ossec/agentless + - worker-wazuh-wodles:/var/ossec/wodles + - worker-filebeat-etc:/etc/filebeat + - worker-filebeat-var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh1.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh1.indexer + restart: always + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-1:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh2.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh2.indexer + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-2:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh3.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh3.indexer + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-3:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: wazuh.dashboard + restart: always + ports: + - 443:443 + environment: + - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200" + - WAZUH_API_URL="https://wazuh.master" + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + depends_on: + - wazuh1.indexer + links: + - wazuh1.indexer:wazuh1.indexer + - wazuh.master:wazuh.master + + nginx: + image: nginx:stable + hostname: nginx + restart: always + ports: + - "1514:1514" + depends_on: + - wazuh.master + - wazuh.worker + - wazuh.dashboard + links: + - wazuh.master:wazuh.master + - wazuh.worker:wazuh.worker + - wazuh.dashboard:wazuh.dashboard + volumes: + - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + +volumes: + master-wazuh-api-configuration: + master-wazuh-etc: + master-wazuh-logs: + master-wazuh-queue: + master-wazuh-var-multigroups: + master-wazuh-integrations: + master-wazuh-active-response: + master-wazuh-agentless: + master-wazuh-wodles: + master-filebeat-etc: + master-filebeat-var: + worker-wazuh-api-configuration: + worker-wazuh-etc: + worker-wazuh-logs: + worker-wazuh-queue: + worker-wazuh-var-multigroups: + worker-wazuh-integrations: + worker-wazuh-active-response: + worker-wazuh-agentless: + worker-wazuh-wodles: + worker-filebeat-etc: + worker-filebeat-var: + wazuh-indexer-data-1: + wazuh-indexer-data-2: + wazuh-indexer-data-3: diff --git a/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml similarity index 56% rename from generate-indexer-certs.yml rename to multi-node/generate-indexer-certs.yml index ce8a0174..c29c50d6 100644 --- a/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -6,5 +6,5 @@ services: image: wazuh/wazuh-certs-generator:0.0.1 hostname: wazuh-certs-generator volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml - - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh new file mode 100755 index 00000000..f11a1da6 --- /dev/null +++ b/multi-node/volume-migrator.sh @@ -0,0 +1,279 @@ +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + $2_wazuh-indexer-data-1 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + $2_wazuh-indexer-data-2 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + $2_wazuh-indexer-data-3 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_api_configuration \ + $2_master_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_etc \ + $2_docker_wazuh_etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-logs \ + $2_master-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-queue \ + $2_master-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-var-multigroups \ + $2_master-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-integrations \ + $2_master-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-active-response \ + $2_master-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-agentless \ + $2_master-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-wodles \ + $2_master-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-etc \ + $2_master-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-var \ + $2_master-filebeat-var + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_api_configuration \ + $2_worker_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_etc \ + $2_worker-wazuh-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-logs \ + $2_worker-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-queue \ + $2_worker-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-var-multigroups \ + $2_worker-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-integrations \ + $2_worker-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-active-response \ + $2_worker-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-agentless \ + $2_worker-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-wodles \ + $2_worker-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + $2_worker-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-var \ + $2_worker-filebeat-var + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v $2_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v $2_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v $2_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-api-configuration:/from \ + -v $2_master-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-etc:/from \ + -v $2_master-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-logs:/from \ + -v $2_master-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-queue:/from \ + -v $2_master-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-var-multigroups:/from \ + -v $2_master-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-integrations:/from \ + -v $2_master-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-active-response:/from \ + -v $2_master-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-agentless:/from \ + -v $2_master-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-wodles:/from \ + -v $2_master-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-etc:/from \ + -v $2_master-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-var:/from \ + -v $2_master-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-api-configuration:/from \ + -v $2_worker-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-etc:/from \ + -v $2_worker-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-logs:/from \ + -v $2_worker-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-queue:/from \ + -v $2_worker-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-var-multigroups:/from \ + -v $2_worker-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-integrations:/from \ + -v $2_worker-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-active-response:/from \ + -v $2_worker-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-agentless:/from \ + -v $2_worker-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-wodles:/from \ + -v $2_worker-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v $2_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" diff --git a/production-cluster.yml b/production-cluster.yml deleted file mode 100644 index 18c59a9a..00000000 --- a/production-cluster.yml +++ /dev/null @@ -1,205 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.master: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.master - restart: always - ports: - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ossec-api-configuration:/var/ossec/api/configuration - - ossec-etc:/var/ossec/etc - - ossec-logs:/var/ossec/logs - - ossec-queue:/var/ossec/queue - - ossec-var-multigroups:/var/ossec/var/multigroups - - ossec-integrations:/var/ossec/integrations - - ossec-active-response:/var/ossec/active-response/bin - - ossec-agentless:/var/ossec/agentless - - ossec-wodles:/var/ossec/wodles - - filebeat-etc:/etc/filebeat - - filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh.worker: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.worker - restart: always - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - volumes: - - worker-ossec-api-configuration:/var/ossec/api/configuration - - worker-ossec-etc:/var/ossec/etc - - worker-ossec-logs:/var/ossec/logs - - worker-ossec-queue:/var/ossec/queue - - worker-ossec-var-multigroups:/var/ossec/var/multigroups - - worker-ossec-integrations:/var/ossec/integrations - - worker-ossec-active-response:/var/ossec/active-response/bin - - worker-ossec-agentless:/var/ossec/agentless - - worker-ossec-wodles:/var/ossec/wodles - - worker-filebeat-etc:/etc/filebeat - - worker-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem - - ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh2.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh2.indexer - restart: always - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh3.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh3.indexer - restart: always - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 - hostname: wazuh.dashboard - restart: always - environment: - - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200" - - WAZUH_API_URL="https://wazuh.master" - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/opensearch_dashboards.yml - - ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml - depends_on: - - wazuh1.indexer - links: - - wazuh1.indexer:wazuh1.indexer - - wazuh.master:wazuh.master - - nginx: - image: nginx:stable - hostname: nginx - restart: always - ports: - - "80:80" - - "443:443" - - "1514:1514" - depends_on: - - wazuh.master - - wazuh.worker - - wazuh.dashboard - links: - - wazuh.master:wazuh.master - - wazuh.worker:wazuh.worker - - wazuh.dashboard:wazuh.dashboard - volumes: - - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro - -volumes: - ossec-api-configuration: - ossec-etc: - ossec-logs: - ossec-queue: - ossec-var-multigroups: - ossec-integrations: - ossec-active-response: - ossec-agentless: - ossec-wodles: - filebeat-etc: - filebeat-var: - worker-ossec-api-configuration: - worker-ossec-etc: - worker-ossec-logs: - worker-ossec-queue: - worker-ossec-var-multigroups: - worker-ossec-integrations: - worker-ossec-active-response: - worker-ossec-agentless: - worker-ossec-wodles: - worker-filebeat-etc: - worker-filebeat-var: - wazuh-indexer-data-1: - wazuh-indexer-data-2: - wazuh-indexer-data-3: diff --git a/production_cluster/nginx/ssl/generate-self-signed-cert.sh b/production_cluster/nginx/ssl/generate-self-signed-cert.sh deleted file mode 100644 index 6fc8d08d..00000000 --- a/production_cluster/nginx/ssl/generate-self-signed-cert.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -cd $DIR - -if [ -s key.pem ] -then - echo "Certificate already exists" - exit -else - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem -fi \ No newline at end of file diff --git a/single-node/README.md b/single-node/README.md new file mode 100644 index 00000000..efd303c7 --- /dev/null +++ b/single-node/README.md @@ -0,0 +1,24 @@ +# Deploy Wazuh Docker in single node configuration + +This deployment is defined in the `docker-compose.yml` file with one Wazuh manager containers, one Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps: + +1) Increase max_map_count on your host (Linux). This command must be run with root permissions: +``` +$ sysctl -w vm.max_map_count=262144 +``` +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the environment with docker-compose: + +- In the foregroud: +``` +$ docker-compose up +``` +- In the background: +``` +$ docker-compose up -d +``` + +The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated. diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf new file mode 100644 index 00000000..aff1af9d --- /dev/null +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -0,0 +1,353 @@ + + + yes + yes + no + no + no + smtp.example.wazuh.com + wazuh@example.wazuh.com + recipient@example.wazuh.com + 12 + alerts.log + 10m + 0 + + + + 3 + 12 + + + + + plain + + + + secure + 1514 + tcp + 131072 + + + + + no + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt + + yes + + + + yes + 1800 + 1d + yes + + wodles/java + wodles/ciscat + + + + + yes + yes + /var/log/osquery/osqueryd.results.log + /etc/osquery/osquery.conf + yes + + + + + no + 1h + yes + yes + yes + yes + yes + yes + yes + + + + 10 + + + + + yes + yes + 12h + yes + + + + no + 5m + 6h + yes + + + + no + trusty + xenial + bionic + focal + 1h + + + + + no + stretch + buster + bullseye + 1h + + + + + no + 5 + 6 + 7 + 8 + 1h + + + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + + + + yes + 1h + + + + + yes + 2010 + 1h + + + + + + + no + + + 43200 + + yes + + + yes + + + no + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 1h + 10 + + + + + + 127.0.0.1 + ^localhost.localdomain$ + 10.0.0.106 + + + + disable-account + disable-account + yes + + + + restart-wazuh + restart-wazuh + + + + firewall-drop + firewall-drop + yes + + + + host-deny + host-deny + yes + + + + route-null + route-null + yes + + + + win_route-null + route-null.exe + yes + + + + netsh + netsh.exe + yes + + + + + + + command + df -P + 360 + + + + full_command + netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + netstat listening ports + 360 + + + + full_command + last -n 20 + 360 + + + + + ruleset/decoders + ruleset/rules + 0215-policy_rules.xml + etc/lists/audit-keys + etc/lists/amazon/aws-eventnames + etc/lists/security-eventchannel + + + etc/decoders + etc/rules + + + + yes + 1 + 64 + 15m + + + + + no + 1515 + no + yes + no + HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH + + no + etc/sslmanager.cert + etc/sslmanager.key + no + + + + wazuh + node01 + master + + 1516 + 0.0.0.0 + + NODE_IP + + no + yes + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..d56fe86b --- /dev/null +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 443 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global diff --git a/single-node/config/wazuh_dashboard/wazuh.yml b/single-node/config/wazuh_dashboard/wazuh.yml new file mode 100644 index 00000000..75ba953c --- /dev/null +++ b/single-node/config/wazuh_dashboard/wazuh.yml @@ -0,0 +1,7 @@ +hosts: + - 1513629884013: + url: "https://wazuh.manager" + port: 55000 + username: acme-user + password: MyS3cr37P450r.*- + run_as: false diff --git a/single-node/config/wazuh_indexer/internal_users.yml b/single-node/config/wazuh_indexer/internal_users.yml new file mode 100644 index 00000000..d9f05b34 --- /dev/null +++ b/single-node/config/wazuh_indexer/internal_users.yml @@ -0,0 +1,56 @@ +--- +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +_meta: + type: "internalusers" + config_version: 2 + +# Define your internal users here + +## Demo users + +admin: + hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" + reserved: true + backend_roles: + - "admin" + description: "Demo admin user" + +kibanaserver: + hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." + reserved: true + description: "Demo kibanaserver user" + +kibanaro: + hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" + reserved: false + backend_roles: + - "kibanauser" + - "readall" + attributes: + attribute1: "value1" + attribute2: "value2" + attribute3: "value3" + description: "Demo kibanaro user" + +logstash: + hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" + reserved: false + backend_roles: + - "logstash" + description: "Demo logstash user" + +readall: + hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" + reserved: false + backend_roles: + - "readall" + description: "Demo readall user" + +snapshotrestore: + hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" + reserved: false + backend_roles: + - "snapshotrestore" + description: "Demo snapshotrestore user" diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..ec3220ef --- /dev/null +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,27 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer +discovery.type: single-node +compatibility.override_main_response_version: true +plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false +plugins.security.audit.type: internal_opensearch +plugins.security.authcz.admin_dn: +- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml new file mode 100644 index 00000000..34059eeb --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/certs.yml @@ -0,0 +1,16 @@ +nodes: + # Wazuh indexer server nodes + indexer: + name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + name: wazuh.dashboard + ip: wazuh.dashboard \ No newline at end of file diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml new file mode 100644 index 00000000..356160ea --- /dev/null +++ b/single-node/docker-compose.yml @@ -0,0 +1,102 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh.manager: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh.indexer + restart: always + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: wazuh.dashboard + restart: always + ports: + - 443:443 + environment: + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=admin + - WAZUH_API_URL=https://wazuh.manager + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + depends_on: + - wazuh.indexer + links: + - wazuh.indexer:wazuh.indexer + - wazuh.manager:wazuh.manager + +volumes: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: + filebeat_etc: + filebeat_var: + wazuh-indexer-data: diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml new file mode 100644 index 00000000..c29c50d6 --- /dev/null +++ b/single-node/generate-indexer-certs.yml @@ -0,0 +1,10 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3' + +services: + generator: + image: wazuh/wazuh-certs-generator:0.0.1 + hostname: wazuh-certs-generator + volumes: + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file