From c2213165f2897917f7dfb499ec5743fdd745de1b Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Mon, 11 Sep 2017 19:17:25 -0500
Subject: [PATCH 1/9] Quiet logging for Kibana

---
 kibana/config/kibana.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kibana/config/kibana.yml b/kibana/config/kibana.yml
index 97bfeb6f..993ad7da 100644
--- a/kibana/config/kibana.yml
+++ b/kibana/config/kibana.yml
@@ -81,7 +81,7 @@ elasticsearch.url: "http://elasticsearch:9200"
 # logging.silent: false
 
 # Set the value of this setting to true to suppress all logging output other than error messages.
-# logging.quiet: false
+logging.quiet: true
 
 # Set the value of this setting to true to log all events, including system usage information
 # and all requests.

From a70c127228a18c2de18949c5cff0f285c2465939 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Mon, 11 Sep 2017 19:17:57 -0500
Subject: [PATCH 2/9] Set defaultIndex and API creeds for Kibana, closes #17

---
 docker-compose.yml           |  1 +
 kibana/config/wait-for-it.sh | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 43c62ff4..fe0502e4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,6 +61,7 @@ services:
       - elasticsearch
     links:
       - elasticsearch:elasticsearch
+      - wazuh
     entrypoint: sh wait-for-it.sh elasticsearch
 #    environment:
 #      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh
index 2953b597..af6942a3 100644
--- a/kibana/config/wait-for-it.sh
+++ b/kibana/config/wait-for-it.sh
@@ -22,4 +22,37 @@ else
   /usr/share/kibana/bin/kibana-plugin install ${WAZUH_KIBANA_PLUGIN_URL}
 fi
 
+sleep 30
+
+echo "Configuring defaultIndex to wazuh-alerts-*"
+
+curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
+
+sleep 30
+
+echo "Setting API credentials into Wazuh APP"
+
+CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/apiconfig)
+if [ "x$CONFIG_CODE" = "x404" ]; then
+  curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/apiconfig -H 'Content-Type: application/json' -d'
+  {
+    "api_user": "foo",
+    "api_password": "YmFy",
+    "url": "http://wazuh",
+    "api_port": "55000",
+    "insecure": "true",
+    "component": "API",
+    "active": "true",
+    "manager": "wazuh-manager",
+    "extensions": {
+      "oscap": true,
+      "audit": true,
+      "pci": true
+    }
+  }
+  ' > /dev/null
+else
+  echo "Wazuh APP already configured"
+fi
+
 exec $cmd

From 160bf4bbe9f90e7eecfd4d4a635d6842eb226bed Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Sat, 16 Sep 2017 22:01:17 -0400
Subject: [PATCH 3/9] Adding Nginx container

* Setting Nginx with SSL and basic auth, closes #20
* Set Content-Type on Kibana API config.
---
 docker-compose.yml           | 22 ++++++++++++++--
 kibana/config/wait-for-it.sh |  2 +-
 nginx/configure.sh           | 49 ++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 3 deletions(-)
 create mode 100644 nginx/configure.sh

diff --git a/docker-compose.yml b/docker-compose.yml
index fe0502e4..883d80ba 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -53,8 +53,8 @@ services:
     image: wazuh/wazuh-kibana
     hostname: kibana
     restart: always
-    ports:
-      - "5601:5601"
+#    ports:
+#      - "5601:5601"
     networks:
         - docker_elk
     depends_on:
@@ -65,6 +65,24 @@ services:
     entrypoint: sh wait-for-it.sh elasticsearch
 #    environment:
 #      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
+  nginx:
+    image: nginx:latest
+    hostname: nginx
+    restart: always
+    command: bash /configure.sh
+    volumes:
+      - ./nginx/configure.sh:/configure.sh
+    environment:
+      - NGINX_PORT=443
+    ports:
+      - "80:80"
+      - "443:443"
+    networks:
+      - docker_elk
+    depends_on:
+      - kibana
+    links:
+      - kibana
 
 networks:
   docker_elk:
diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh
index af6942a3..88cb344f 100644
--- a/kibana/config/wait-for-it.sh
+++ b/kibana/config/wait-for-it.sh
@@ -26,7 +26,7 @@ sleep 30
 
 echo "Configuring defaultIndex to wazuh-alerts-*"
 
-curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
+curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -H 'Content-Type: application/json' -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
 
 sleep 30
 
diff --git a/nginx/configure.sh b/nginx/configure.sh
new file mode 100644
index 00000000..2877a2ee
--- /dev/null
+++ b/nginx/configure.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -e
+
+if [ ! -d /etc/pki/tls/certs ]; then
+  echo "Generating SSL certificates"
+  if [ ! -x /usr/bin/openssl ]; then
+    apt-get update >/dev/null
+    apt-get -y install openssl >/dev/null
+  fi
+  mkdir -p /etc/pki/tls/certs /etc/pki/tls/private
+  openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/kibana-access.key -out /etc/pki/tls/certs/kibana-access.pem >/dev/null
+fi
+
+if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
+  echo "Setting kibana credentials"
+  if [ ! -x /usr/bin/htpasswd ]; then
+    apt-get update >/dev/null
+    apt-get -y install apache2-utils >/dev/null
+  fi
+  echo bar|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd foo >/dev/null
+else
+  echo "Kibana credentials already configured"
+fi
+
+echo "Configuring NGINX"
+cat > /etc/nginx/conf.d/default.conf <<EOF
+server {
+    listen 80;
+    listen [::]:80;
+    return 301 https://\$host:$NGINX_PORT\$request_uri;
+}
+
+server {
+    listen $NGINX_PORT default_server;
+    listen [::]:$NGINX_PORT;
+    ssl on;
+    ssl_certificate /etc/pki/tls/certs/kibana-access.pem;
+    ssl_certificate_key /etc/pki/tls/private/kibana-access.key;
+    location / {
+        auth_basic "Restricted";
+        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+        proxy_pass http://kibana:5601/;
+    }
+}
+EOF
+
+echo "Starting Nginx"
+nginx -g 'daemon off; error_log /dev/stdout info;'

From a2ba029918c5bff348c08a37faa0c6f6a1094a7c Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Mon, 25 Sep 2017 18:46:46 -0400
Subject: [PATCH 4/9] Setting wazuh-nginx image

---
 docker-compose.yml |  6 ++----
 nginx/Dockerfile   |  5 +++++
 nginx/configure.sh | 12 +++---------
 3 files changed, 10 insertions(+), 13 deletions(-)
 create mode 100644 nginx/Dockerfile

diff --git a/docker-compose.yml b/docker-compose.yml
index 883d80ba..6d3614cc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -66,12 +66,10 @@ services:
 #    environment:
 #      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
   nginx:
-    image: nginx:latest
+    image: wazuh/wazuh-nginx
     hostname: nginx
     restart: always
-    command: bash /configure.sh
-    volumes:
-      - ./nginx/configure.sh:/configure.sh
+    entrypoint: sh /configure.sh
     environment:
       - NGINX_PORT=443
     ports:
diff --git a/nginx/Dockerfile b/nginx/Dockerfile
new file mode 100644
index 00000000..f6da2fab
--- /dev/null
+++ b/nginx/Dockerfile
@@ -0,0 +1,5 @@
+FROM nginx:latest
+
+RUN apt-get update && apt-get install -y openssl apache2-utils
+
+COPY ./configure.sh /configure.sh
diff --git a/nginx/configure.sh b/nginx/configure.sh
index 2877a2ee..758bdd81 100644
--- a/nginx/configure.sh
+++ b/nginx/configure.sh
@@ -4,20 +4,14 @@ set -e
 
 if [ ! -d /etc/pki/tls/certs ]; then
   echo "Generating SSL certificates"
-  if [ ! -x /usr/bin/openssl ]; then
-    apt-get update >/dev/null
-    apt-get -y install openssl >/dev/null
-  fi
   mkdir -p /etc/pki/tls/certs /etc/pki/tls/private
   openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/kibana-access.key -out /etc/pki/tls/certs/kibana-access.pem >/dev/null
+else
+  echo "SSL certificates already present"
 fi
 
 if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
-  echo "Setting kibana credentials"
-  if [ ! -x /usr/bin/htpasswd ]; then
-    apt-get update >/dev/null
-    apt-get -y install apache2-utils >/dev/null
-  fi
+  echo "Setting Nginx credentials"
   echo bar|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd foo >/dev/null
 else
   echo "Kibana credentials already configured"

From 6e6912c3806cc20f92aff65bfa78e2669291d666 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Mon, 25 Sep 2017 18:48:49 -0400
Subject: [PATCH 5/9] Using Wazuh v2.1.0

---
 wazuh/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 82efb023..00d2ebac 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -9,7 +9,7 @@ RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
 RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - &&\
     yum install -y nodejs
-RUN yum install -y wazuh-manager wazuh-api
+RUN yum install -y wazuh-manager-2.1.0 wazuh-api-2.1.0
 
 
 ADD config/data_dirs.env /data_dirs.env

From 845398d7c713571424fc9a15957fabb4ccbab052 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Tue, 26 Sep 2017 21:56:41 -0400
Subject: [PATCH 6/9] Nginx start script path changed

---
 docker-compose.yml                    | 2 +-
 nginx/Dockerfile                      | 2 +-
 nginx/{configure.sh => config/run.sh} | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename nginx/{configure.sh => config/run.sh} (100%)

diff --git a/docker-compose.yml b/docker-compose.yml
index 6d3614cc..ce93581b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -69,7 +69,7 @@ services:
     image: wazuh/wazuh-nginx
     hostname: nginx
     restart: always
-    entrypoint: sh /configure.sh
+    entrypoint: sh run.sh
     environment:
       - NGINX_PORT=443
     ports:
diff --git a/nginx/Dockerfile b/nginx/Dockerfile
index f6da2fab..4315179d 100644
--- a/nginx/Dockerfile
+++ b/nginx/Dockerfile
@@ -2,4 +2,4 @@ FROM nginx:latest
 
 RUN apt-get update && apt-get install -y openssl apache2-utils
 
-COPY ./configure.sh /configure.sh
+COPY ./config/run.sh /run.sh
diff --git a/nginx/configure.sh b/nginx/config/run.sh
similarity index 100%
rename from nginx/configure.sh
rename to nginx/config/run.sh

From 97a042cfcdafe11bc857e1b9eca2d1147b69cc33 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Sun, 19 Nov 2017 22:42:36 -0500
Subject: [PATCH 7/9] Refactoring to new Elastic Stack versions.

---
 docker-compose.yml           | 26 ++++++++++++++++++++------
 kibana/Dockerfile            | 10 ++++++----
 kibana/config/kibana.yml     |  7 +++++++
 kibana/config/wait-for-it.sh | 14 ++++++--------
 logstash/Dockerfile          | 10 +---------
 nginx/Dockerfile             |  2 ++
 wazuh/Dockerfile             |  7 ++++---
 7 files changed, 46 insertions(+), 30 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index ce93581b..faea2709 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -35,16 +35,30 @@ services:
       - elasticsearch
     environment:
       - LS_HEAP_SIZE=2048m
+      - XPACK_MONITORING_ENABLED=false
   elasticsearch:
-    image: elasticsearch:5.5.2
+    image: docker.elastic.co/elasticsearch/elasticsearch:5.6.4
     hostname: elasticsearch
     restart: always
-    command: elasticsearch -E node.name="node-1" -E cluster.name="wazuh" -E network.host=0.0.0.0
     ports:
       - "9200:9200"
-      - "9300:9300"
+#      - "9300:9300"
     environment:
-      ES_JAVA_OPTS: "-Xms2g -Xmx2g"
+      - node.name=node-1
+      - cluster.name=wazuh
+      - network.host=0.0.0.0
+      - bootstrap.memory_lock=true
+      - xpack.security.enabled=false
+      - xpack.monitoring.enabled=false
+      - xpack.ml.enabled=false
+      - xpack.watcher.enabled=false
+      - xpack.graph.enabled=false
+      - "ES_JAVA_OPTS=-Xms1g -Xmx1g"
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+    mem_limit: 2g
 #    volumes:
 #      - my-path:/usr/share/elasticsearch/data
     networks:
@@ -62,14 +76,14 @@ services:
     links:
       - elasticsearch:elasticsearch
       - wazuh
-    entrypoint: sh wait-for-it.sh elasticsearch
+    entrypoint: /wait-for-it.sh elasticsearch
 #    environment:
 #      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
   nginx:
     image: wazuh/wazuh-nginx
     hostname: nginx
     restart: always
-    entrypoint: sh run.sh
+    entrypoint: /run.sh
     environment:
       - NGINX_PORT=443
     ports:
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 3985b3fd..90b81d58 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -1,7 +1,9 @@
-FROM kibana:5.5.2
+FROM docker.elastic.co/kibana/kibana:5.6.4
 
-RUN apt-get update && apt-get install -y curl
+USER root
 
-COPY ./config/kibana.yml /opt/kibana/config/kibana.yml
+COPY ./config/kibana.yml /usr/share/kibana/config/kibana.yml
 
-COPY config/wait-for-it.sh /
+COPY config/wait-for-it.sh /wait-for-it.sh
+
+RUN chmod 755 /wait-for-it.sh
diff --git a/kibana/config/kibana.yml b/kibana/config/kibana.yml
index 993ad7da..e898fe1a 100644
--- a/kibana/config/kibana.yml
+++ b/kibana/config/kibana.yml
@@ -90,3 +90,10 @@ logging.quiet: true
 # Set the interval in milliseconds to sample system and process performance
 # metrics. Minimum is 100ms. Defaults to 10000.
 # ops.interval: 10000
+
+xpack.security.enabled: false
+xpack.grokdebugger.enabled: false
+xpack.graph.enabled: false
+xpack.ml.enabled: false
+xpack.monitoring.enabled: false
+xpack.reporting.enabled: false
\ No newline at end of file
diff --git a/kibana/config/wait-for-it.sh b/kibana/config/wait-for-it.sh
index 88cb344f..7fd776fc 100644
--- a/kibana/config/wait-for-it.sh
+++ b/kibana/config/wait-for-it.sh
@@ -5,15 +5,13 @@ set -e
 host="$1"
 shift
 cmd="kibana"
-WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-2.1.0_5.5.2.zip}
+WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-2.1.1_5.6.4.zip}
 
 until curl -XGET $host:9200; do
   >&2 echo "Elastic is unavailable - sleeping"
-  sleep 1
+  sleep 5
 done
 
-sleep 30
-
 >&2 echo "Elastic is up - executing command"
 
 if /usr/share/kibana/bin/kibana-plugin list | grep wazuh; then
@@ -26,9 +24,7 @@ sleep 30
 
 echo "Configuring defaultIndex to wazuh-alerts-*"
 
-curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -H 'Content-Type: application/json' -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
-
-sleep 30
+curl -s -XPUT http://$host:9200/.kibana/config/5.6.4 -H 'Content-Type: application/json' -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
 
 echo "Setting API credentials into Wazuh APP"
 
@@ -38,7 +34,7 @@ if [ "x$CONFIG_CODE" = "x404" ]; then
   {
     "api_user": "foo",
     "api_password": "YmFy",
-    "url": "http://wazuh",
+    "url": "https://wazuh",
     "api_port": "55000",
     "insecure": "true",
     "component": "API",
@@ -55,4 +51,6 @@ else
   echo "Wazuh APP already configured"
 fi
 
+sleep 5
+
 exec $cmd
diff --git a/logstash/Dockerfile b/logstash/Dockerfile
index 48db68be..6510c2ae 100644
--- a/logstash/Dockerfile
+++ b/logstash/Dockerfile
@@ -1,12 +1,4 @@
-FROM logstash:5.5.2
-
-RUN apt-get update
+FROM docker.elastic.co/logstash/logstash:5.6.4
 
 COPY config/logstash.conf /etc/logstash/conf.d/logstash.conf
 COPY config/wazuh-elastic5-template.json /etc/logstash/wazuh-elastic5-template.json
-
-
-ADD config/run.sh /tmp/run.sh
-RUN chmod 755 /tmp/run.sh
-
-ENTRYPOINT ["/tmp/run.sh"]
diff --git a/nginx/Dockerfile b/nginx/Dockerfile
index 4315179d..be30a2aa 100644
--- a/nginx/Dockerfile
+++ b/nginx/Dockerfile
@@ -3,3 +3,5 @@ FROM nginx:latest
 RUN apt-get update && apt-get install -y openssl apache2-utils
 
 COPY ./config/run.sh /run.sh
+
+RUN chmod 755 /run.sh
diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index 00d2ebac..ebf8c215 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -1,15 +1,15 @@
 FROM centos:latest
-ARG FILEBEAT_VERSION=5.5.2
+ARG FILEBEAT_VERSION=5.6.4
 COPY config/*.repo /etc/yum.repos.d/
 
 RUN yum -y update; yum clean all;
-RUN yum -y install epel-release openssl useradd; yum clean all
+RUN yum -y install epel-release openssl useradd which; yum clean all
 RUN yum -y install postfix mailx cyrus-sasl cyrus-sasl-plain; yum clean all
 RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
 RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - &&\
     yum install -y nodejs
-RUN yum install -y wazuh-manager-2.1.0 wazuh-api-2.1.0
+RUN yum install -y wazuh-manager wazuh-api
 
 
 ADD config/data_dirs.env /data_dirs.env
@@ -19,6 +19,7 @@ RUN chmod 755 /init.bash &&\
   sync && /init.bash &&\
   sync && rm /init.bash
 
+RUN sed -i 's/inet_protocols = all/inet_protocols = ipv4/g' /etc/postfix/main.cf
 
 RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm &&\
   rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm filebeat-${FILEBEAT_VERSION}-x86_64.rpm

From a866f41ecf1249a446c1ad00cf11b4feadac7934 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Tue, 21 Nov 2017 22:12:27 -0500
Subject: [PATCH 8/9] Using phusion/baseimage for Wazuh manager, closes #19

---
 wazuh/Dockerfile    | 23 +++++++--------
 wazuh/config/run.sh | 72 +++++++++++++++++++++++++++------------------
 2 files changed, 53 insertions(+), 42 deletions(-)

diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile
index ebf8c215..b6de3168 100644
--- a/wazuh/Dockerfile
+++ b/wazuh/Dockerfile
@@ -1,16 +1,15 @@
-FROM centos:latest
+FROM phusion/baseimage:latest
 ARG FILEBEAT_VERSION=5.6.4
-COPY config/*.repo /etc/yum.repos.d/
 
-RUN yum -y update; yum clean all;
-RUN yum -y install epel-release openssl useradd which; yum clean all
-RUN yum -y install postfix mailx cyrus-sasl cyrus-sasl-plain; yum clean all
+RUN apt-get update; apt-get -y dist-upgrade
+RUN apt-get -y install openssl postfix bsd-mailx curl apt-transport-https lsb-release
 RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
-RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - &&\
-    yum install -y nodejs
-RUN yum install -y wazuh-manager wazuh-api
-
+RUN curl --silent --location https://deb.nodesource.com/setup_6.x | bash - &&\
+    apt-get install -y nodejs
+RUN curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
+RUN echo "deb https://packages.wazuh.com/apt $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/wazuh.list
+RUN apt-get update && apt-get -y install wazuh-manager wazuh-api expect
 
 ADD config/data_dirs.env /data_dirs.env
 ADD config/init.bash /init.bash
@@ -19,10 +18,8 @@ RUN chmod 755 /init.bash &&\
   sync && /init.bash &&\
   sync && rm /init.bash
 
-RUN sed -i 's/inet_protocols = all/inet_protocols = ipv4/g' /etc/postfix/main.cf
-
-RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm &&\
-  rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm filebeat-${FILEBEAT_VERSION}-x86_64.rpm
+RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
+    dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm filebeat-${FILEBEAT_VERSION}-amd64.deb
 
 COPY config/filebeat.yml /etc/filebeat/
 
diff --git a/wazuh/config/run.sh b/wazuh/config/run.sh
index 5e9412a7..4b520de3 100644
--- a/wazuh/config/run.sh
+++ b/wazuh/config/run.sh
@@ -15,12 +15,31 @@ source /data_dirs.env
 FIRST_TIME_INSTALLATION=false
 DATA_PATH=/var/ossec/data
 
+print() {
+    echo -e $1
+}
+
+error_and_exit() {
+    echo "Error executing command: '$1'."
+    echo 'Exiting.'
+    exit 1
+}
+
+exec_cmd() {
+    eval $1 > /dev/null 2>&1 || error_and_exit "$1"
+}
+
+
+edit_configuration() { # $1 -> setting,  $2 -> value
+    sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${DATA_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
+}
+
 for ossecdir in "${DATA_DIRS[@]}"; do
   if [ ! -e "${DATA_PATH}/${ossecdir}" ]
   then
-    echo "Installing ${ossecdir}"
-    mkdir -p $(dirname ${DATA_PATH}/${ossecdir})
-    cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}
+    print "Installing ${ossecdir}"
+    exec_cmd "mkdir -p $(dirname ${DATA_PATH}/${ossecdir})"
+    exec_cmd "cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}"
     FIRST_TIME_INSTALLATION=true
   fi
 done
@@ -30,50 +49,45 @@ chgrp ossec ${DATA_PATH}/process_list
 chmod g+rw ${DATA_PATH}/process_list
 
 AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
+API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
 
 if [ $FIRST_TIME_INSTALLATION == true ]
 then
-
   if [ $AUTO_ENROLLMENT_ENABLED == true ]
   then
     if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
     then
-      echo "Creating ossec-authd key and cert"
-      openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096
-      openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key\
-        -out ${DATA_PATH}/etc/sslmanager.cert -days 3650\
-        -subj /CN=${HOSTNAME}/
+      print "Creating ossec-authd key and cert"
+      exec_cmd "openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096"
+      exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key -out ${DATA_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
+    fi
+  fi
+  if [ $API_GENERATE_CERTS == true ]
+  then
+    if [ ! -e ${DATA_PATH}/api/configuration/ssl/server.crt ]
+    then
+      print "Enabling Wazuh API HTTPS"
+      edit_configuration "https" "yes"
+      print "Create Wazuh API key and cert"
+      exec_cmd "openssl genrsa -out ${DATA_PATH}/api/configuration/ssl/server.key 4096"
+      exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/api/configuration/ssl/server.key -out ${DATA_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
     fi
   fi
 fi
 
 function ossec_shutdown(){
-  /var/ossec/bin/ossec-control stop;
-  if [ $AUTO_ENROLLMENT_ENABLED == true ]
-  then
-     kill $AUTHD_PID
-  fi
+  ${DATA_PATH}/bin/ossec-control stop;
 }
 
+
 # Trap exit signals and do a proper shutdown
 trap "ossec_shutdown; exit" SIGINT SIGTERM
 
 chmod -R g+rw ${DATA_PATH}
 
-if [ $AUTO_ENROLLMENT_ENABLED == true ]
-then
-  echo "Starting ossec-authd..."
-  /var/ossec/bin/ossec-authd -p 1515 -g ossec $AUTHD_OPTIONS >/dev/null 2>&1 &
-  AUTHD_PID=$!
-fi
-sleep 15 # give ossec a reasonable amount of time to start before checking status
-LAST_OK_DATE=`date +%s`
-
-## Start services
-/usr/sbin/postfix start
-/bin/node /var/ossec/api/app.js &
-/usr/bin/filebeat.sh &
-/var/ossec/bin/ossec-control restart
-
+service postfix start
+service wazuh-api start
+service wazuh-manager start
+service filebeat start
 
 tail -f /var/ossec/logs/ossec.log

From d1adafdcde22d87c1908a1eedcc1b5c334543367 Mon Sep 17 00:00:00 2001
From: Miguelangel Freitas <miguelangel@wazuh.com>
Date: Thu, 23 Nov 2017 16:21:14 -0500
Subject: [PATCH 9/9] Enabling ossec-authd by default.

---
 wazuh/config/run.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/wazuh/config/run.sh b/wazuh/config/run.sh
index 4b520de3..5cb7eb61 100644
--- a/wazuh/config/run.sh
+++ b/wazuh/config/run.sh
@@ -75,11 +75,13 @@ then
   fi
 fi
 
+#Enabling ossec-authd.
+exec_cmd "/var/ossec/bin/ossec-control enable auth"
+
 function ossec_shutdown(){
   ${DATA_PATH}/bin/ossec-control stop;
 }
 
-
 # Trap exit signals and do a proper shutdown
 trap "ossec_shutdown; exit" SIGINT SIGTERM