From 919500bd741ff020cc46e070b8a64a95dc055e18 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 14 Jul 2023 16:22:52 -0300 Subject: [PATCH 01/24] bump master to 4.8.0 --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- build-docker-images/wazuh-dashboard/config/config.sh | 4 ++-- build-docker-images/wazuh-indexer/config/config.sh | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- indexer-certs-creator/config/entrypoint.sh | 4 ++-- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 12 files changed, 28 insertions(+), 22 deletions(-) diff --git a/.env b/.env index a4909eb4..08a3c7ed 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.7.0 -WAZUH_IMAGE_VERSION=4.7.0 +WAZUH_VERSION=4.8.0 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 95764f97..ee5833ce 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.7.0-1 + - 4.8.0-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 8dd8664a..d032d59a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.8.0 +### Added + +- Update Wazuh to version [4.8.0](https://github.com/wazuh/wazuh/blob/v4.8.0/CHANGELOG.md#v480) + ## Wazuh Docker v4.7.0 ### Added diff --git a/README.md b/README.md index 8dc20aa5..ff52c494 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.8.0 | | | | v4.7.0 | | | | v4.6.0 | | | | v4.5.1 | | | diff --git a/VERSION b/VERSION index aa9abeed..ad87fa06 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.7.0" -REVISION="40700" +WAZUH-DOCKER_VERSION="4.8.0" +REVISION="40800" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index ded56d43..250f6dee 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.7.0 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 8cdb1a01..79306721 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 0bdd1bef..a01b761c 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE} ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 277b6e6c..c1184918 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -5,7 +5,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -ARG TEMPLATE_VERSION=4.7 +ARG TEMPLATE_VERSION=4.8 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 03d866e7..5379402b 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.7/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ +PACKAGES_URL=https://packages.wazuh.com/4.8/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.8/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 1ecbe45f..fdf63047 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.7.0 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 79919e53..76e71c17 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.7.0 + image: wazuh/wazuh-manager:4.8.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.7.0 + image: wazuh/wazuh-indexer:4.8.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.7.0 + image: wazuh/wazuh-dashboard:4.8.0 hostname: wazuh.dashboard restart: always ports: From 7db3d0d27896d2664af2c6e1167e1e68c58490cd Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 21 Jul 2023 15:22:22 -0300 Subject: [PATCH 02/24] Bump branch for trivy scan --- .github/workflows/trivy-dashboard-4-4.yml | 2 +- .github/workflows/trivy-indexer-4-4.yml | 2 +- .github/workflows/trivy-manager-4-4.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy-dashboard-4-4.yml b/.github/workflows/trivy-dashboard-4-4.yml index eb3f3b4f..863f4b03 100644 --- a/.github/workflows/trivy-dashboard-4-4.yml +++ b/.github/workflows/trivy-dashboard-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml index d48d0d85..9baec82c 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager-4-4.yml index 8a886871..d8631089 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager-4-4.yml @@ -31,7 +31,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: 4.4 } + with: { ref: v4.4.5 } - name: Installing dependencies run: | From d0eaae482c9314efb0d4fcfffbde32fd5175d47d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 11 Aug 2023 12:15:28 -0300 Subject: [PATCH 03/24] modify base for Wazuh Docker images --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ++-- build-docker-images/wazuh-indexer/Dockerfile | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 1b95ca88..e6c8c71b 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal AS builder +FROM ubuntu:jammy AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/ # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM ubuntu:focal +FROM ubuntu:jammy # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 696c0462..f2b809c3 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal AS builder +FROM ubuntu:jammy AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -26,7 +26,7 @@ RUN bash config.sh # Copy wazuh-indexer from stage 0 # Add entrypoint ################################################################################ -FROM ubuntu:focal +FROM ubuntu:jammy ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index c1184918..20ceac4e 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal +FROM ubuntu:jammy RUN rm /bin/sh && ln -s /bin/bash /bin/sh From 6a4dc3c3eb01d9c530dcceb46eebc1cce3e18d4d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:11:21 -0300 Subject: [PATCH 04/24] change repository checkout --- .../workflows/{trivy-dashboard-4-4.yml => trivy-dashboard.yml} | 3 ++- .github/workflows/{trivy-indexer-4-4.yml => trivy-indexer.yml} | 3 ++- .github/workflows/{trivy-manager-4-4.yml => trivy-manager.yml} | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) rename .github/workflows/{trivy-dashboard-4-4.yml => trivy-dashboard.yml} (94%) rename .github/workflows/{trivy-indexer-4-4.yml => trivy-indexer.yml} (94%) rename .github/workflows/{trivy-manager-4-4.yml => trivy-manager.yml} (94%) diff --git a/.github/workflows/trivy-dashboard-4-4.yml b/.github/workflows/trivy-dashboard.yml similarity index 94% rename from .github/workflows/trivy-dashboard-4-4.yml rename to .github/workflows/trivy-dashboard.yml index 863f4b03..a9c04a23 100644 --- a/.github/workflows/trivy-dashboard-4-4.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer.yml similarity index 94% rename from .github/workflows/trivy-indexer-4-4.yml rename to .github/workflows/trivy-indexer.yml index 9baec82c..2a5b182a 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager.yml similarity index 94% rename from .github/workflows/trivy-manager-4-4.yml rename to .github/workflows/trivy-manager.yml index d8631089..8b1dc659 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager.yml @@ -31,12 +31,13 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v3 - with: { ref: v4.4.5 } - name: Installing dependencies run: | sudo apt-get update sudo apt-get install -y jq + latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git checkout $latest - name: Build Wazuh images run: build-docker-images/build-images.sh From bd513e80cc524132c22e57643e5c07ccbdeecfa2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:18:56 -0300 Subject: [PATCH 05/24] add new step --- .github/workflows/trivy-dashboard.yml | 3 +++ .github/workflows/trivy-indexer.yml | 3 +++ .github/workflows/trivy-manager.yml | 3 +++ 3 files changed, 9 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index a9c04a23..8ee00521 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index 2a5b182a..71d272e0 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index 8b1dc659..e5787f80 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -36,8 +36,11 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq + + - name: Checkout latest tag latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest + - name: Build Wazuh images run: build-docker-images/build-images.sh From a2f50192b6c560b414a3acd326a06230b2d5fd06 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:21:07 -0300 Subject: [PATCH 06/24] add new step --- .github/workflows/trivy-dashboard.yml | 1 + .github/workflows/trivy-indexer.yml | 1 + .github/workflows/trivy-manager.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index 8ee00521..5f247878 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index 71d272e0..aacb42b9 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index e5787f80..89db7dc7 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -38,6 +38,7 @@ jobs: sudo apt-get install -y jq - name: Checkout latest tag + run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') git checkout $latest From 1d8332725f2f5ce90140e2002219b44664a9a49d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 18 Aug 2023 15:23:12 -0300 Subject: [PATCH 07/24] add fetch --- .github/workflows/trivy-dashboard.yml | 1 + .github/workflows/trivy-indexer.yml | 1 + .github/workflows/trivy-manager.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml index 5f247878..8bc2decf 100644 --- a/.github/workflows/trivy-dashboard.yml +++ b/.github/workflows/trivy-dashboard.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml index aacb42b9..3582e21d 100644 --- a/.github/workflows/trivy-indexer.yml +++ b/.github/workflows/trivy-indexer.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml index 89db7dc7..18bdf1b8 100644 --- a/.github/workflows/trivy-manager.yml +++ b/.github/workflows/trivy-manager.yml @@ -40,6 +40,7 @@ jobs: - name: Checkout latest tag run: | latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') + git fetch origin git checkout $latest - name: Build Wazuh images From b40e90d19c11d2bb7fe5272603a281d8e3454d32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= <33964202+teddytpc1@users.noreply.github.com> Date: Wed, 20 Sep 2023 08:29:53 -0300 Subject: [PATCH 08/24] Create SECURITY.md Wazuh security policy added. --- SECURITY.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..54e59de1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,45 @@ +# Wazuh Open Source Project Security Policy + +Version: 2023-06-12 + +## Introduction +This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities. + +## Scope +This policy applies to all open source projects developed, maintained, or hosted by Wazuh. + +## Reporting Security Vulnerabilities +If you believe you've discovered a potential security vulnerability in one of our open source projects, we strongly encourage you to report it to us responsibly. + +Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com). + +## Vulnerability Disclosure Policy +Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps: + +- Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation. +- Validation: We will validate the issue and work on reproducing it in our environment. +- Remediation: We will work on a fix and thoroughly test it +- Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party. +- Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments. + +This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability. + +## Automatic Scanning +We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner. + +## Credit +We believe in giving credit where credit is due. If you report a security vulnerability to us, and we determine that it is a valid vulnerability, we will publicly credit you for the discovery when we disclose the vulnerability. If you wish to remain anonymous, please indicate so in your initial report. + +We do appreciate and encourage feedback from our community, but currently we do not have a bounty program. We might start bounty programs in the future. + +## Compliance with this Policy +We consider the discovery and reporting of security vulnerabilities an important public service. We encourage responsible reporting of any vulnerabilities that may be found in our site or applications. + +Furthermore, we will not take legal action against or suspend or terminate access to the site or services of those who discover and report security vulnerabilities in accordance with this policy because of the fact. + +We ask that all users and contributors respect this policy and the security of our community's users by disclosing vulnerabilities to us in accordance with this policy. + +## Changes to this Security Policy +This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date. + +If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com). From 5aaeb0d944647c055eea49de46ba2855f6877c70 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 9 Oct 2023 06:34:35 -0300 Subject: [PATCH 09/24] Updated version in new builder script --- build-docker-images/README.md | 2 +- build-docker-images/build-images.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index a62978ac..10ba48d0 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.2. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.6.0. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.7.1. -h, --help Show this help. ``` \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 092cdc67..611b065a 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="4.6.0" +WAZUH_IMAGE_VERSION="4.7.1" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.2" From 4d153f6705e613a84d7f3b3a48f36bc7fe40e12a Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 11 Oct 2023 05:44:48 -0300 Subject: [PATCH 10/24] bump new builder script --- build-docker-images/README.md | 4 ++-- build-docker-images/build-images.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 10ba48d0..10a5da78 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: ``` -$ build-docker-images/build-images.sh -v 4.5.2 +$ build-docker-images/build-images.sh -v 4.8.0 ``` To get all the available script options use the -h or --help option: @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.2. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.7.1. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.8.0. -h, --help Show this help. ``` \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index cabc2b99..04e1084f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.7.1 +WAZUH_IMAGE_VERSION=4.8.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') @@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="4.7.1" +WAZUH_IMAGE_VERSION="4.8.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.2" From 4c2582952fb6077801f5d873fdd5404da78028c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Mon, 23 Oct 2023 13:28:22 -0300 Subject: [PATCH 11/24] Dashboard default route update --- .../wazuh-dashboard/config/opensearch_dashboards.yml | 2 +- multi-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- single-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml index 994b83e2..68e6c85f 100644 --- a/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml +++ b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml @@ -9,5 +9,5 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/config/certs/dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/config/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml index b065a625..3a53c3f8 100644 --- a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -9,4 +9,4 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml index 2a9cdba2..ccaec070 100644 --- a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -9,4 +9,4 @@ server.ssl.enabled: true server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wazuh +uiSettings.overrides.defaultRoute: /app/wz-home From 486c41e3f9c931632d37f0b345a3b10bef1c5260 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 9 Nov 2023 09:09:08 -0300 Subject: [PATCH 12/24] Updated security config files --- README.md | 1 + build-docker-images/wazuh-indexer/Dockerfile | 2 ++ .../wazuh-indexer/config/action_groups.yml | 12 ++++++++++++ build-docker-images/wazuh-indexer/config/config.sh | 1 + build-docker-images/wazuh-indexer/config/roles.yml | 12 ++++++++++-- .../wazuh-indexer/config/roles_mapping.yml | 11 +++++++++-- 6 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 build-docker-images/wazuh-indexer/config/action_groups.yml diff --git a/README.md b/README.md index 46b093fe..e1df9d68 100644 --- a/README.md +++ b/README.md @@ -101,6 +101,7 @@ WAZUH_MONITORING_REPLICAS=0 ## │   │   └── Dockerfile │   ├── wazuh-indexer │   │   ├── config + │ │ │ ├── action_groups.yml │   │   │   ├── config.sh │   │   │   ├── config.yml │   │   │   ├── entrypoint.sh diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index f2b809c3..985a3a05 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -12,6 +12,8 @@ COPY config/config.sh . COPY config/config.yml / +COPY config/action_groups.yml / + COPY config/internal_users.yml / COPY config/roles_mapping.yml / diff --git a/build-docker-images/wazuh-indexer/config/action_groups.yml b/build-docker-images/wazuh-indexer/config/action_groups.yml new file mode 100644 index 00000000..04119c8a --- /dev/null +++ b/build-docker-images/wazuh-indexer/config/action_groups.yml @@ -0,0 +1,12 @@ +--- +_meta: + type: "actiongroups" + config_version: 2 + +# ISM API permissions group +manage_ism: + reserved: true + hidden: false + allowed_actions: + - "cluster:admin/opendistro/ism/*" + static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 0b953fc5..0b4b3791 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -120,6 +120,7 @@ cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/ # Copy Wazuh's config files for the security plugin cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /action_groups.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} # Copy Wazuh indexer's certificates diff --git a/build-docker-images/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml index ed47beae..f8bc557a 100644 --- a/build-docker-images/wazuh-indexer/config/roles.yml +++ b/build-docker-images/wazuh-indexer/config/roles.yml @@ -142,7 +142,7 @@ wazuh_ui_user: allowed_actions: - "read" tenant_permissions: [] - static: false + static: false wazuh_ui_admin: reserved: true @@ -160,4 +160,12 @@ wazuh_ui_admin: - "manage" - "index" tenant_permissions: [] - static: false \ No newline at end of file + static: false + +# ISM API permissions role +manage_ism: + reserved: true + hidden: false + cluster_permissions: + - "manage_ism" + static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml index 6f893132..7fa57a4d 100644 --- a/build-docker-images/wazuh-indexer/config/roles_mapping.yml +++ b/build-docker-images/wazuh-indexer/config/roles_mapping.yml @@ -33,7 +33,7 @@ kibana_user: - "kibanauser" users: - "wazuh_user" - - "wazuh_admin" + - "wazuh_admin" description: "Maps kibanauser to kibana_user" readall: @@ -68,4 +68,11 @@ wazuh_ui_user: hosts: [] users: - "wazuh_user" - and_backend_roles: [] \ No newline at end of file + and_backend_roles: [] + +# ISM API permissions role mapping +manage_ism: + reserved: true + hidden: false + users: + - "kibanaserver" \ No newline at end of file From b55cfaa9a078e793b1febab4c517c49e196be1ea Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 09:25:00 -0300 Subject: [PATCH 13/24] add ism policies --- .env | 5 ++++- build-docker-images/wazuh-indexer/Dockerfile | 6 +++++- build-docker-images/wazuh-indexer/config/entrypoint.sh | 2 ++ build-docker-images/wazuh-indexer/config/ism-check.sh | 10 ++++++++++ multi-node/docker-compose.yml | 1 + single-node/docker-compose.yml | 3 ++- 6 files changed, 24 insertions(+), 3 deletions(-) create mode 100644 build-docker-images/wazuh-indexer/config/ism-check.sh diff --git a/.env b/.env index 08a3c7ed..9471b392 100755 --- a/.env +++ b/.env @@ -1,3 +1,6 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 -WAZUH_TAG_REVISION=1 +WAZUH_TAG_REVISION=40800 +FILEBEAT_TEMPLATE_BRANCH=4.8.0 +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_UI_REVISION=40800 diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 985a3a05..abb95e22 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -35,6 +35,8 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" +RUN apt-get update -y && apt-get install curl -y + RUN getent group $GROUP || groupadd -r -g 1000 $GROUP RUN useradd --system \ @@ -52,7 +54,9 @@ COPY config/entrypoint.sh / COPY config/securityadmin.sh / -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh +COPY config/ism-check.sh / + +RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && chmod 700 /ism-check.sh RUN chown 1000:1000 /*.sh diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 2acb4aa0..2d3396d6 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -90,4 +90,6 @@ fi # touch "/var/lib/wazuh-indexer/.flag" #fi +nohup /ism-check.sh & + run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh new file mode 100644 index 00000000..fcfeeaa0 --- /dev/null +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +if [[ -n "$INDEXER_PASSWORD" ]]; then + until [[ `curl -XGET https://0.0.0.0:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] + do + echo "Wazuh indexer Security is not initiaized"; + sleep 30 + done + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -i 127.0.0.1 -p $INDEXER_PASSWORD +fi \ No newline at end of file diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a72fd4f5..684d9813 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -89,6 +89,7 @@ services: environment: - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "bootstrap.memory_lock=true" + - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 45a8feb7..8627df27 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -52,7 +52,8 @@ services: ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" + - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m" + - 'INDEXER_PASSWORD=SecretPassword' ulimits: memlock: soft: -1 From ed136c994e84efb474f2ddda9180c58ba5c87ca1 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 09:26:54 -0300 Subject: [PATCH 14/24] change apt-key add command --- .../wazuh-manager/config/check_repository.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index adc94e79..bd7ffea9 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,6 +1,7 @@ ## variables +GPG_SIGN='[arch=amd64 signed-by=/etc/apt/keyrings/wazuh.gpg]' APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH -REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" +REPOSITORY="deb ${GPG_SIGN} https://packages.wazuh.com/4.x/apt/ stable main" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -12,18 +13,18 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + REPOSITORY="deb ${GPG_SIGN} https://packages-dev.wazuh.com/pre-release/apt/ unstable main" fi fi fi -apt-key adv --fetch-keys ${APT_KEY} +curl ${APT_KEY} | gpg --dearmor -o /etc/apt/keyrings/wazuh.gpg echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file From ff5e59982bbed7eec8ef5c2ff773dfc07384d73d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Nov 2023 13:59:56 -0300 Subject: [PATCH 15/24] change hostname from apply ism policy --- build-docker-images/wazuh-indexer/config/ism-check.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index fcfeeaa0..7a605399 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -1,10 +1,10 @@ #!/bin/bash - +SERVER=`hostname` if [[ -n "$INDEXER_PASSWORD" ]]; then - until [[ `curl -XGET https://0.0.0.0:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] + until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] do echo "Wazuh indexer Security is not initiaized"; sleep 30 done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -i 127.0.0.1 -p $INDEXER_PASSWORD + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER fi \ No newline at end of file From 95bd43c7e56476ae867af3c4e8d71f4cbf157bd5 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 10 Nov 2023 13:03:44 -0300 Subject: [PATCH 16/24] change revision tag --- .env | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.env b/.env index 9471b392..6b66d4a0 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 -WAZUH_TAG_REVISION=40800 +WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz -WAZUH_UI_REVISION=40800 +WAZUH_UI_REVISION=1 From 9f58e6f21fb73c13ae7ce242f208ddaea19d93f8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Nov 2023 05:00:31 -0300 Subject: [PATCH 17/24] add more optionsfor ism policies deploy --- build-docker-images/wazuh-indexer/config/ism-check.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-indexer/config/ism-check.sh b/build-docker-images/wazuh-indexer/config/ism-check.sh index 7a605399..08900dc0 100644 --- a/build-docker-images/wazuh-indexer/config/ism-check.sh +++ b/build-docker-images/wazuh-indexer/config/ism-check.sh @@ -1,4 +1,8 @@ #!/bin/bash +MIN_SHARD_SIZE=${MIN_SHARD_SIZE:-25} +MIN_INDEX_AGE=${MIN_INDEX_AGE:-"7d"} +MIN_DOC_COUNT=${MIN_DOC_COUNT:-600000000} +ISM_PRIORITY=${ISM_PRIORITY:-50} SERVER=`hostname` if [[ -n "$INDEXER_PASSWORD" ]]; then until [[ `curl -XGET https://$SERVER:9200/_cat/indices -u admin:SecretPassword -k -s | grep .opendistro_security | wc -l` -eq 1 ]] @@ -6,5 +10,5 @@ if [[ -n "$INDEXER_PASSWORD" ]]; then echo "Wazuh indexer Security is not initiaized"; sleep 30 done - bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER + bash /usr/share/wazuh-indexer/bin/indexer-ism-init.sh -p $INDEXER_PASSWORD -i $SERVER -P $ISM_PRIORITY -d $MIN_DOC_COUNT -a $MIN_INDEX_AGE -s $MIN_SHARD_SIZE fi \ No newline at end of file From c38a25224c65a04a388ab34bbd1cc88538a69fb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 13:52:41 +0100 Subject: [PATCH 18/24] Adapted docker build to multiple Wazuh Dashboards plugins --- .../wazuh-dashboard/config/install_wazuh_app.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index a95158cb..95782530 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,5 +1,8 @@ ## variables WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CHECK_UPDATES=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CORE=https://packages-dev.wazuh.com/staging/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -22,4 +25,6 @@ elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then fi # Install Wazuh App -$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root \ No newline at end of file +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_CHECK_UPDATES --allow-root +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_CORE --allow-root \ No newline at end of file From 573090edcb6a2367ec62d09dc6eb74ee204c41fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 15:54:25 +0100 Subject: [PATCH 19/24] Added variables in validations for different repositories --- .../wazuh-dashboard/config/install_wazuh_app.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index 95782530..49f11b53 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,8 +1,7 @@ ## variables WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CHECK_UPDATES=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -WAZUH_CORE=https://packages-dev.wazuh.com/staging/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +WAZUH_CORE=https://packages.wazuh.com/4.x/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -14,12 +13,18 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi fi fi From 37d38ecf9267d08242e86e2bb57aa42971cce837 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Thu, 16 Nov 2023 15:59:44 +0100 Subject: [PATCH 20/24] Fixed identation --- build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index 49f11b53..a9cea3a5 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -18,7 +18,7 @@ if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip - WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + WAZUH_CHECK_UPDATES=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCheckUpdates-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CORE=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuhCore-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then From 10008a792b5f2ed80655cfc52d01a1e9721fc44e Mon Sep 17 00:00:00 2001 From: c-bordon Date: Tue, 19 Dec 2023 09:27:17 -0300 Subject: [PATCH 21/24] Updated Filebeat module version --- .env | 2 +- build-docker-images/README.md | 2 +- build-docker-images/build-images.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.env b/.env index 6b66d4a0..d8abf73e 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 7753ca77..b51af049 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -24,7 +24,7 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.3. + -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.8.0. -h, --help Show this help. diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 61691bfd..a0383362 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -15,7 +15,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} WAZUH_IMAGE_VERSION="4.8.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" -FILEBEAT_MODULE_VERSION="0.3" +FILEBEAT_MODULE_VERSION="0.4" # ----------------------------------------------------------------------------- From 09aeb68b14be4de82d77165268097232b30ebfec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Tue, 19 Dec 2023 10:45:21 -0300 Subject: [PATCH 22/24] New VD config update --- .../config/etc/cont-init.d/2-manager | 9 ++ .../config/wazuh_cluster/wazuh_manager.conf | 106 ++++-------------- .../config/wazuh_cluster/wazuh_worker.conf | 106 ++++-------------- .../config/wazuh_cluster/wazuh_manager.conf | 104 ++++------------- 4 files changed, 73 insertions(+), 252 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index 9e70ace9..8ddce84e 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -112,6 +112,12 @@ function_entrypoint_scripts() { fi } +function_configure_vulnerability_detection() { +if [ "$INDEXER_PASSWORD" != "" ]; then + >&2 echo "Configuring password." + sed -i "s|VDPass|'$INDEXER_PASSWORD'|g" /var/ossec/etc/ossec.conf +fi +} # Migrate data from /wazuh-migration volume function_wazuh_migration @@ -119,6 +125,9 @@ function_wazuh_migration # create API custom user function_create_custom_user +# configure Vulnerabilty detection +function_configure_vulnerability_detection + # run entrypoint scripts function_entrypoint_scripts diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 6c5d9ae7..1ec10630 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -95,91 +95,29 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - yes - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh1.indexer:9200 + https://wazuh2.indexer:9200 + https://wazuh3.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 341e6301..9d277622 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -95,91 +95,29 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh1.indexer:9200 + https://wazuh2.indexer:9200 + https://wazuh3.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 0cf738f3..9dd0990c 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -95,91 +95,27 @@ yes - - no - 5m - 6h - yes + + yes + yes + 60m + - - - no - trusty - xenial - bionic - focal - jammy - 1h - - - - - no - buster - bullseye - bookworm - 1h - - - - - no - 5 - 6 - 7 - 8 - 9 - 1h - - - - - no - amazon-linux - amazon-linux-2 - amazon-linux-2023 - 1h - - - - - no - 11-server - 11-desktop - 12-server - 12-desktop - 15-server - 15-desktop - 1h - - - - - no - 1h - - - - - no - 8 - 9 - 1h - - - - - yes - 1h - - - - - yes - 1h - - - + + yes + + https://wazuh.indexer:9200 + + admin + VDPass + + + /etc/ssl/root-ca.pem + + /etc/ssl/filebeat.pem + /etc/ssl/filebeat.key + + From 2258605ec21e5b6fb4426ce7042b8a24cc373529 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 20 Dec 2023 04:28:33 -0300 Subject: [PATCH 23/24] delete single quotes for configurate vuln detection --- .env | 2 +- .../wazuh-manager/config/etc/cont-init.d/2-manager | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.env b/.env index 6b66d4a0..e4e7c63c 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.2.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.3.tar.gz WAZUH_UI_REVISION=1 diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index 8ddce84e..f0cf6ec3 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -115,7 +115,7 @@ function_entrypoint_scripts() { function_configure_vulnerability_detection() { if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - sed -i "s|VDPass|'$INDEXER_PASSWORD'|g" /var/ossec/etc/ossec.conf + sed -i "s|VDPass|$INDEXER_PASSWORD|g" /var/ossec/etc/ossec.conf fi } From 9b1ba35383b085d81e6d8ea7754859ce27cd30a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Correa=20Rodr=C3=ADguez?= Date: Wed, 20 Dec 2023 16:29:00 +0100 Subject: [PATCH 24/24] Changed Filebeat module version to 0.4 --- .env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.env b/.env index e4e7c63c..d8abf73e 100755 --- a/.env +++ b/.env @@ -2,5 +2,5 @@ WAZUH_VERSION=4.8.0 WAZUH_IMAGE_VERSION=4.8.0 WAZUH_TAG_REVISION=1 FILEBEAT_TEMPLATE_BRANCH=4.8.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.3.tar.gz +WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1