yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #527 from wazuh/merge-42-into-master

Browse Source 
Merge 4.2 in master
This commit is contained in:
Alberto Rodríguez
2021-10-04 15:42:01 +02:00
committed by GitHub
parent f34b7d0465 1588bc26ff
commit 2a297bab38
12 changed files with 75 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.goss.yaml
+7 -7
View File
@@ -6,7 +6,7 @@ file:
group: root
filetype: file
contains: []
/var/ossec/bin/ossec-control:
/var/ossec/bin/wazuh-control:
exists: true
mode: "0750"
owner: root
@@ -95,17 +95,17 @@ group:
process:
filebeat:
running: true
ossec-analysisd:
wazuh-analysisd:
running: true
ossec-authd:
wazuh-authd:
running: true
ossec-execd:
wazuh-execd:
running: true
ossec-monitord:
wazuh-monitord:
running: true
ossec-remoted:
wazuh-remoted:
running: true
ossec-syscheckd:
wazuh-syscheckd:
running: true
s6-supervise:
running: true
CHANGELOG.md
+10
View File
@@ -6,6 +6,16 @@ All notable changes to this project will be documented in this file.
- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430)
## Wazuh Docker v4.2.2
### Added
- Update Wazuh to version [4.2.2](https://github.com/wazuh/wazuh/blob/v4.2.2/CHANGELOG.md#v422)
## Wazuh Docker v4.2.1
### Added
- Update Wazuh to version [4.2.1](https://github.com/wazuh/wazuh/blob/v4.2.1/CHANGELOG.md#v421)
## Wazuh Docker v4.2.0
### Added
README.md
+6 -4
View File
@@ -22,11 +22,11 @@ In addition, a docker-compose file is provided to launch the containers mentione
* [Docker hub](https://hub.docker.com/u/wazuh)
### Setup SSL certificate and Basic Authentication
### Setup SSL certificate
Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth.
Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed).
Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md).
Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment).
## Environment Variables
@@ -153,7 +153,9 @@ ADMIN_PRIVILEGES=true # App privileges
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
| v4.3.0 | 1.13.2 | 7.10.2 |
| v4.3.0 | 1.13.2 | 7.11.2 |
| v4.2.2 | 1.13.2 | 7.11.2 |
| v4.2.1 | 1.13.2 | 7.11.2 |
| v4.2.0 | 1.13.2 | 7.10.2 |
| v4.1.5 | 1.13.2 | 7.10.2 |
| v4.1.4 | 1.12.0 | 7.10.2 |
generate-elasticsearch-certs.yml
+1 -1
View File
@@ -10,7 +10,7 @@ services:
bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out config/certificates/bundle.zip;
unzip config/certificates/bundle.zip -d config/certificates/;
fi;
chown -R 1000:0 /certs
chown -R 1000:0 config/certificates
'
user: "0"
working_dir: /usr/share/elasticsearch
kibana-odfe/config/kibana_settings.sh
+1 -1
View File
@@ -53,6 +53,6 @@ rm -f ${default_index}
sleep 5
# Configuring Kibana TimePicker.
curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}'
echo "End settings"
kibana/config/kibana_settings.sh
+1 -1
View File
@@ -70,7 +70,7 @@ rm -f ${default_index}
sleep 5
# Configuring Kibana TimePicker.
curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}'
'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}'
sleep 5
# Do not ask user to help providing usage statistics to Elastic
production-cluster.yml
+1 -1
View File
@@ -87,7 +87,7 @@ services:
- ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key
- ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem
- ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem
- ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key
- ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key
- ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
production_cluster/kibana_ssl/generate-self-signed-cert.sh
+1
View File
@@ -9,4 +9,5 @@ then
exit
else
openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem
chown -R 1000:1000 *.pem
fi
production_cluster/ssl_certs/certs.yml
+2 -2
View File
@@ -27,8 +27,8 @@ nodes:
- name: filebeat
dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com
dns:
- wazuh
- wazuh
clients:
- name: admin
dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com
wazuh-odfe/config/etc/cont-init.d/0-wazuh-init
+21 -1
View File
@@ -74,6 +74,23 @@ apply_exclusion_data() {
done
}
##############################################################################
# This function will rename in the permanent data volume every file
# contained in PERMANENT_DATA_MOVE
##############################################################################
move_data_files() {
for mov_file in "${PERMANENT_DATA_MOVE[@]}"; do
file_split=( $mov_file )
if [ -e ${file_split[0]} ]
then
print "moving ${mov_file}"
exec_cmd "mv -f ${mov_file}"
fi
done
}
##############################################################################
# This function will delete from the permanent data volume every file
# contained in PERMANENT_DATA_DEL
@@ -84,7 +101,7 @@ remove_data_files() {
if [ -e ${del_file} ]
then
print "Removing ${del_file}"
exec_cmd "rm ${del_file}"
exec_cmd "rm -f ${del_file}"
fi
done
}
@@ -158,6 +175,9 @@ main() {
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
apply_exclusion_data
# Rename files stored in permanent data (i.e. queue/ossec)
move_data_files
# Remove some files in permanent_data (i.e. .template.db)
remove_data_files
wazuh-odfe/config/permanent_data.env
+20 -15
View File
@@ -4,6 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
PERMANENT_DATA[((i++))]="/var/ossec/etc"
PERMANENT_DATA[((i++))]="/var/ossec/logs"
PERMANENT_DATA[((i++))]="/var/ossec/queue"
PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector"
PERMANENT_DATA[((i++))]="/var/ossec/queue/tasks"
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
@@ -21,23 +22,21 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
@@ -61,9 +60,15 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
export PERMANENT_DATA_EXCP
# Files mounted in a volume that should be deleted
i=0
PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db"
export PERMANENT_DATA_DEL
i=0
PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh"
PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets"
export PERMANENT_DATA_MOVE
xpack-from-sources.yml
+4 -4
View File
@@ -7,7 +7,7 @@ services:
context: wazuh-odfe/
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.10.2
- FILEBEAT_VERSION=7.11.2
image: wazuh/wazuh:4.3.0
hostname: wazuh-manager
restart: always
@@ -42,7 +42,7 @@ services:
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
hostname: elasticsearch
restart: always
ports:
@@ -79,7 +79,7 @@ services:
- ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt
elasticsearch2:
image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
hostname: elasticsearch2
restart: always
environment:
@@ -114,7 +114,7 @@ services:
- ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt
elasticsearch3:
image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2
image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2
hostname: elasticsearch3
restart: always
environment: