diff --git a/.goss.yaml b/.goss.yaml index a50e56eb..292c1a66 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -6,7 +6,7 @@ file: group: root filetype: file contains: [] - /var/ossec/bin/ossec-control: + /var/ossec/bin/wazuh-control: exists: true mode: "0750" owner: root @@ -95,17 +95,17 @@ group: process: filebeat: running: true - ossec-analysisd: + wazuh-analysisd: running: true - ossec-authd: + wazuh-authd: running: true - ossec-execd: + wazuh-execd: running: true - ossec-monitord: + wazuh-monitord: running: true - ossec-remoted: + wazuh-remoted: running: true - ossec-syscheckd: + wazuh-syscheckd: running: true s6-supervise: running: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 57d43d84..432a6206 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,16 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430) +## Wazuh Docker v4.2.2 +### Added + +- Update Wazuh to version [4.2.2](https://github.com/wazuh/wazuh/blob/v4.2.2/CHANGELOG.md#v422) + +## Wazuh Docker v4.2.1 +### Added + +- Update Wazuh to version [4.2.1](https://github.com/wazuh/wazuh/blob/v4.2.1/CHANGELOG.md#v421) + ## Wazuh Docker v4.2.0 ### Added diff --git a/README.md b/README.md index 92e63e1b..9aaf87ab 100644 --- a/README.md +++ b/README.md @@ -22,11 +22,11 @@ In addition, a docker-compose file is provided to launch the containers mentione * [Docker hub](https://hub.docker.com/u/wazuh) -### Setup SSL certificate and Basic Authentication +### Setup SSL certificate -Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. +Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). -Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md). +Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). ## Environment Variables @@ -153,7 +153,9 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.3.0 | 1.13.2 | 7.10.2 | +| v4.3.0 | 1.13.2 | 7.11.2 | +| v4.2.2 | 1.13.2 | 7.11.2 | +| v4.2.1 | 1.13.2 | 7.11.2 | | v4.2.0 | 1.13.2 | 7.10.2 | | v4.1.5 | 1.13.2 | 7.10.2 | | v4.1.4 | 1.12.0 | 7.10.2 | diff --git a/generate-elasticsearch-certs.yml b/generate-elasticsearch-certs.yml index e777e881..e68bbf62 100644 --- a/generate-elasticsearch-certs.yml +++ b/generate-elasticsearch-certs.yml @@ -10,7 +10,7 @@ services: bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out config/certificates/bundle.zip; unzip config/certificates/bundle.zip -d config/certificates/; fi; - chown -R 1000:0 /certs + chown -R 1000:0 config/certificates ' user: "0" working_dir: /usr/share/elasticsearch diff --git a/kibana-odfe/config/kibana_settings.sh b/kibana-odfe/config/kibana_settings.sh index 4663889b..7b182678 100644 --- a/kibana-odfe/config/kibana_settings.sh +++ b/kibana-odfe/config/kibana_settings.sh @@ -53,6 +53,6 @@ rm -f ${default_index} sleep 5 # Configuring Kibana TimePicker. curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' +'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}' echo "End settings" diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh index f62054f1..146ff53e 100644 --- a/kibana/config/kibana_settings.sh +++ b/kibana/config/kibana_settings.sh @@ -70,7 +70,7 @@ rm -f ${default_index} sleep 5 # Configuring Kibana TimePicker. curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' +'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}' sleep 5 # Do not ask user to help providing usage statistics to Elastic diff --git a/production-cluster.yml b/production-cluster.yml index 9ec9ce92..df0d2250 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -87,7 +87,7 @@ services: - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem - - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key + - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml diff --git a/production_cluster/kibana_ssl/generate-self-signed-cert.sh b/production_cluster/kibana_ssl/generate-self-signed-cert.sh index e006733f..5951acf7 100644 --- a/production_cluster/kibana_ssl/generate-self-signed-cert.sh +++ b/production_cluster/kibana_ssl/generate-self-signed-cert.sh @@ -9,4 +9,5 @@ then exit else openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem + chown -R 1000:1000 *.pem fi diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml index a4afcd45..486e4178 100644 --- a/production_cluster/ssl_certs/certs.yml +++ b/production_cluster/ssl_certs/certs.yml @@ -27,8 +27,8 @@ nodes: - name: filebeat dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com dns: - - wazuh - + - wazuh + clients: - name: admin dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index b45dced5..e3c9ebfa 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -74,6 +74,23 @@ apply_exclusion_data() { done } +############################################################################## +# This function will rename in the permanent data volume every file +# contained in PERMANENT_DATA_MOVE +############################################################################## + +move_data_files() { + for mov_file in "${PERMANENT_DATA_MOVE[@]}"; do + file_split=( $mov_file ) + if [ -e ${file_split[0]} ] + then + print "moving ${mov_file}" + exec_cmd "mv -f ${mov_file}" + fi + done +} + + ############################################################################## # This function will delete from the permanent data volume every file # contained in PERMANENT_DATA_DEL @@ -84,7 +101,7 @@ remove_data_files() { if [ -e ${del_file} ] then print "Removing ${del_file}" - exec_cmd "rm ${del_file}" + exec_cmd "rm -f ${del_file}" fi done } @@ -158,6 +175,9 @@ main() { # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) apply_exclusion_data + # Rename files stored in permanent data (i.e. queue/ossec) + move_data_files + # Remove some files in permanent_data (i.e. .template.db) remove_data_files diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 2f51fe4a..a4eca61a 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,6 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" +PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector" PERMANENT_DATA[((i++))]="/var/ossec/queue/tasks" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" @@ -21,23 +22,21 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" @@ -61,9 +60,15 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" export PERMANENT_DATA_DEL + +i=0 +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" +export PERMANENT_DATA_MOVE diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 33074e5d..922eee93 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -7,7 +7,7 @@ services: context: wazuh-odfe/ args: - FILEBEAT_CHANNEL=filebeat - - FILEBEAT_VERSION=7.10.2 + - FILEBEAT_VERSION=7.11.2 image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always @@ -42,7 +42,7 @@ services: elasticsearch: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch restart: always ports: @@ -79,7 +79,7 @@ services: - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt elasticsearch2: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch2 restart: always environment: @@ -114,7 +114,7 @@ services: - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt elasticsearch3: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch3 restart: always environment: