From 45e08437fcd8542035848a4970555315428ae77b Mon Sep 17 00:00:00 2001 From: VictorMorenoJimenez Date: Thu, 15 Apr 2021 15:57:48 +0200 Subject: [PATCH 01/24] Change ossec-control to wazuh-control --- .goss.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.goss.yaml b/.goss.yaml index a0380493..920a5994 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -6,7 +6,7 @@ file: group: root filetype: file contains: [] - /var/ossec/bin/ossec-control: + /var/ossec/bin/wazuh-control: exists: true mode: "0750" owner: root From 5550edb4ae7b025c186ecf06b6e727345d9dadfd Mon Sep 17 00:00:00 2001 From: jcruzlp Date: Tue, 27 Apr 2021 12:37:45 +0200 Subject: [PATCH 02/24] Fixed broken link --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8ff10da5..336d2ba6 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ In addition, a docker-compose file is provided to launch the containers mentione Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. -Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md). +Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). ## Environment Variables From 2b9e1a6f8991fd78d6e2ab3c172d705af3cf3ed6 Mon Sep 17 00:00:00 2001 From: jcruzlp Date: Tue, 27 Apr 2021 12:39:04 +0200 Subject: [PATCH 03/24] Removed unussed basic auth --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 336d2ba6..f5550b1b 100644 --- a/README.md +++ b/README.md @@ -22,9 +22,9 @@ In addition, a docker-compose file is provided to launch the containers mentione * [Docker hub](https://hub.docker.com/u/wazuh) -### Setup SSL certificate and Basic Authentication +### Setup SSL certificate -Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. +Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). From fc54288a0d239609e3feed339c76b9934ba25cd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Fern=C3=A1ndez?= Date: Mon, 24 May 2021 11:45:07 +0200 Subject: [PATCH 04/24] Update README --- README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/README.md b/README.md index f5550b1b..d080e75b 100644 --- a/README.md +++ b/README.md @@ -146,9 +146,8 @@ ADMIN_PRIVILEGES=true # App privileges ## Branches -* `4.0` branch on correspond to the latest Wazuh-Docker stable version. * `master` branch contains the latest code, be aware of possible bugs on this branch. -* `Wazuh.Version` (for example 3.13.1_7.8.0 or 4.1.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch. +* `stable` branch on correspond to the last Wazuh stable version. ## Compatibility Matrix From c8b8e8b134d59c260f9db30a4422bdb0241d42ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Fern=C3=A1ndez?= Date: Mon, 24 May 2021 13:01:47 +0200 Subject: [PATCH 05/24] Bump to ODFE 1.13.2 --- .goss.yaml | 2 +- CHANGELOG.md | 6 ++++++ README.md | 13 ++----------- build-from-sources.yml | 2 +- docker-compose.yml | 2 +- kibana-odfe/Dockerfile | 4 ++-- kibana-odfe/config/kibana_settings.sh | 2 -- kibana-odfe/config/welcome_wazuh.sh | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- 10 files changed, 18 insertions(+), 23 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 920a5994..198f523f 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -52,7 +52,7 @@ package: filebeat: installed: true versions: - - 7.10.0 + - 7.10.2 wazuh-manager: installed: true versions: diff --git a/CHANGELOG.md b/CHANGELOG.md index edd03a8e..292007c0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,12 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.2.0](https://github.com/wazuh/wazuh/blob/v4.2.0/CHANGELOG.md#v420) +## Wazuh Docker v4.1.5 +### Added + +- Update Wazuh to version [4.1.5](https://github.com/wazuh/wazuh/blob/v4.1.5/CHANGELOG.md#v415) +- Update ODFE compatibility to version 1.13.2 + ## Wazuh Docker v4.1.4 ### Added diff --git a/README.md b/README.md index d080e75b..916b79f2 100644 --- a/README.md +++ b/README.md @@ -154,26 +154,17 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.2.0 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| +| v4.2.0 | 1.13.2 | 7.10.2 | +| v4.1.5 | 1.13.2 | 7.10.2 | | v4.1.4 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.3 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.2 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.1 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.0 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.0.4 | 1.11.0 | | -|---------------|---------|--------| | v4.0.3 | 1.11.0 | | -|---------------|---------|--------| | v4.0.2 | 1.11.0 | | -|---------------|---------|--------| | v4.0.1 | 1.11.0 | | -|---------------|---------|--------| | v4.0.0 | 1.10.1 | | ## Credits and Thank you diff --git a/build-from-sources.yml b/build-from-sources.yml index 14e21304..2ab4d2ac 100644 --- a/build-from-sources.yml +++ b/build-from-sources.yml @@ -31,7 +31,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.3 hostname: elasticsearch restart: always ports: diff --git a/docker-compose.yml b/docker-compose.yml index 73d7b57c..1a1f2d2f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -30,7 +30,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index b919d9bf..2997d858 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -1,7 +1,7 @@ # Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) -FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0 +FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana -ARG ELASTIC_VERSION=7.10.0 +ARG ELASTIC_VERSION=7.10.2 ARG WAZUH_VERSION=4.2.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" diff --git a/kibana-odfe/config/kibana_settings.sh b/kibana-odfe/config/kibana_settings.sh index 4bc39a5f..4663889b 100644 --- a/kibana-odfe/config/kibana_settings.sh +++ b/kibana-odfe/config/kibana_settings.sh @@ -18,8 +18,6 @@ WAZUH_MAJOR=4 # Customize elasticsearch ip ############################################################################## sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml -# disable multitenancy -sed -i "s|opendistro_security.multitenancy.enabled:.*|opendistro_security.multitenancy.enabled: false|g" /usr/share/kibana/config/kibana.yml # If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate. if [ "$KIBANA_INDEX" != "" ]; then diff --git a/kibana-odfe/config/welcome_wazuh.sh b/kibana-odfe/config/welcome_wazuh.sh index b0bcfc70..c3846762 100644 --- a/kibana-odfe/config/welcome_wazuh.sh +++ b/kibana-odfe/config/welcome_wazuh.sh @@ -4,7 +4,7 @@ if [[ $CHANGE_WELCOME == "true" ]] then echo "Set Wazuh app as the default landing page" - echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml + echo "server.defaultRoute: /app/wazuh?security_tenant=global" >> /usr/share/kibana/config/kibana.yml echo "Set custom welcome styles" cp -f /tmp/custom_welcome/template.js.hbs /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs diff --git a/production-cluster.yml b/production-cluster.yml index b739bab7..bf3d4386 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -67,7 +67,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: @@ -90,7 +90,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml elasticsearch-2: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-2 restart: always environment: @@ -111,7 +111,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml elasticsearch-3: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-3 restart: always environment: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index 37723a8d..1a6d989a 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss -ARG FILEBEAT_VERSION=7.10.0 +ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_VERSION=4.2.0-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" From 64c61bcdbff3903f2aac82e8d9621d138a4396c8 Mon Sep 17 00:00:00 2001 From: Alberto R Date: Mon, 28 Jun 2021 23:35:30 +0200 Subject: [PATCH 06/24] Fixed mode Kibana settings --- kibana-odfe/config/kibana_settings.sh | 2 +- kibana/config/kibana_settings.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kibana-odfe/config/kibana_settings.sh b/kibana-odfe/config/kibana_settings.sh index 4663889b..7b182678 100644 --- a/kibana-odfe/config/kibana_settings.sh +++ b/kibana-odfe/config/kibana_settings.sh @@ -53,6 +53,6 @@ rm -f ${default_index} sleep 5 # Configuring Kibana TimePicker. curl ${auth} -POST -k "https://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' +'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}' echo "End settings" diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh index f62054f1..146ff53e 100644 --- a/kibana/config/kibana_settings.sh +++ b/kibana/config/kibana_settings.sh @@ -70,7 +70,7 @@ rm -f ${default_index} sleep 5 # Configuring Kibana TimePicker. curl ${auth} -POST -k "$kibana_proto://127.0.0.1:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' +'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-12h\",\n \"to\": \"now\"}"}}' sleep 5 # Do not ask user to help providing usage statistics to Elastic From 0699c8fe21d12d84f4cc7c369688baf2c1f65966 Mon Sep 17 00:00:00 2001 From: dfolcha Date: Thu, 26 Aug 2021 15:08:18 +0200 Subject: [PATCH 07/24] Add admin key pair to production development --- VERSION | 2 +- production-cluster.yml | 2 ++ .../elastic_opendistro/elasticsearch-node1.yml | 2 +- .../elastic_opendistro/elasticsearch-node2.yml | 2 +- .../elastic_opendistro/elasticsearch-node3.yml | 2 +- production_cluster/ssl_certs/certs.yml | 7 ++++++- 6 files changed, 12 insertions(+), 5 deletions(-) diff --git a/VERSION b/VERSION index 156da5c1..be0692cf 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.2.0" -REVISION="41100" +REVISION="40212" diff --git a/production-cluster.yml b/production-cluster.yml index bf3d4386..2296fb9a 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -86,6 +86,8 @@ services: - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem + - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem + - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml diff --git a/production_cluster/elastic_opendistro/elasticsearch-node1.yml b/production_cluster/elastic_opendistro/elasticsearch-node1.yml index c343818e..4f9a628d 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node1.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node1.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true diff --git a/production_cluster/elastic_opendistro/elasticsearch-node2.yml b/production_cluster/elastic_opendistro/elasticsearch-node2.yml index 3e9bae49..e368461e 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node2.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node2.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true diff --git a/production_cluster/elastic_opendistro/elasticsearch-node3.yml b/production_cluster/elastic_opendistro/elasticsearch-node3.yml index 574bce5c..14717a81 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node3.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node3.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml index f7dad185..486e4178 100644 --- a/production_cluster/ssl_certs/certs.yml +++ b/production_cluster/ssl_certs/certs.yml @@ -27,4 +27,9 @@ nodes: - name: filebeat dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com dns: - - wazuh + - wazuh + +clients: + - name: admin + dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com + admin: true From 8a014959689e74b06a03ca3ae0f459fdd45d379f Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 10:47:45 +0200 Subject: [PATCH 08/24] Update AR files --- wazuh-odfe/config/permanent_data.env | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 9c2556d8..47f5c06b 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -20,23 +20,21 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" From 25cb1fa872030cb1c4d6e30109d733c9839b2cfc Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 12:01:58 +0200 Subject: [PATCH 09/24] Fix wrong OD version --- build-from-sources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-from-sources.yml b/build-from-sources.yml index 2ab4d2ac..637556e1 100644 --- a/build-from-sources.yml +++ b/build-from-sources.yml @@ -31,7 +31,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.13.3 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: From 137f0ba88fbe05f505605706b2591e0075df132c Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 27 Aug 2021 12:11:00 +0200 Subject: [PATCH 10/24] Update goss tests --- .goss.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 198f523f..049c8121 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -95,17 +95,17 @@ group: process: filebeat: running: true - ossec-analysisd: + wazuh-analysisd: running: true - ossec-authd: + wazuh-authd: running: true - ossec-execd: + wazuh-execd: running: true - ossec-monitord: + wazuh-monitord: running: true - ossec-remoted: + wazuh-remoted: running: true - ossec-syscheckd: + wazuh-syscheckd: running: true s6-supervise: running: true From 6da1b19698965e3ee89a74a826091ba19e39c18d Mon Sep 17 00:00:00 2001 From: dfolcha Date: Thu, 2 Sep 2021 10:17:07 +0200 Subject: [PATCH 11/24] Exclude queue/ossec from volume --- wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 2 +- wazuh-odfe/config/permanent_data.env | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index b45dced5..fbc08153 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -84,7 +84,7 @@ remove_data_files() { if [ -e ${del_file} ] then print "Removing ${del_file}" - exec_cmd "rm ${del_file}" + exec_cmd "rm -rf ${del_file}" fi done } diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 47f5c06b..3c259ff7 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,6 +4,8 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" +PERMANENT_DATA[((i++))]="/var/ossec/queue/sockets" +PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/ossec/integrations" @@ -62,4 +64,5 @@ export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" +PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/ossec" export PERMANENT_DATA_DEL From 68bc08f78f2cf4920d958e10752a6622ff19700e Mon Sep 17 00:00:00 2001 From: dfolcha Date: Thu, 2 Sep 2021 17:05:23 +0200 Subject: [PATCH 12/24] Add function to rename files and directories --- .../config/etc/cont-init.d/0-wazuh-init | 20 +++++++++++++++++++ wazuh-odfe/config/permanent_data.env | 7 +++++-- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index fbc08153..46697125 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -74,6 +74,23 @@ apply_exclusion_data() { done } +############################################################################## +# This function will rename in the permanent data volume every file +# contained in PERMANENT_DATA_MOVE +############################################################################## + +move_data_files() { + for mov_file in "${PERMANENT_DATA_MOVE[@]}"; do + file_split=( $mov_file ) + if [ -e ${file_split[0]} ] + then + print "moving ${mov_file}" + exec_cmd "mv -f ${mov_file}" + fi + done +} + + ############################################################################## # This function will delete from the permanent data volume every file # contained in PERMANENT_DATA_DEL @@ -158,6 +175,9 @@ main() { # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) apply_exclusion_data + # Rename files stored in permanent data (i.e. queue/ossec) + move_data_files + # Remove some files in permanent_data (i.e. .template.db) remove_data_files diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 3c259ff7..9ec743af 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,7 +4,6 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" -PERMANENT_DATA[((i++))]="/var/ossec/queue/sockets" PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" @@ -64,5 +63,9 @@ export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" -PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/ossec" export PERMANENT_DATA_DEL + +i=0 +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" +PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" +export PERMANENT_DATA_MOVE \ No newline at end of file From 413dd71d4436d977acc52a24eca8b26a549606f8 Mon Sep 17 00:00:00 2001 From: dfolcha Date: Fri, 3 Sep 2021 09:16:20 +0200 Subject: [PATCH 13/24] Remove -r flag --- wazuh-odfe/config/etc/cont-init.d/0-wazuh-init | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init index 46697125..e3c9ebfa 100644 --- a/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init +++ b/wazuh-odfe/config/etc/cont-init.d/0-wazuh-init @@ -101,7 +101,7 @@ remove_data_files() { if [ -e ${del_file} ] then print "Removing ${del_file}" - exec_cmd "rm -rf ${del_file}" + exec_cmd "rm -f ${del_file}" fi done } From 9e9de07322011b73b280f0ef59b8f68e112faac0 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Sep 2021 09:23:36 -0300 Subject: [PATCH 14/24] Update 4.2.1 --- .goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 2 +- docker-compose.yml | 4 ++-- kibana-odfe/Dockerfile | 2 +- kibana/Dockerfile | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- xpack-compose.yml | 4 ++-- xpack-from-sources.yml | 4 ++-- 11 files changed, 20 insertions(+), 14 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 049c8121..27188600 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.2.0 + - 4.2.1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 292007c0..d7c693e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.2.1 +### Added + +- Update Wazuh to version [4.2.1](https://github.com/wazuh/wazuh/blob/v4.2.1/CHANGELOG.md#v421) + ## Wazuh Docker v4.2.0 ### Added diff --git a/README.md b/README.md index 916b79f2..3d9b4b69 100644 --- a/README.md +++ b/README.md @@ -154,6 +154,7 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.2.1 | 1.13.2 | 7.10.2 | | v4.2.0 | 1.13.2 | 7.10.2 | | v4.1.5 | 1.13.2 | 7.10.2 | | v4.1.4 | 1.12.0 | 7.10.2 | diff --git a/VERSION b/VERSION index be0692cf..69593b64 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.2.0" +WAZUH-DOCKER_VERSION="4.2.1" REVISION="40212" diff --git a/docker-compose.yml b/docker-compose.yml index 1a1f2d2f..9b229b10 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.2.1 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.2.0 + image: wazuh/wazuh-kibana-odfe:4.2.1 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 2997d858..83bfff78 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.0 +ARG WAZUH_VERSION=4.2.1 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 2124b225..dd638832 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.0 +ARG WAZUH_VERSION=4.2.1 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index 2296fb9a..2b5cf217 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.2.1 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.2.1 hostname: wazuh-worker restart: always environment: @@ -134,7 +134,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.2.0 + image: wazuh/wazuh-kibana-odfe:4.2.1 hostname: kibana restart: always ports: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index 1a6d989a..f97d3424 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.0-1 +ARG WAZUH_VERSION=4.2.1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" diff --git a/xpack-compose.yml b/xpack-compose.yml index 77017087..aa92a58b 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.2.0 + image: wazuh/wazuh:4.2.1 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.2.0 + image: wazuh/wazuh-kibana:4.2.1 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 6265ecb7..4e2ac2dc 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.10.2 - image: wazuh/wazuh:4.2.0 + image: wazuh/wazuh:4.2.1 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.2.0 + image: wazuh/wazuh-kibana:4.2.1 hostname: kibana restart: always ports: From 8d0dd5baeb6e7eacf1b9af2c6016d0ea020a1fb8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 9 Sep 2021 11:13:04 -0300 Subject: [PATCH 15/24] Update 4.2.1 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 69593b64..f34ad021 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.2.1" -REVISION="40212" +REVISION="40214" From daaac09c9cead0574fc32cec90475afaeb2a456b Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 13 Sep 2021 15:21:53 -0300 Subject: [PATCH 16/24] Update 4.2.1 --- .../kibana_ssl/generate-self-signed-cert.sh | 1 + xpack-from-sources.yml | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/production_cluster/kibana_ssl/generate-self-signed-cert.sh b/production_cluster/kibana_ssl/generate-self-signed-cert.sh index e006733f..c7326bca 100644 --- a/production_cluster/kibana_ssl/generate-self-signed-cert.sh +++ b/production_cluster/kibana_ssl/generate-self-signed-cert.sh @@ -9,4 +9,5 @@ then exit else openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem + chown -R 1000:1000 . fi diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 4e2ac2dc..e248f01f 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -7,7 +7,7 @@ services: context: wazuh-odfe/ args: - FILEBEAT_CHANNEL=filebeat - - FILEBEAT_VERSION=7.10.2 + - FILEBEAT_VERSION=7.11.2 image: wazuh/wazuh:4.2.1 hostname: wazuh-manager restart: always @@ -42,7 +42,7 @@ services: elasticsearch: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch restart: always ports: @@ -79,7 +79,7 @@ services: - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt elasticsearch2: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch2 restart: always environment: @@ -114,7 +114,7 @@ services: - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt elasticsearch3: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 hostname: elasticsearch3 restart: always environment: From 2dd9fdfa99770d16cdc25f4c6fb6393a21c6ca5a Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 Sep 2021 10:03:16 -0300 Subject: [PATCH 17/24] Update 4.2.1 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3d9b4b69..28916b15 100644 --- a/README.md +++ b/README.md @@ -154,7 +154,7 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.2.1 | 1.13.2 | 7.10.2 | +| v4.2.1 | 1.13.2 | 7.11.2 | | v4.2.0 | 1.13.2 | 7.10.2 | | v4.1.5 | 1.13.2 | 7.10.2 | | v4.1.4 | 1.12.0 | 7.10.2 | From 61f3e080a3856c9e67e5541458c55a548b0224d9 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 Sep 2021 10:08:48 -0300 Subject: [PATCH 18/24] Update 4.2.1 --- production_cluster/kibana_ssl/generate-self-signed-cert.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/production_cluster/kibana_ssl/generate-self-signed-cert.sh b/production_cluster/kibana_ssl/generate-self-signed-cert.sh index c7326bca..5951acf7 100644 --- a/production_cluster/kibana_ssl/generate-self-signed-cert.sh +++ b/production_cluster/kibana_ssl/generate-self-signed-cert.sh @@ -9,5 +9,5 @@ then exit else openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem - chown -R 1000:1000 . + chown -R 1000:1000 *.pem fi From f0ebabad894c004141347d5075141e736cb6bebc Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Sep 2021 10:51:19 -0300 Subject: [PATCH 19/24] Update 4.2.2 --- .goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 4 ++-- docker-compose.yml | 4 ++-- kibana-odfe/Dockerfile | 2 +- kibana/Dockerfile | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- xpack-compose.yml | 4 ++-- xpack-from-sources.yml | 4 ++-- 11 files changed, 21 insertions(+), 15 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 27188600..d82e3219 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.2.1 + - 4.2.2 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index d7c693e2..362db30f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.2.2 +### Added + +- Update Wazuh to version [4.2.2](https://github.com/wazuh/wazuh/blob/v4.2.2/CHANGELOG.md#v422) + ## Wazuh Docker v4.2.1 ### Added diff --git a/README.md b/README.md index 28916b15..a4dd3720 100644 --- a/README.md +++ b/README.md @@ -154,6 +154,7 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.2.2 | 1.13.2 | 7.11.2 | | v4.2.1 | 1.13.2 | 7.11.2 | | v4.2.0 | 1.13.2 | 7.10.2 | | v4.1.5 | 1.13.2 | 7.10.2 | diff --git a/VERSION b/VERSION index f34ad021..2c257c43 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.2.1" -REVISION="40214" +WAZUH-DOCKER_VERSION="4.2.2" +REVISION="40215" diff --git a/docker-compose.yml b/docker-compose.yml index 9b229b10..e283651b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.1 + image: wazuh/wazuh-odfe:4.2.2 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.2.1 + image: wazuh/wazuh-kibana-odfe:4.2.2 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 83bfff78..d5c462f4 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.1 +ARG WAZUH_VERSION=4.2.2 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index dd638832..b05920ac 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.1 +ARG WAZUH_VERSION=4.2.2 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index 2b5cf217..ce32b17d 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.2.1 + image: wazuh/wazuh-odfe:4.2.2 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.2.1 + image: wazuh/wazuh-odfe:4.2.2 hostname: wazuh-worker restart: always environment: @@ -134,7 +134,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.2.1 + image: wazuh/wazuh-kibana-odfe:4.2.2 hostname: kibana restart: always ports: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index f97d3424..78707f9a 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.1 +ARG WAZUH_VERSION=4.2.2 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" diff --git a/xpack-compose.yml b/xpack-compose.yml index aa92a58b..d8a5ea82 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.2.1 + image: wazuh/wazuh:4.2.2 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.2.1 + image: wazuh/wazuh-kibana:4.2.2 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index e248f01f..ee12e251 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.2.1 + image: wazuh/wazuh:4.2.2 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.2.1 + image: wazuh/wazuh-kibana:4.2.2 hostname: kibana restart: always ports: From 084407f9c9d5d6569585a1a03f04763049e38296 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Sep 2021 10:55:43 -0300 Subject: [PATCH 20/24] Update 4.2.2 --- generate-elasticsearch-certs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generate-elasticsearch-certs.yml b/generate-elasticsearch-certs.yml index e777e881..e68bbf62 100644 --- a/generate-elasticsearch-certs.yml +++ b/generate-elasticsearch-certs.yml @@ -10,7 +10,7 @@ services: bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out config/certificates/bundle.zip; unzip config/certificates/bundle.zip -d config/certificates/; fi; - chown -R 1000:0 /certs + chown -R 1000:0 config/certificates ' user: "0" working_dir: /usr/share/elasticsearch From e99ba259e031da3c6749f4acd6b24e7cf010c860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alberto=20Rodr=C3=ADguez?= Date: Thu, 23 Sep 2021 20:00:03 +0200 Subject: [PATCH 21/24] Added `util.py` to permanent data --- wazuh-odfe/config/permanent_data.env | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 9ec743af..c9cbcd3e 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -58,6 +58,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted @@ -68,4 +69,4 @@ export PERMANENT_DATA_DEL i=0 PERMANENT_DATA_MOVE[((i++))]="/var/ossec/logs/ossec /var/ossec/logs/wazuh" PERMANENT_DATA_MOVE[((i++))]="/var/ossec/queue/ossec /var/ossec/queue/sockets" -export PERMANENT_DATA_MOVE \ No newline at end of file +export PERMANENT_DATA_MOVE From 503db33dde67b6eadb77a6807b7b3a2ec5705fd2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 16:50:34 -0300 Subject: [PATCH 22/24] Merge 4.2 into master --- production_cluster/ssl_certs/certs.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml index d9551f05..486e4178 100644 --- a/production_cluster/ssl_certs/certs.yml +++ b/production_cluster/ssl_certs/certs.yml @@ -27,13 +27,8 @@ nodes: - name: filebeat dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com dns: -<<<<<<< HEAD - wazuh -======= - - wazuh - ->>>>>>> f34b7d0465dbc8bf717d81e2bc4f13f44a03a55d clients: - name: admin dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com From c33cb0d2741520cd01989ccb3d8d2b3b73dc9bbc Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 16:54:29 -0300 Subject: [PATCH 23/24] Merge 4.2 into master --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0053ecfd..9aaf87ab 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ In addition, a docker-compose file is provided to launch the containers mentione Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). -Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). +Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). ## Environment Variables From 1588bc26ff01f778e08b67142509b42be2ef4f23 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 18:09:31 -0300 Subject: [PATCH 24/24] Merge 4.2 into master --- xpack-from-sources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 80ca6b19..922eee93 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.2.2 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: