diff --git a/CHANGELOG.md b/CHANGELOG.md index cd900438..61093b6a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,11 +10,18 @@ All notable changes to this project will be documented in this file. - Adding the option to disable some xpack features. ([#111](https://github.com/wazuh/wazuh-docker/pull/111)) - Wazuh-Kibana customizable at plugin level. ([#117](https://github.com/wazuh/wazuh-docker/pull/117)) - Adding env variables for alerts data flow. ([#118](https://github.com/wazuh/wazuh-docker/pull/118)) +- New Logstash entrypoint added. ([#135](https://github.com/wazuh/wazuh-docker/pull/135/files)) +- Welcome screen management. ([#133](https://github.com/wazuh/wazuh-docker/pull/133)) ### Changed - Update to Wazuh version 3.8.2. ([#105](https://github.com/wazuh/wazuh-docker/pull/105)) +### Removed + +- Remove alerts created in build time. ([#137](https://github.com/wazuh/wazuh-docker/pull/137)) + + ## Wazuh Docker v3.8.1_6.5.4 ### Changed diff --git a/docker-compose.yml b/docker-compose.yml index c4cc56bd..91a0d9fc 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -57,6 +57,7 @@ services: restart: always environment: - NGINX_PORT=443 + - NGINX_CREDENTIALS ports: - "80:80" - "443:443" diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile index 19a605fd..f5a8b6d8 100644 --- a/elasticsearch/Dockerfile +++ b/elasticsearch/Dockerfile @@ -9,6 +9,8 @@ ENV API_USER="foo" \ ENV XPACK_ML="true" +ENV ENABLE_CONFIGURE_S3="false" + ENV TEMPLATE_VERSION=v3.8.2 ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/wazuh-elastic6-template-alerts.json /usr/share/elasticsearch/config @@ -21,5 +23,10 @@ COPY --chown=elasticsearch:elasticsearch ./config/load_settings.sh ./ RUN chmod +x ./load_settings.sh +RUN elasticsearch-plugin install --batch repository-s3 + +COPY config/configure_s3.sh ./config/configure_s3.sh +RUN chmod 755 ./config/configure_s3.sh + ENTRYPOINT ["/entrypoint.sh"] CMD ["elasticsearch"] diff --git a/elasticsearch/config/configure_s3.sh b/elasticsearch/config/configure_s3.sh new file mode 100644 index 00000000..49c88a25 --- /dev/null +++ b/elasticsearch/config/configure_s3.sh @@ -0,0 +1,76 @@ +#!/bin/bash + +set -e + +# Check number of arguments passed to configure_s3.sh. If it is different from 4 or 5, the process will finish with error. +# param 1: number of arguments passed to configure_s3.sh + +function CheckArgs() +{ + if [ $1 != 4 ] && [ $1 != 5 ];then + echo "Use: configure_s3.sh (By default is added to the path and the repository name)" + echo "or use: configure_s3.sh " + exit 1 + + fi +} + +# Create S3 repository from base_path / (if there is no argument, current version is added) +# Repository name would be - (if there is no argument, current version is added) +# param 1: +# param 2: +# param 3: +# param 4: +# param 5: Optional +# output: It will show "acknowledged" if the repository has been successfully created + +function CreateRepo() +{ + + elastic_ip_port="$2" + bucket_name="$3" + path="$4" + repository_name="$5" + + if [ $1 == 5 ];then + version="$6" + else + version=`curl -s $elastic_ip_port | grep number | cut -d"\"" -f4 | cut -c1` + fi + + if ! [[ "$version" =~ ^[0-9]+$ ]];then + echo "Elasticsearch major version must be an integer" + exit 1 + fi + + repository="$repository_name-$version" + s3_path="$path/$version" + + curl -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d' + { + "type": "s3", + "settings": { + "bucket": "'$bucket_name'", + "base_path": "'$s3_path'" + } + } + ' + +} + +# Run functions CheckArgs and CreateRepo +# param 1: number of arguments passed to configure_s3.sh +# param 2: +# param 3: +# param 4: +# param 5: +# param 6: Optional + +function Main() +{ + CheckArgs $1 + + CreateRepo $1 $2 $3 $4 $5 $6 +} + +Main $# $1 $2 $3 $4 $5 \ No newline at end of file diff --git a/elasticsearch/config/load_settings.sh b/elasticsearch/config/load_settings.sh index bac61378..17154c29 100644 --- a/elasticsearch/config/load_settings.sh +++ b/elasticsearch/config/load_settings.sh @@ -23,6 +23,25 @@ done >&2 echo "Elastic is up - executing command" +if [ $ENABLE_CONFIGURE_S3 ]; then + #Wait for Elasticsearch to be ready to create the repository + sleep 10 + IP_PORT="${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" + + if [ "x$S3_PATH" != "x" ]; then + + if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then + ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR + + else + ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME + + fi + + fi + +fi + #Insert default templates sed -i 's| "index.refresh_interval": "5s"| "index.refresh_interval": "5s", "number_of_shards" : '"${ALERTS_SHARDS}"', "number_of_replicas" : '"${ALERTS_REPLICAS}"'|' /usr/share/elasticsearch/config/wazuh-elastic6-template-alerts.json diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 80919392..abe4825b 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -49,6 +49,7 @@ ARG XPACK_DEVTOOLS="true" ARG XPACK_MONITORING="true" ARG XPACK_APM="true" +ARG CHANGE_WELCOME="false" COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ @@ -64,6 +65,12 @@ RUN chmod +x ./xpack_config.sh RUN ./xpack_config.sh +COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ + +RUN chmod +x ./welcome_wazuh.sh + +RUN ./welcome_wazuh.sh + RUN /usr/local/bin/kibana-docker --optimize ENTRYPOINT /entrypoint.sh diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh index c38bb1d7..f7788d29 100644 --- a/kibana/config/entrypoint.sh +++ b/kibana/config/entrypoint.sh @@ -3,6 +3,10 @@ set -e +############################################################################## +# Waiting for elasticsearch +############################################################################## + if [ "x${ELASTICSEARCH_URL}" = "x" ]; then el_url="http://elasticsearch:9200" else @@ -10,11 +14,32 @@ else fi until curl -XGET $el_url; do - >&2 echo "Elastic is unavailable - sleeping" + >&2 echo "Elastic is unavailable - sleeping." sleep 5 done ->&2 echo "Elastic is up - executing command" +sleep 2 + +>&2 echo "Elasticsearch is up." + + +############################################################################## +# Waiting for wazuh alerts template +############################################################################## + +strlen=0 + +while [[ $strlen -eq 0 ]] +do + template=$(curl $el_url/_cat/templates/wazuh -s) + strlen=${#template} + >&2 echo "Wazuh alerts template not loaded - sleeping." + sleep 2 +done + +sleep 2 + +>&2 echo "Wazuh alerts template is loaded." ./wazuh_app_config.sh diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh new file mode 100644 index 00000000..0925d57a --- /dev/null +++ b/kibana/config/welcome_wazuh.sh @@ -0,0 +1,23 @@ +#!/bin/bash + +if [[ $CHANGE_WELCOME == "true" ]] +then + + rm -rf ./optimize/bundles + + kibana_path="/usr/share/kibana" + # Set Wazuh app as the default landing page + echo "Set Wazuh app as the default landing page" + echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml + + # Redirect Kibana welcome screen to Discover + echo "Redirect Kibana welcome screen to Discover" + sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html + sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js + + # Redirect Kibana welcome screen to Discover + echo "Hide undesired links" + sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js + sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js +fi + diff --git a/logstash/Dockerfile b/logstash/Dockerfile index 146050de..a89feed8 100644 --- a/logstash/Dockerfile +++ b/logstash/Dockerfile @@ -1,12 +1,12 @@ # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) FROM docker.elastic.co/logstash/logstash:6.6.1 +COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh + +RUN chmod 755 /entrypoint.sh + RUN rm -f /usr/share/logstash/pipeline/logstash.conf COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf -USER root -COPY config/run.sh /run.sh -RUN chmod +x /run.sh - -ENTRYPOINT ["/run.sh"] +ENTRYPOINT /entrypoint.sh diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh new file mode 100644 index 00000000..88c3d169 --- /dev/null +++ b/logstash/config/entrypoint.sh @@ -0,0 +1,72 @@ +#!/bin/bash +# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) +# +# OSSEC container bootstrap. See the README for information of the environment +# variables expected by this script. +# + +set -e + +############################################################################## +# Waiting for elasticsearch +############################################################################## + +if [ "x${ELASTICSEARCH_URL}" = "x" ]; then + el_url="http://elasticsearch:9200" +else + el_url="${ELASTICSEARCH_URL}" +fi + +until curl -XGET $el_url; do + >&2 echo "Elastic is unavailable - sleeping." + sleep 5 +done + +sleep 2 + +>&2 echo "Elasticsearch is up." + +############################################################################## +# Waiting for wazuh alerts template +############################################################################## + +strlen=0 + +while [[ $strlen -eq 0 ]] +do + template=$(curl $el_url/_cat/templates/wazuh -s) + strlen=${#template} + >&2 echo "Wazuh alerts template not loaded - sleeping." + sleep 2 +done + +sleep 2 + +>&2 echo "Wazuh alerts template is loaded." + +############################################################################## +# Customize logstash output ip +############################################################################## + +if [ "$LOGSTASH_OUTPUT" != "" ]; then + >&2 echo "Customize Logstash ouput ip." + sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf + sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml +fi + +############################################################################## +# Map environment variables to entries in logstash.yml. +# Note that this will mutate logstash.yml in place if any such settings are found. +# This may be undesirable, especially if logstash.yml is bind-mounted from the +# host system. +############################################################################## + +env2yaml /usr/share/logstash/config/logstash.yml + +export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS" + +if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then + exec logstash "$@" +else + exec "$@" +fi diff --git a/logstash/config/run.sh b/logstash/config/run.sh deleted file mode 100644 index 0ccb2eee..00000000 --- a/logstash/config/run.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -# -# OSSEC container bootstrap. See the README for information of the environment -# variables expected by this script. -# - -############################################################################## -# Customize logstash output ip -############################################################################## -if [ "$LOGSTASH_OUTPUT" != "" ]; then - sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/pipeline/01-wazuh.conf - sed -i "s/elasticsearch:9200/$LOGSTASH_OUTPUT:9200/" /usr/share/logstash/config/logstash.yml -fi - -/usr/local/bin/docker-entrypoint diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh index a6eeec9e..385d7aa8 100644 --- a/nginx/config/entrypoint.sh +++ b/nginx/config/entrypoint.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) set -e @@ -12,15 +12,37 @@ else echo "SSL certificates already present" fi -# Configuring default credentiales. +# Setting users credentials. +# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b): +# +# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or +# export NGINX_CREDENTIALS="user1:pass1;user2:pass2" +# +# b) Set NGINX_CREDENTIALS in docker-compose.yml: +# NGINX_CREDENTIALS=user1:pass1;user2:pass2; or +# NGINX_CREDENTIALS=user1:pass1;user2:pass2 +# if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then - echo "Setting Nginx credentials" - echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null + echo "Setting users credentials" + if [ ! -z "$NGINX_CREDENTIALS" ]; then + IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS" + for index in "${!users[@]}" + do + IFS=':' read -r -a credentials <<< "${users[index]}" + if [ $index -eq 0 ]; then + echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null + else + echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null + fi + done + else + # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile + echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null + fi else echo "Kibana credentials already configured" fi - if [ "x${NGINX_PORT}" = "x" ]; then NGINX_PORT=443 fi diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index 268d2a3d..b412a8e8 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -17,7 +17,8 @@ RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee / RUN add-apt-repository universe && apt-get update && apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \ apt-get --no-install-recommends --no-install-suggests -y install openssl postfix bsd-mailx python-boto python-pip \ apt-transport-https vim expect nodejs python-cryptography mailutils libsasl2-modules wazuh-manager=${WAZUH_VERSION} \ - wazuh-api=${WAZUH_VERSION} && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* + wazuh-api=${WAZUH_VERSION} && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && rm -f \ + /var/ossec/logs/alerts/*/*/*.log && rm -f /var/ossec/logs/alerts/*/*/*.json # Adding first run script and entrypoint COPY config/data_dirs.env /data_dirs.env diff --git a/wazuh/config/filebeat.yml b/wazuh/config/filebeat.yml index 1835863b..bb02a5d8 100644 --- a/wazuh/config/filebeat.yml +++ b/wazuh/config/filebeat.yml @@ -8,6 +8,7 @@ filebeat: json.message_key: log json.keys_under_root: true json.overwrite_keys: true + tail_files: true output: logstash: