diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 0112d1bf..1761d2c3 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.10.2 + - 4.10.2-1 port: tcp:1514: listening: true diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 153ba074..43619b7b 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -14,7 +14,7 @@ on: required: false products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer' required: true filebeat_module_version: description: 'Filebeat module version' @@ -52,7 +52,7 @@ on: type: string products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer' required: true type: string filebeat_module_version: diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 962c656a..c7d34d61 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -8,7 +8,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v3 - name: Install docker-compose run: | @@ -27,36 +27,28 @@ jobs: docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - name: Temporarily save Wazuh manager Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v3 with: name: docker-artifact-manager path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar retention-days: 1 - name: Temporarily save Wazuh indexer Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v3 with: name: docker-artifact-indexer path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar retention-days: 1 - name: Temporarily save Wazuh dashboard Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v3 with: name: docker-artifact-dashboard path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar retention-days: 1 - - name: Temporarily save Wazuh agent Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-agent - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - retention-days: 1 - - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: @@ -74,7 +66,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v3 - name: Install docker-compose run: | @@ -85,31 +77,26 @@ jobs: run: cat .env > $GITHUB_ENV - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-indexer - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-manager - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-dashboard - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - name: Docker load run: | docker load --input ./wazuh-indexer.tar docker load --input ./wazuh-dashboard.tar docker load --input ./wazuh-manager.tar - docker load --input ./wazuh-agent.tar + - name: Create single node certficates run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator @@ -198,20 +185,7 @@ jobs: exit 1 fi - - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file - run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Start Wazuh agent - run: docker-compose -f wazuh-agent/docker-compose.yml up -d - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager + - name: Check errors in ossec.log run: ./.github/single-node-log-check.sh check-multi-node: @@ -220,7 +194,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v3 - name: Install docker-compose run: | @@ -235,35 +209,30 @@ jobs: sudo swapoff -a sudo rm -f /swapfile sudo apt clean + docker rmi $(docker image ls -aq) df -h - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-dashboard - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-manager - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v3 with: name: docker-artifact-indexer - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - name: Docker load run: | docker load --input ./wazuh-manager.tar docker load --input ./wazuh-indexer.tar docker load --input ./wazuh-dashboard.tar - docker load --input ./wazuh-agent.tar - rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar + rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar - name: Create multi node certficates run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator @@ -370,18 +339,5 @@ jobs: exit 1 fi - - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file - run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Start Wazuh agent - run: docker-compose -f wazuh-agent/docker-compose.yml up -d - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager + - name: Check errors in ossec.log run: ./.github/multi-node-log-check.sh \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 676edea7..81dd3ec5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. ### Added -- BACKPORT: Agent Docker images code ([#1807](https://github.com/wazuh/wazuh-docker/pull/1807)) +- None ### Changed diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index c3789359..90fbb897 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -36,16 +36,6 @@ services: - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - wazuh.agent: - build: - context: wazuh-agent/ - args: - WAZUH_VERSION: ${WAZUH_VERSION} - WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION} - hostname: wazuh.manager - restart: always - wazuh.indexer: build: context: wazuh-indexer/ diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile deleted file mode 100644 index 8a237787..00000000 --- a/build-docker-images/wazuh-agent/Dockerfile +++ /dev/null @@ -1,36 +0,0 @@ -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023 - -RUN rm /bin/sh && ln -s /bin/bash /bin/sh - -ARG WAZUH_VERSION -ARG WAZUH_TAG_REVISION -ARG S6_VERSION="v2.2.0.3" -ARG WAZUH_MANAGER='CHANGE_MANAGER_IP' -ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT' -ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP' -ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT' -ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME' - -COPY config/check_repository.sh / - -RUN yum install curl-minimal tar gzip procps -y &&\ - yum clean all - -RUN chmod 775 /check_repository.sh -RUN source /check_repository.sh - -RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all && \ - sed -i '//d' /var/ossec/etc/ossec.conf && \ - curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz - -COPY config/etc/ /etc/ - -RUN rm /etc/yum.repos.d/wazuh.repo - -ENTRYPOINT [ "/init" ] diff --git a/build-docker-images/wazuh-agent/config/check_repository.sh b/build-docker-images/wazuh-agent/config/check_repository.sh deleted file mode 100644 index e49e69c2..00000000 --- a/build-docker-images/wazuh-agent/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init deleted file mode 100644 index 2fcf4a88..00000000 --- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init +++ /dev/null @@ -1,90 +0,0 @@ -#!/usr/bin/with-contenv bash -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) - -WAZUH_INSTALL_PATH=/var/ossec -WAZUH_CONFIG_MOUNT=/wazuh-config-mount -WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER -WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"} -WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER} -WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"} -WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD -WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"} - -############################################################################## -# Aux functions -############################################################################## -print() { - echo -e $1 -} - -error_and_exit() { - echo "Error executing command: '$1'." - echo 'Exiting.' - exit 1 -} - -exec_cmd() { - eval $1 > /dev/null 2>&1 || error_and_exit "$1" -} - -exec_cmd_stdout() { - eval $1 2>&1 || error_and_exit "$1" -} - -############################################################################## -# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect -# destination files permissions -# -# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at -# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will -# replace the ossec.conf file in /var/ossec/data/etc with yours. -############################################################################## - -mount_files() { - if [ -e "$WAZUH_CONFIG_MOUNT" ] - then - print "Identified Wazuh configuration files to mount..." - exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $WAZUH_INSTALL_PATH" - else - print "No Wazuh configuration files to mount..." - fi -} - -############################################################################## -# Allow users to set the manager ip and port, enrollment ip and port and -# enroll dynamically on container start. -# -# To use this: -# 1. Create your own ossec.conf file -# 2. In your ossec.conf file, use the configuration -# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf -############################################################################## - -set_manager_conn() { - echo "ossec.conf configuration" - sed -i "s#
CHANGE_MANAGER_IP
#
$WAZUH_MANAGER_SERVER
#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_MANAGER_PORT#$WAZUH_MANAGER_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_ENROLL_IP#$WAZUH_REGISTRATION_SERVER#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_ENROLL_PORT#$WAZUH_REGISTRATION_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGEE_AGENT_NAME#$WAZUH_AGENT_NAME#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \ - echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass -} - -############################################################################## -# Main function -############################################################################## - -main() { - - # Mount selected files (WAZUH_CONFIG_MOUNT) to container - mount_files - - # Configure agent variables - set_manager_conn - -} - -main diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent b/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent deleted file mode 100644 index 076ac6ce..00000000 --- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/with-contenv bash - -############################################################################## -# Migration sequence -# Detect if there is a mounted volume on /wazuh-migration and copy the data -# to /var/ossec, finally it will create a flag ".migration-completed" inside -# the mounted volume -############################################################################## - -function __colortext() -{ - echo -e " \e[1;$2m$1\e[0m" -} - -function echogreen() -{ - echo $(__colortext "$1" "32") -} - -function echoyellow() -{ - echo $(__colortext "$1" "33") -} - -function echored() -{ - echo $(__colortext "$1" "31") -} - -function_entrypoint_scripts() { - # It will run every .sh script located in entrypoint-scripts folder in lexicographical order - if [ -d "/entrypoint-scripts/" ] - then - for script in `ls /entrypoint-scripts/*.sh | sort -n`; do - bash "$script" - done - fi -} - -# run entrypoint scripts -function_entrypoint_scripts - -# Start Wazuh -/var/ossec/bin/wazuh-control start diff --git a/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run deleted file mode 100644 index e96cba8f..00000000 --- a/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh - -# dumping ossec.log to standard output -exec tail -F /var/ossec/logs/ossec.log diff --git a/wazuh-agent/config/wazuh-agent-conf b/wazuh-agent/config/wazuh-agent-conf deleted file mode 100644 index 73a355f1..00000000 --- a/wazuh-agent/config/wazuh-agent-conf +++ /dev/null @@ -1,194 +0,0 @@ - - - - - -
CHANGE_MANAGER_IP
- CHANGE_MANAGER_PORT - tcp -
- amzn, amzn2023 - 10 - 60 - yes - aes - - yes - CHANGE_ENROLL_IP - CHANGE_ENROLL_PORT - CHANGEE_AGENT_NAME - etc/authd.pass - -
- - - - no - 5000 - 500 - - - - - no - yes - yes - yes - yes - yes - yes - yes - - - 43200 - - etc/shared/rootkit_files.txt - etc/shared/rootkit_trojans.txt - - yes - - /var/lib/containerd - /var/lib/docker/overlay2 - - - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - - - - 10 - - - - - yes - yes - 12h - yes - - - - - no - - - 43200 - - yes - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - - - .log$|.swp$ - - - /etc/ssl/private.key - - yes - yes - yes - yes - - - 10 - - - 50 - - - - yes - 5m - 10 - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - no - etc/wpk_root.pem - yes - - - - - plain - - -
- - - - syslog - /var/ossec/logs/active-responses.log - - - diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml deleted file mode 100644 index 9e5b11d2..00000000 --- a/wazuh-agent/docker-compose.yml +++ /dev/null @@ -1,11 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.agent: - image: wazuh/wazuh-agent:4.10.2 - restart: always - environment: - - WAZUH_MANAGER_SERVER=172.17.0.1 - volumes: - - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf \ No newline at end of file