diff --git a/.env b/.env
new file mode 100755
index 00000000..bfc67828
--- /dev/null
+++ b/.env
@@ -0,0 +1,3 @@
+WAZUH_VERSION=4.4.0
+WAZUH_IMAGE_VERSION=4.4.0
+WAZUH_TAG_REVISION=1
diff --git a/.github/.goss.yaml b/.github/.goss.yaml
index 769fbcbb..6a6ed8eb 100644
--- a/.github/.goss.yaml
+++ b/.github/.goss.yaml
@@ -70,28 +70,6 @@ port:
listening: true
ip:
- 0.0.0.0
-user:
- wazuh:
- exists: true
- groups:
- - wazuh
- home: /var/ossec
- shell: /sbin/nologin
- wazuh:
- exists: true
- groups:
- - wazuh
- home: /var/ossec
- shell: /sbin/nologin
- wazuh:
- exists: true
- groups:
- - wazuh
- home: /var/ossec
- shell: /sbin/nologin
-group:
- wazuh:
- exists: true
process:
filebeat:
running: true
@@ -113,3 +91,13 @@ process:
running: true
wazuh-modulesd:
running: true
+user:
+ wazuh:
+ exists: true
+ groups:
+ - wazuh
+ home: /var/ossec
+ shell: /sbin/nologin
+group:
+ wazuh:
+ exists: true
\ No newline at end of file
diff --git a/.github/multi-node-filebeat-check.sh b/.github/multi-node-filebeat-check.sh
new file mode 100755
index 00000000..39a21827
--- /dev/null
+++ b/.github/multi-node-filebeat-check.sh
@@ -0,0 +1,18 @@
+filebeatout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
+filebeatstatus1=$(echo "${filebeatout1}" | grep -c OK)
+if [[ filebeatstatus1 -eq 7 ]]; then
+ echo "No errors in master filebeat"
+else
+ echo "Errors in master filebeat"
+ echo "${filebeatout1}"
+ exit 1
+fi
+filebeatout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
+filebeatstatus2=$(echo "${filebeatout2}" | grep -c OK)
+if [[ filebeatstatus2 -eq 7 ]]; then
+ echo "No errors in worker filebeat"
+else
+ echo "Errors in worker filebeat"
+ echo "${filebeatout2}"
+ exit 1
+fi
\ No newline at end of file
diff --git a/.github/multi-node-log-check.sh b/.github/multi-node-log-check.sh
new file mode 100755
index 00000000..bfa1649a
--- /dev/null
+++ b/.github/multi-node-log-check.sh
@@ -0,0 +1,16 @@
+log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "$log1" ]]; then
+ echo "No errors in master ossec.log"
+else
+ echo "Errors in master ossec.log:"
+ echo "${log1}"
+ exit 1
+fi
+log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "${log2}" ]]; then
+ echo "No errors in worker ossec.log"
+else
+ echo "Errors in worker ossec.log:"
+ echo "${log2}"
+ exit 1
+fi
\ No newline at end of file
diff --git a/.github/single-node-filebeat-check.sh b/.github/single-node-filebeat-check.sh
new file mode 100755
index 00000000..7f9ae7d3
--- /dev/null
+++ b/.github/single-node-filebeat-check.sh
@@ -0,0 +1,9 @@
+filebeatout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
+filebeatstatus=$(echo "${filebeatout}" | grep -c OK)
+if [[ filebeatstatus -eq 7 ]]; then
+ echo "No errors in filebeat"
+else
+ echo "Errors in filebeat"
+ echo "${filebeatout}"
+ exit 1
+fi
\ No newline at end of file
diff --git a/.github/single-node-log-check.sh b/.github/single-node-log-check.sh
new file mode 100755
index 00000000..806e9238
--- /dev/null
+++ b/.github/single-node-log-check.sh
@@ -0,0 +1,8 @@
+log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "$log" ]]; then
+ echo "No errors in ossec.log"
+else
+ echo "Errors in ossec.log:"
+ echo "${log}"
+ exit 1
+fi
\ No newline at end of file
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 8919b1a0..33967eef 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -1,31 +1,310 @@
name: Wazuh Docker pipeline
-on: [push]
+on: [pull_request]
jobs:
- build-stack:
+ build-docker-images:
runs-on: ubuntu-latest
steps:
- name: Check out code
- uses: actions/checkout@v2
+ uses: actions/checkout@v3
- - name: Build the docker-compose stack
- run: docker-compose -f build-wazuh-images.yml up -d --build
+ - name: Build Wazuh images
+ run: build-docker-images/build-images.sh
- - name: Check running containers
- run: docker ps -a
+ - name: Create enviroment variables
+ run: cat .env > $GITHUB_ENV
- - name: Shutdown the stack
- run: docker-compose -f build-wazuh-images.yml kill
+ - name: Create backup Docker images
+ run: |
+ mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
+ docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+ docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+ docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+
+ - name: Temporarily save Wazuh manager Docker image
+ uses: actions/upload-artifact@v3
+ with:
+ name: docker-artifact-manager
+ path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+ retention-days: 1
+
+ - name: Temporarily save Wazuh indexer Docker image
+ uses: actions/upload-artifact@v3
+ with:
+ name: docker-artifact-indexer
+ path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+ retention-days: 1
+
+ - name: Temporarily save Wazuh dashboard Docker image
+ uses: actions/upload-artifact@v3
+ with:
+ name: docker-artifact-dashboard
+ path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+ retention-days: 1
- name: Install Goss
uses: e1himself/goss-installation-action@v1.0.3
with:
version: v0.3.16
- - name: Execute Goss tests (wazuh-odfe)
- run: dgoss run wazuh/wazuh-manager:4.4.0
+ - name: Execute Goss tests (wazuh-manager)
+ run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}
env:
GOSS_SLEEP: 30
- GOSS_FILE: .github/.goss.yaml
\ No newline at end of file
+ GOSS_FILE: .github/.goss.yaml
+
+ check-single-node:
+ runs-on: ubuntu-latest
+ needs: build-docker-images
+ steps:
+
+ - name: Check out code
+ uses: actions/checkout@v3
+
+ - name: Create enviroment variables
+ run: cat .env > $GITHUB_ENV
+
+ - name: Retrieve saved Wazuh indexer Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-indexer
+
+ - name: Retrieve saved Wazuh manager Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-manager
+
+ - name: Retrieve saved Wazuh dashboard Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-dashboard
+
+ - name: Docker load
+ run: |
+ docker load --input ./wazuh-indexer.tar
+ docker load --input ./wazuh-dashboard.tar
+ docker load --input ./wazuh-manager.tar
+
+
+ - name: Create single node certficates
+ run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator
+
+ - name: Start single node stack
+ run: docker-compose -f single-node/docker-compose.yml up -d
+
+ - name: Check Wazuh indexer start
+ run: |
+ sleep 60
+ status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+ if [[ $status_green -eq 1 ]]; then
+ curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+ else
+ curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+ exit 1
+ fi
+ status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+ status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
+ if [[ $status_index_green -eq $status_index ]]; then
+ curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+ else
+ curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+ exit 1
+ fi
+
+
+ - name: Check Wazuh indexer nodes
+ run: |
+ nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+ if [[ $nodes -eq 1 ]]; then
+ echo "Wazuh indexer nodes: ${nodes}"
+ else
+ echo "Wazuh indexer nodes: ${nodes}"
+ exit 1
+ fi
+
+ - name: Check documents into wazuh-alerts index
+ run: |
+ docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
+ if [[ $docs -gt 100 ]]; then
+ echo "wazuh-alerts index documents: ${docs}"
+ else
+ echo "wazuh-alerts index documents: ${docs}"
+ exit 1
+ fi
+
+ - name: Check Wazuh templates
+ run: |
+ qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
+ templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
+ if [[ $qty_templates -eq 3 ]]; then
+ echo "wazuh templates:"
+ echo "${templates}"
+ else
+ echo "wazuh templates:"
+ echo "${templates}"
+ exit 1
+ fi
+
+ - name: Check Wazuh manager start
+ run: |
+ services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+ if [[ $services -gt 9 ]]; then
+ echo "Wazuh Manager Services: ${services}"
+ echo "OK"
+ else
+ echo "Wazuh indexer nodes: ${nodes}"
+ curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+ exit 1
+ fi
+ env:
+ TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+ - name: Check errors in ossec.log
+ run: ./.github/single-node-log-check.sh
+
+
+ - name: Check filebeat output
+ run: ./.github/single-node-filebeat-check.sh
+
+ - name: Check Wazuh dashboard service URL
+ run: |
+ status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}')
+ if [[ $status -eq 200 ]]; then
+ echo "Wazuh dashboard status: ${status}"
+ else
+ echo "Wazuh dashboard status: ${status}"
+ exit 1
+ fi
+
+ - name: Stop single node stack
+ run: docker-compose -f single-node/docker-compose.yml down
+
+ check-multi-node:
+ runs-on: ubuntu-latest
+ needs: build-docker-images
+ steps:
+
+ - name: Check out code
+ uses: actions/checkout@v3
+
+ - name: Create enviroment variables
+ run: cat .env > $GITHUB_ENV
+
+ - name: Retrieve saved Wazuh dashboard Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-dashboard
+
+ - name: Retrieve saved Wazuh manager Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-manager
+
+ - name: Retrieve saved Wazuh indexer Docker image
+ uses: actions/download-artifact@v3
+ with:
+ name: docker-artifact-indexer
+
+ - name: Docker load
+ run: |
+ docker load --input ./wazuh-manager.tar
+ docker load --input ./wazuh-indexer.tar
+ docker load --input ./wazuh-dashboard.tar
+
+ - name: Create multi node certficates
+ run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator
+
+ - name: Start multi node stack
+ run: docker-compose -f multi-node/docker-compose.yml up -d
+
+ - name: Check Wazuh indexer start
+ run: |
+ sleep 120
+ status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+ if [[ $status_green -eq 1 ]]; then
+ curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+ else
+ curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+ exit 1
+ fi
+ status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+ status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
+ if [[ $status_index_green -eq $status_index ]]; then
+ curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+ else
+ curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+ exit 1
+ fi
+
+ - name: Check Wazuh indexer nodes
+ run: |
+ nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+ if [[ $nodes -eq 3 ]]; then
+ echo "Wazuh indexer nodes: ${nodes}"
+ else
+ echo "Wazuh indexer nodes: ${nodes}"
+ exit 1
+ fi
+
+ - name: Check documents into wazuh-alerts index
+ run: |
+ docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
+ if [[ $docs -gt 200 ]]; then
+ echo "wazuh-alerts index documents: ${docs}"
+ else
+ echo "wazuh-alerts index documents: ${docs}"
+ exit 1
+ fi
+
+ - name: Check Wazuh templates
+ run: |
+ qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
+ templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
+ if [[ $qty_templates -eq 3 ]]; then
+ echo "wazuh templates:"
+ echo "${templates}"
+ else
+ echo "wazuh templates:"
+ echo "${templates}"
+ exit 1
+ fi
+
+ - name: Check Wazuh manager start
+ run: |
+ services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+ if [[ $services -gt 10 ]]; then
+ echo "Wazuh Manager Services: ${services}"
+ echo "OK"
+ else
+ echo "Wazuh indexer nodes: ${nodes}"
+ curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+ exit 1
+ fi
+ nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l)
+ if [[ $nodes -eq 2 ]]; then
+ echo "Wazuh manager nodes: ${nodes}"
+ else
+ echo "Wazuh manager nodes: ${nodes}"
+ exit 1
+ fi
+ env:
+ TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+ - name: Check errors in ossec.log
+ run: ./.github/multi-node-log-check.sh
+
+
+ - name: Check filebeat output
+ run: ./.github/multi-node-filebeat-check.sh
+
+ - name: Check Wazuh dashboard service URL
+ run: |
+ status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}')
+ if [[ $status -eq 200 ]]; then
+ echo "Wazuh dashboard status: ${status}"
+ else
+ echo "Wazuh dashboard status: ${status}"
+ exit 1
+ fi
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index a2abaa56..6d7fadef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
single-node/config/wazuh_indexer_ssl_certs/*.pem
single-node/config/wazuh_indexer_ssl_certs/*.key
multi-node/config/wazuh_indexer_ssl_certs/*.pem
-multi-node/config/wazuh_indexer_ssl_certs/*.key
+multi-node/config/wazuh_indexer_ssl_certs/*.key
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 106428fe..35ae3ee9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,43 @@ All notable changes to this project will be documented in this file.
- Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440)
+## Wazuh Docker v4.3.10
+### Added
+
+- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310)
+
+
+## Wazuh Docker v4.3.9
+### Added
+
+- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439)
+
+
+## Wazuh Docker v4.3.8
+### Added
+
+- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438)
+
+## Wazuh Docker v4.3.7
+### Added
+
+- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437)
+
+## Wazuh Docker v4.3.6
+### Added
+
+- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436)
+
+## Wazuh Docker v4.3.5
+### Added
+
+- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435)
+
+## Wazuh Docker v4.3.4
+### Added
+
+- Update Wazuh to version [4.3.4](https://github.com/wazuh/wazuh/blob/v4.3.4/CHANGELOG.md#v434)
+
## Wazuh Docker v4.3.3
### Added
diff --git a/README.md b/README.md
index ff3449c4..3d661734 100644
--- a/README.md
+++ b/README.md
@@ -36,8 +36,8 @@ Default values are included when available.
### Wazuh
```
-API_USERNAME="wazuh" # Wazuh API username
-API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements
+API_USERNAME="wazuh-wui" # Wazuh API username
+API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements
# (8+ length, uppercase, lowercase, specials chars)
INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL
@@ -78,10 +78,12 @@ API_SELECTOR=true Defines if the user is allowed to change the sel
IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu
IP_IGNORE="[]" # List of index patterns to be ignored
+DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore
+DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore
WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices
WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task
WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas
-WAZUH_MONITORING_REPLICAS=0 #
+WAZUH_MONITORING_REPLICAS=0 ##
```
## Directory structure
@@ -194,6 +196,13 @@ WAZUH_MONITORING_REPLICAS=0 #
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
| v4.4.0 | | |
+| v4.3.10 | | |
+| v4.3.9 | | |
+| v4.3.8 | | |
+| v4.3.7 | | |
+| v4.3.6 | | |
+| v4.3.5 | | |
+| v4.3.4 | | |
| v4.3.3 | | |
| v4.3.2 | | |
| v4.3.1 | | |
diff --git a/build-docker-images/README.md b/build-docker-images/README.md
index 9860d8b0..13f1c9bf 100644
--- a/build-docker-images/README.md
+++ b/build-docker-images/README.md
@@ -1,7 +1,11 @@
# Wazuh Docker Image Builder
-This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command:
+The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script
+
+To execute the process, the following must be executed in the root of the wazuh-docker repository:
```
-$ docker-compose build
-```
\ No newline at end of file
+$ build-docker-images/build-images.sh
+```
+
+This script initializes the environment variables needed to build each of the images.
diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh
new file mode 100755
index 00000000..b244673d
--- /dev/null
+++ b/build-docker-images/build-images.sh
@@ -0,0 +1,25 @@
+WAZUH_IMAGE_VERSION=4.4.0
+WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
+WAZUH_TAG_REVISION=1
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
+
+MAJOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f1)
+MID_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f2)
+MINOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f3)
+
+MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
+MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
+MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
+
+## If wazuh manager exists in apt dev repository, change variables, if not, exit 1
+if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then
+ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
+else
+ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
+fi
+
+echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
+echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env
+echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
+
+docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache
\ No newline at end of file
diff --git a/build-docker-images/docker-compose.yml b/build-docker-images/build-images.yml
similarity index 75%
rename from build-docker-images/docker-compose.yml
rename to build-docker-images/build-images.yml
index a99f4e48..52984bf9 100644
--- a/build-docker-images/docker-compose.yml
+++ b/build-docker-images/build-images.yml
@@ -3,8 +3,12 @@ version: '3.7'
services:
wazuh.manager:
- build: wazuh-manager/
- image: wazuh/wazuh-manager:4.4.0
+ build:
+ context: wazuh-manager/
+ args:
+ WAZUH_VERSION: ${WAZUH_VERSION}
+ WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
+ image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
hostname: wazuh.manager
restart: always
ports:
@@ -31,8 +35,12 @@ services:
- filebeat_var:/var/lib/filebeat
wazuh.indexer:
- build: wazuh-indexer/
- image: wazuh/wazuh-indexer:4.4.0
+ build:
+ context: wazuh-indexer/
+ args:
+ WAZUH_VERSION: ${WAZUH_VERSION}
+ WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
+ image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
hostname: wazuh.indexer
restart: always
ports:
@@ -48,8 +56,12 @@ services:
hard: 65536
wazuh.dashboard:
- build: wazuh-dashboard/
- image: wazuh/wazuh-dashboard:4.4.0
+ build:
+ context: wazuh-dashboard/
+ args:
+ WAZUH_VERSION: ${WAZUH_VERSION}
+ WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
+ image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
hostname: wazuh.dashboard
restart: always
ports:
diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile
index dc690c85..1b95ca88 100644
--- a/build-docker-images/wazuh-dashboard/Dockerfile
+++ b/build-docker-images/wazuh-dashboard/Dockerfile
@@ -1,8 +1,10 @@
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
FROM ubuntu:focal AS builder
-ARG WAZUH_VERSION=4.4.0
+ARG WAZUH_VERSION
+ARG WAZUH_TAG_REVISION
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
+ARG WAZUH_UI_REVISION=1
# Update and install dependencies
RUN apt-get update && apt install curl libcap2-bin xz-utils -y
@@ -11,16 +13,17 @@ RUN apt-get update && apt install curl libcap2-bin xz-utils -y
RUN mkdir -p $INSTALL_DIR
# Download and extract Wazuh dashboard base
-RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \
- tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1
+COPY config/dl_base.sh .
+RUN bash dl_base.sh
# Generate certificates
COPY config/config.sh .
COPY config/config.yml /
RUN bash config.sh
-# Install Wazuh App
-RUN $INSTALL_DIR/bin/opensearch-dashboards-plugin install https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}.zip --allow-root
+COPY config/install_wazuh_app.sh /
+RUN chmod 775 /install_wazuh_app.sh
+RUN bash /install_wazuh_app.sh
# Copy and set permissions to config files
COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/
diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh
new file mode 100644
index 00000000..00ffe992
--- /dev/null
+++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh
@@ -0,0 +1,29 @@
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
+MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
+MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
+MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
+MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
+MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
+MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
+
+## check version to use the correct repository
+if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
+ if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+ elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
+ if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+ else
+ REPOSITORY="packages.wazuh.com"
+ fi
+ else
+ REPOSITORY="packages.wazuh.com"
+ fi
+else
+ REPOSITORY="packages.wazuh.com"
+fi
+
+curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz
+tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1
diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
index 54fe0d3e..290f9fa8 100644
--- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh
+++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh
@@ -7,7 +7,7 @@ DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
# Create and configure Wazuh dashboard keystore
-$INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
+yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
@@ -15,6 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o
# Start Wazuh dashboard
##############################################################################
-/wazuh_app_config.sh
+/wazuh_app_config.sh $WAZUH_UI_REVISION
/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
\ No newline at end of file
diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh
new file mode 100644
index 00000000..d10d97c1
--- /dev/null
+++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh
@@ -0,0 +1,30 @@
+## Variables
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
+MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
+MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
+MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
+MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
+MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
+MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
+
+## check version to use the correct repository
+if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then
+ WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
+ if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then
+ WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+ elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
+ if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then
+ WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+ else
+ WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+ fi
+ else
+ WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+ fi
+else
+ WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
+fi
+
+# Install Wazuh App
+$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root
\ No newline at end of file
diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile
index 9a6c700d..d126d18e 100644
--- a/build-docker-images/wazuh-indexer/Dockerfile
+++ b/build-docker-images/wazuh-indexer/Dockerfile
@@ -1,6 +1,9 @@
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
FROM ubuntu:focal AS builder
+ARG WAZUH_VERSION
+ARG WAZUH_TAG_REVISION
+
RUN apt-get update -y && apt-get install curl openssl xz-utils -y
COPY config/opensearch.yml /
diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh
index dcfb5f80..c3328d13 100644
--- a/build-docker-images/wazuh-indexer/config/config.sh
+++ b/build-docker-images/wazuh-indexer/config/config.sh
@@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME}
# Package build options
export USER=${NAME}
export GROUP=${NAME}
-export VERSION=4.4.0
+export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
export LOG_DIR=/var/log/${NAME}
export LIB_DIR=/var/lib/${NAME}
export PID_DIR=/run/${NAME}
@@ -19,10 +19,36 @@ export INDEXER_FILE=wazuh-indexer-base.tar.xz
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
export REPO_DIR=/unattended_installer
-
rm -rf ${INSTALLATION_DIR}/
-curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE}
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
+MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
+MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
+MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
+MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
+MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
+MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
+
+## If wazuh manager exists in apt dev repository, change variables, if not exit 1
+if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
+ if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+ elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
+ if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then
+ REPOSITORY="packages-dev.wazuh.com"
+ else
+ REPOSITORY="packages.wazuh.com"
+ fi
+ else
+ REPOSITORY="packages.wazuh.com"
+ fi
+else
+ REPOSITORY="packages.wazuh.com"
+fi
+
+curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE}
tar -xf ${INDEXER_FILE}
## TOOLS
@@ -106,5 +132,9 @@ cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.
cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem
cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem
+# Delete xms and xmx parameters in jvm.options
+sed '/-Xms/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
+sed '/-Xmx/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
+
chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs
chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/*
\ No newline at end of file
diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile
index 4042bc99..6ac46be8 100644
--- a/build-docker-images/wazuh-manager/Dockerfile
+++ b/build-docker-images/wazuh-manager/Dockerfile
@@ -1,7 +1,10 @@
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
FROM ubuntu:focal
-ARG WAZUH_VERSION=4.4.0
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+ARG WAZUH_VERSION
+ARG WAZUH_TAG_REVISION
ARG TEMPLATE_VERSION=4.4
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2
@@ -9,10 +12,13 @@ ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y
-RUN apt-key adv --fetch-keys https://packages.wazuh.com/key/GPG-KEY-WAZUH && \
- echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list && \
- apt-get update && \
- apt-get install wazuh-manager=${WAZUH_VERSION}-1
+COPY config/check_repository.sh /
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN apt-get update && \
+ apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\
dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \
diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh
new file mode 100644
index 00000000..152f07e0
--- /dev/null
+++ b/build-docker-images/wazuh-manager/config/check_repository.sh
@@ -0,0 +1,35 @@
+## Variables
+WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
+MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
+MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
+MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
+MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
+MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
+MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
+
+## If wazuh manager exists in apt dev repository, change variables, if not exit 1
+if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then
+ APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
+elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
+ if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then
+ APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
+ elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
+ if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then
+ APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
+ else
+ APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
+ fi
+ else
+ APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
+ fi
+else
+ APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+ REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
+fi
+apt-key adv --fetch-keys ${APT_KEY}
+echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list
\ No newline at end of file
diff --git a/build-docker-images/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py
index cc492398..e2a89325 100644
--- a/build-docker-images/wazuh-manager/config/create_user.py
+++ b/build-docker-images/wazuh-manager/config/create_user.py
@@ -21,7 +21,7 @@ try:
set_user_role,
update_user,
)
-except Exception as e:
+except ModuleNotFoundError as e:
logging.error("No module 'wazuh' found.")
sys.exit(1)
diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
index 0e93d33d..ea1ab5f0 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
@@ -179,6 +179,15 @@ set_rids_owner() {
chown -R wazuh:wazuh /var/ossec/queue/rids
}
+##############################################################################
+# Change any ossec user/group to wazuh user/group
+##############################################################################
+
+set_correct_permOwner() {
+ find / -group 997 -exec chown :101 {} +;
+ find / -user 999 -exec chown 101 {} +;
+}
+
##############################################################################
# Main function
##############################################################################
@@ -189,6 +198,9 @@ main() {
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
apply_exclusion_data
+
+ # Apply correct permission and ownership
+ set_correct_permOwner
# Rename files stored in permanent data (i.e. queue/ossec)
move_data_files
diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat
index c9062ba0..c4a5c7f4 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat
@@ -12,32 +12,38 @@ fi
if [ "$INDEXER_USERNAME" != "" ]; then
>&2 echo "Configuring username."
- sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
fi
if [ "$INDEXER_PASSWORD" != "" ]; then
>&2 echo "Configuring password."
- sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
fi
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
>&2 echo "Configuring SSL verification mode."
- sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
>&2 echo "Configuring Certificate Authorities."
- sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE" != "" ]; then
>&2 echo "Configuring SSL Certificate."
- sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_KEY" != "" ]; then
>&2 echo "Configuring SSL Key."
- sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
+ sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
+ sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
fi
diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh
index 8fa25065..1909e63e 100644
--- a/indexer-certs-creator/config/entrypoint.sh
+++ b/indexer-certs-creator/config/entrypoint.sh
@@ -51,11 +51,11 @@ chown 1000:1000 /certificates/*
echo "Setting UID for wazuh manager and worker"
cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
cp /certificates/root-ca.key /certificates/root-ca-manager.key
-chown 999:997 /certificates/root-ca-manager.pem
-chown 999:997 /certificates/root-ca-manager.key
+chown 101:101 /certificates/root-ca-manager.pem
+chown 101:101 /certificates/root-ca-manager.key
for i in ${node_names[@]};
do
- chown 999:997 "/certificates/${i}.pem"
- chown 999:997 "/certificates/${i}-key.pem"
+ chown 101:101 "/certificates/${i}.pem"
+ chown 101:101 "/certificates/${i}-key.pem"
done
diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.4.md
similarity index 99%
rename from multi-node/Migration-to-Wazuh-4.3.md
rename to multi-node/Migration-to-Wazuh-4.4.md
index 611e14b8..3ff10a84 100644
--- a/multi-node/Migration-to-Wazuh-4.3.md
+++ b/multi-node/Migration-to-Wazuh-4.4.md
@@ -1,6 +1,6 @@
# Opendistro data migration to Wazuh indexer on docker.
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
-The example is migrating from v4.2 to v4.3.
+The example is migrating from v4.2 to v4.4.
## Procedure
Assuming that you have a v4.2 production deployment, perform the following steps.
@@ -350,9 +350,9 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to"
```
-**7. Start the 4.3 environment.**
+**7. Start the 4.4 environment.**
```
-git checkout 4.3
+git checkout 4.4
cd multi-node
docker-compose -f generate-indexer-certs.yml run --rm generator
docker-compose up -d
diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf
index 8747f02e..aec223a1 100644
--- a/multi-node/config/wazuh_cluster/wazuh_manager.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf
@@ -349,24 +349,9 @@
/var/ossec/logs/active-responses.log
-
- syslog
- /var/log/auth.log
-
-
-
- syslog
- /var/log/syslog
-
-
syslog
/var/log/dpkg.log
-
- syslog
- /var/log/kern.log
-
-
\ No newline at end of file
diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf
index dc4475d2..46fceb1e 100644
--- a/multi-node/config/wazuh_cluster/wazuh_worker.conf
+++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf
@@ -349,24 +349,9 @@
/var/ossec/logs/active-responses.log
-
- syslog
- /var/log/auth.log
-
-
-
- syslog
- /var/log/syslog
-
-
syslog
/var/log/dpkg.log
-
- syslog
- /var/log/kern.log
-
-
\ No newline at end of file