diff --git a/.env b/.env new file mode 100755 index 00000000..bfc67828 --- /dev/null +++ b/.env @@ -0,0 +1,3 @@ +WAZUH_VERSION=4.4.0 +WAZUH_IMAGE_VERSION=4.4.0 +WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 769fbcbb..6a6ed8eb 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -70,28 +70,6 @@ port: listening: true ip: - 0.0.0.0 -user: - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin -group: - wazuh: - exists: true process: filebeat: running: true @@ -113,3 +91,13 @@ process: running: true wazuh-modulesd: running: true +user: + wazuh: + exists: true + groups: + - wazuh + home: /var/ossec + shell: /sbin/nologin +group: + wazuh: + exists: true \ No newline at end of file diff --git a/.github/multi-node-filebeat-check.sh b/.github/multi-node-filebeat-check.sh new file mode 100755 index 00000000..39a21827 --- /dev/null +++ b/.github/multi-node-filebeat-check.sh @@ -0,0 +1,18 @@ +filebeatout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output') +filebeatstatus1=$(echo "${filebeatout1}" | grep -c OK) +if [[ filebeatstatus1 -eq 7 ]]; then + echo "No errors in master filebeat" +else + echo "Errors in master filebeat" + echo "${filebeatout1}" + exit 1 +fi +filebeatout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output') +filebeatstatus2=$(echo "${filebeatout2}" | grep -c OK) +if [[ filebeatstatus2 -eq 7 ]]; then + echo "No errors in worker filebeat" +else + echo "Errors in worker filebeat" + echo "${filebeatout2}" + exit 1 +fi \ No newline at end of file diff --git a/.github/multi-node-log-check.sh b/.github/multi-node-log-check.sh new file mode 100755 index 00000000..bfa1649a --- /dev/null +++ b/.github/multi-node-log-check.sh @@ -0,0 +1,16 @@ +log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "$log1" ]]; then + echo "No errors in master ossec.log" +else + echo "Errors in master ossec.log:" + echo "${log1}" + exit 1 +fi +log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "${log2}" ]]; then + echo "No errors in worker ossec.log" +else + echo "Errors in worker ossec.log:" + echo "${log2}" + exit 1 +fi \ No newline at end of file diff --git a/.github/single-node-filebeat-check.sh b/.github/single-node-filebeat-check.sh new file mode 100755 index 00000000..7f9ae7d3 --- /dev/null +++ b/.github/single-node-filebeat-check.sh @@ -0,0 +1,9 @@ +filebeatout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output') +filebeatstatus=$(echo "${filebeatout}" | grep -c OK) +if [[ filebeatstatus -eq 7 ]]; then + echo "No errors in filebeat" +else + echo "Errors in filebeat" + echo "${filebeatout}" + exit 1 +fi \ No newline at end of file diff --git a/.github/single-node-log-check.sh b/.github/single-node-log-check.sh new file mode 100755 index 00000000..806e9238 --- /dev/null +++ b/.github/single-node-log-check.sh @@ -0,0 +1,8 @@ +log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "$log" ]]; then + echo "No errors in ossec.log" +else + echo "Errors in ossec.log:" + echo "${log}" + exit 1 +fi \ No newline at end of file diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 8919b1a0..33967eef 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,31 +1,310 @@ name: Wazuh Docker pipeline -on: [push] +on: [pull_request] jobs: - build-stack: + build-docker-images: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v2 + uses: actions/checkout@v3 - - name: Build the docker-compose stack - run: docker-compose -f build-wazuh-images.yml up -d --build + - name: Build Wazuh images + run: build-docker-images/build-images.sh - - name: Check running containers - run: docker ps -a + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV - - name: Shutdown the stack - run: docker-compose -f build-wazuh-images.yml kill + - name: Create backup Docker images + run: | + mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/ + docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar + docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar + docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar + + - name: Temporarily save Wazuh manager Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-manager + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar + retention-days: 1 + + - name: Temporarily save Wazuh indexer Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-indexer + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar + retention-days: 1 + + - name: Temporarily save Wazuh dashboard Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-dashboard + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar + retention-days: 1 - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: version: v0.3.16 - - name: Execute Goss tests (wazuh-odfe) - run: dgoss run wazuh/wazuh-manager:4.4.0 + - name: Execute Goss tests (wazuh-manager) + run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} env: GOSS_SLEEP: 30 - GOSS_FILE: .github/.goss.yaml \ No newline at end of file + GOSS_FILE: .github/.goss.yaml + + check-single-node: + runs-on: ubuntu-latest + needs: build-docker-images + steps: + + - name: Check out code + uses: actions/checkout@v3 + + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV + + - name: Retrieve saved Wazuh indexer Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-indexer + + - name: Retrieve saved Wazuh manager Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-manager + + - name: Retrieve saved Wazuh dashboard Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-dashboard + + - name: Docker load + run: | + docker load --input ./wazuh-indexer.tar + docker load --input ./wazuh-dashboard.tar + docker load --input ./wazuh-manager.tar + + + - name: Create single node certficates + run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator + + - name: Start single node stack + run: docker-compose -f single-node/docker-compose.yml up -d + + - name: Check Wazuh indexer start + run: | + sleep 60 + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + if [[ $status_green -eq 1 ]]; then + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + exit 1 + fi + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + exit 1 + fi + + + - name: Check Wazuh indexer nodes + run: | + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + if [[ $nodes -eq 1 ]]; then + echo "Wazuh indexer nodes: ${nodes}" + else + echo "Wazuh indexer nodes: ${nodes}" + exit 1 + fi + + - name: Check documents into wazuh-alerts index + run: | + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + if [[ $docs -gt 100 ]]; then + echo "wazuh-alerts index documents: ${docs}" + else + echo "wazuh-alerts index documents: ${docs}" + exit 1 + fi + + - name: Check Wazuh templates + run: | + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + if [[ $qty_templates -eq 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi + + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh + + + - name: Check filebeat output + run: ./.github/single-node-filebeat-check.sh + + - name: Check Wazuh dashboard service URL + run: | + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') + if [[ $status -eq 200 ]]; then + echo "Wazuh dashboard status: ${status}" + else + echo "Wazuh dashboard status: ${status}" + exit 1 + fi + + - name: Stop single node stack + run: docker-compose -f single-node/docker-compose.yml down + + check-multi-node: + runs-on: ubuntu-latest + needs: build-docker-images + steps: + + - name: Check out code + uses: actions/checkout@v3 + + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV + + - name: Retrieve saved Wazuh dashboard Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-dashboard + + - name: Retrieve saved Wazuh manager Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-manager + + - name: Retrieve saved Wazuh indexer Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-indexer + + - name: Docker load + run: | + docker load --input ./wazuh-manager.tar + docker load --input ./wazuh-indexer.tar + docker load --input ./wazuh-dashboard.tar + + - name: Create multi node certficates + run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator + + - name: Start multi node stack + run: docker-compose -f multi-node/docker-compose.yml up -d + + - name: Check Wazuh indexer start + run: | + sleep 120 + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + if [[ $status_green -eq 1 ]]; then + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + exit 1 + fi + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + exit 1 + fi + + - name: Check Wazuh indexer nodes + run: | + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + if [[ $nodes -eq 3 ]]; then + echo "Wazuh indexer nodes: ${nodes}" + else + echo "Wazuh indexer nodes: ${nodes}" + exit 1 + fi + + - name: Check documents into wazuh-alerts index + run: | + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + if [[ $docs -gt 200 ]]; then + echo "wazuh-alerts index documents: ${docs}" + else + echo "wazuh-alerts index documents: ${docs}" + exit 1 + fi + + - name: Check Wazuh templates + run: | + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" + if [[ $qty_templates -eq 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi + + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 10 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) + if [[ $nodes -eq 2 ]]; then + echo "Wazuh manager nodes: ${nodes}" + else + echo "Wazuh manager nodes: ${nodes}" + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/multi-node-log-check.sh + + + - name: Check filebeat output + run: ./.github/multi-node-filebeat-check.sh + + - name: Check Wazuh dashboard service URL + run: | + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') + if [[ $status -eq 200 ]]; then + echo "Wazuh dashboard status: ${status}" + else + echo "Wazuh dashboard status: ${status}" + exit 1 + fi \ No newline at end of file diff --git a/.gitignore b/.gitignore index a2abaa56..6d7fadef 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem single-node/config/wazuh_indexer_ssl_certs/*.key multi-node/config/wazuh_indexer_ssl_certs/*.pem -multi-node/config/wazuh_indexer_ssl_certs/*.key +multi-node/config/wazuh_indexer_ssl_certs/*.key \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 106428fe..35ae3ee9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,43 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440) +## Wazuh Docker v4.3.10 +### Added + +- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310) + + +## Wazuh Docker v4.3.9 +### Added + +- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439) + + +## Wazuh Docker v4.3.8 +### Added + +- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438) + +## Wazuh Docker v4.3.7 +### Added + +- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437) + +## Wazuh Docker v4.3.6 +### Added + +- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436) + +## Wazuh Docker v4.3.5 +### Added + +- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435) + +## Wazuh Docker v4.3.4 +### Added + +- Update Wazuh to version [4.3.4](https://github.com/wazuh/wazuh/blob/v4.3.4/CHANGELOG.md#v434) + ## Wazuh Docker v4.3.3 ### Added diff --git a/README.md b/README.md index ff3449c4..3d661734 100644 --- a/README.md +++ b/README.md @@ -36,8 +36,8 @@ Default values are included when available. ### Wazuh ``` -API_USERNAME="wazuh" # Wazuh API username -API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements +API_USERNAME="wazuh-wui" # Wazuh API username +API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements # (8+ length, uppercase, lowercase, specials chars) INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL @@ -78,10 +78,12 @@ API_SELECTOR=true Defines if the user is allowed to change the sel IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu IP_IGNORE="[]" # List of index patterns to be ignored +DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore +DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas -WAZUH_MONITORING_REPLICAS=0 # +WAZUH_MONITORING_REPLICAS=0 ## ``` ## Directory structure @@ -194,6 +196,13 @@ WAZUH_MONITORING_REPLICAS=0 # | Wazuh version | ODFE | XPACK | |---------------|---------|--------| | v4.4.0 | | | +| v4.3.10 | | | +| v4.3.9 | | | +| v4.3.8 | | | +| v4.3.7 | | | +| v4.3.6 | | | +| v4.3.5 | | | +| v4.3.4 | | | | v4.3.3 | | | | v4.3.2 | | | | v4.3.1 | | | diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 9860d8b0..13f1c9bf 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -1,7 +1,11 @@ # Wazuh Docker Image Builder -This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command: +The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script + +To execute the process, the following must be executed in the root of the wazuh-docker repository: ``` -$ docker-compose build -``` \ No newline at end of file +$ build-docker-images/build-images.sh +``` + +This script initializes the environment variables needed to build each of the images. diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh new file mode 100755 index 00000000..b244673d --- /dev/null +++ b/build-docker-images/build-images.sh @@ -0,0 +1,25 @@ +WAZUH_IMAGE_VERSION=4.4.0 +WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') +WAZUH_TAG_REVISION=1 +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') + +MAJOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f3) + +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 +if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then + IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +else + IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +fi + +echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env +echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env +echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env + +docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache \ No newline at end of file diff --git a/build-docker-images/docker-compose.yml b/build-docker-images/build-images.yml similarity index 75% rename from build-docker-images/docker-compose.yml rename to build-docker-images/build-images.yml index a99f4e48..52984bf9 100644 --- a/build-docker-images/docker-compose.yml +++ b/build-docker-images/build-images.yml @@ -3,8 +3,12 @@ version: '3.7' services: wazuh.manager: - build: wazuh-manager/ - image: wazuh/wazuh-manager:4.4.0 + build: + context: wazuh-manager/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} hostname: wazuh.manager restart: always ports: @@ -31,8 +35,12 @@ services: - filebeat_var:/var/lib/filebeat wazuh.indexer: - build: wazuh-indexer/ - image: wazuh/wazuh-indexer:4.4.0 + build: + context: wazuh-indexer/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} hostname: wazuh.indexer restart: always ports: @@ -48,8 +56,12 @@ services: hard: 65536 wazuh.dashboard: - build: wazuh-dashboard/ - image: wazuh/wazuh-dashboard:4.4.0 + build: + context: wazuh-dashboard/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} hostname: wazuh.dashboard restart: always ports: diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index dc690c85..1b95ca88 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,8 +1,10 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder -ARG WAZUH_VERSION=4.4.0 +ARG WAZUH_VERSION +ARG WAZUH_TAG_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard +ARG WAZUH_UI_REVISION=1 # Update and install dependencies RUN apt-get update && apt install curl libcap2-bin xz-utils -y @@ -11,16 +13,17 @@ RUN apt-get update && apt install curl libcap2-bin xz-utils -y RUN mkdir -p $INSTALL_DIR # Download and extract Wazuh dashboard base -RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \ - tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 +COPY config/dl_base.sh . +RUN bash dl_base.sh # Generate certificates COPY config/config.sh . COPY config/config.yml / RUN bash config.sh -# Install Wazuh App -RUN $INSTALL_DIR/bin/opensearch-dashboards-plugin install https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}.zip --allow-root +COPY config/install_wazuh_app.sh / +RUN chmod 775 /install_wazuh_app.sh +RUN bash /install_wazuh_app.sh # Copy and set permissions to config files COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/ diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh new file mode 100644 index 00000000..00ffe992 --- /dev/null +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -0,0 +1,29 @@ +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## check version to use the correct repository +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + else + REPOSITORY="packages.wazuh.com" + fi + else + REPOSITORY="packages.wazuh.com" + fi +else + REPOSITORY="packages.wazuh.com" +fi + +curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz +tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 54fe0d3e..290f9fa8 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -7,7 +7,7 @@ DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" # Create and configure Wazuh dashboard keystore -$INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ +yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root @@ -15,6 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o # Start Wazuh dashboard ############################################################################## -/wazuh_app_config.sh +/wazuh_app_config.sh $WAZUH_UI_REVISION /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh new file mode 100644 index 00000000..d10d97c1 --- /dev/null +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -0,0 +1,30 @@ +## Variables +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## check version to use the correct repository +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + fi + else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + fi +else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +fi + +# Install Wazuh App +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 9a6c700d..d126d18e 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,6 +1,9 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder +ARG WAZUH_VERSION +ARG WAZUH_TAG_REVISION + RUN apt-get update -y && apt-get install curl openssl xz-utils -y COPY config/opensearch.yml / diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index dcfb5f80..c3328d13 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=4.4.0 +export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} @@ -19,10 +19,36 @@ export INDEXER_FILE=wazuh-indexer-base.tar.xz export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz export REPO_DIR=/unattended_installer - rm -rf ${INSTALLATION_DIR}/ -curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE} +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## If wazuh manager exists in apt dev repository, change variables, if not exit 1 +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + else + REPOSITORY="packages.wazuh.com" + fi + else + REPOSITORY="packages.wazuh.com" + fi +else + REPOSITORY="packages.wazuh.com" +fi + +curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} tar -xf ${INDEXER_FILE} ## TOOLS @@ -106,5 +132,9 @@ cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca. cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem +# Delete xms and xmx parameters in jvm.options +sed '/-Xms/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options +sed '/-Xmx/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options + chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/* \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 4042bc99..6ac46be8 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,7 +1,10 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal -ARG WAZUH_VERSION=4.4.0 +RUN rm /bin/sh && ln -s /bin/bash /bin/sh + +ARG WAZUH_VERSION +ARG WAZUH_TAG_REVISION ARG TEMPLATE_VERSION=4.4 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 @@ -9,10 +12,13 @@ ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y -RUN apt-key adv --fetch-keys https://packages.wazuh.com/key/GPG-KEY-WAZUH && \ - echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list && \ - apt-get update && \ - apt-get install wazuh-manager=${WAZUH_VERSION}-1 +COPY config/check_repository.sh / + +RUN chmod 775 /check_repository.sh +RUN source /check_repository.sh + +RUN apt-get update && \ + apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\ dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \ diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh new file mode 100644 index 00000000..152f07e0 --- /dev/null +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -0,0 +1,35 @@ +## Variables +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## If wazuh manager exists in apt dev repository, change variables, if not exit 1 +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" + fi + else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" + fi +else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" +fi +apt-key adv --fetch-keys ${APT_KEY} +echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py index cc492398..e2a89325 100644 --- a/build-docker-images/wazuh-manager/config/create_user.py +++ b/build-docker-images/wazuh-manager/config/create_user.py @@ -21,7 +21,7 @@ try: set_user_role, update_user, ) -except Exception as e: +except ModuleNotFoundError as e: logging.error("No module 'wazuh' found.") sys.exit(1) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 0e93d33d..ea1ab5f0 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -179,6 +179,15 @@ set_rids_owner() { chown -R wazuh:wazuh /var/ossec/queue/rids } +############################################################################## +# Change any ossec user/group to wazuh user/group +############################################################################## + +set_correct_permOwner() { + find / -group 997 -exec chown :101 {} +; + find / -user 999 -exec chown 101 {} +; +} + ############################################################################## # Main function ############################################################################## @@ -189,6 +198,9 @@ main() { # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) apply_exclusion_data + + # Apply correct permission and ownership + set_correct_permOwner # Rename files stored in permanent data (i.e. queue/ossec) move_data_files diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat index c9062ba0..c4a5c7f4 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat @@ -12,32 +12,38 @@ fi if [ "$INDEXER_USERNAME" != "" ]; then >&2 echo "Configuring username." - sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml + sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml + sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml fi if [ "$INDEXER_PASSWORD" != "" ]; then >&2 echo "Configuring password." - sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml + sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml + sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml fi if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then >&2 echo "Configuring SSL verification mode." - sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml + sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml + sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml fi if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then >&2 echo "Configuring Certificate Authorities." - sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml + sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml + sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml fi if [ "$SSL_CERTIFICATE" != "" ]; then >&2 echo "Configuring SSL Certificate." - sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml + sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml + sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml fi if [ "$SSL_KEY" != "" ]; then >&2 echo "Configuring SSL Key." - sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml + sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml + sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml fi diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 8fa25065..1909e63e 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -51,11 +51,11 @@ chown 1000:1000 /certificates/* echo "Setting UID for wazuh manager and worker" cp /certificates/root-ca.pem /certificates/root-ca-manager.pem cp /certificates/root-ca.key /certificates/root-ca-manager.key -chown 999:997 /certificates/root-ca-manager.pem -chown 999:997 /certificates/root-ca-manager.key +chown 101:101 /certificates/root-ca-manager.pem +chown 101:101 /certificates/root-ca-manager.key for i in ${node_names[@]}; do - chown 999:997 "/certificates/${i}.pem" - chown 999:997 "/certificates/${i}-key.pem" + chown 101:101 "/certificates/${i}.pem" + chown 101:101 "/certificates/${i}-key.pem" done diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.4.md similarity index 99% rename from multi-node/Migration-to-Wazuh-4.3.md rename to multi-node/Migration-to-Wazuh-4.4.md index 611e14b8..3ff10a84 100644 --- a/multi-node/Migration-to-Wazuh-4.3.md +++ b/multi-node/Migration-to-Wazuh-4.4.md @@ -1,6 +1,6 @@ # Opendistro data migration to Wazuh indexer on docker. This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2 to v4.3. +The example is migrating from v4.2 to v4.4. ## Procedure Assuming that you have a v4.2 production deployment, perform the following steps. @@ -350,9 +350,9 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` -**7. Start the 4.3 environment.** +**7. Start the 4.4 environment.** ``` -git checkout 4.3 +git checkout 4.4 cd multi-node docker-compose -f generate-indexer-certs.yml run --rm generator docker-compose up -d diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 8747f02e..aec223a1 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -349,24 +349,9 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/auth.log - - - - syslog - /var/log/syslog - - syslog /var/log/dpkg.log - - syslog - /var/log/kern.log - - \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index dc4475d2..46fceb1e 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -349,24 +349,9 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/auth.log - - - - syslog - /var/log/syslog - - syslog /var/log/dpkg.log - - syslog - /var/log/kern.log - - \ No newline at end of file