From 66f50039b0830f922e4b42d80c3fba8a014d7c23 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Tue, 24 Dec 2019 16:19:52 +0100 Subject: [PATCH 1/9] Bump version to 3.11.0_7.5.1 --- VERSION | 4 ++-- docker-compose.yml | 8 ++++---- elasticsearch/Dockerfile | 4 ++-- kibana/Dockerfile | 6 +++--- wazuh/Dockerfile | 8 ++++---- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/VERSION b/VERSION index e7de9ceb..407ab706 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="3.10.2_7.5.0" -REVISION="31030" \ No newline at end of file +WAZUH-DOCKER_VERSION="3.11.0_7.5.1" +REVISION="31100" diff --git a/docker-compose.yml b/docker-compose.yml index c80df55e..5f6b23c8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '2' services: wazuh: - image: wazuh/wazuh:3.10.2_7.5.0 + image: wazuh/wazuh:3.11.0_7.5.1 hostname: wazuh-manager restart: always ports: @@ -13,7 +13,7 @@ services: - "55000:55000" elasticsearch: - image: wazuh/wazuh-elasticsearch:3.10.2_7.5.0 + image: wazuh/wazuh-elasticsearch:3.11.0_7.5.1 hostname: elasticsearch restart: always ports: @@ -30,7 +30,7 @@ services: mem_limit: 2g kibana: - image: wazuh/wazuh-kibana:3.10.2_7.5.0 + image: wazuh/wazuh-kibana:3.11.0_7.5.1 hostname: kibana restart: always depends_on: @@ -39,7 +39,7 @@ services: - elasticsearch:elasticsearch - wazuh:wazuh nginx: - image: wazuh/wazuh-nginx:3.10.2_7.5.0 + image: wazuh/wazuh-nginx:3.11.0_7.5.1 hostname: nginx restart: always environment: diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile index 25633294..ede61fbc 100644 --- a/elasticsearch/Dockerfile +++ b/elasticsearch/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -ARG ELASTIC_VERSION=7.5.0 +ARG ELASTIC_VERSION=7.5.1 FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION} ARG S3_PLUGIN_URL="https://artifacts.elastic.co/downloads/elasticsearch-plugins/repository-s3/repository-s3-${ELASTIC_VERSION}.zip" @@ -15,7 +15,7 @@ ENV XPACK_ML="true" ENV ENABLE_CONFIGURE_S3="false" -ARG TEMPLATE_VERSION=v3.10.2 +ARG TEMPLATE_VERSION=v3.11.0 # Elasticearch cluster configuration environment variables # If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration diff --git a/kibana/Dockerfile b/kibana/Dockerfile index d7f64b61..3bfad3de 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -1,8 +1,8 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM docker.elastic.co/kibana/kibana:7.5.0 +FROM docker.elastic.co/kibana/kibana:7.5.1 USER kibana -ARG ELASTIC_VERSION=7.5.0 -ARG WAZUH_VERSION=3.10.2 +ARG ELASTIC_VERSION=7.5.1 +ARG WAZUH_VERSION=3.11.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" #ADD https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /usr/share/kibana/ diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index cc813988..4dc7b238 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -1,14 +1,14 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) FROM phusion/baseimage:latest -ARG FILEBEAT_VERSION=7.5.0 +ARG FILEBEAT_VERSION=7.5.1 -ARG WAZUH_VERSION=3.10.2-1 +ARG WAZUH_VERSION=3.11.0-1 ENV API_USER="foo" \ API_PASS="bar" -ARG TEMPLATE_VERSION="v3.10.2" +ARG TEMPLATE_VERSION="v3.11.0" # Set repositories. RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \ @@ -77,4 +77,4 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e RUN chmod go-w /etc/filebeat/wazuh-template.json # Run all services -ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file +ENTRYPOINT ["/entrypoint.sh"] From 774d14ee183384f605e96c28e94c9c056b562baf Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Tue, 24 Dec 2019 17:02:53 +0100 Subject: [PATCH 2/9] Update changelog --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09bd3987..10c28926 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v3.11.0_7.5.1 + +### Added + +- Update to Wazuh version 3.11.0_7.5.1 + ## Wazuh Docker v3.10.2_7.5.0 ### Added From 88ec0fc0432f335e0e86f6ccb820b80179bb563c Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Tue, 24 Dec 2019 18:06:45 +0100 Subject: [PATCH 3/9] Update config filename --- kibana/config/wazuh_app_config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index 5f238325..6cead207 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -1,7 +1,7 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -kibana_config_file="/usr/share/kibana/plugins/wazuh/config.yml" +kibana_config_file="/usr/share/kibana/plugins/wazuh/wazuh.yml" declare -A CONFIG_MAP=( [pattern]=$PATTERN From 23fffddf950f0ccf5a15fca4e32e26e112daa50a Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Thu, 26 Dec 2019 13:30:10 +0100 Subject: [PATCH 4/9] Remove default entry --- kibana/config/wazuh_app_config.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index 6cead207..0528d7d8 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -32,6 +32,8 @@ declare -A CONFIG_MAP=( [admin]=$ADMIN_PRIVILEGES ) +sed -ie '/- default:/,+4d' $kibana_config_file + for i in "${!CONFIG_MAP[@]}" do if [ "${CONFIG_MAP[$i]}" != "" ]; then From 3c7d0f441dbc4a679d7e858ac9a69f0c7529ac6b Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Thu, 26 Dec 2019 16:49:31 +0100 Subject: [PATCH 5/9] Remove API setup from Elasticsearch image --- elasticsearch/config/load_settings.sh | 43 --------------------------- 1 file changed, 43 deletions(-) diff --git a/elasticsearch/config/load_settings.sh b/elasticsearch/config/load_settings.sh index 65f90a76..140c19c0 100644 --- a/elasticsearch/config/load_settings.sh +++ b/elasticsearch/config/load_settings.sh @@ -5,11 +5,6 @@ set -e el_url=${ELASTICSEARCH_URL} -if [ "x${WAZUH_API_URL}" = "x" ]; then - wazuh_url="https://wazuh" -else - wazuh_url="${WAZUH_API_URL}" -fi if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then auth="" @@ -43,44 +38,6 @@ if [ $ENABLE_CONFIGURE_S3 ]; then fi -#Insert default templates - -API_PASS_Q=`echo "$API_PASS" | tr -d '"'` -API_USER_Q=`echo "$API_USER" | tr -d '"'` -API_PASSWORD=`echo -n $API_PASS_Q | base64` - -echo "Setting API credentials into Wazuh APP" -CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) - -if [ "x$CONFIG_CODE" != "x200" ]; then - curl -s -XPOST $el_url/.wazuh/_doc/1513629884013 ${auth} -H 'Content-Type: application/json' -d' - { - "api_user": "'"$API_USER_Q"'", - "api_password": "'"$API_PASSWORD"'", - "url": "'"$wazuh_url"'", - "api_port": "55000", - "insecure": "true", - "component": "API", - "cluster_info": { - "manager": "wazuh-manager", - "cluster": "Disabled", - "status": "disabled" - }, - "extensions": { - "oscap": true, - "audit": true, - "pci": true, - "aws": true, - "virustotal": true, - "gdpr": true, - "ciscat": true - } - } - ' > /dev/null -else - echo "Wazuh APP already configured" -fi -sleep 5 curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d' { From 7e8e11bfd67d44d3765ba037d1cb637db2edfe75 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Thu, 26 Dec 2019 16:56:24 +0100 Subject: [PATCH 6/9] Write API entry to wazuh.yml --- kibana/config/wazuh_app_config.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index 0528d7d8..78679eda 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -32,11 +32,18 @@ declare -A CONFIG_MAP=( [admin]=$ADMIN_PRIVILEGES ) -sed -ie '/- default:/,+4d' $kibana_config_file - for i in "${!CONFIG_MAP[@]}" do if [ "${CONFIG_MAP[$i]}" != "" ]; then sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file fi done + +sed -ie '/- default:/,+4d' $kibana_config_file +cat << EOF >> $kibana_config_file + - default: + url: ${API_URL:-https://wazuh} + port: ${API_PORT:-55000} + user: ${API_USER:-foo} + password: ${API_PASS:-bar} +EOF From 380ba92708c46becc92f3606bdc655373be8b1f7 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Fri, 27 Dec 2019 15:48:49 +0100 Subject: [PATCH 7/9] Check for previous API settings on Wazuh Plugin --- kibana/config/wazuh_app_config.sh | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index 78679eda..db060050 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -1,6 +1,11 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) +wazuh_url="${WAZUH_API_URL:-https://wazuh}" +wazuh_port="${API_PORT:-55000}" +api_user="${API_USER:-foo}" +api_password="${API_PASS:-bar}" + kibana_config_file="/usr/share/kibana/plugins/wazuh/wazuh.yml" declare -A CONFIG_MAP=( @@ -39,11 +44,22 @@ do fi done +# remove default API entry (starting with 3.11.0_7.5.1) sed -ie '/- default:/,+4d' $kibana_config_file + +CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) + +grep -q 1513629884013 $kibana_config_file +_config_exists=$? + +if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then cat << EOF >> $kibana_config_file - - default: - url: ${API_URL:-https://wazuh} - port: ${API_PORT:-55000} - user: ${API_USER:-foo} - password: ${API_PASS:-bar} + - 1513629884013: + url: $wazuh_url + port: $wazuh_port + user: $api_user + password: $api_password EOF +else + echo "Wazuh APP already configured" +fi From e83a092449076b9cb10040ec9b82b10b64c803b3 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Fri, 27 Dec 2019 17:07:58 +0100 Subject: [PATCH 8/9] Clarify comment --- kibana/config/wazuh_app_config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index db060050..f0fbd720 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -44,7 +44,7 @@ do fi done -# remove default API entry (starting with 3.11.0_7.5.1) +# remove default API entry (new in 3.11.0_7.5.1) sed -ie '/- default:/,+4d' $kibana_config_file CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) From 49f1b476b5ba07c575a4279450baa1204330d454 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Fri, 27 Dec 2019 17:17:39 +0100 Subject: [PATCH 9/9] Update changelog --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 10c28926..19b71325 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to this project will be documented in this file. ### Added - Update to Wazuh version 3.11.0_7.5.1 +- Filebeat configuration file updated to latest version ([@manuasir](https://github.com/manuasir)) [#271](https://github.com/wazuh/wazuh-docker/pull/271) +- Allow using the hostname as node_name for managers ([@JPLachance](https://github.com/JPLachance)) [#261](https://github.com/wazuh/wazuh-docker/pull/261) ## Wazuh Docker v3.10.2_7.5.0