diff --git a/README.md b/README.md index cf5f1ee3..682d7d21 100644 --- a/README.md +++ b/README.md @@ -135,10 +135,7 @@ ADMIN_PRIVILEGES=true # App privileges │   └── Dockerfile ├── LICENSE ├── multi-node - │   ├── docker-compose.yml - │   ├── generate-indexer-certs.yml - │   ├── Migration-to-Wazuh-4.3.md - │   ├── production_cluster + │   ├── config │   │   ├── nginx │   │   │   └── nginx.conf │   │   ├── wazuh_cluster @@ -147,17 +144,43 @@ ADMIN_PRIVILEGES=true # App privileges │   │   ├── wazuh_dashboard │   │   │   ├── opensearch_dashboards.yml │   │   │   └── wazuh.yml - │   │   ├── wazuh-indexer + │   │   ├── wazuh_indexer │   │   │   ├── internal_users.yml │   │   │   ├── wazuh1.indexer.yml │   │   │   ├── wazuh2.indexer.yml │   │   │   └── wazuh3.indexer.yml │   │   └── wazuh_indexer_ssl_certs │   │   └── certs.yml + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   ├── Migration-to-Wazuh-4.3.md │   └── volume-migrator.sh ├── README.md ├── single-node - │   └── docker-compose.yml + │   ├── config + │   │   ├── wazuh_cluster + │   │   │   └── wazuh_manager.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   └── wazuh.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   ├── admin-key.pem + │   │   ├── admin.pem + │   │   ├── certs.yml + │   │   ├── root-ca.key + │   │   ├── root-ca.pem + │   │   ├── wazuh.dashboard-key.pem + │   │   ├── wazuh.dashboard.pem + │   │   ├── wazuh.indexer-key.pem + │   │   ├── wazuh.indexer.pem + │   │   ├── wazuh.manager-key.pem + │   │   └── wazuh.manager.pem + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   └── README.md └── VERSION diff --git a/multi-node/production_cluster/nginx/nginx.conf b/multi-node/config/nginx/nginx.conf similarity index 100% rename from multi-node/production_cluster/nginx/nginx.conf rename to multi-node/config/nginx/nginx.conf diff --git a/multi-node/production_cluster/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf similarity index 100% rename from multi-node/production_cluster/wazuh_cluster/wazuh_manager.conf rename to multi-node/config/wazuh_cluster/wazuh_manager.conf diff --git a/multi-node/production_cluster/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf similarity index 100% rename from multi-node/production_cluster/wazuh_cluster/wazuh_worker.conf rename to multi-node/config/wazuh_cluster/wazuh_worker.conf diff --git a/multi-node/production_cluster/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml similarity index 100% rename from multi-node/production_cluster/wazuh_dashboard/opensearch_dashboards.yml rename to multi-node/config/wazuh_dashboard/opensearch_dashboards.yml diff --git a/multi-node/production_cluster/wazuh_dashboard/wazuh.yml b/multi-node/config/wazuh_dashboard/wazuh.yml similarity index 100% rename from multi-node/production_cluster/wazuh_dashboard/wazuh.yml rename to multi-node/config/wazuh_dashboard/wazuh.yml diff --git a/multi-node/production_cluster/wazuh-indexer/internal_users.yml b/multi-node/config/wazuh_indexer/internal_users.yml similarity index 100% rename from multi-node/production_cluster/wazuh-indexer/internal_users.yml rename to multi-node/config/wazuh_indexer/internal_users.yml diff --git a/multi-node/production_cluster/wazuh-indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml similarity index 100% rename from multi-node/production_cluster/wazuh-indexer/wazuh1.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh1.indexer.yml diff --git a/multi-node/production_cluster/wazuh-indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml similarity index 100% rename from multi-node/production_cluster/wazuh-indexer/wazuh2.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh2.indexer.yml diff --git a/multi-node/production_cluster/wazuh-indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml similarity index 100% rename from multi-node/production_cluster/wazuh-indexer/wazuh3.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh3.indexer.yml diff --git a/multi-node/production_cluster/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml similarity index 100% rename from multi-node/production_cluster/wazuh_indexer_ssl_certs/certs.yml rename to multi-node/config/wazuh_indexer_ssl_certs/certs.yml diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 7d9d1a2f..7707f76b 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -32,10 +32,10 @@ services: - master-wazuh-wodles:/var/ossec/wodles - master-filebeat-etc:/etc/filebeat - master-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: image: wazuh/wazuh-manager:4.3.0 @@ -61,10 +61,10 @@ services: - worker-wazuh-wodles:/var/ossec/wodles - worker-filebeat-etc:/etc/filebeat - worker-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -84,13 +84,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem - - ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh2.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -108,11 +108,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh3.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -130,11 +130,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.3.0 @@ -148,11 +148,11 @@ services: - API_USERNAME=acme-user - API_PASSWORD=MyS3cr37P450r.*- volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - - ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml depends_on: - wazuh1.indexer links: @@ -174,7 +174,7 @@ services: - wazuh.worker:wazuh.worker - wazuh.dashboard:wazuh.dashboard volumes: - - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro volumes: master-wazuh-api-configuration: diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml index ce8a0174..c29c50d6 100644 --- a/multi-node/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -6,5 +6,5 @@ services: image: wazuh/wazuh-certs-generator:0.0.1 hostname: wazuh-certs-generator volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml - - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file diff --git a/single-node/README.md b/single-node/README.md new file mode 100644 index 00000000..9ae37099 --- /dev/null +++ b/single-node/README.md @@ -0,0 +1,27 @@ +# Deploy Wazuh Docker in single node configuration + +This deployment generates a Docker Compose stack with 1 Wazuh Manager container, 1 Wazuh Indexer container and 1 Wazuh Dashboard container. + +In case of upgrading from 4.2, the deployment hosted in the multi-node directory should be reviewed + +For the next deployment, the following steps must be performed: + +1) Increase max_map_count on your host (Linux) + +$ sysctl -w vm.max_map_count=262144 + +This command must be run with root permissions + +2) Run the certificate creation script: + +$ docker-compose -f generate-indexer-certs.yml run --rm generator + +3) Start the stack with docker-compose: + +In Foregroud: +$ docker-compose up + +Background +$ docker-compose up -d + +The stack takes about 1 minute to get up for the first time, since Wazuh Indexer must be started for the first time and the Indexes and Index Patterns must be generated. \ No newline at end of file diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf new file mode 100644 index 00000000..aff1af9d --- /dev/null +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -0,0 +1,353 @@ + + + yes + yes + no + no + no + smtp.example.wazuh.com + wazuh@example.wazuh.com + recipient@example.wazuh.com + 12 + alerts.log + 10m + 0 + + + + 3 + 12 + + + + + plain + + + + secure + 1514 + tcp + 131072 + + + + + no + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt + + yes + + + + yes + 1800 + 1d + yes + + wodles/java + wodles/ciscat + + + + + yes + yes + /var/log/osquery/osqueryd.results.log + /etc/osquery/osquery.conf + yes + + + + + no + 1h + yes + yes + yes + yes + yes + yes + yes + + + + 10 + + + + + yes + yes + 12h + yes + + + + no + 5m + 6h + yes + + + + no + trusty + xenial + bionic + focal + 1h + + + + + no + stretch + buster + bullseye + 1h + + + + + no + 5 + 6 + 7 + 8 + 1h + + + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + + + + yes + 1h + + + + + yes + 2010 + 1h + + + + + + + no + + + 43200 + + yes + + + yes + + + no + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 1h + 10 + + + + + + 127.0.0.1 + ^localhost.localdomain$ + 10.0.0.106 + + + + disable-account + disable-account + yes + + + + restart-wazuh + restart-wazuh + + + + firewall-drop + firewall-drop + yes + + + + host-deny + host-deny + yes + + + + route-null + route-null + yes + + + + win_route-null + route-null.exe + yes + + + + netsh + netsh.exe + yes + + + + + + + command + df -P + 360 + + + + full_command + netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + netstat listening ports + 360 + + + + full_command + last -n 20 + 360 + + + + + ruleset/decoders + ruleset/rules + 0215-policy_rules.xml + etc/lists/audit-keys + etc/lists/amazon/aws-eventnames + etc/lists/security-eventchannel + + + etc/decoders + etc/rules + + + + yes + 1 + 64 + 15m + + + + + no + 1515 + no + yes + no + HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH + + no + etc/sslmanager.cert + etc/sslmanager.key + no + + + + wazuh + node01 + master + + 1516 + 0.0.0.0 + + NODE_IP + + no + yes + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..d56fe86b --- /dev/null +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 443 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global diff --git a/single-node/config/wazuh_dashboard/wazuh.yml b/single-node/config/wazuh_dashboard/wazuh.yml new file mode 100644 index 00000000..75ba953c --- /dev/null +++ b/single-node/config/wazuh_dashboard/wazuh.yml @@ -0,0 +1,7 @@ +hosts: + - 1513629884013: + url: "https://wazuh.manager" + port: 55000 + username: acme-user + password: MyS3cr37P450r.*- + run_as: false diff --git a/single-node/config/wazuh_indexer/internal_users.yml b/single-node/config/wazuh_indexer/internal_users.yml new file mode 100644 index 00000000..d9f05b34 --- /dev/null +++ b/single-node/config/wazuh_indexer/internal_users.yml @@ -0,0 +1,56 @@ +--- +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +_meta: + type: "internalusers" + config_version: 2 + +# Define your internal users here + +## Demo users + +admin: + hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" + reserved: true + backend_roles: + - "admin" + description: "Demo admin user" + +kibanaserver: + hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." + reserved: true + description: "Demo kibanaserver user" + +kibanaro: + hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" + reserved: false + backend_roles: + - "kibanauser" + - "readall" + attributes: + attribute1: "value1" + attribute2: "value2" + attribute3: "value3" + description: "Demo kibanaro user" + +logstash: + hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" + reserved: false + backend_roles: + - "logstash" + description: "Demo logstash user" + +readall: + hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" + reserved: false + backend_roles: + - "readall" + description: "Demo readall user" + +snapshotrestore: + hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" + reserved: false + backend_roles: + - "snapshotrestore" + description: "Demo snapshotrestore user" diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..ec3220ef --- /dev/null +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,27 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer +discovery.type: single-node +compatibility.override_main_response_version: true +plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false +plugins.security.audit.type: internal_opensearch +plugins.security.authcz.admin_dn: +- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] diff --git a/single-node/config/wazuh_indexer_ssl_certs/admin-key.pem b/single-node/config/wazuh_indexer_ssl_certs/admin-key.pem new file mode 100644 index 00000000..a8231c7c --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/admin-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDD40EQPXlnfl+h +cqnWeGN7iv4p21Ukqs5ar/nMTiu1sBd3weqkHX9tEyvZjNH1kJWvAPjFr/XalCmm +JKLoJn0lXe7CzbDJcM41D18QYen+rpUg7zINa5YwHwrVqNF4NRJkRDPaM17iYopO +H81TinJk6x5n1SfOhvRUQ/QyUH4DRaqKVaT5eSeLJ2FQmTZ7dWWVEluhvbP33rFu +DM74jNAAU0EbT1tcihek0kTkVVGKfHFGI+GyaMMO2epPyPf3zXe2jqEJIlmn3adz +uykWyLpf0WOhp/592+76wg3CAIq8+DZoyIObDVA7iURMkOR6RaNyBUbf0OGLL/Mn +EDsmVkWZAgMBAAECggEARvCoAW+h5d8YVumlpCwZKwadIR9zaEILVUBhoKG2pqfM +9+vcQ+8C1Meam8Cp0Nq5upUJgt5ElRIPO0INVTGLJNstupKvMWSO6RxV+yLakQc8 +rp6xa7bIv0ierd3jbjsaHAGvHZh5BldVaxGNVHHRF8cmTcgeEGdDWLj7WLVZzWjs +eSs8/ZgX6OgoLh/c4mU8AuaFxecV1POwgkhWBsEsfTD8y4KF//TqBHdswL9qt+/W +YFi0jsdblEoMb+ILgml/4TdSuo++FJxejlmFTOmEtlskJrxEomhklGUyYKyXtCJq +fx6wrM3ycSbY3Gl7Hyw+uXsgOEpMMeNAnylIuRmq+QKBgQD2TMSimLCLyxOXuFll +wVdDfxnhTR4iAXczPde9psNnT5h0EcAR6liiTFpcJ9lQD4KWX6h/ZzPMrGqbsmTs +w52jo1Sf4P+bKW/ecgnPdBm+lQJ8i3X+8vBFEhJ7KZVBx0FejuE9cj+hb+4kmRji +B74atgOfjeHRIzdMYy4QWfhSJwKBgQDLmjkfGoKykCoJ2x+TQ68NZXsXdaQ2CsCS +QD+BYGDbBTD/FHuTMm/TFZ8X07dQa71n38hoyuqkPZJPsbTyaYZJnZRDn2eTJqrY +GXyAX/kGMQUb1SZgogN4EXBFUwgcyxByvwhu3zwZPlBwoJFRrQTkgaeXiQu6hjjH +39ekHhRCPwKBgBeyAQTnjayVR/hDuw4IEL4knzfGtIxu+anLXFMZlRj+VltsTb8r +fYV3tQXCq6yBIX4YC9zd7+TT/ZmnCwCgPS0+DGkpO04RKXsMG5eCwutL6KZUwHBb +rPPoLjD9Kife5JIVSuQfdrGwVAffVr6AIjDtq+GQw9Xb/njx3b+i+DnnAoGAF3b5 +uFT01SF6RtKDLBSz2wZkDksXlsbcdL6E0yNJZlSN1ggFSeyZKKmoQTW8Pb98/7ix +vyoLqswRza98XCe/O0K28KgxZqshK3CcgasN5yHFJfUFzEM/xRm1Z7fvCmp4xdCw +Zx7BLWOaH7DRrqkTFEbBCtzXhjKr3pU0pAx3Zz8CgYEAwiia3cX1hhYE+VwF4SxG +8OUuX1Ad7k7yeT62lv5bn1ZMpOx0SPgOV63DMJHf2DxMgwtvS548Ti18iM1/kaIC +nN3VvXrd6Ma+Eky/J1X1zi3jg91bngCHmLCzxrhuxitzz0DNlA7FFFwPPfuqpnrV +Ud/8jWxBp7Xirz/TzKJCbjs= +-----END PRIVATE KEY----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/admin.pem b/single-node/config/wazuh_indexer_ssl_certs/admin.pem new file mode 100644 index 00000000..5fbe75fc --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/admin.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDDjCCAfYCFAU87O0mgSwCKgJKxO06KRVmCYLfMA0GCSqGSIb3DQEBCwUAMDUx +DjAMBgNVBAsMBVdhenVoMQ4wDAYDVQQKDAVXYXp1aDETMBEGA1UEBwwKQ2FsaWZv +cm5pYTAeFw0yMjAzMzExNTU4NThaFw0zMjAzMjgxNTU4NThaMFIxCzAJBgNVBAYT +AlVTMRMwEQYDVQQHDApDYWxpZm9ybmlhMQ4wDAYDVQQKDAVXYXp1aDEOMAwGA1UE +CwwFV2F6dWgxDjAMBgNVBAMMBWFkbWluMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEAw+NBED15Z35foXKp1nhje4r+KdtVJKrOWq/5zE4rtbAXd8HqpB1/ +bRMr2YzR9ZCVrwD4xa/12pQppiSi6CZ9JV3uws2wyXDONQ9fEGHp/q6VIO8yDWuW +MB8K1ajReDUSZEQz2jNe4mKKTh/NU4pyZOseZ9Unzob0VEP0MlB+A0WqilWk+Xkn +iydhUJk2e3VllRJbob2z996xbgzO+IzQAFNBG09bXIoXpNJE5FVRinxxRiPhsmjD +DtnqT8j39813to6hCSJZp92nc7spFsi6X9Fjoaf+fdvu+sINwgCKvPg2aMiDmw1Q +O4lETJDkekWjcgVG39Dhiy/zJxA7JlZFmQIDAQABMA0GCSqGSIb3DQEBCwUAA4IB +AQAPMETJTs2cA3PFSZsXwp0MvqbGstgbtW/UgBMJJjpVg8G7Txapj9uLYZRVBa72 +nPPyBpttY0GGGuhH3TQP/jwW1HSw/fDWz7LsdLsMLAAHRDJ5Y+zuS1KkWTMTb+Ih +M31xJvRWW+Vy7GQlx0w20UcyIV/9uOXs3smhFcXsUrk/bKqPk/xx5pPWQgU/kYNq +Rkjg2NK7FLbR0ydNfhNAN99Q82sPtIArl3UHVslC8rW7M0fcsAp+KOi69BbNHPfO +omGedS/XGlsPbNQObAyrJF6P9qcioL/FNECEG29J/5grAfezUIlx+eXUL69fwtwA +RQPMsegj5KAWeULTQtIMOQKs +-----END CERTIFICATE----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml new file mode 100644 index 00000000..34059eeb --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/certs.yml @@ -0,0 +1,16 @@ +nodes: + # Wazuh indexer server nodes + indexer: + name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + name: wazuh.dashboard + ip: wazuh.dashboard \ No newline at end of file diff --git a/single-node/config/wazuh_indexer_ssl_certs/root-ca.key b/single-node/config/wazuh_indexer_ssl_certs/root-ca.key new file mode 100644 index 00000000..c50279e6 --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/root-ca.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC0HNHBVRwConob +LgAOejIbbLkeGAQiGqpkCxoyb/HL/u3hje0TAnKozY5pxwp9Jeo7REmolorJ7YXL +OT390Wh5cI5/Fj4tPsoYzQZuQZiy6DAWbGjKmQUjBCcoQkYftDY0PlMMjfbpvBe8 +b8qul3ZYPP9EvZ66i7OthBVwNw+dJrQXLFRCBssg6ev+Rr3jbWrxwMObaRFoXJRd +jXFm69PA+HPpuACYQPTHvEhkh+uTU6w36/ZFpiuHeFNJsJZ+cG8sUUMdWNgvq+R3 +bzAALOCFQepONvNowKcTKNf/R3gM94r58PK0G7ehN8Kme7KFUCXUL73ucTpAeXcE +TDAL+yTVAgMBAAECggEAAxSvHdB33y+qSQa7Z4P9kWyFqhcdEvxDx9xMwWoax7N/ +nCkSUg3rqimB8xs9ebCJViQv4ltY2mVesYA0KEBJujILre7Sd3GogU4YexBSLVU9 +ZVTLYhPF+7hZdx3TFz28453hS8it3YejHE0JOX1Lv+yjLSjVKzmyhBhLSZUXhkeY +118drOwj4Ji0KrzTZilpWBPAPHJMkChClLbaJcbOexUkQxvoXgWUQfYi+CtY67Rm +tRnuot29kCTq/r97Iz4NiEHGzAu6IA6xE2S1qJ2ndjoiFRhfKF8wL0f0a71zp9Vo +jXl85qV13Kb0FN17DbmQnSx7dBKIly1Y7cLLq6PkoQKBgQDjWkkx3YqD5VW3c6fr +lyC7Jl0AIvd/1lpOksCofVc2GUBEfR1D87YMc9H917t6rfRjgE3wgYis9Wk2AfIl +Iky/8x+MZHZFOrAcNTArlyBBhXlXIFcAM3br+gTeJKbQwCrMbukGPuBl2+GtYcFh +eEdb9yimAKOlaKIFDEOtt1LxmQKBgQDKzrWtsB4CGPZ1EZZXNfZ6BDtFXdStjirA +411ffc0xNLVducD+bb8jzupOlzstvnnosCnX6QZUzjz8A89ePX6gTwwFUjp03JcK +sb0QcIOVNNt1cHRUx5e0mMQhM/LGhWuZkwO6L7m4DcVb4B4hu12p8503USVZ/YlR +vowtvDUKnQKBgGvm7dY8zwDKV2Q5//hQQbiQ/JKUBeMmWLXx8H4G/t0uHtJijwEx +KbW/Qmq3eMNAzDxtKJB86eEsmEKJqeL15Hc1bEO1amxw7iR1GeeWUjjGoFA5iREP +W+GjR6wmuQVaLvXXrcDJFrdBJFqliqI386YyJ5ihtQlMH5lFuNk5qKQBAoGAXUXW +XqxaEMLkTpEpILDry9A4Zj2yO6Pf29h1sB5OiavhIdr1fM6Ckvht4HlDOVWaAb9L +b0Z3p/c2Kv2hmIkVvKq+L5BS3D47pSp7dp0Ylz25FPkEN52YEvITeeXHaTAhfX8U +vsOGWbTTqN6ZXRAsEqa9DpzeXdXyGstU8w/VIS0CgYBFzwoivG/EgFMUofcVqRf9 +DR9nbF3dAgCVP2pjPevuEUn7CgxhBNdjyBfZQ9AePh8N+snlzvWxCBCNH43/Bbzf +KLXoP/w3i16NyhLRiNWEDWdgBmh0DexuQkXStUYItk8749WH5PItEuUbFImPJ7sz +xMKXRy85xA+O8Ys15v/z+w== +-----END PRIVATE KEY----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/root-ca.pem b/single-node/config/wazuh_indexer_ssl_certs/root-ca.pem new file mode 100644 index 00000000..aa65ed21 --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/root-ca.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDSzCCAjOgAwIBAgIUc6jxrdFdpeRz9LqBXbPnL10xwIwwDQYJKoZIhvcNAQEL +BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD +YWxpZm9ybmlhMB4XDTIyMDMzMTE1NTg1OFoXDTMyMDMyODE1NTg1OFowNTEOMAwG +A1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApDYWxpZm9ybmlh +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtBzRwVUcAqJ6Gy4ADnoy +G2y5HhgEIhqqZAsaMm/xy/7t4Y3tEwJyqM2OaccKfSXqO0RJqJaKye2Fyzk9/dFo +eXCOfxY+LT7KGM0GbkGYsugwFmxoypkFIwQnKEJGH7Q2ND5TDI326bwXvG/Krpd2 +WDz/RL2euouzrYQVcDcPnSa0FyxUQgbLIOnr/ka9421q8cDDm2kRaFyUXY1xZuvT +wPhz6bgAmED0x7xIZIfrk1OsN+v2RaYrh3hTSbCWfnBvLFFDHVjYL6vkd28wACzg +hUHqTjbzaMCnEyjX/0d4DPeK+fDytBu3oTfCpnuyhVAl1C+97nE6QHl3BEwwC/sk +1QIDAQABo1MwUTAdBgNVHQ4EFgQUhwVk/zxcbNU6lDR9eD1UtbdGMqUwHwYDVR0j +BBgwFoAUhwVk/zxcbNU6lDR9eD1UtbdGMqUwDwYDVR0TAQH/BAUwAwEB/zANBgkq +hkiG9w0BAQsFAAOCAQEAVYq19mPRxRvfTj70gUQUuoDiHU48/VM58L0dEs2EPvzN +IiaMI0ablsInQE1ZJZc2GYsmnPZjoAuE7R6FIMSS6XErhPeJLxLkieibmhQXpElI +kEik3Uwhv4kjwh5TEwPqjVORRgvthLO9kl1riwlyu3rAEsohJlvUB1uWT99+emSc +jRivo3pXHmu9PI+JBcCxbzc2mixpSuqUalVkx8r7+RayD2EMdckK0WGz9SRplx8p +aNJI6Z0M3+yk4D5bvmAtkX0p1Wk9fk6HLsynLoSZ2CwT9rjm89lIYHEPcUsZHyor +gW64BfUXTNJDcycEg8zDlosdi2zCe/qfmZXgC0t9dA== +-----END CERTIFICATE----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem new file mode 100644 index 00000000..cb55bfe5 --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDDyjevayE979UH +0Y8IhN6tMSiwlr8C1E4UmK1oTK+4fjy0/zoyaBfwcYVmGqqcPDvDdU4r937SPP9r +CPGH24gUuoAL+c1E4IyR1iCPs2N8UcyRAQfZX3t3SSD7HxFmRtKlTypL1Uc70NEZ +aXVmsBQIXBYpOfJNAEjcbvD5rB2fmYUZ8QTx+aNiwTnLJMUAkqax1NASRhnVw9jo +MJ41q2yveR3Wk2f0ODiGYLDekIH3FOuGf1ypFIDfyrMEh5VYJnIqYrgZt2ljuMcV +O7THkW8jhZ7l+3cMT3LXVMr4PY61ad5Nw5bz2fHZyo6rl2D7Ks7s0WVkun9kKRf9 +nCeRMArrAgMBAAECggEBAKciU4Damcjul9MRz+D8073SziJYvPvkUjcA0l7Lv+Fl +WdtEWOC4vV7S+YZc0zGFtZq346BiqQ89ZOhw/QX1oGfZgP84IkNe0ICZ4rfo8c8p +YNCTqaik+peshIv6THcblCvrtXaAvUtRiX4A6WhcfO1Z9s0Am1eiG5CY3/qyM6OO +Ae+3TGF6GtMYsKPZvtbOkWs6CzAfn/cfzyM8TJQA17HhX0UVTalFWMunYJIbk9jP +nGGzuBxeICtFmQ0c3vJq4dNs7FeGV6EHOYXeaZrPFMFWnu0aWmgVw3ONKPBXY2hb +b+ykHXGzPZrgt01wW6S7NL3aYrd0ocZzUCsbMVGcpZECgYEA7qIjNRIym6jyr0cV +6T7g7hHb+3u5p0BUhWZrxfzVLpZf5AOOl97tQiHRXGnNjEuddcvA5O25yWJl1Amk +mHYkSuLfTVL+qqXKrrDEvqdwUetPjZWdo9MEoUjQvnjirsn59fMzFPSbw7sYI8/i +ZpNyXwll2AZHDSaGPC+BOWCFukkCgYEA0gnid5+4sm8r0DWR7r1WCXbODFhNnqkA +ptfpyp3NfX6ALJ7kT6vGzhCxC1XQXNwR61V1x6/CBTSZ779eNT9sDYr+4ZHaVz8f +bQA2Cmes4z/3NifsWC4HtvzJxkS8ZLD1ImPMa4MFkezA/H//c27uy/8w2YSB34JD +9KoG53y9e5MCgYBl1zpRTufcOJkBpsO6HESgNWz9gYr0zuaDW/eIsmNEk5Zu1/nF +5LS6sXYJC3pWcnrLp941lSLhyCWO/WKKUnkgoHwOIupeZ4z9SqFcgFbWDyePVBfH +r6ndLxcvAqYzVC1iAp19Rvsm6DTgK7sCbdC0sG0PaXZvLU7CZr+uffv0SQKBgQC1 +XiG3aC1lrwenR8rW25mCnJs6H7oOyiKs736LHo6F0gk9/oppnYwS/mjSv+wnc0Tp +8Ka+oq8oLY7LbnUcB8L3QtHq2DYw5mnthqQjgfjRVrfShNDaKA0zXr+hPFNtozxZ +0NGA+OeDZWwT3TcpZ14+uwJkob4/0U165KMHmzhHjwKBgQDd7RfgePWsT/pB4Imd +I/u1KC/7AkqBHx81kCL2XTFtKoSYKAKjHo/VfoQiohPvEdpJuP7dRIdKN/leC9xF +TGe/TRjv6Sir6a61iHAKRif7gorMMu7WMPS4gt9/A+uVRD2ywsYBUOYqJGmjbRKM +RHwR71NJ2edSI3i6/3TBJTbnSg== +-----END PRIVATE KEY----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem new file mode 100644 index 00000000..ac273dcc --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDdjCCAl6gAwIBAgIUBTzs7SaBLAIqAkrE7TopFWYJguIwDQYJKoZIhvcNAQEL +BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD +YWxpZm9ybmlhMB4XDTIyMDMzMTE1NTg1OFoXDTMyMDMyODE1NTg1OFowXDELMAkG +A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w +DAYDVQQLDAVXYXp1aDEYMBYGA1UEAwwPd2F6dWguZGFzaGJvYXJkMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw8o3r2shPe/VB9GPCITerTEosJa/AtRO +FJitaEyvuH48tP86MmgX8HGFZhqqnDw7w3VOK/d+0jz/awjxh9uIFLqAC/nNROCM +kdYgj7NjfFHMkQEH2V97d0kg+x8RZkbSpU8qS9VHO9DRGWl1ZrAUCFwWKTnyTQBI +3G7w+awdn5mFGfEE8fmjYsE5yyTFAJKmsdTQEkYZ1cPY6DCeNatsr3kd1pNn9Dg4 +hmCw3pCB9xTrhn9cqRSA38qzBIeVWCZyKmK4GbdpY7jHFTu0x5FvI4We5ft3DE9y +11TK+D2OtWneTcOW89nx2cqOq5dg+yrO7NFlZLp/ZCkX/ZwnkTAK6wIDAQABo1cw +VTAfBgNVHSMEGDAWgBSHBWT/PFxs1TqUNH14PVS1t0YypTAJBgNVHRMEAjAAMAsG +A1UdDwQEAwIE8DAaBgNVHREEEzARgg93YXp1aC5kYXNoYm9hcmQwDQYJKoZIhvcN +AQELBQADggEBAKatO2nfF24Z9mrYzyHBs4BN0m7H29VrYi953YB7qKlWOr8CDFGe +olfaDgrY7Hc7MM5kzGtCF7POywVMfX6ug9WiAeYX+kaAJxHYctwy/AMyYeEhDjKx +et/SD++rR8V6EDeuevag+21HhqzOptiRKAyg1P13B4d8/UwK/d42T8Rgujh4tAB1 +PYN269ID3tQ3GMG1y0QaAwtpPEpBv3AF/kANVkHV+rwtWyKQKK8WEVxcqAppY1ap +AY4zUTpEO8rAZXSfOk/tJ9hPJrF6+Ld44pcxDzw1fs0LOY4r/RY9V4DT0ayForrG +uBUpPEkB1rh1eHAi1OWfNj4sseYMysYmz5c= +-----END CERTIFICATE----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem new file mode 100644 index 00000000..376ccf7a --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC8V/BRL1YWMZmO +YCNBMtSxLnyBUOkVneF+o6fNuAF2szv/H2CpH9oEpmH4gB9x66bNNuwfb2THOwfO +fYySA3IGwyKk8xyC1+6mW0QIWzNvAYROBpDD0lZwMxLwf3PecFXzN2hEuTOPavS6 +B6BaTlhYfOgSFwKQUJIKLzq+/TfwzJUW87/5uI6+GpSXdVBFFOrjcmntxahMrnBv +3mxJlsr60LHcfXcPc+qtrNGVmmD/V0sFE0Gi9m07vpK2nDnja0IME4A6s/Jo0TlX +pGKlXi8BXixjas1WZn9gfe7VrTtCYpkGFLjWC+Rz1tHBnwKkjoVNQrxrvd7h7tU/ +OmSs7gTHAgMBAAECggEBALIbWvf7EqakOvknss8aGYaAVl8Xu4OkrLRMYQgqZL/y +WN82tfrZUxuol+ceih354eAYewxzE9NP4F8F3SPLPE5mw+FGwYR+XIFWtyxLyoTD +43DBxq5Xv0QVGGjzrggBJVZ95A1xMfADDfDJ+3rKscLkQ7Wvqs38U05sQVqRLRB5 +VnArp6hn5Lj4Y37/6ER2hyB/CahE5i6SQTe8dWHlvs3eiXfeXx7AmJzvNRezH9Zo +LVUDoGpdU7Zm5eo0kQevfHjs1Wrtn4Oq+tev+WSninOWR1j/2T0T7SLNI6cABP/K +LtObnhdZhpMEiWe7AN/oDxrkEo954QZTkj3Dkub2QWECgYEA7DEDBYMEGMmvQbKx +jF1qtWqHABdbjR29YtFfpcAm8yAadaftvX0qZq7Ym2DwHCwPX8O8kpGUpN5zYr+W +xsja1s/bUDat82on2RRn1+e5cBfJ1dyLGisvMu1QN1/b/593WfZwbPGxDq5nFjUd +1SyJE0/EKSCnNjcTNpgLbEB9+XECgYEAzCOj48yhIfhQY8UhUgDojiEhEhAmrMBY +MYb+LZvTg5b2fruPwgsA/MADoL68pwF0LSSoysbS7SIFEUTvyHv3zjNvtPR3kEuE +/JHS4vppFvuFKozf+tMHcIIF7pigyLRkGpePgPaeQ86AvKitq8YHn0I8nVD15n2f +0TlLl+hZhbcCgYBd+8q2AMI6ktZ4EADyV6HEepUphiHZ70GS9rlWnTVifR3KP34s +bofWwDBU86fXrfiYJKz+rYs2Z4YGfzIh+36JB8C/FGL3fwBIMwR3Ny/k2LJptQ5s +5U4st525yx0hhHTbiWKHF01bCC7g+VXbo5MP6iemLeYbfqLYkHvLIYZ/IQKBgENe +T6vR0Cthw0XpvIFPg2/ERyGq6th/8ZsGrcNndXory9UvGNY0w3Kl+4yE5cVHmYt8 +WafxzZIsc/erBGbpYnJOT0MsmnioM48WoL3/XccT4nKUYyZnlkDu5/5BqG4T+iU8 +d0NcIAbIk3uvPwE9LS7FsTNJkJ0sQB3QBr5vE3wpAoGBAM5aCO/GIa++tCQZ5N9x +eNd3Uta8C6JI+KVROCNda8auFHeh9lfYgv1Kj64nmJZErG4PwuYwdWQ8FnDrpM+f +YMRz/rpcvqL01XswnYgr72EV/qnEDtVLG4x6rY0n2Rd2/i4NMMIcqxVZZdnoAh7A +Y+IqIDCAvPM/NjRTAMUDqFj3 +-----END PRIVATE KEY----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem new file mode 100644 index 00000000..6fd0dfba --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDcjCCAlqgAwIBAgIUBTzs7SaBLAIqAkrE7TopFWYJguAwDQYJKoZIhvcNAQEL +BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD +YWxpZm9ybmlhMB4XDTIyMDMzMTE1NTg1OFoXDTMyMDMyODE1NTg1OFowWjELMAkG +A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w +DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWguaW5kZXhlcjCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBALxX8FEvVhYxmY5gI0Ey1LEufIFQ6RWd4X6j +p824AXazO/8fYKkf2gSmYfiAH3Hrps027B9vZMc7B859jJIDcgbDIqTzHILX7qZb +RAhbM28BhE4GkMPSVnAzEvB/c95wVfM3aES5M49q9LoHoFpOWFh86BIXApBQkgov +Or79N/DMlRbzv/m4jr4alJd1UEUU6uNyae3FqEyucG/ebEmWyvrQsdx9dw9z6q2s +0ZWaYP9XSwUTQaL2bTu+kracOeNrQgwTgDqz8mjROVekYqVeLwFeLGNqzVZmf2B9 +7tWtO0JimQYUuNYL5HPW0cGfAqSOhU1CvGu93uHu1T86ZKzuBMcCAwEAAaNVMFMw +HwYDVR0jBBgwFoAUhwVk/zxcbNU6lDR9eD1UtbdGMqUwCQYDVR0TBAIwADALBgNV +HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWguaW5kZXhlcjANBgkqhkiG9w0BAQsF +AAOCAQEAXAgTFAGo4BVcGSCSRtqpW2Y6NmYOx2n60sN+1Gkvqkto8qngimr/D3o0 +Biy14GO5Y8he9lVVXaM/r5UTm96VRYRoTP2jug6J2wBAag/gTIBbwwwV71luBAq6 +jiccjPSdrZumHj0alO1yMYAxTowqg9wiBlzYgDiURmaX6Yty+48BGiwetAxdb9FI +XW9fJgWdvjdPzbdtB60ce9mqdKKg1gHzIQaBKYuYxNfHaJ6NEO6NqBGiXKJ0RFDG +cZ8L5U+vieD/9re0v0wUPjfOyccqg684/Hexiad3uQpeppFGKqdwSMR4WjYIsvWu +55a2YACV03UKQrwTb+Kn4ejlWKF8rA== +-----END CERTIFICATE----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem new file mode 100644 index 00000000..ebb7cc55 --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDe35HaipLAWf9F +PxdMNeH6e3iQS39iQs9TgVsnxMw3Xvhi17kyt42sEfZkzxT0nHirQXNI5cAYHZR8 +baa25vMdNPQTX1OxdeL8ptsvDnn37pREbxlqZN4rZ7mIrIVSbCoS0f/nrk2EZVeD +vTqU6zWtVPmXMfRGl/cAQLP+ieTB8ZkmKzwNn7/hyj3qVbX2201JLZIKhUlo02gD +u5XnVuQZJG244G6BmBJTb9Bq8K7NwJmAKRxVgAWLrbwneyn3X67UoZn7tbO2QyyG +JRR5dnapi6EpSx27uMHNWptUp51/TxgIuP7bw8ZAv81RTy2jlYHzR3tZGapWVAeH +B8S+SCnJAgMBAAECggEBAJWLIcynyowyVuxZxwIl7Xkqu9zmK5T9CywW0dk/XV+R +48w+v09ehjr82n0NzhvLmdQfWIGDV39W6bkLwh9bm6jvTQ5qmjeqyCGKu+s5JXHM +rcO1YDJZeBFbycwBJnwFg72ZFsKX2/+IGE6W++XMZPnm2IowxJ1RfjS3NY8Ha20N +s9Pilp801fnBkEXr5dFwMggeD9mbALa9MW0KuXCGwIIeXbsIP7C/HohTxgwp+cxg +0FqagILBcQ0Gw+cx2f2WFY5d238OMWF9S6587T8A1wIXUVfqyv0TIwJh8kQWgUxz +LXYZYQxC4bty8TEh58hsTlrBw4Y0vtNM51yevGtjdGECgYEA/4c3vHANOKY25z/j +LkRAhhBqQxSO2Hl3tTC0l54yZ6KJ/pdQik+66mRe10hUcfCES/5FzHlJIiF1sVFa +N6n4AigrzF8opjRYLoM/JEMFZKBITkYT9huh9CY1MN5gvXJgEjxHaZ3gr7BBhNfj +/Ds/v7oP4sGx8c4RxxC5lxpa7i0CgYEA30jqtHQpF4AuIqKZTbfbClThfOgvCX93 +mEPEmckcv8GUpfZvhNqmul/IYxPSwGtNh875DheDg37COAwhqVZhqPH5R4vAaJgt +BqDqsLjzRtstWDmAsyue+HfJmujLmaBqdv+ZZWzPS285gLL3AuoHUEnF7t43wZ0d +CUCtEI4Gx40CgYEAlDJe7+nosRctNncGEhpBdb9lcZwlsITaGXqy8lAsmZBaCg7G +BkFxfWlS2/a2CxLcF5rT7l/VO3c+Y+Vztl7cWJvlsvTphWNMVUWHREeehBq1dLgN +8albB1d1d+8xGg6Qi2LsY+PNoPdPOHVhYzMVqOOHPRLrWfsSsmoPyQPfAs0CgYBN +PX0rpY9deNL82kCsGPDl9wz116AF6hlmC/Nju6V9VCrm6oQTckwA5wd79qyOMdBl +LZ0MWef9wgjPuKqgWKh5+BLixB5wUEwrIdlt/tzxYvqhrWqvEGTy0QVl2CguYcbS +mYLoCib/kl9S/RXj5S9Yf9y/0BF7oa0cuUnlEyyXNQKBgFktEg1mnIZ4NNurwVVy +GscbGTaNqiLCVar5/sEICAb46oWeEiTubm9nIrml7L5PHgWBX8ko0bCNECvZB6oP +hsHTw5q7mSPT//TO9hQhNK2WvK82e8yuuNGEiAZ1TIHILqxDCcTKPATIU/PO//aZ +ziy5/xTwidJVHqPBuZrjHLD9 +-----END PRIVATE KEY----- diff --git a/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager.pem b/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager.pem new file mode 100644 index 00000000..9d0e69fd --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/wazuh.manager.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDcjCCAlqgAwIBAgIUBTzs7SaBLAIqAkrE7TopFWYJguEwDQYJKoZIhvcNAQEL +BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD +YWxpZm9ybmlhMB4XDTIyMDMzMTE1NTg1OFoXDTMyMDMyODE1NTg1OFowWjELMAkG +A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w +DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWgubWFuYWdlcjCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAN7fkdqKksBZ/0U/F0w14fp7eJBLf2JCz1OB +WyfEzDde+GLXuTK3jawR9mTPFPSceKtBc0jlwBgdlHxtprbm8x009BNfU7F14vym +2y8OeffulERvGWpk3itnuYishVJsKhLR/+euTYRlV4O9OpTrNa1U+Zcx9EaX9wBA +s/6J5MHxmSYrPA2fv+HKPepVtfbbTUktkgqFSWjTaAO7ledW5BkkbbjgboGYElNv +0Grwrs3AmYApHFWABYutvCd7KfdfrtShmfu1s7ZDLIYlFHl2dqmLoSlLHbu4wc1a +m1SnnX9PGAi4/tvDxkC/zVFPLaOVgfNHe1kZqlZUB4cHxL5IKckCAwEAAaNVMFMw +HwYDVR0jBBgwFoAUhwVk/zxcbNU6lDR9eD1UtbdGMqUwCQYDVR0TBAIwADALBgNV +HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWgubWFuYWdlcjANBgkqhkiG9w0BAQsF +AAOCAQEAJzaP0Ui4dnXJnruBNIu/XjZUC82+BmQ+DhwfQO5BKT9DXSllGLli2ZcQ +fRmaaqtgO8T3ar/eMVH7296qZNrLvNLBjyuxm1fOKyDtANTUsJdXbpHJuzWrq9rT +BvovBkrP3HJQNX3R9nHM+ZcrONA4uQCgDTqNnvle9N3R7FhXVMFtrMlha1N1jehJ +hs9JGfVA0W3txw8nPiyLs1xyenQSALpROntIr5e8zN+GVRGtYCDjk4Mcuiw9TNqc +mVKADqxH2CBOQ/+tpOvmUFC6iLf2hPcp/gQ2Bgp/6L2ko4KYsLGTeA34OZJuSjIh +9zldYNWPUbg4IcpMhQ8rXE1qetOlug== +-----END CERTIFICATE----- diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index d5cc463c..356160ea 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -14,8 +14,13 @@ services: environment: - INDEXER_URL=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- volumes: - wazuh_api_configuration:/var/ossec/api/configuration - wazuh_etc:/var/ossec/etc @@ -28,6 +33,10 @@ services: - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: image: wazuh/wazuh-indexer:4.3.0 @@ -46,6 +55,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.3.0 @@ -57,6 +73,14 @@ services: - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - WAZUH_API_URL=https://wazuh.manager + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml depends_on: - wazuh.indexer links: diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml new file mode 100644 index 00000000..c29c50d6 --- /dev/null +++ b/single-node/generate-indexer-certs.yml @@ -0,0 +1,10 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3' + +services: + generator: + image: wazuh/wazuh-certs-generator:0.0.1 + hostname: wazuh-certs-generator + volumes: + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file