diff --git a/.goss.yaml b/.goss.yaml
index 7d32530e..292c1a66 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -16,22 +16,22 @@ file:
/var/ossec/etc/lists/audit-keys:
exists: true
mode: "0660"
- owner: ossec
- group: ossec
+ owner: wazuh
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/ossec.conf:
exists: true
mode: "0660"
owner: root
- group: ossec
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/rules/local_rules.xml:
exists: true
mode: "0660"
- owner: ossec
- group: ossec
+ owner: wazuh
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/sslmanager.cert:
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.2.3
+ - 4.3.0
port:
tcp:1514:
listening: true
@@ -71,26 +71,26 @@ port:
ip:
- 0.0.0.0
user:
- ossec:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
- ossecm:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
- ossecr:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
group:
- ossec:
+ wazuh:
exists: true
process:
filebeat:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 058500d4..e9d3cf26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.3.0
+### Added
+
+- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430)
+
## Wazuh Docker v4.2.3
### Added
diff --git a/README.md b/README.md
index a91a06b8..dae2e5c5 100644
--- a/README.md
+++ b/README.md
@@ -26,7 +26,7 @@ In addition, a docker-compose file is provided to launch the containers mentione
Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed).
-Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment).
+Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment).
## Environment Variables
@@ -149,11 +149,11 @@ ADMIN_PRIVILEGES=true # App privileges
* `master` branch contains the latest code, be aware of possible bugs on this branch.
* `stable` branch on correspond to the last Wazuh stable version.
-
## Compatibility Matrix
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.3.0 | 1.13.2 | 7.11.2 |
| v4.2.3 | 1.13.2 | 7.11.2 |
| v4.2.2 | 1.13.2 | 7.11.2 |
| v4.2.1 | 1.13.2 | 7.11.2 |
diff --git a/VERSION b/VERSION
index 319f9594..5fedc35e 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.2.3"
-REVISION="40217"
+WAZUH-DOCKER_VERSION="4.3.0"
+REVISION="43100"
diff --git a/docker-compose.yml b/docker-compose.yml
index 89ac3313..2b12af30 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.2.3
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.2.3
+ image: wazuh/wazuh-kibana-odfe:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index de1a2212..1d304341 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.3
+ARG WAZUH_VERSION=4.3.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index 6f26594b..d98443ae 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.3
+ARG WAZUH_VERSION=4.3.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index 666140c0..df0d2250 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.2.3
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.2.3
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-worker
restart: always
environment:
@@ -134,7 +134,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.2.3
+ image: wazuh/wazuh-kibana-odfe:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/production_cluster/wazuh_cluster/wazuh_manager.conf
index 9619da45..38a180d6 100644
--- a/production_cluster/wazuh_cluster/wazuh_manager.conf
+++ b/production_cluster/wazuh_cluster/wazuh_manager.conf
@@ -6,7 +6,7 @@
no
no
smtp.example.wazuh.com
- ossecm@example.wazuh.com
+ wazuh@example.wazuh.com
recipient@example.wazuh.com
12
alerts.log
@@ -200,8 +200,8 @@
127.0.0.1
^localhost.localdomain$
- 4.2.3.1
- 4.2.3.2
+ 4.3.0.1
+ 4.3.0.2
208.67.220.220
diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/production_cluster/wazuh_cluster/wazuh_worker.conf
index 1494c37a..bc0bbb8d 100644
--- a/production_cluster/wazuh_cluster/wazuh_worker.conf
+++ b/production_cluster/wazuh_cluster/wazuh_worker.conf
@@ -6,7 +6,7 @@
no
no
smtp.example.wazuh.com
- ossecm@example.wazuh.com
+ wazuh@example.wazuh.com
recipient@example.wazuh.com
12
alerts.log
@@ -200,8 +200,8 @@
127.0.0.1
^localhost.localdomain$
- 4.2.3.1
- 4.2.3.2
+ 4.3.0.1
+ 4.3.0.2
208.67.220.220
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 371cf6b8..1e0756e2 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.3
+ARG WAZUH_VERSION=4.3.0-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
@@ -39,7 +39,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e
RUN chmod go-w /etc/filebeat/wazuh-template.json
COPY config/etc/ /etc/
-COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py
+COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
# Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547
diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager
index 58807682..9e70ace9 100644
--- a/wazuh-odfe/config/etc/cont-init.d/2-manager
+++ b/wazuh-odfe/config/etc/cont-init.d/2-manager
@@ -36,11 +36,11 @@ function_wazuh_migration(){
fi
\cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf
- chown root:ossec /var/ossec/etc/ossec.conf
+ chown root:wazuh /var/ossec/etc/ossec.conf
chmod 640 /var/ossec/etc/ossec.conf
\cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys
- chown ossec:ossec /var/ossec/etc/client.keys
+ chown wazuh:wazuh /var/ossec/etc/client.keys
chmod 640 /var/ossec/etc/client.keys
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert
@@ -49,25 +49,25 @@ function_wazuh_migration(){
chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf
- chown ossec:ossec /var/ossec/etc/shared/default/agent.conf
+ chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf
chmod 660 /var/ossec/etc/shared/default/agent.conf
\cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/
- chown ossec:ossec /var/ossec/etc/decoders/*
+ chown wazuh:wazuh /var/ossec/etc/decoders/*
chmod 660 /var/ossec/etc/decoders/*
\cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/
- chown ossec:ossec /var/ossec/etc/rules/*
+ chown wazuh:wazuh /var/ossec/etc/rules/*
chmod 660 /var/ossec/etc/rules/*
if [ -e /wazuh-migration/data/agentless/.passlist ]; then
\cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
- chown root:ossec /var/ossec/agentless/.passlist
+ chown root:wazuh /var/ossec/agentless/.passlist
chmod 640 /var/ossec/agentless/.passlist
fi
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
- chown ossec:ossec /var/ossec/queue/db/global.db
+ chown wazuh:wazuh /var/ossec/queue/db/global.db
chmod 640 /var/ossec/queue/db/global.db
# mark volume as migrated
diff --git a/wazuh-odfe/config/etc/services.d/ossec-logs/run b/wazuh-odfe/config/etc/services.d/ossec-logs/run
index edb4b87c..e96cba8f 100644
--- a/wazuh-odfe/config/etc/services.d/ossec-logs/run
+++ b/wazuh-odfe/config/etc/services.d/ossec-logs/run
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv sh
# dumping ossec.log to standard output
-exec tail -f /var/ossec/logs/ossec.log
+exec tail -F /var/ossec/logs/ossec.log
diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env
index c9cbcd3e..a4eca61a 100644
--- a/wazuh-odfe/config/permanent_data.env
+++ b/wazuh-odfe/config/permanent_data.env
@@ -5,6 +5,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/etc"
PERMANENT_DATA[((i++))]="/var/ossec/logs"
PERMANENT_DATA[((i++))]="/var/ossec/queue"
PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector"
+PERMANENT_DATA[((i++))]="/var/ossec/queue/tasks"
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
PERMANENT_DATA[((i++))]="/var/ossec/integrations"
@@ -48,6 +49,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index 45d90f77..f741a7ce 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.2.3
+ image: wazuh/wazuh:4.3.0
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.2.3
+ image: wazuh/wazuh-kibana:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index 631e3337..922eee93 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -8,7 +8,7 @@ services:
args:
- FILEBEAT_CHANNEL=filebeat
- FILEBEAT_VERSION=7.11.2
- image: wazuh/wazuh:4.2.3
+ image: wazuh/wazuh:4.3.0
hostname: wazuh-manager
restart: always
ports:
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.2.3
+ image: wazuh/wazuh-kibana:4.3.0
hostname: kibana
restart: always
ports: