From ab58d0aa23c3ae144c5af25a8540da998bc9377c Mon Sep 17 00:00:00 2001 From: Thibault VINCENT Date: Mon, 1 Mar 2021 20:35:43 +0100 Subject: [PATCH 01/17] fix: missing directory for tasks manager db This will prevent error : wazuh-db: ERROR: Couldn't create SQLite database 'queue/tasks/tasks.db' --- wazuh-odfe/config/permanent_data.env | 1 + 1 file changed, 1 insertion(+) diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 9c2556d8..177b3191 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -4,6 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" +PERMANENT_DATA[((i++))]="/var/ossec/queue/tasks" PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/ossec/integrations" From f346a51c0faf75040c4dd3fe21793b20bfd25a52 Mon Sep 17 00:00:00 2001 From: VictorMorenoJimenez Date: Wed, 14 Apr 2021 08:59:10 +0200 Subject: [PATCH 02/17] Bump to v4.3.0 --- .goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 2 ++ VERSION | 2 +- docker-compose.yml | 4 ++-- kibana-odfe/Dockerfile | 2 +- kibana/Dockerfile | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- xpack-compose.yml | 4 ++-- xpack-from-sources.yml | 4 ++-- 11 files changed, 21 insertions(+), 14 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index a0380493..2354bcab 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.2.0 + - 4.3.0 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index edd03a8e..1ec05c23 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.3.0 +### Added + +- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430) + ## Wazuh Docker v4.2.0 ### Added diff --git a/README.md b/README.md index 8ff10da5..15ba59f5 100644 --- a/README.md +++ b/README.md @@ -155,6 +155,8 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.3.0 | 1.12.0 | 7.10.2 | +|---------------|---------|--------| | v4.2.0 | 1.12.0 | 7.10.2 | |---------------|---------|--------| | v4.1.4 | 1.12.0 | 7.10.2 | diff --git a/VERSION b/VERSION index 156da5c1..dbe284b1 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.2.0" +WAZUH-DOCKER_VERSION="4.3.0" REVISION="41100" diff --git a/docker-compose.yml b/docker-compose.yml index 73d7b57c..35e682f4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.2.0 + image: wazuh/wazuh-kibana-odfe:4.3.0 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index b919d9bf..347a0c38 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0 USER kibana ARG ELASTIC_VERSION=7.10.0 -ARG WAZUH_VERSION=4.2.0 +ARG WAZUH_VERSION=4.3.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 2124b225..d98443ae 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.0 +ARG WAZUH_VERSION=4.3.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index b739bab7..af9d35c6 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.2.0 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-worker restart: always environment: @@ -132,7 +132,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.2.0 + image: wazuh/wazuh-kibana-odfe:4.3.0 hostname: kibana restart: always ports: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index 37723a8d..e6b45ce4 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.0 -ARG WAZUH_VERSION=4.2.0-1 +ARG WAZUH_VERSION=4.3.0-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" diff --git a/xpack-compose.yml b/xpack-compose.yml index 77017087..f741a7ce 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.2.0 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.2.0 + image: wazuh/wazuh-kibana:4.3.0 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 6265ecb7..33074e5d 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.10.2 - image: wazuh/wazuh:4.2.0 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.2.0 + image: wazuh/wazuh-kibana:4.3.0 hostname: kibana restart: always ports: From 2c5014a150a47f48861a8a91c6d4cb61fe07818b Mon Sep 17 00:00:00 2001 From: Victor Moreno Jimenez Date: Tue, 16 Mar 2021 17:20:31 +0100 Subject: [PATCH 03/17] 448. Rename users and groups according to new Wazuh naming standard --- .goss.yaml | 24 +++++++++---------- .../wazuh_cluster/wazuh_manager.conf | 2 +- .../wazuh_cluster/wazuh_worker.conf | 2 +- wazuh-odfe/Dockerfile | 2 +- wazuh-odfe/config/etc/cont-init.d/2-manager | 14 +++++------ 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 2354bcab..16655717 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -16,22 +16,22 @@ file: /var/ossec/etc/lists/audit-keys: exists: true mode: "0660" - owner: ossec - group: ossec + owner: wazuh + group: wazuh filetype: file contains: [] /var/ossec/etc/ossec.conf: exists: true mode: "0660" owner: root - group: ossec + group: wazuh filetype: file contains: [] /var/ossec/etc/rules/local_rules.xml: exists: true mode: "0660" - owner: ossec - group: ossec + owner: wazuh + group: wazuh filetype: file contains: [] /var/ossec/etc/sslmanager.cert: @@ -71,26 +71,26 @@ port: ip: - 0.0.0.0 user: - ossec: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin - ossecm: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin - ossecr: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin group: - ossec: + wazuh: exists: true process: filebeat: diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/production_cluster/wazuh_cluster/wazuh_manager.conf index d6e4f5ec..e877e6e5 100644 --- a/production_cluster/wazuh_cluster/wazuh_manager.conf +++ b/production_cluster/wazuh_cluster/wazuh_manager.conf @@ -6,7 +6,7 @@ no no smtp.example.wazuh.com - ossecm@example.wazuh.com + wazuh@example.wazuh.com recipient@example.wazuh.com 12 alerts.log diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/production_cluster/wazuh_cluster/wazuh_worker.conf index e202e849..0d66b453 100644 --- a/production_cluster/wazuh_cluster/wazuh_worker.conf +++ b/production_cluster/wazuh_cluster/wazuh_worker.conf @@ -6,7 +6,7 @@ no no smtp.example.wazuh.com - ossecm@example.wazuh.com + wazuh@example.wazuh.com recipient@example.wazuh.com 12 alerts.log diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index e6b45ce4..dd461073 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -39,7 +39,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e RUN chmod go-w /etc/filebeat/wazuh-template.json COPY config/etc/ /etc/ -COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py +COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager index 58807682..9e70ace9 100644 --- a/wazuh-odfe/config/etc/cont-init.d/2-manager +++ b/wazuh-odfe/config/etc/cont-init.d/2-manager @@ -36,11 +36,11 @@ function_wazuh_migration(){ fi \cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf - chown root:ossec /var/ossec/etc/ossec.conf + chown root:wazuh /var/ossec/etc/ossec.conf chmod 640 /var/ossec/etc/ossec.conf \cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys - chown ossec:ossec /var/ossec/etc/client.keys + chown wazuh:wazuh /var/ossec/etc/client.keys chmod 640 /var/ossec/etc/client.keys \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert @@ -49,25 +49,25 @@ function_wazuh_migration(){ chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf - chown ossec:ossec /var/ossec/etc/shared/default/agent.conf + chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf chmod 660 /var/ossec/etc/shared/default/agent.conf \cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/ - chown ossec:ossec /var/ossec/etc/decoders/* + chown wazuh:wazuh /var/ossec/etc/decoders/* chmod 660 /var/ossec/etc/decoders/* \cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/ - chown ossec:ossec /var/ossec/etc/rules/* + chown wazuh:wazuh /var/ossec/etc/rules/* chmod 660 /var/ossec/etc/rules/* if [ -e /wazuh-migration/data/agentless/.passlist ]; then \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist - chown root:ossec /var/ossec/agentless/.passlist + chown root:wazuh /var/ossec/agentless/.passlist chmod 640 /var/ossec/agentless/.passlist fi \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db - chown ossec:ossec /var/ossec/queue/db/global.db + chown wazuh:wazuh /var/ossec/queue/db/global.db chmod 640 /var/ossec/queue/db/global.db # mark volume as migrated From 7c3384f9a330b0c54547f6decf13a596adf78704 Mon Sep 17 00:00:00 2001 From: Alberto R Date: Thu, 22 Apr 2021 17:43:49 +0200 Subject: [PATCH 04/17] Bumped to 4.1.5 --- .goss.yaml | 2 +- CHANGELOG.md | 5 +++++ VERSION | 2 +- docker-compose.yml | 4 ++-- kibana-odfe/Dockerfile | 2 +- kibana/Dockerfile | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- xpack-compose.yml | 4 ++-- xpack-from-sources.yml | 4 ++-- 10 files changed, 19 insertions(+), 14 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index b5f3796b..df044975 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.1.4 + - 4.1.5 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 4180c4b7..040de54b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.1.5 +### Added + +- Update Wazuh to version [4.1.5](https://github.com/wazuh/wazuh/blob/v4.1.5/CHANGELOG.md#v415) + ## Wazuh Docker v4.1.4 ### Added diff --git a/VERSION b/VERSION index 9400c683..33ad3ee2 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.1.4" +WAZUH-DOCKER_VERSION="4.1.5" REVISION="41100" diff --git a/docker-compose.yml b/docker-compose.yml index afda5fb5..53d919a1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.1.4 + image: wazuh/wazuh-odfe:4.1.5 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.1.4 + image: wazuh/wazuh-kibana-odfe:4.1.5 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index c5801882..00ee8bba 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0 USER kibana ARG ELASTIC_VERSION=7.10.0 -ARG WAZUH_VERSION=4.1.4 +ARG WAZUH_VERSION=4.1.5 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 56a5c4de..144afb91 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.1.4 +ARG WAZUH_VERSION=4.1.5 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index b68cbded..803ebfb0 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.1.4 + image: wazuh/wazuh-odfe:4.1.5 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.1.4 + image: wazuh/wazuh-odfe:4.1.5 hostname: wazuh-worker restart: always environment: @@ -132,7 +132,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.1.4 + image: wazuh/wazuh-kibana-odfe:4.1.5 hostname: kibana restart: always ports: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index 00da5b88..1b18e3d3 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.0 -ARG WAZUH_VERSION=4.1.4-1 +ARG WAZUH_VERSION=4.1.5-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" diff --git a/xpack-compose.yml b/xpack-compose.yml index 4271df4a..938c89d7 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.1.4 + image: wazuh/wazuh:4.1.5 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.1.4 + image: wazuh/wazuh-kibana:4.1.5 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 309bf500..68ffab3e 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.10.2 - image: wazuh/wazuh:4.1.4 + image: wazuh/wazuh:4.1.5 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.1.4 + image: wazuh/wazuh-kibana:4.1.5 hostname: kibana restart: always ports: From 53bbddd754797f11805a674698b9dfaf9c5d3ea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alberto=20Rodr=C3=ADguez?= Date: Thu, 22 Apr 2021 18:06:12 +0200 Subject: [PATCH 05/17] Update VERSION MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Víctor Moreno Jiménez --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 33ad3ee2..2b1e35cf 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.1.5" -REVISION="41100" +REVISION="40114" From c0d243471e2867e6e4ede16dd9d066321350310b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Fern=C3=A1ndez?= Date: Mon, 24 May 2021 11:44:35 +0200 Subject: [PATCH 06/17] Update README --- README.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/README.md b/README.md index 15ba59f5..8fd89df3 100644 --- a/README.md +++ b/README.md @@ -146,10 +146,8 @@ ADMIN_PRIVILEGES=true # App privileges ## Branches -* `4.0` branch on correspond to the latest Wazuh-Docker stable version. * `master` branch contains the latest code, be aware of possible bugs on this branch. -* `Wazuh.Version` (for example 3.13.1_7.8.0 or 4.1.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch. - +* `stable` branch on correspond to the last Wazuh stable version. ## Compatibility Matrix From 0e0160121bc8d1e3f659acae169130e71dd16f3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Fern=C3=A1ndez?= Date: Mon, 24 May 2021 12:53:06 +0200 Subject: [PATCH 07/17] Bump to ODFE 1.13.2 --- .goss.yaml | 2 +- CHANGELOG.md | 2 ++ README.md | 16 +++------------- build-from-sources.yml | 2 +- docker-compose.yml | 2 +- kibana-odfe/Dockerfile | 4 ++-- kibana-odfe/config/kibana_settings.sh | 2 -- kibana-odfe/config/welcome_wazuh.sh | 2 +- production-cluster.yml | 6 +++--- wazuh-odfe/Dockerfile | 2 +- 10 files changed, 15 insertions(+), 25 deletions(-) diff --git a/.goss.yaml b/.goss.yaml index 16655717..a50e56eb 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -52,7 +52,7 @@ package: filebeat: installed: true versions: - - 7.10.0 + - 7.10.2 wazuh-manager: installed: true versions: diff --git a/CHANGELOG.md b/CHANGELOG.md index d3ba4d9f..57d43d84 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,10 +10,12 @@ All notable changes to this project will be documented in this file. ### Added - Update Wazuh to version [4.2.0](https://github.com/wazuh/wazuh/blob/v4.2.0/CHANGELOG.md#v420) + ## Wazuh Docker v4.1.5 ### Added - Update Wazuh to version [4.1.5](https://github.com/wazuh/wazuh/blob/v4.1.5/CHANGELOG.md#v415) +- Update ODFE compatibility to version 1.13.2 ## Wazuh Docker v4.1.4 ### Added diff --git a/README.md b/README.md index 8fd89df3..92e63e1b 100644 --- a/README.md +++ b/README.md @@ -153,28 +153,18 @@ ADMIN_PRIVILEGES=true # App privileges | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.3.0 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| -| v4.2.0 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| +| v4.3.0 | 1.13.2 | 7.10.2 | +| v4.2.0 | 1.13.2 | 7.10.2 | +| v4.1.5 | 1.13.2 | 7.10.2 | | v4.1.4 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.3 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.2 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.1 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.1.0 | 1.12.0 | 7.10.2 | -|---------------|---------|--------| | v4.0.4 | 1.11.0 | | -|---------------|---------|--------| | v4.0.3 | 1.11.0 | | -|---------------|---------|--------| | v4.0.2 | 1.11.0 | | -|---------------|---------|--------| | v4.0.1 | 1.11.0 | | -|---------------|---------|--------| | v4.0.0 | 1.10.1 | | ## Credits and Thank you diff --git a/build-from-sources.yml b/build-from-sources.yml index 14e21304..637556e1 100644 --- a/build-from-sources.yml +++ b/build-from-sources.yml @@ -31,7 +31,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: diff --git a/docker-compose.yml b/docker-compose.yml index 35e682f4..2b12af30 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -30,7 +30,7 @@ services: - filebeat_var:/var/lib/filebeat elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 347a0c38..1d304341 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -1,7 +1,7 @@ # Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) -FROM amazon/opendistro-for-elasticsearch-kibana:1.12.0 +FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana -ARG ELASTIC_VERSION=7.10.0 +ARG ELASTIC_VERSION=7.10.2 ARG WAZUH_VERSION=4.3.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" diff --git a/kibana-odfe/config/kibana_settings.sh b/kibana-odfe/config/kibana_settings.sh index 4bc39a5f..4663889b 100644 --- a/kibana-odfe/config/kibana_settings.sh +++ b/kibana-odfe/config/kibana_settings.sh @@ -18,8 +18,6 @@ WAZUH_MAJOR=4 # Customize elasticsearch ip ############################################################################## sed -i "s|elasticsearch.hosts:.*|elasticsearch.hosts: $el_url|g" /usr/share/kibana/config/kibana.yml -# disable multitenancy -sed -i "s|opendistro_security.multitenancy.enabled:.*|opendistro_security.multitenancy.enabled: false|g" /usr/share/kibana/config/kibana.yml # If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate. if [ "$KIBANA_INDEX" != "" ]; then diff --git a/kibana-odfe/config/welcome_wazuh.sh b/kibana-odfe/config/welcome_wazuh.sh index b0bcfc70..c3846762 100644 --- a/kibana-odfe/config/welcome_wazuh.sh +++ b/kibana-odfe/config/welcome_wazuh.sh @@ -4,7 +4,7 @@ if [[ $CHANGE_WELCOME == "true" ]] then echo "Set Wazuh app as the default landing page" - echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml + echo "server.defaultRoute: /app/wazuh?security_tenant=global" >> /usr/share/kibana/config/kibana.yml echo "Set custom welcome styles" cp -f /tmp/custom_welcome/template.js.hbs /usr/share/kibana/src/legacy/ui/ui_render/bootstrap/template.js.hbs diff --git a/production-cluster.yml b/production-cluster.yml index af9d35c6..fa1bf78f 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -67,7 +67,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch restart: always ports: @@ -90,7 +90,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml elasticsearch-2: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-2 restart: always environment: @@ -111,7 +111,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml elasticsearch-3: - image: amazon/opendistro-for-elasticsearch:1.12.0 + image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-3 restart: always environment: diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index dd461073..1e0756e2 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss -ARG FILEBEAT_VERSION=7.10.0 +ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_VERSION=4.3.0-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" From b94748732548951ee151cf19847b278ea116707d Mon Sep 17 00:00:00 2001 From: CuFa <46934023+orsifacundo@users.noreply.github.com> Date: Wed, 9 Jun 2021 16:39:39 -0300 Subject: [PATCH 08/17] Update certs.yml --- production_cluster/ssl_certs/certs.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml index f7dad185..a4afcd45 100644 --- a/production_cluster/ssl_certs/certs.yml +++ b/production_cluster/ssl_certs/certs.yml @@ -28,3 +28,8 @@ nodes: dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com dns: - wazuh + +clients: + - name: admin + dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com + admin: true From 04309afadacca51776e5ce7d18b4e824bb044f2e Mon Sep 17 00:00:00 2001 From: CuFa <46934023+orsifacundo@users.noreply.github.com> Date: Wed, 9 Jun 2021 16:40:39 -0300 Subject: [PATCH 09/17] Update production-cluster.yml --- production-cluster.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/production-cluster.yml b/production-cluster.yml index fa1bf78f..9ec9ce92 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -86,6 +86,8 @@ services: - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem + - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem + - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml From 4ae07e1d77b85a0ddbe0ef3c4f9bb6f5e04a3054 Mon Sep 17 00:00:00 2001 From: CuFa <46934023+orsifacundo@users.noreply.github.com> Date: Wed, 9 Jun 2021 16:41:09 -0300 Subject: [PATCH 10/17] Update elasticsearch-node1.yml --- production_cluster/elastic_opendistro/elasticsearch-node1.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/production_cluster/elastic_opendistro/elasticsearch-node1.yml b/production_cluster/elastic_opendistro/elasticsearch-node1.yml index c343818e..4f9a628d 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node1.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node1.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true From 64bac445070e56c619080a53bbb1b07866d45a43 Mon Sep 17 00:00:00 2001 From: CuFa <46934023+orsifacundo@users.noreply.github.com> Date: Wed, 9 Jun 2021 16:41:19 -0300 Subject: [PATCH 11/17] Update elasticsearch-node2.yml --- production_cluster/elastic_opendistro/elasticsearch-node2.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/production_cluster/elastic_opendistro/elasticsearch-node2.yml b/production_cluster/elastic_opendistro/elasticsearch-node2.yml index 3e9bae49..e368461e 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node2.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node2.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true From 3f3a688d4a4649021197e9603ef20d4d8f7a06f3 Mon Sep 17 00:00:00 2001 From: CuFa <46934023+orsifacundo@users.noreply.github.com> Date: Wed, 9 Jun 2021 16:41:32 -0300 Subject: [PATCH 12/17] Update elasticsearch-node3.yml --- production_cluster/elastic_opendistro/elasticsearch-node3.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/production_cluster/elastic_opendistro/elasticsearch-node3.yml b/production_cluster/elastic_opendistro/elasticsearch-node3.yml index 574bce5c..14717a81 100644 --- a/production_cluster/elastic_opendistro/elasticsearch-node3.yml +++ b/production_cluster/elastic_opendistro/elasticsearch-node3.yml @@ -20,7 +20,7 @@ opendistro_security.nodes_dn: - 'CN=node2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=node3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' - 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -opendistro_security.authcz.admin_dn: [] +opendistro_security.authcz.admin_dn: ['CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com'] opendistro_security.audit.type: internal_elasticsearch opendistro_security.enable_snapshot_restore_privilege: true opendistro_security.check_snapshot_restore_write_privileges: true From 3aad1aecd5e3f8f8ddf492ccd851cd9f666e13e2 Mon Sep 17 00:00:00 2001 From: fhielpos Date: Thu, 23 Sep 2021 11:40:46 -0300 Subject: [PATCH 13/17] Change tail argument to prevent log rotation issues --- wazuh-odfe/config/etc/services.d/ossec-logs/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wazuh-odfe/config/etc/services.d/ossec-logs/run b/wazuh-odfe/config/etc/services.d/ossec-logs/run index edb4b87c..e96cba8f 100644 --- a/wazuh-odfe/config/etc/services.d/ossec-logs/run +++ b/wazuh-odfe/config/etc/services.d/ossec-logs/run @@ -1,4 +1,4 @@ #!/usr/bin/with-contenv sh # dumping ossec.log to standard output -exec tail -f /var/ossec/logs/ossec.log +exec tail -F /var/ossec/logs/ossec.log From 96dfa2a8d8f2a096a23d8edf8a0cdeff4c04cca8 Mon Sep 17 00:00:00 2001 From: fhielpos Date: Fri, 24 Sep 2021 11:39:56 -0300 Subject: [PATCH 14/17] Add utils.py to persistent_data --- wazuh-odfe/config/permanent_data.env | 1 + 1 file changed, 1 insertion(+) diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 177b3191..2f51fe4a 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -50,6 +50,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" From 503db33dde67b6eadb77a6807b7b3a2ec5705fd2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 16:50:34 -0300 Subject: [PATCH 15/17] Merge 4.2 into master --- production_cluster/ssl_certs/certs.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml index d9551f05..486e4178 100644 --- a/production_cluster/ssl_certs/certs.yml +++ b/production_cluster/ssl_certs/certs.yml @@ -27,13 +27,8 @@ nodes: - name: filebeat dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com dns: -<<<<<<< HEAD - wazuh -======= - - wazuh - ->>>>>>> f34b7d0465dbc8bf717d81e2bc4f13f44a03a55d clients: - name: admin dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com From c33cb0d2741520cd01989ccb3d8d2b3b73dc9bbc Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 16:54:29 -0300 Subject: [PATCH 16/17] Merge 4.2 into master --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0053ecfd..9aaf87ab 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ In addition, a docker-compose file is provided to launch the containers mentione Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). -Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). +Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). ## Environment Variables From 1588bc26ff01f778e08b67142509b42be2ef4f23 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 30 Sep 2021 18:09:31 -0300 Subject: [PATCH 17/17] Merge 4.2 into master --- xpack-from-sources.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 80ca6b19..922eee93 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.2.2 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: