yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #611 from wazuh/608-misc-fixes

Browse Source 
Test rework of Docker repository
This commit is contained in:
Alberto Rodríguez
2022-04-11 18:07:42 +02:00
committed by GitHub
parent ce8908bcd8 28cbfa5dd6
commit 5464bf4b91
11 changed files with 17 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -6
View File
@@ -9,11 +9,12 @@ In this repository you will find the containers to run:
* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS
* Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status.
* Wazuh indexer: Wazuh indexer container (working as a single-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
In addition, a docker-compose file is provided to launch the containers mentioned above.
* Wazuh indexer cluster. In the Wazuh indexer Dockerfile we can visualize variables to configure an Wazuh indexer Cluster. These variables are used in the file *config_cluster.sh* to set them in the *opensearch.yml* configuration file. You can see the meaning of the node variables and other cluster settings [here](https://opensearch.org/docs/latest/opensearch/cluster/).
The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets.
The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets.
The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard.
The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard.
## Documentation
@@ -81,8 +82,6 @@ WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-mo
WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task
WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas
WAZUH_MONITORING_REPLICAS=0 #
ADMIN_PRIVILEGES=true # App privileges
```
## Directory structure
build-docker-images/README.md
+2 -8
View File
@@ -3,11 +3,5 @@
This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command:
```
$ docker-compose up -d --build
```
Once the image creation process is finished, a Wazuh single-node environment will be spinned up. It can be terminated with the following command:
```
$ docker-compose down
```
$ docker-compose build
```
build-docker-images/wazuh-dashboard/Dockerfile
+1 -9
View File
@@ -78,15 +78,7 @@ ENV PATTERN="" \
WAZUH_MONITORING_ENABLED="" \
WAZUH_MONITORING_FREQUENCY="" \
WAZUH_MONITORING_SHARDS="" \
WAZUH_MONITORING_REPLICAS="" \
ADMIN_PRIVILEGES="" \
XPACK_CANVAS="true" \
XPACK_LOGS="true" \
XPACK_INFRA="true" \
XPACK_ML="true" \
XPACK_DEVTOOLS="true" \
XPACK_MONITORING="true" \
XPACK_APM="true"
WAZUH_MONITORING_REPLICAS=""
# Create wazuh-dashboard user and group
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
build-docker-images/wazuh-dashboard/config/wazuh.yml
-6
View File
@@ -77,12 +77,6 @@
# List of index patterns to be ignored
#ip.ignore: []
#
# -------------------------------- X-Pack RBAC ---------------------------------
#
# Custom setting to enable/disable built-in X-Pack RBAC security capabilities.
# Default: enabled
#xpack.rbac.enabled: true
#
# ------------------------------ wazuh-monitoring ------------------------------
#
# Custom setting to enable/disable wazuh-monitoring indices.
build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh
-1
View File
@@ -36,7 +36,6 @@ declare -A CONFIG_MAP=(
[wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
[wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
[wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
[admin]=$ADMIN_PRIVILEGES
)
for i in "${!CONFIG_MAP[@]}"
build-docker-images/wazuh-indexer/config/roles_mapping.yml
+2 -2
View File
@@ -1,6 +1,6 @@
---
# In this file users, backendroles and hosts can be mapped to Open Distro Security roles.
# Permissions for Opendistro roles are configured in roles.yml
# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles.
# Permissions for Wazuh indexer roles are configured in roles.yml
_meta:
type: "rolesmapping"
multi-node/Migration-to-Wazuh-4.3.md
+5 -4
View File
@@ -17,7 +17,12 @@ Assuming that you have a v4.2 production deployment, perform the following steps
**4. Spin down the 4.2 environment.**
`docker-compose -f production-cluster.yml down`
**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.**
Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command.
```
docker volume create \
--label com.docker.compose.project=multi-node \
@@ -345,10 +350,6 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to"
```
**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.**
Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
**7. Start the 4.3 environment.**
```
git checkout 4.3
multi-node/config/wazuh_indexer/wazuh1.indexer.yml
-2
View File
@@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
opendistro_security.audit.config.disabled_transport_categories: NONE
compatibility.override_main_response_version: true
multi-node/config/wazuh_indexer/wazuh2.indexer.yml
-2
View File
@@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
opendistro_security.audit.config.disabled_transport_categories: NONE
compatibility.override_main_response_version: true
multi-node/config/wazuh_indexer/wazuh3.indexer.yml
-2
View File
@@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
opendistro_security.audit.config.disabled_transport_categories: NONE
compatibility.override_main_response_version: true
single-node/config/wazuh_indexer/wazuh.indexer.yml
+2
View File
@@ -25,3 +25,5 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false