diff --git a/README.md b/README.md index 8419df5c..f08f61fd 100644 --- a/README.md +++ b/README.md @@ -9,11 +9,12 @@ In this repository you will find the containers to run: * Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS * Wazuh dashboard: provides a web user interface to browse through alerts data and allows you to visualize agents configuration and status. -* Wazuh indexer: Wazuh indexer container (working as a single-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** +* Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** -In addition, a docker-compose file is provided to launch the containers mentioned above. - -* Wazuh indexer cluster. In the Wazuh indexer Dockerfile we can visualize variables to configure an Wazuh indexer Cluster. These variables are used in the file *config_cluster.sh* to set them in the *opensearch.yml* configuration file. You can see the meaning of the node variables and other cluster settings [here](https://opensearch.org/docs/latest/opensearch/cluster/). +The folder `build-docker-images` contains a README explaining how to build the Wazuh images and the necessary assets. +The folder `indexer-certs-creator` contains a README explaining how to create the certificates creator tool and the necessary assets. +The folder `single-node` contains a README explaining how to run a Wazuh environment with one Wazuh manager, one Wazuh indexer, and one Wazuh dashboard. +The folder `multi-node` contains a README explaining how to run a Wazuh environment with two Wazuh managers, three Wazuh indexer, and one Wazuh dashboard. ## Documentation @@ -81,8 +82,6 @@ WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-mo WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas WAZUH_MONITORING_REPLICAS=0 # - -ADMIN_PRIVILEGES=true # App privileges ``` ## Directory structure diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 5839ac52..9860d8b0 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -3,11 +3,5 @@ This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command: ``` -$ docker-compose up -d --build -``` - -Once the image creation process is finished, a Wazuh single-node environment will be spinned up. It can be terminated with the following command: - -``` -$ docker-compose down -``` +$ docker-compose build +``` \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 8f38685f..3853f180 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -78,15 +78,7 @@ ENV PATTERN="" \ WAZUH_MONITORING_ENABLED="" \ WAZUH_MONITORING_FREQUENCY="" \ WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" \ - XPACK_CANVAS="true" \ - XPACK_LOGS="true" \ - XPACK_INFRA="true" \ - XPACK_ML="true" \ - XPACK_DEVTOOLS="true" \ - XPACK_MONITORING="true" \ - XPACK_APM="true" + WAZUH_MONITORING_REPLICAS="" # Create wazuh-dashboard user and group RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml index aeb519f7..2c5649d7 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh.yml +++ b/build-docker-images/wazuh-dashboard/config/wazuh.yml @@ -77,12 +77,6 @@ # List of index patterns to be ignored #ip.ignore: [] # -# -------------------------------- X-Pack RBAC --------------------------------- -# -# Custom setting to enable/disable built-in X-Pack RBAC security capabilities. -# Default: enabled -#xpack.rbac.enabled: true -# # ------------------------------ wazuh-monitoring ------------------------------ # # Custom setting to enable/disable wazuh-monitoring indices. diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 784f10eb..3b5f2f5d 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -36,7 +36,6 @@ declare -A CONFIG_MAP=( [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS - [admin]=$ADMIN_PRIVILEGES ) for i in "${!CONFIG_MAP[@]}" diff --git a/build-docker-images/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml index 7d8429cb..6f893132 100644 --- a/build-docker-images/wazuh-indexer/config/roles_mapping.yml +++ b/build-docker-images/wazuh-indexer/config/roles_mapping.yml @@ -1,6 +1,6 @@ --- -# In this file users, backendroles and hosts can be mapped to Open Distro Security roles. -# Permissions for Opendistro roles are configured in roles.yml +# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles. +# Permissions for Wazuh indexer roles are configured in roles.yml _meta: type: "rolesmapping" diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.3.md index 5b884743..97d49f0e 100644 --- a/multi-node/Migration-to-Wazuh-4.3.md +++ b/multi-node/Migration-to-Wazuh-4.3.md @@ -17,7 +17,12 @@ Assuming that you have a v4.2 production deployment, perform the following steps **4. Spin down the 4.2 environment.** `docker-compose -f production-cluster.yml down` +**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.** + +Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node + **5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command. + ``` docker volume create \ --label com.docker.compose.project=multi-node \ @@ -345,10 +350,6 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` -**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.** - -Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node - **7. Start the 4.3 environment.** ``` git checkout 4.3 diff --git a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml index bbcfc80e..44067088 100644 --- a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true diff --git a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml index 4df75839..b60933ba 100644 --- a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml index 1b923fed..4f974bc0 100644 --- a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml @@ -36,6 +36,4 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -opendistro_security.audit.config.disabled_rest_categories: NONE -opendistro_security.audit.config.disabled_transport_categories: NONE compatibility.override_main_response_version: true \ No newline at end of file diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index e9c480ca..c2480ca4 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -25,3 +25,5 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.system_indices.enabled: true plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false \ No newline at end of file