diff --git a/.env b/.env new file mode 100755 index 00000000..7986c42f --- /dev/null +++ b/.env @@ -0,0 +1,2 @@ +WAZUH_VERSION=4.3.3 +WAZUH_IMAGE_VERSION=4.3.3 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 3dd8343b..8ef1b8bb 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.3.4 + - 4.3.4-1 port: tcp:1514: listening: true @@ -70,28 +70,6 @@ port: listening: true ip: - 0.0.0.0 -user: - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin - wazuh: - exists: true - groups: - - wazuh - home: /var/ossec - shell: /sbin/nologin -group: - wazuh: - exists: true process: filebeat: running: true @@ -113,3 +91,13 @@ process: running: true wazuh-modulesd: running: true +user: + wazuh: + exists: true + groups: + - wazuh + home: /var/ossec + shell: /sbin/nologin +group: + wazuh: + exists: true \ No newline at end of file diff --git a/.github/multi-node-filebeat-check.sh b/.github/multi-node-filebeat-check.sh new file mode 100755 index 00000000..39a21827 --- /dev/null +++ b/.github/multi-node-filebeat-check.sh @@ -0,0 +1,18 @@ +filebeatout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output') +filebeatstatus1=$(echo "${filebeatout1}" | grep -c OK) +if [[ filebeatstatus1 -eq 7 ]]; then + echo "No errors in master filebeat" +else + echo "Errors in master filebeat" + echo "${filebeatout1}" + exit 1 +fi +filebeatout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output') +filebeatstatus2=$(echo "${filebeatout2}" | grep -c OK) +if [[ filebeatstatus2 -eq 7 ]]; then + echo "No errors in worker filebeat" +else + echo "Errors in worker filebeat" + echo "${filebeatout2}" + exit 1 +fi \ No newline at end of file diff --git a/.github/multi-node-log-check.sh b/.github/multi-node-log-check.sh new file mode 100755 index 00000000..bfa1649a --- /dev/null +++ b/.github/multi-node-log-check.sh @@ -0,0 +1,16 @@ +log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "$log1" ]]; then + echo "No errors in master ossec.log" +else + echo "Errors in master ossec.log:" + echo "${log1}" + exit 1 +fi +log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "${log2}" ]]; then + echo "No errors in worker ossec.log" +else + echo "Errors in worker ossec.log:" + echo "${log2}" + exit 1 +fi \ No newline at end of file diff --git a/.github/single-node-filebeat-check.sh b/.github/single-node-filebeat-check.sh new file mode 100755 index 00000000..7f9ae7d3 --- /dev/null +++ b/.github/single-node-filebeat-check.sh @@ -0,0 +1,9 @@ +filebeatout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output') +filebeatstatus=$(echo "${filebeatout}" | grep -c OK) +if [[ filebeatstatus -eq 7 ]]; then + echo "No errors in filebeat" +else + echo "Errors in filebeat" + echo "${filebeatout}" + exit 1 +fi \ No newline at end of file diff --git a/.github/single-node-log-check.sh b/.github/single-node-log-check.sh new file mode 100755 index 00000000..806e9238 --- /dev/null +++ b/.github/single-node-log-check.sh @@ -0,0 +1,8 @@ +log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT") +if [[ -z "$log" ]]; then + echo "No errors in ossec.log" +else + echo "Errors in ossec.log:" + echo "${log}" + exit 1 +fi \ No newline at end of file diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0714dd98..e7a0d4aa 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,31 +1,314 @@ name: Wazuh Docker pipeline -on: [push] +on: [pull_request] jobs: - build-stack: + build-docker-images: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v2 + uses: actions/checkout@v3 - - name: Build the docker-compose stack - run: docker-compose -f build-wazuh-images.yml up -d --build + - name: Build Wazuh images + run: build-docker-images/build-images.sh - - name: Check running containers - run: docker ps -a + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV - - name: Shutdown the stack - run: docker-compose -f build-wazuh-images.yml kill + - name: Create backup Docker images + run: | + mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/ + docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar + docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar + docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar + docker rmi $(docker images -q) + docker load --input /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar + docker load --input /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar + docker load --input /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar + + - name: Temporarily save Wazuh manager Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-manager + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar + retention-days: 1 + + - name: Temporarily save Wazuh indexer Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-indexer + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar + retention-days: 1 + + - name: Temporarily save Wazuh dashboard Docker image + uses: actions/upload-artifact@v3 + with: + name: docker-artifact-dashboard + path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar + retention-days: 1 - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: version: v0.3.16 - - name: Execute Goss tests (wazuh-odfe) - run: dgoss run wazuh/wazuh-manager:4.3.4 + - name: Execute Goss tests (wazuh-manager) + run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} env: GOSS_SLEEP: 30 - GOSS_FILE: .github/.goss.yaml \ No newline at end of file + GOSS_FILE: .github/.goss.yaml + + check-single-node: + runs-on: ubuntu-latest + needs: build-docker-images + steps: + + - name: Check out code + uses: actions/checkout@v3 + + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV + + - name: Retrieve saved Wazuh indexer Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-indexer + + - name: Retrieve saved Wazuh manager Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-manager + + - name: Retrieve saved Wazuh dashboard Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-dashboard + + - name: Docker load + run: | + docker load --input ./wazuh-indexer.tar + docker load --input ./wazuh-dashboard.tar + docker load --input ./wazuh-manager.tar + + + - name: Create single node certficates + run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator + + - name: Start single node stack + run: docker-compose -f single-node/docker-compose.yml up -d + + - name: Check Wazuh indexer start + run: | + sleep 60 + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + if [[ $status_green -eq 1 ]]; then + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + exit 1 + fi + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + exit 1 + fi + + + - name: Check Wazuh indexer nodes + run: | + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + if [[ $nodes -eq 1 ]]; then + echo "Wazuh indexer nodes: ${nodes}" + else + echo "Wazuh indexer nodes: ${nodes}" + exit 1 + fi + + - name: Check documents into wazuh-alerts index + run: | + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + if [[ $docs -gt 100 ]]; then + echo "wazuh-alerts index documents: ${docs}" + else + echo "wazuh-alerts index documents: ${docs}" + exit 1 + fi + + - name: Check Wazuh templates + run: | + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + if [[ $qty_templates -eq 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi + + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh + + + - name: Check filebeat output + run: ./.github/single-node-filebeat-check.sh + + - name: Check Wazuh dashboard service URL + run: | + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') + if [[ $status -eq 200 ]]; then + echo "Wazuh dashboard status: ${status}" + else + echo "Wazuh dashboard status: ${status}" + exit 1 + fi + + - name: Stop single node stack + run: docker-compose -f single-node/docker-compose.yml down + + check-multi-node: + runs-on: ubuntu-latest + needs: build-docker-images + steps: + + - name: Check out code + uses: actions/checkout@v3 + + - name: Create enviroment variables + run: cat .env > $GITHUB_ENV + + - name: Retrieve saved Wazuh dashboard Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-dashboard + + - name: Retrieve saved Wazuh manager Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-manager + + - name: Retrieve saved Wazuh indexer Docker image + uses: actions/download-artifact@v3 + with: + name: docker-artifact-indexer + + - name: Docker load + run: | + docker load --input ./wazuh-manager.tar + docker load --input ./wazuh-indexer.tar + docker load --input ./wazuh-dashboard.tar + + - name: Create multi node certficates + run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator + + - name: Start multi node stack + run: docker-compose -f multi-node/docker-compose.yml up -d + + - name: Check Wazuh indexer start + run: | + sleep 120 + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + if [[ $status_green -eq 1 ]]; then + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + exit 1 + fi + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`" + if [[ $status_index_green -eq $status_index ]]; then + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + else + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + exit 1 + fi + + - name: Check Wazuh indexer nodes + run: | + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + if [[ $nodes -eq 3 ]]; then + echo "Wazuh indexer nodes: ${nodes}" + else + echo "Wazuh indexer nodes: ${nodes}" + exit 1 + fi + + - name: Check documents into wazuh-alerts index + run: | + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + if [[ $docs -gt 200 ]]; then + echo "wazuh-alerts index documents: ${docs}" + else + echo "wazuh-alerts index documents: ${docs}" + exit 1 + fi + + - name: Check Wazuh templates + run: | + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" + if [[ $qty_templates -eq 3 ]]; then + echo "wazuh templates:" + echo "${templates}" + else + echo "wazuh templates:" + echo "${templates}" + exit 1 + fi + + - name: Check Wazuh manager start + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 10 ]]; then + echo "Wazuh Manager Services: ${services}" + echo "OK" + else + echo "Wazuh indexer nodes: ${nodes}" + curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) + if [[ $nodes -eq 2 ]]; then + echo "Wazuh manager nodes: ${nodes}" + else + echo "Wazuh manager nodes: ${nodes}" + exit 1 + fi + env: + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log + run: ./.github/multi-node-log-check.sh + + + - name: Check filebeat output + run: ./.github/multi-node-filebeat-check.sh + + - name: Check Wazuh dashboard service URL + run: | + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') + if [[ $status -eq 200 ]]; then + echo "Wazuh dashboard status: ${status}" + else + echo "Wazuh dashboard status: ${status}" + exit 1 + fi \ No newline at end of file diff --git a/.gitignore b/.gitignore index a2abaa56..6d7fadef 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,4 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem single-node/config/wazuh_indexer_ssl_certs/*.key multi-node/config/wazuh_indexer_ssl_certs/*.pem -multi-node/config/wazuh_indexer_ssl_certs/*.key +multi-node/config/wazuh_indexer_ssl_certs/*.key \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh new file mode 100755 index 00000000..10105990 --- /dev/null +++ b/build-docker-images/build-images.sh @@ -0,0 +1,15 @@ +WAZUH_IMAGE_VERSION=4.3.4 +WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') +WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') + +## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 +if [ "$WAZUH_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then + IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +else + IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +fi + +echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env +echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env + +docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache \ No newline at end of file diff --git a/build-docker-images/docker-compose.yml b/build-docker-images/build-images.yml similarity index 80% rename from build-docker-images/docker-compose.yml rename to build-docker-images/build-images.yml index 6a07c63d..f842e7d6 100644 --- a/build-docker-images/docker-compose.yml +++ b/build-docker-images/build-images.yml @@ -3,8 +3,11 @@ version: '3.7' services: wazuh.manager: - build: wazuh-manager/ - image: wazuh/wazuh-manager:4.3.4 + build: + context: wazuh-manager/ + args: + - WAZUH_VERSION=${WAZUH_VERSION} + image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} hostname: wazuh.manager restart: always ports: @@ -31,8 +34,11 @@ services: - filebeat_var:/var/lib/filebeat wazuh.indexer: - build: wazuh-indexer/ - image: wazuh/wazuh-indexer:4.3.4 + build: + context: wazuh-indexer/ + args: + - WAZUH_VERSION=${WAZUH_VERSION} + image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} hostname: wazuh.indexer restart: always ports: @@ -48,8 +54,11 @@ services: hard: 65536 wazuh.dashboard: - build: wazuh-dashboard/ - image: wazuh/wazuh-dashboard:4.3.4 + build: + context: wazuh-dashboard/ + args: + - WAZUH_VERSION=${WAZUH_VERSION} + image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} hostname: wazuh.dashboard restart: always ports: diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 60b180c3..2b08e7fa 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,9 +1,9 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder -ARG WAZUH_VERSION=4.3.4 -ARG WAZUH_UI_REVISION=1 +ARG WAZUH_VERSION ARG INSTALL_DIR=/usr/share/wazuh-dashboard +ARG WAZUH_UI_REVISION=1 # Update and install dependencies RUN apt-get update && apt install curl libcap2-bin xz-utils -y @@ -20,8 +20,14 @@ COPY config/config.sh . COPY config/config.yml / RUN bash config.sh -# Install Wazuh App -RUN $INSTALL_DIR/bin/opensearch-dashboards-plugin install https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip --allow-root +# Create and configure Wazuh dashboard keystore +RUN $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ + echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ + echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root + +COPY config/install_wazuh_app.sh / +RUN chmod 775 /install_wazuh_app.sh +RUN bash /install_wazuh_app.sh # Copy and set permissions to config files COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/ diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 54fe0d3e..03091825 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -15,6 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o # Start Wazuh dashboard ############################################################################## -/wazuh_app_config.sh +/wazuh_app_config.sh $WAZUH_UI_REVISION /usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh new file mode 100644 index 00000000..b0698c5f --- /dev/null +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -0,0 +1,12 @@ +## Variables +WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') +WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +## If wazuh manager exists in apt dev repository, change variables, if not exit 1 +if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +else + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +fi + +# Install Wazuh App +$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 9a6c700d..216a8822 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,6 +1,8 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder +ARG WAZUH_VERSION + RUN apt-get update -y && apt-get install curl openssl xz-utils -y COPY config/opensearch.yml / diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 1d481cb3..7647936f 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=4.3.4 +export VERSION=${WAZUH_VERSION} export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index c975c883..871357ae 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,7 +1,9 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal -ARG WAZUH_VERSION=4.3.4 +RUN rm /bin/sh && ln -s /bin/bash /bin/sh + +ARG WAZUH_VERSION ARG TEMPLATE_VERSION=4.3 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 @@ -9,9 +11,12 @@ ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y -RUN apt-key adv --fetch-keys https://packages.wazuh.com/key/GPG-KEY-WAZUH && \ - echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list && \ - apt-get update && \ +COPY config/check_repository.sh / + +RUN chmod 775 /check_repository.sh +RUN source /check_repository.sh + +RUN apt-get update && \ apt-get install wazuh-manager=${WAZUH_VERSION}-1 RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\ diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh new file mode 100644 index 00000000..1a0763ce --- /dev/null +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -0,0 +1,13 @@ +## Variables +WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') +WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +## If wazuh manager exists in apt dev repository, change variables, if not exit 1 +if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" +else + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" +fi +apt-key adv --fetch-keys ${APT_KEY} +echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 8747f02e..aec223a1 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -349,24 +349,9 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/auth.log - - - - syslog - /var/log/syslog - - syslog /var/log/dpkg.log - - syslog - /var/log/kern.log - - \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index dc4475d2..46fceb1e 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -349,24 +349,9 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/auth.log - - - - syslog - /var/log/syslog - - syslog /var/log/dpkg.log - - syslog - /var/log/kern.log - - \ No newline at end of file