From 5da96004dd5f58309c82bc60b1de2ccffe1c7ab8 Mon Sep 17 00:00:00 2001
From: Jose M <jm.garcia@wazuh.com>
Date: Wed, 14 Aug 2019 11:52:52 +0200
Subject: [PATCH] Add sed blocks to modify Filebeat.yml

---
 wazuh/config/01-config_filebeat.sh | 37 ++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/wazuh/config/01-config_filebeat.sh b/wazuh/config/01-config_filebeat.sh
index ad241ced..4c2d9ccc 100644
--- a/wazuh/config/01-config_filebeat.sh
+++ b/wazuh/config/01-config_filebeat.sh
@@ -4,7 +4,7 @@
 set -e
 
 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
-# Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
+
 if [ "$ELASTICSEARCH_URL" != "" ]; then
   >&2 echo "Customize Elasticsearch ouput IP."
   sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
@@ -12,7 +12,36 @@ fi
 
 # Install Wazuh Filebeat Module
 
-
-curl -s "https://packages-dev.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
+curl -s "https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
 mkdir -p /usr/share/filebeat/module/wazuh
-chmod 755 -R /usr/share/filebeat/module/wazuh
\ No newline at end of file
+chmod 755 -R /usr/share/filebeat/module/wazuh
+
+chown root: /etc/filebeat/filebeat.yml
+chmod go-w /etc/filebeat/filebeat.yml
+
+# Configure filebeat.yml security settings
+
+if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|#ssl.certificate_authorities:|'ssl.certificate_authorities:\ [\"$SSL_CERTIFICATE\"]'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_CERTIFICATE" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|#ssl.certificate:|'ssl.certificate:\ \"$SSL_CERTIFICATE\"'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$SSL_KEY" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|#ssl.key:|'ssl.key:\ \"$SSL_KEY\"'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$USERNAME" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|#username:|'username:\ \"$USERNAME\"'|g' /etc/filebeat/filebeat.yml
+fi
+
+if [ "$PASSWORD" != "" ]; then
+  >&2 echo "Customize Elasticsearch ouput IP."
+  sed -i 's|#password:|'password:\ \"$PASSWORD\"'|g' /etc/filebeat/filebeat.yml
+fi