yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge wazuh container from 3.10-refactor

Browse Source
This commit is contained in:
Manuel Gutierrez
2020-01-09 18:07:33 +01:00
parent 370c59dbe7
commit 6038525d4b
16 changed files with 102 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wazuh/config/01-config_filebeat.sh
-19
View File
@@ -1,19 +0,0 @@
#!/bin/bash
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
set -e
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
# Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
if [ "$ELASTICSEARCH_URL" != "" ]; then
>&2 echo "Customize Elasticsearch ouput IP."
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
fi
# Install Wazuh Filebeat Module
curl -s "https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
mkdir -p /usr/share/filebeat/module/wazuh
chmod 755 -R /usr/share/filebeat/module/wazuh
wazuh/config/entrypoint.sh
-14
View File
@@ -1,14 +0,0 @@
#!/bin/bash
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
bash "$script"
done
##############################################################################
# Start Wazuh Server.
##############################################################################
/sbin/my_init
wazuh/config/00-wazuh.sh → wazuh/config/etc/cont-init.d/0-wazuh-init
+5 -38
View File
@@ -1,4 +1,4 @@
#!/bin/bash
#!/usr/bin/with-contenv bash
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
# Wazuh container bootstrap. See the README for information of the environment
@@ -7,7 +7,7 @@
# Startup the services
source /data_dirs.env
FIRST_TIME_INSTALLATION=false
FIRST_TIME_INSTALLATION=true
WAZUH_INSTALL_PATH=/var/ossec
DATA_PATH=${WAZUH_INSTALL_PATH}/data
@@ -59,30 +59,6 @@ chmod g+rw ${DATA_PATH}/process_list
AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
if [ $FIRST_TIME_INSTALLATION == true ]
then
if [ $AUTO_ENROLLMENT_ENABLED == true ]
then
if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
then
print "Creating ossec-authd key and cert"
exec_cmd "openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096"
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key -out ${DATA_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
fi
fi
if [ $API_GENERATE_CERTS == true ]
then
if [ ! -e ${DATA_PATH}/api/configuration/ssl/server.crt ]
then
print "Enabling Wazuh API HTTPS"
edit_configuration "https" "yes"
print "Create Wazuh API key and cert"
exec_cmd "openssl genrsa -out ${DATA_PATH}/api/configuration/ssl/server.key 4096"
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/api/configuration/ssl/server.key -out ${DATA_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
fi
fi
fi
##############################################################################
# Copy all files from $WAZUH_CONFIG_MOUNT to $DATA_PATH and respect
# destination files permissions
@@ -104,17 +80,6 @@ function ossec_shutdown(){
${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
}
##############################################################################
# Allow users to set the container hostname as <node_name> dynamically on
# container start.
#
# To use this:
# 1. Create your own ossec.conf file
# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name
# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
##############################################################################
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
# Trap exit signals and do a proper shutdown
trap "ossec_shutdown; exit" SIGINT SIGTERM
@@ -139,8 +104,10 @@ done
pushd /var/ossec/api/configuration/auth/
env
echo "Change Wazuh API user credentials"
change_user="node htpasswd -b -c user $API_USER $API_PASS"
eval $change_user
popd
popd
wazuh/config/etc/cont-init.d/1-config-filebeat
+31
View File
@@ -0,0 +1,31 @@
#!/usr/bin/with-contenv bash
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
set -e
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
if [ "$ELASTICSEARCH_URL" != "" ]; then
>&2 echo "Customize Elasticsearch ouput IP"
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
fi
# Configure filebeat.yml security settings
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
>&2 echo "Configuring Certificate Authorities."
sed -i 's|#ssl.certificate_authorities:|'ssl.certificate_authorities:\ [\"$SSL_CERTIFICATE_AUTHORITIES\"]'|g' /etc/filebeat/filebeat.yml
fi
if [ "$USERNAME" != "" ]; then
>&2 echo "Configuring username."
sed -i 's|#username:|'username:\ \"$USERNAME\"'|g' /etc/filebeat/filebeat.yml
fi
if [ "$PASSWORD" != "" ]; then
>&2 echo "Configuring password."
sed -i 's|#password:|'password:\ \"$PASSWORD\"'|g' /etc/filebeat/filebeat.yml
fi
chmod go-w /etc/filebeat/filebeat.yml || true
chown root: /etc/filebeat/filebeat.yml || true
wazuh/config/etc/cont-init.d/2-manager
+3
View File
@@ -0,0 +1,3 @@
#!/usr/bin/with-contenv bash
/var/ossec/bin/ossec-control start
wazuh/config/etc/services.d/api/finish
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env sh
echo >&2 "API exited. code=${1}"
# terminate other services to exit from the container
exec s6-svscanctl -t /var/run/s6/services
wazuh/config/etc/services.d/api/run
+4
View File
@@ -0,0 +1,4 @@
#!/usr/bin/with-contenv sh
echo >&2 "starting API"
exec /bin/node /var/ossec/api/app.js
wazuh/config/etc/services.d/filebeat/finish
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env sh
echo >&2 "Filebeat exited. code=${1}"
# terminate other services to exit from the container
exec s6-svscanctl -t /var/run/s6/services
wazuh/config/etc/services.d/filebeat/run
+4
View File
@@ -0,0 +1,4 @@
#!/usr/bin/with-contenv sh
echo >&2 "starting Filebeat"
exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
wazuh/config/filebeat.runit.service
-4
View File
@@ -1,4 +0,0 @@
#!/bin/sh
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
service filebeat start
tail -f /var/log/filebeat/filebeat
wazuh/config/filebeat.yml
-15
View File
@@ -1,15 +0,0 @@
# Wazuh - Filebeat configuration file
filebeat.modules:
- module: wazuh
alerts:
enabled: true
archives:
enabled: false
setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false
output.elasticsearch.hosts: ['http://elasticsearch:9200']
wazuh/config/postfix.runit.service
-4
View File
@@ -1,4 +0,0 @@
#!/bin/sh
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
service postfix start
tail -f /var/log/mail.log
wazuh/config/wazuh-api.runit.service
-5
View File
@@ -1,5 +0,0 @@
#!/bin/sh
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
service wazuh-api start
tail -f /var/ossec/data/logs/api.log
wazuh/config/wazuh.repo
+7
View File
@@ -0,0 +1,7 @@
[wazuh_repo]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/3.x/yum/
protect=1
wazuh/config/wazuh.runit.service
-5
View File
@@ -1,5 +0,0 @@
#!/bin/sh
# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
service wazuh-manager start
tail -f /var/ossec/data/logs/ossec.log