diff --git a/.goss.yaml b/.goss.yaml
index d82e3219..292c1a66 100644
--- a/.goss.yaml
+++ b/.goss.yaml
@@ -16,22 +16,22 @@ file:
/var/ossec/etc/lists/audit-keys:
exists: true
mode: "0660"
- owner: ossec
- group: ossec
+ owner: wazuh
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/ossec.conf:
exists: true
mode: "0660"
owner: root
- group: ossec
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/rules/local_rules.xml:
exists: true
mode: "0660"
- owner: ossec
- group: ossec
+ owner: wazuh
+ group: wazuh
filetype: file
contains: []
/var/ossec/etc/sslmanager.cert:
@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- - 4.2.2
+ - 4.3.0
port:
tcp:1514:
listening: true
@@ -71,26 +71,26 @@ port:
ip:
- 0.0.0.0
user:
- ossec:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
- ossecm:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
- ossecr:
+ wazuh:
exists: true
groups:
- - ossec
+ - wazuh
home: /var/ossec
shell: /sbin/nologin
group:
- ossec:
+ wazuh:
exists: true
process:
filebeat:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 362db30f..432a6206 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,11 @@
# Change Log
All notable changes to this project will be documented in this file.
+## Wazuh Docker v4.3.0
+### Added
+
+- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430)
+
## Wazuh Docker v4.2.2
### Added
diff --git a/README.md b/README.md
index a4dd3720..0053ecfd 100644
--- a/README.md
+++ b/README.md
@@ -149,11 +149,11 @@ ADMIN_PRIVILEGES=true # App privileges
* `master` branch contains the latest code, be aware of possible bugs on this branch.
* `stable` branch on correspond to the last Wazuh stable version.
-
## Compatibility Matrix
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
+| v4.3.0 | 1.13.2 | 7.11.2 |
| v4.2.2 | 1.13.2 | 7.11.2 |
| v4.2.1 | 1.13.2 | 7.11.2 |
| v4.2.0 | 1.13.2 | 7.10.2 |
diff --git a/VERSION b/VERSION
index 2c257c43..5fedc35e 100644
--- a/VERSION
+++ b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.2.2"
-REVISION="40215"
+WAZUH-DOCKER_VERSION="4.3.0"
+REVISION="43100"
diff --git a/docker-compose.yml b/docker-compose.yml
index e283651b..2b12af30 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh-odfe:4.2.2
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-manager
restart: always
ports:
@@ -50,7 +50,7 @@ services:
hard: 65536
kibana:
- image: wazuh/wazuh-kibana-odfe:4.2.2
+ image: wazuh/wazuh-kibana-odfe:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile
index d5c462f4..1d304341 100644
--- a/kibana-odfe/Dockerfile
+++ b/kibana-odfe/Dockerfile
@@ -2,7 +2,7 @@
FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.2
+ARG WAZUH_VERSION=4.3.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/kibana/Dockerfile b/kibana/Dockerfile
index b05920ac..d98443ae 100644
--- a/kibana/Dockerfile
+++ b/kibana/Dockerfile
@@ -2,7 +2,7 @@
FROM docker.elastic.co/kibana/kibana:7.10.2
USER kibana
ARG ELASTIC_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.2
+ARG WAZUH_VERSION=4.3.0
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
WORKDIR /usr/share/kibana
diff --git a/production-cluster.yml b/production-cluster.yml
index ce32b17d..df0d2250 100644
--- a/production-cluster.yml
+++ b/production-cluster.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh-master:
- image: wazuh/wazuh-odfe:4.2.2
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-master
restart: always
ports:
@@ -38,7 +38,7 @@ services:
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh-worker:
- image: wazuh/wazuh-odfe:4.2.2
+ image: wazuh/wazuh-odfe:4.3.0
hostname: wazuh-worker
restart: always
environment:
@@ -134,7 +134,7 @@ services:
- ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
kibana:
- image: wazuh/wazuh-kibana-odfe:4.2.2
+ image: wazuh/wazuh-kibana-odfe:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/production_cluster/ssl_certs/certs.yml b/production_cluster/ssl_certs/certs.yml
index 486e4178..d9551f05 100644
--- a/production_cluster/ssl_certs/certs.yml
+++ b/production_cluster/ssl_certs/certs.yml
@@ -27,8 +27,13 @@ nodes:
- name: filebeat
dn: CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com
dns:
+<<<<<<< HEAD
- wazuh
+=======
+ - wazuh
+
+>>>>>>> f34b7d0465dbc8bf717d81e2bc4f13f44a03a55d
clients:
- name: admin
dn: CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com
diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/production_cluster/wazuh_cluster/wazuh_manager.conf
index d6e4f5ec..e877e6e5 100644
--- a/production_cluster/wazuh_cluster/wazuh_manager.conf
+++ b/production_cluster/wazuh_cluster/wazuh_manager.conf
@@ -6,7 +6,7 @@
no
no
smtp.example.wazuh.com
- ossecm@example.wazuh.com
+ wazuh@example.wazuh.com
recipient@example.wazuh.com
12
alerts.log
diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/production_cluster/wazuh_cluster/wazuh_worker.conf
index e202e849..0d66b453 100644
--- a/production_cluster/wazuh_cluster/wazuh_worker.conf
+++ b/production_cluster/wazuh_cluster/wazuh_worker.conf
@@ -6,7 +6,7 @@
no
no
smtp.example.wazuh.com
- ossecm@example.wazuh.com
+ wazuh@example.wazuh.com
recipient@example.wazuh.com
12
alerts.log
diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile
index 78707f9a..1e0756e2 100644
--- a/wazuh-odfe/Dockerfile
+++ b/wazuh-odfe/Dockerfile
@@ -3,7 +3,7 @@ FROM centos:7
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2
-ARG WAZUH_VERSION=4.2.2
+ARG WAZUH_VERSION=4.3.0-1
ARG TEMPLATE_VERSION="master"
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
@@ -39,7 +39,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e
RUN chmod go-w /etc/filebeat/wazuh-template.json
COPY config/etc/ /etc/
-COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py
+COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
# Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547
diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager
index 58807682..9e70ace9 100644
--- a/wazuh-odfe/config/etc/cont-init.d/2-manager
+++ b/wazuh-odfe/config/etc/cont-init.d/2-manager
@@ -36,11 +36,11 @@ function_wazuh_migration(){
fi
\cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf
- chown root:ossec /var/ossec/etc/ossec.conf
+ chown root:wazuh /var/ossec/etc/ossec.conf
chmod 640 /var/ossec/etc/ossec.conf
\cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys
- chown ossec:ossec /var/ossec/etc/client.keys
+ chown wazuh:wazuh /var/ossec/etc/client.keys
chmod 640 /var/ossec/etc/client.keys
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert
@@ -49,25 +49,25 @@ function_wazuh_migration(){
chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf
- chown ossec:ossec /var/ossec/etc/shared/default/agent.conf
+ chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf
chmod 660 /var/ossec/etc/shared/default/agent.conf
\cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/
- chown ossec:ossec /var/ossec/etc/decoders/*
+ chown wazuh:wazuh /var/ossec/etc/decoders/*
chmod 660 /var/ossec/etc/decoders/*
\cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/
- chown ossec:ossec /var/ossec/etc/rules/*
+ chown wazuh:wazuh /var/ossec/etc/rules/*
chmod 660 /var/ossec/etc/rules/*
if [ -e /wazuh-migration/data/agentless/.passlist ]; then
\cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
- chown root:ossec /var/ossec/agentless/.passlist
+ chown root:wazuh /var/ossec/agentless/.passlist
chmod 640 /var/ossec/agentless/.passlist
fi
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
- chown ossec:ossec /var/ossec/queue/db/global.db
+ chown wazuh:wazuh /var/ossec/queue/db/global.db
chmod 640 /var/ossec/queue/db/global.db
# mark volume as migrated
diff --git a/wazuh-odfe/config/etc/services.d/ossec-logs/run b/wazuh-odfe/config/etc/services.d/ossec-logs/run
index edb4b87c..e96cba8f 100644
--- a/wazuh-odfe/config/etc/services.d/ossec-logs/run
+++ b/wazuh-odfe/config/etc/services.d/ossec-logs/run
@@ -1,4 +1,4 @@
#!/usr/bin/with-contenv sh
# dumping ossec.log to standard output
-exec tail -f /var/ossec/logs/ossec.log
+exec tail -F /var/ossec/logs/ossec.log
diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env
index c9cbcd3e..a4eca61a 100644
--- a/wazuh-odfe/config/permanent_data.env
+++ b/wazuh-odfe/config/permanent_data.env
@@ -5,6 +5,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/etc"
PERMANENT_DATA[((i++))]="/var/ossec/logs"
PERMANENT_DATA[((i++))]="/var/ossec/queue"
PERMANENT_DATA[((i++))]="/var/ossec/queue/logcollector"
+PERMANENT_DATA[((i++))]="/var/ossec/queue/tasks"
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
PERMANENT_DATA[((i++))]="/var/ossec/integrations"
@@ -48,6 +49,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
diff --git a/xpack-compose.yml b/xpack-compose.yml
index d8a5ea82..f741a7ce 100644
--- a/xpack-compose.yml
+++ b/xpack-compose.yml
@@ -3,7 +3,7 @@ version: '3.7'
services:
wazuh:
- image: wazuh/wazuh:4.2.2
+ image: wazuh/wazuh:4.3.0
hostname: wazuh-manager
restart: always
ports:
@@ -146,7 +146,7 @@ services:
kibana:
- image: wazuh/wazuh-kibana:4.2.2
+ image: wazuh/wazuh-kibana:4.3.0
hostname: kibana
restart: always
ports:
diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml
index ee12e251..80ca6b19 100644
--- a/xpack-from-sources.yml
+++ b/xpack-from-sources.yml
@@ -152,7 +152,7 @@ services:
kibana:
build: kibana/
- image: wazuh/wazuh-kibana:4.2.2
+ image: wazuh/wazuh-kibana:4.3.0
hostname: kibana
restart: always
ports: