diff --git a/CHANGELOG.md b/CHANGELOG.md index fabec1b3..f64412d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. ### Added -- Add Wazuh agent image build and deploy ([#1801](https://github.com/wazuh/wazuh-docker/pull/1801)) +- None ### Changed diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index afa31d98..90fbb897 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -36,16 +36,6 @@ services: - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - wazuh.agent: - build: - context: wazuh-agent/ - args: - WAZUH_VERSION: ${WAZUH_VERSION} - WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION} - hostname: wazuh.agent - restart: always - wazuh.indexer: build: context: wazuh-indexer/ diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile deleted file mode 100644 index 8a237787..00000000 --- a/build-docker-images/wazuh-agent/Dockerfile +++ /dev/null @@ -1,36 +0,0 @@ -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023 - -RUN rm /bin/sh && ln -s /bin/bash /bin/sh - -ARG WAZUH_VERSION -ARG WAZUH_TAG_REVISION -ARG S6_VERSION="v2.2.0.3" -ARG WAZUH_MANAGER='CHANGE_MANAGER_IP' -ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT' -ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP' -ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT' -ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME' - -COPY config/check_repository.sh / - -RUN yum install curl-minimal tar gzip procps -y &&\ - yum clean all - -RUN chmod 775 /check_repository.sh -RUN source /check_repository.sh - -RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all && \ - sed -i '//d' /var/ossec/etc/ossec.conf && \ - curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz - -COPY config/etc/ /etc/ - -RUN rm /etc/yum.repos.d/wazuh.repo - -ENTRYPOINT [ "/init" ] diff --git a/build-docker-images/wazuh-agent/config/check_repository.sh b/build-docker-images/wazuh-agent/config/check_repository.sh deleted file mode 100644 index e49e69c2..00000000 --- a/build-docker-images/wazuh-agent/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init deleted file mode 100644 index 2fcf4a88..00000000 --- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init +++ /dev/null @@ -1,90 +0,0 @@ -#!/usr/bin/with-contenv bash -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) - -WAZUH_INSTALL_PATH=/var/ossec -WAZUH_CONFIG_MOUNT=/wazuh-config-mount -WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER -WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"} -WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER} -WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"} -WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD -WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"} - -############################################################################## -# Aux functions -############################################################################## -print() { - echo -e $1 -} - -error_and_exit() { - echo "Error executing command: '$1'." - echo 'Exiting.' - exit 1 -} - -exec_cmd() { - eval $1 > /dev/null 2>&1 || error_and_exit "$1" -} - -exec_cmd_stdout() { - eval $1 2>&1 || error_and_exit "$1" -} - -############################################################################## -# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect -# destination files permissions -# -# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at -# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will -# replace the ossec.conf file in /var/ossec/data/etc with yours. -############################################################################## - -mount_files() { - if [ -e "$WAZUH_CONFIG_MOUNT" ] - then - print "Identified Wazuh configuration files to mount..." - exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $WAZUH_INSTALL_PATH" - else - print "No Wazuh configuration files to mount..." - fi -} - -############################################################################## -# Allow users to set the manager ip and port, enrollment ip and port and -# enroll dynamically on container start. -# -# To use this: -# 1. Create your own ossec.conf file -# 2. In your ossec.conf file, use the configuration -# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf -############################################################################## - -set_manager_conn() { - echo "ossec.conf configuration" - sed -i "s#
CHANGE_MANAGER_IP
#
$WAZUH_MANAGER_SERVER
#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_MANAGER_PORT#$WAZUH_MANAGER_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_ENROLL_IP#$WAZUH_REGISTRATION_SERVER#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_ENROLL_PORT#$WAZUH_REGISTRATION_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGEE_AGENT_NAME#$WAZUH_AGENT_NAME#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \ - echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass -} - -############################################################################## -# Main function -############################################################################## - -main() { - - # Mount selected files (WAZUH_CONFIG_MOUNT) to container - mount_files - - # Configure agent variables - set_manager_conn - -} - -main diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent b/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent deleted file mode 100644 index 076ac6ce..00000000 --- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/1-agent +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/with-contenv bash - -############################################################################## -# Migration sequence -# Detect if there is a mounted volume on /wazuh-migration and copy the data -# to /var/ossec, finally it will create a flag ".migration-completed" inside -# the mounted volume -############################################################################## - -function __colortext() -{ - echo -e " \e[1;$2m$1\e[0m" -} - -function echogreen() -{ - echo $(__colortext "$1" "32") -} - -function echoyellow() -{ - echo $(__colortext "$1" "33") -} - -function echored() -{ - echo $(__colortext "$1" "31") -} - -function_entrypoint_scripts() { - # It will run every .sh script located in entrypoint-scripts folder in lexicographical order - if [ -d "/entrypoint-scripts/" ] - then - for script in `ls /entrypoint-scripts/*.sh | sort -n`; do - bash "$script" - done - fi -} - -# run entrypoint scripts -function_entrypoint_scripts - -# Start Wazuh -/var/ossec/bin/wazuh-control start diff --git a/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run deleted file mode 100644 index e96cba8f..00000000 --- a/build-docker-images/wazuh-agent/config/etc/services.d/ossec-logs/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh - -# dumping ossec.log to standard output -exec tail -F /var/ossec/logs/ossec.log diff --git a/wazuh-agent/config/wazuh-agent-conf b/wazuh-agent/config/wazuh-agent-conf deleted file mode 100644 index 73a355f1..00000000 --- a/wazuh-agent/config/wazuh-agent-conf +++ /dev/null @@ -1,194 +0,0 @@ - - - - - -
CHANGE_MANAGER_IP
- CHANGE_MANAGER_PORT - tcp -
- amzn, amzn2023 - 10 - 60 - yes - aes - - yes - CHANGE_ENROLL_IP - CHANGE_ENROLL_PORT - CHANGEE_AGENT_NAME - etc/authd.pass - -
- - - - no - 5000 - 500 - - - - - no - yes - yes - yes - yes - yes - yes - yes - - - 43200 - - etc/shared/rootkit_files.txt - etc/shared/rootkit_trojans.txt - - yes - - /var/lib/containerd - /var/lib/docker/overlay2 - - - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - - - - 10 - - - - - yes - yes - 12h - yes - - - - - no - - - 43200 - - yes - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - - - .log$|.swp$ - - - /etc/ssl/private.key - - yes - yes - yes - yes - - - 10 - - - 50 - - - - yes - 5m - 10 - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - no - etc/wpk_root.pem - yes - - - - - plain - - -
- - - - syslog - /var/ossec/logs/active-responses.log - - - diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml deleted file mode 100644 index 3912908f..00000000 --- a/wazuh-agent/docker-compose.yml +++ /dev/null @@ -1,11 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.agent: - image: wazuh/wazuh-agent:4.12.1 - restart: always - environment: - - WAZUH_MANAGER_SERVER= - volumes: - - ./config/wazuh-agent-conf:/wazuh-config-mount/etc/ossec.conf \ No newline at end of file