yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Adapt cloud to v4.2.1 (#488)

Browse Source 
Former-commit-id: dd797edf51
This commit is contained in:
AlfonsoRBJ
2021-09-16 20:20:22 +02:00
committed by GitHub
parent 68547952ec
commit 741b530585
4 changed files with 63 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wazuh/Dockerfile
+3 -3
View File
@@ -3,7 +3,7 @@ FROM waystonesystems/baseimage-centos:0.2.0
# Arguments
ARG FILEBEAT_VERSION=7.10.2
ARG WAZUH_VERSION=4.1.5-1
ARG WAZUH_VERSION=4.2.1-1
# Environment variables
ENV API_USER="foo" \
@@ -17,13 +17,13 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
RUN echo $'[wazuh] \n\
gpgcheck=1\n\
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\n\
gpgcheck=0\n\
enabled=1\n\
name=Wazuh repository\n\
baseurl=https://packages.wazuh.com/4.x/yum/\n\
protect=1\n'\
>> /etc/yum.repos.d/wazuh.repo
# Install packages
RUN set -x && \
curl -sL https://rpm.nodesource.com/setup_8.x | bash - && \
@@ -41,7 +41,7 @@ RUN set -x && \
rm -f /var/ossec/logs/firewall/*/*/* && \
rm -f /var/ossec/logs/api/*/*/* && \
rm -f /var/ossec/logs/cluster/*/*/* && \
rm -f /var/ossec/logs/ossec/*/*/* && \
rm -f /var/ossec/logs/wazuh/*/*/* && \
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
wazuh/config/01-wazuh.sh
+46 -30
View File
@@ -35,38 +35,54 @@ exec_cmd_stdout() {
##############################################################################
# Check_update
# This function considers the following cases:
# - If /var/ossec/etc/ossec-init.conf does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh
# - If /var/ossec/etc/VERSION does not exist -> Action: Update. The previous version was prior to 3.11.5.
# - If both files exist: different Wazuh version -> Action: Update. The previous version is older than the current one.
# - If both files exist: the same Wazuh version -> Acton: Nothing. Same Wazuh version.
# - If /var/ossec/etc/VERSION does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh
# - If different Wazuh version -> Action: Update. The previous version is older than the current one.
# - If the same Wazuh version -> Acton: Nothing. Same Wazuh version.
##############################################################################
check_update() {
if [ -e /var/ossec/etc/ossec-init.conf ]
if [ -e /var/ossec/etc/VERSION ]
then
if [ -e /var/ossec/etc/VERSION ]
previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2)
echo "Previous version: $previous_version"
current_version=$(/var/ossec/bin/wazuh-control -j info | jq .data[0].WAZUH_VERSION | cut -d'"' -f2)
echo "Current version: $current_version"
if [ $previous_version == $current_version ]
then
previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2)
echo "Previous version: $previous_version"
current_version=$(cat ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/etc/ossec-init.conf | grep -i version | cut -d'"' -f2)
echo "Current version: $current_version"
if [ $previous_version == $current_version ]
then
echo "Same Wazuh version in the EBS and image"
return 0
else
echo "Different Wazuh version: Update"
if [[ ${previous_version} == "v4.0.4" ]]; then
print "Installing /var/ossec/queue/tasks directory and subdirectories"
mkdir /var/ossec/queue/tasks
chown ossec:ossec /var/ossec/queue/tasks
chmod 770 /var/ossec/queue/tasks
exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/tasks/. /var/ossec/queue/tasks"
fi
return 1
fi
echo "Same Wazuh version in the EBS and image"
return 0
else
echo "Previous version prior to 3.11.5: Update"
echo "Different Wazuh version: Update"
if [ $previous_version == "v4.1.5" ]
then
echo "Remove simbolic link from ossec-init.conf"
unlink /var/ossec/etc/ossec-init.conf
echo "Change /var/ossec/queue/ossec path to /var/ossec/queue/sockets"
mkdir /var/ossec/queue/sockets
chown ossec:ossec /var/ossec/queue/sockets
chmod 770 /var/ossec/queue/sockets
exec_cmd "cp -ra /var/ossec/queue/ossec/. /var/ossec/queue/sockets/"
rm -rf /var/ossec/queue/ossec
echo "Change /var/ossec/logs/ossec path to /var/ossec/logs/wazuh"
mkdir /var/ossec/logs/wazuh
chown ossec:ossec /var/ossec/logs/wazuh
chmod 750 /var/ossec/logs/wazuh
exec_cmd "cp -ra /var/ossec/logs/ossec/. /var/ossec/logs/wazuh/"
rm -rf /var/ossec/logs/ossec
echo "Restore logcollector queue dir"
mkdir /var/ossec/queue/logcollector
chown ossec:ossec /var/ossec/queue/logcollector
chmod 750 /var/ossec/queue/logcollector
exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/logcollector/. /var/ossec/queue/logcollector"
echo "Restore syscollector queue dir"
mkdir /var/ossec/queue/syscollector
chown ossec:ossec /var/ossec/queue/syscollector
chmod 750 /var/ossec/queue/syscollector
exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/syscollector/. /var/ossec/queue/syscollector"
fi
return 1
fi
else
@@ -146,7 +162,7 @@ remove_data_files() {
##############################################################################
create_ossec_key_cert() {
print "Creating ossec-authd key and cert"
print "Creating wazuh-authd key and cert"
exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
}
@@ -176,7 +192,7 @@ mount_files() {
##############################################################################
function ossec_shutdown(){
${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
${WAZUH_INSTALL_PATH}/bin/wazuh-control stop;
}
##############################################################################
@@ -184,7 +200,7 @@ function ossec_shutdown(){
# paths or commands, and execute them.
#
# This can be useful for actions that need to be run before the services are
# started, such as "/var/ossec/bin/ossec-control enable agentless".
# started, such as "/var/ossec/bin/wazuh-control enable agentless".
##############################################################################
docker_custom_args() {
@@ -276,7 +292,7 @@ main() {
echo "Keeping databases"
fi
# Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
# Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
if [ $AUTO_ENROLLMENT_ENABLED == true ]
then
if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]
wazuh/config/85-save_wazuh_version.sh
+1 -1
View File
@@ -3,4 +3,4 @@
# Copy /var/ossec/etc/ossec-init.conf contents in /var/ossec/etc/VERSION to be able to check the previous Wazuh version in pod.
echo "Adding Wazuh version to /var/ossec/etc/VERSION"
cat /var/ossec/etc/ossec-init.conf > /var/ossec/etc/VERSION
/var/ossec/bin/wazuh-control info > /var/ossec/etc/VERSION
wazuh/config/permanent_data.env
+13 -18
View File
@@ -16,31 +16,27 @@ export PERMANENT_DATA
# Files mounted in a volume that should not be permanent
i=0
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.crt"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.key"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
@@ -64,7 +60,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/msu.json.gz"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db"
export PERMANENT_DATA_EXCP