diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index 471746f0..9f45cd8f 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -3,7 +3,7 @@ FROM waystonesystems/baseimage-centos:0.2.0 # Arguments ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.1.5-1 +ARG WAZUH_VERSION=4.2.1-1 # Environment variables ENV API_USER="foo" \ @@ -17,13 +17,13 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH RUN echo $'[wazuh] \n\ gpgcheck=1\n\ gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\n\ -gpgcheck=0\n\ enabled=1\n\ name=Wazuh repository\n\ baseurl=https://packages.wazuh.com/4.x/yum/\n\ protect=1\n'\ >> /etc/yum.repos.d/wazuh.repo + # Install packages RUN set -x && \ curl -sL https://rpm.nodesource.com/setup_8.x | bash - && \ @@ -41,7 +41,7 @@ RUN set -x && \ rm -f /var/ossec/logs/firewall/*/*/* && \ rm -f /var/ossec/logs/api/*/*/* && \ rm -f /var/ossec/logs/cluster/*/*/* && \ - rm -f /var/ossec/logs/ossec/*/*/* && \ + rm -f /var/ossec/logs/wazuh/*/*/* && \ curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \ rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \ sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo diff --git a/wazuh/config/01-wazuh.sh b/wazuh/config/01-wazuh.sh index 639c7ec6..6e49940e 100644 --- a/wazuh/config/01-wazuh.sh +++ b/wazuh/config/01-wazuh.sh @@ -35,38 +35,54 @@ exec_cmd_stdout() { ############################################################################## # Check_update # This function considers the following cases: -# - If /var/ossec/etc/ossec-init.conf does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh -# - If /var/ossec/etc/VERSION does not exist -> Action: Update. The previous version was prior to 3.11.5. -# - If both files exist: different Wazuh version -> Action: Update. The previous version is older than the current one. -# - If both files exist: the same Wazuh version -> Acton: Nothing. Same Wazuh version. +# - If /var/ossec/etc/VERSION does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh +# - If different Wazuh version -> Action: Update. The previous version is older than the current one. +# - If the same Wazuh version -> Acton: Nothing. Same Wazuh version. ############################################################################## check_update() { - if [ -e /var/ossec/etc/ossec-init.conf ] + if [ -e /var/ossec/etc/VERSION ] then - if [ -e /var/ossec/etc/VERSION ] + previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2) + echo "Previous version: $previous_version" + current_version=$(/var/ossec/bin/wazuh-control -j info | jq .data[0].WAZUH_VERSION | cut -d'"' -f2) + echo "Current version: $current_version" + if [ $previous_version == $current_version ] then - previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2) - echo "Previous version: $previous_version" - current_version=$(cat ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/etc/ossec-init.conf | grep -i version | cut -d'"' -f2) - echo "Current version: $current_version" - if [ $previous_version == $current_version ] - then - echo "Same Wazuh version in the EBS and image" - return 0 - else - echo "Different Wazuh version: Update" - if [[ ${previous_version} == "v4.0.4" ]]; then - print "Installing /var/ossec/queue/tasks directory and subdirectories" - mkdir /var/ossec/queue/tasks - chown ossec:ossec /var/ossec/queue/tasks - chmod 770 /var/ossec/queue/tasks - exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/tasks/. /var/ossec/queue/tasks" - fi - return 1 - fi + echo "Same Wazuh version in the EBS and image" + return 0 else - echo "Previous version prior to 3.11.5: Update" + echo "Different Wazuh version: Update" + if [ $previous_version == "v4.1.5" ] + then + echo "Remove simbolic link from ossec-init.conf" + unlink /var/ossec/etc/ossec-init.conf + echo "Change /var/ossec/queue/ossec path to /var/ossec/queue/sockets" + mkdir /var/ossec/queue/sockets + chown ossec:ossec /var/ossec/queue/sockets + chmod 770 /var/ossec/queue/sockets + exec_cmd "cp -ra /var/ossec/queue/ossec/. /var/ossec/queue/sockets/" + rm -rf /var/ossec/queue/ossec + + echo "Change /var/ossec/logs/ossec path to /var/ossec/logs/wazuh" + mkdir /var/ossec/logs/wazuh + chown ossec:ossec /var/ossec/logs/wazuh + chmod 750 /var/ossec/logs/wazuh + exec_cmd "cp -ra /var/ossec/logs/ossec/. /var/ossec/logs/wazuh/" + rm -rf /var/ossec/logs/ossec + + echo "Restore logcollector queue dir" + mkdir /var/ossec/queue/logcollector + chown ossec:ossec /var/ossec/queue/logcollector + chmod 750 /var/ossec/queue/logcollector + exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/logcollector/. /var/ossec/queue/logcollector" + + echo "Restore syscollector queue dir" + mkdir /var/ossec/queue/syscollector + chown ossec:ossec /var/ossec/queue/syscollector + chmod 750 /var/ossec/queue/syscollector + exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/syscollector/. /var/ossec/queue/syscollector" + fi return 1 fi else @@ -146,7 +162,7 @@ remove_data_files() { ############################################################################## create_ossec_key_cert() { - print "Creating ossec-authd key and cert" + print "Creating wazuh-authd key and cert" exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096" exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/" } @@ -176,7 +192,7 @@ mount_files() { ############################################################################## function ossec_shutdown(){ - ${WAZUH_INSTALL_PATH}/bin/ossec-control stop; + ${WAZUH_INSTALL_PATH}/bin/wazuh-control stop; } ############################################################################## @@ -184,7 +200,7 @@ function ossec_shutdown(){ # paths or commands, and execute them. # # This can be useful for actions that need to be run before the services are -# started, such as "/var/ossec/bin/ossec-control enable agentless". +# started, such as "/var/ossec/bin/wazuh-control enable agentless". ############################################################################## docker_custom_args() { @@ -276,7 +292,7 @@ main() { echo "Keeping databases" fi - # Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist + # Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist if [ $AUTO_ENROLLMENT_ENABLED == true ] then if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ] diff --git a/wazuh/config/85-save_wazuh_version.sh b/wazuh/config/85-save_wazuh_version.sh index 2b996d6e..bbe78d45 100644 --- a/wazuh/config/85-save_wazuh_version.sh +++ b/wazuh/config/85-save_wazuh_version.sh @@ -3,4 +3,4 @@ # Copy /var/ossec/etc/ossec-init.conf contents in /var/ossec/etc/VERSION to be able to check the previous Wazuh version in pod. echo "Adding Wazuh version to /var/ossec/etc/VERSION" -cat /var/ossec/etc/ossec-init.conf > /var/ossec/etc/VERSION \ No newline at end of file +/var/ossec/bin/wazuh-control info > /var/ossec/etc/VERSION \ No newline at end of file diff --git a/wazuh/config/permanent_data.env b/wazuh/config/permanent_data.env index 0ef61cf1..4fb7498b 100644 --- a/wazuh/config/permanent_data.env +++ b/wazuh/config/permanent_data.env @@ -16,31 +16,27 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.crt" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.key" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" @@ -64,7 +60,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/msu.json.gz" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db" export PERMANENT_DATA_EXCP