diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 6a6ed8eb..304bf1f6 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.0 + - 4.4.0-1 port: tcp:1514: listening: true diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 33967eef..360ef4e6 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -126,7 +126,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 100 ]]; then echo "wazuh-alerts index documents: ${docs}" else @@ -250,7 +250,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 200 ]]; then echo "wazuh-alerts index documents: ${docs}" else diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index b244673d..87e2bb4f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -3,14 +3,6 @@ WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') -MAJOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f1) -MID_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f2) -MINOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f3) - -MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) -MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) -MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) - ## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then IMAGE_VERSION=${WAZUH_IMAGE_VERSION} diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index 00ffe992..9ae9f0a8 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -1,3 +1,4 @@ +REPOSITORY="packages.wazuh.com" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -7,23 +8,18 @@ MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" - else - REPOSITORY="packages.wazuh.com" fi - else - REPOSITORY="packages.wazuh.com" fi -else - REPOSITORY="packages.wazuh.com" fi + curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index d10d97c1..a95158cb 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,4 +1,5 @@ -## Variables +## variables +WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -8,22 +9,16 @@ MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip - else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi - else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi -else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi # Install Wazuh App diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index d126d18e..696c0462 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -59,14 +59,15 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/s COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d +RUN chown -R 1000:1000 /usr/share/wazuh-indexer RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer/config && \ - chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ - chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml + chmod 700 /usr/share/wazuh-indexer && \ + chmod 600 /usr/share/wazuh-indexer/jvm.options && \ + chmod 600 /usr/share/wazuh-indexer/opensearch.yml USER wazuh-indexer diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index c3328d13..eb01f8b4 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -13,7 +13,7 @@ export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} -export CONFIG_DIR=${INSTALLATION_DIR}/config +export CONFIG_DIR=${INSTALLATION_DIR} export BASE_DIR=${NAME}-* export INDEXER_FILE=wazuh-indexer-base.tar.xz export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz @@ -21,6 +21,8 @@ export REPO_DIR=/unattended_installer rm -rf ${INSTALLATION_DIR}/ +## variables +REPOSITORY="packages.wazuh.com" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -29,25 +31,20 @@ MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) -## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +## check version to use the correct repository +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" - else - REPOSITORY="packages.wazuh.com" fi - else - REPOSITORY="packages.wazuh.com" fi -else - REPOSITORY="packages.wazuh.com" fi + curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} tar -xf ${INDEXER_FILE} @@ -96,6 +93,7 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A # copy to target mkdir -p ${TARGET_DIR}${INSTALLATION_DIR} +mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ mkdir -p ${TARGET_DIR}${CONFIG_DIR} mkdir -p ${TARGET_DIR}${LIB_DIR} mkdir -p ${TARGET_DIR}${LOG_DIR} @@ -120,9 +118,9 @@ cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR} cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ # Copy Wazuh's config files for the security plugin -cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ -cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ -cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ +cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} # Copy Wazuh indexer's certificates cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 9b8747b5..2acb4aa0 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -6,7 +6,7 @@ umask 0002 export USER=wazuh-indexer export INSTALLATION_DIR=/usr/share/wazuh-indexer -export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config +export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR} export JAVA_HOME=${INSTALLATION_DIR}/jdk export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) @@ -59,7 +59,7 @@ if [[ -f bin/opensearch-users ]]; then # enabled, but we have no way of knowing which node we are yet. We'll just # honor the variable if it's present. if [[ -n "$INDEXER_PASSWORD" ]]; then - [[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) + [[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then # keystore is unencrypted if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then @@ -84,10 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then fi -if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then +#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then # run securityadmin.sh for single node with CACERT, CERT and KEY parameter - nohup /securityadmin.sh & - touch "/var/lib/wazuh-indexer/.flag" -fi +# nohup /securityadmin.sh & +# touch "/var/lib/wazuh-indexer/.flag" +#fi run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml index 4e944c89..1f0a78b3 100644 --- a/build-docker-images/wazuh-indexer/config/opensearch.yml +++ b/build-docker-images/wazuh-indexer/config/opensearch.yml @@ -4,12 +4,12 @@ path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node compatibility.override_main_response_version: true -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem plugins.security.ssl.http.enabled: true plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.resolve_hostname: false diff --git a/build-docker-images/wazuh-indexer/config/securityadmin.sh b/build-docker-images/wazuh-indexer/config/securityadmin.sh index 1fcf6467..df576cf4 100644 --- a/build-docker-images/wazuh-indexer/config/securityadmin.sh +++ b/build-docker-images/wazuh-indexer/config/securityadmin.sh @@ -1,3 +1,3 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) sleep 30 -bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9300 -icl \ No newline at end of file +bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index 152f07e0..adc94e79 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,4 +1,6 @@ -## Variables +## variables +APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH +REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -7,29 +9,21 @@ MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) -## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +## check version to use the correct repository +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" - else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi - else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi -else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi + apt-key adv --fetch-keys ${APT_KEY} echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file diff --git a/multi-node/config/certs.yml b/multi-node/config/certs.yml index f88f5f7f..5c3f4f1d 100644 --- a/multi-node/config/certs.yml +++ b/multi-node/config/certs.yml @@ -21,4 +21,4 @@ nodes: # Wazuh dashboard node dashboard: - name: wazuh.dashboard - ip: wazuh.dashboard \ No newline at end of file + ip: wazuh.dashboard diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 0dd6a427..0f54c72d 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -84,13 +84,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: image: wazuh/wazuh-indexer:4.4.0 @@ -108,11 +108,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem - - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: image: wazuh/wazuh-indexer:4.4.0 @@ -130,11 +130,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem - - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.4.0 diff --git a/single-node/config/certs.yml b/single-node/config/certs.yml index 8cb8d3f2..c3e017be 100755 --- a/single-node/config/certs.yml +++ b/single-node/config/certs.yml @@ -13,4 +13,4 @@ nodes: # Wazuh dashboard node dashboard: - name: wazuh.dashboard - ip: wazuh.dashboard \ No newline at end of file + ip: wazuh.dashboard diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index cd432c19..9aea806a 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -331,14 +331,14 @@ wazuh node01 master - + aa093264ef885029653eea20dfcf51ae 1516 0.0.0.0 - NODE_IP + wazuh.manager no - yes + no diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index e87e35ea..84c3dbf9 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -3,13 +3,15 @@ node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node +http.port: 9200-9299 +transport.tcp.port: 9300-9399 compatibility.override_main_response_version: true -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem plugins.security.ssl.http.enabled: true plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.resolve_hostname: false diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8b4b75e1..61b71f7d 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -55,13 +55,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.4.0 diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml index a3398661..d10151fd 100644 --- a/single-node/generate-indexer-certs.yml +++ b/single-node/generate-indexer-certs.yml @@ -7,4 +7,4 @@ services: hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml \ No newline at end of file + - ./config/certs.yml:/config/certs.yml