diff --git a/CHANGELOG.md b/CHANGELOG.md index fca8573a..19b71325 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,20 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v3.11.0_7.5.1 + +### Added + +- Update to Wazuh version 3.11.0_7.5.1 +- Filebeat configuration file updated to latest version ([@manuasir](https://github.com/manuasir)) [#271](https://github.com/wazuh/wazuh-docker/pull/271) +- Allow using the hostname as node_name for managers ([@JPLachance](https://github.com/JPLachance)) [#261](https://github.com/wazuh/wazuh-docker/pull/261) + +## Wazuh Docker v3.10.2_7.5.0 + +### Added + +- Update to Wazuh version 3.10.2_7.5.0 + ## Wazuh Docker v3.10.2_7.3.2 ### Added diff --git a/README.md b/README.md index 4635ac1b..0dffdeeb 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ In addition, a docker-compose file is provided to launch the containers mentione * `stable` branch on correspond to the latest Wazuh-Docker stable version. * `master` branch contains the latest code, be aware of possible bugs on this branch. -* `Wazuh.Version_ElasticStack.Version` (for example 3.10.2_7.3.2) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch. +* `Wazuh.Version_ElasticStack.Version` (for example 3.10.2_7.5.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch. ## Credits and Thank you diff --git a/VERSION b/VERSION index 443c76ac..407ab706 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="3.10.2_7.3.2" -REVISION="31020" \ No newline at end of file +WAZUH-DOCKER_VERSION="3.11.0_7.5.1" +REVISION="31100" diff --git a/docker-compose.yml b/docker-compose.yml index 327ab969..5f6b23c8 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '2' services: wazuh: - image: wazuh/wazuh:3.10.2_7.3.2 + image: wazuh/wazuh:3.11.0_7.5.1 hostname: wazuh-manager restart: always ports: @@ -13,7 +13,7 @@ services: - "55000:55000" elasticsearch: - image: wazuh/wazuh-elasticsearch:3.10.2_7.3.2 + image: wazuh/wazuh-elasticsearch:3.11.0_7.5.1 hostname: elasticsearch restart: always ports: @@ -30,7 +30,7 @@ services: mem_limit: 2g kibana: - image: wazuh/wazuh-kibana:3.10.2_7.3.2 + image: wazuh/wazuh-kibana:3.11.0_7.5.1 hostname: kibana restart: always depends_on: @@ -39,7 +39,7 @@ services: - elasticsearch:elasticsearch - wazuh:wazuh nginx: - image: wazuh/wazuh-nginx:3.10.2_7.3.2 + image: wazuh/wazuh-nginx:3.11.0_7.5.1 hostname: nginx restart: always environment: diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile index 83d6d89f..ede61fbc 100644 --- a/elasticsearch/Dockerfile +++ b/elasticsearch/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -ARG ELASTIC_VERSION=7.3.2 +ARG ELASTIC_VERSION=7.5.1 FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION} ARG S3_PLUGIN_URL="https://artifacts.elastic.co/downloads/elasticsearch-plugins/repository-s3/repository-s3-${ELASTIC_VERSION}.zip" @@ -15,7 +15,7 @@ ENV XPACK_ML="true" ENV ENABLE_CONFIGURE_S3="false" -ARG TEMPLATE_VERSION=v3.10.2 +ARG TEMPLATE_VERSION=v3.11.0 # Elasticearch cluster configuration environment variables # If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration diff --git a/elasticsearch/config/load_settings.sh b/elasticsearch/config/load_settings.sh index 65f90a76..140c19c0 100644 --- a/elasticsearch/config/load_settings.sh +++ b/elasticsearch/config/load_settings.sh @@ -5,11 +5,6 @@ set -e el_url=${ELASTICSEARCH_URL} -if [ "x${WAZUH_API_URL}" = "x" ]; then - wazuh_url="https://wazuh" -else - wazuh_url="${WAZUH_API_URL}" -fi if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then auth="" @@ -43,44 +38,6 @@ if [ $ENABLE_CONFIGURE_S3 ]; then fi -#Insert default templates - -API_PASS_Q=`echo "$API_PASS" | tr -d '"'` -API_USER_Q=`echo "$API_USER" | tr -d '"'` -API_PASSWORD=`echo -n $API_PASS_Q | base64` - -echo "Setting API credentials into Wazuh APP" -CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) - -if [ "x$CONFIG_CODE" != "x200" ]; then - curl -s -XPOST $el_url/.wazuh/_doc/1513629884013 ${auth} -H 'Content-Type: application/json' -d' - { - "api_user": "'"$API_USER_Q"'", - "api_password": "'"$API_PASSWORD"'", - "url": "'"$wazuh_url"'", - "api_port": "55000", - "insecure": "true", - "component": "API", - "cluster_info": { - "manager": "wazuh-manager", - "cluster": "Disabled", - "status": "disabled" - }, - "extensions": { - "oscap": true, - "audit": true, - "pci": true, - "aws": true, - "virustotal": true, - "gdpr": true, - "ciscat": true - } - } - ' > /dev/null -else - echo "Wazuh APP already configured" -fi -sleep 5 curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d' { diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 12fb2c38..3bfad3de 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -1,21 +1,19 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM docker.elastic.co/kibana/kibana:7.3.2 -ARG ELASTIC_VERSION=7.3.2 -ARG WAZUH_VERSION=3.10.2 +FROM docker.elastic.co/kibana/kibana:7.5.1 +USER kibana +ARG ELASTIC_VERSION=7.5.1 +ARG WAZUH_VERSION=3.11.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" +#ADD https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /usr/share/kibana/ + +RUN /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip +# RUN rm -rf /tmp/wazuhapp-${WAZUH_APP_VERSION}.zip + USER root - -ADD https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /tmp - -RUN /usr/share/kibana/bin/kibana-plugin install --allow-root file:///tmp/wazuhapp-${WAZUH_APP_VERSION}.zip -RUN rm -rf /tmp/wazuhapp-${WAZUH_APP_VERSION}.zip - COPY config/entrypoint.sh ./entrypoint.sh RUN chmod 755 ./entrypoint.sh -USER kibana - ENV PATTERN="" \ CHECKS_PATTERN="" \ CHECKS_TEMPLATE="" \ @@ -72,7 +70,7 @@ COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ RUN chmod +x ./welcome_wazuh.sh RUN ./welcome_wazuh.sh - +USER kibana RUN /usr/local/bin/kibana-docker --optimize ENTRYPOINT ./entrypoint.sh diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh index 5f238325..f0fbd720 100644 --- a/kibana/config/wazuh_app_config.sh +++ b/kibana/config/wazuh_app_config.sh @@ -1,7 +1,12 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -kibana_config_file="/usr/share/kibana/plugins/wazuh/config.yml" +wazuh_url="${WAZUH_API_URL:-https://wazuh}" +wazuh_port="${API_PORT:-55000}" +api_user="${API_USER:-foo}" +api_password="${API_PASS:-bar}" + +kibana_config_file="/usr/share/kibana/plugins/wazuh/wazuh.yml" declare -A CONFIG_MAP=( [pattern]=$PATTERN @@ -38,3 +43,23 @@ do sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file fi done + +# remove default API entry (new in 3.11.0_7.5.1) +sed -ie '/- default:/,+4d' $kibana_config_file + +CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) + +grep -q 1513629884013 $kibana_config_file +_config_exists=$? + +if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then +cat << EOF >> $kibana_config_file + - 1513629884013: + url: $wazuh_url + port: $wazuh_port + user: $api_user + password: $api_password +EOF +else + echo "Wazuh APP already configured" +fi diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index a1fb62c6..4dc7b238 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -1,14 +1,14 @@ # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) FROM phusion/baseimage:latest -ARG FILEBEAT_VERSION=7.3.2 +ARG FILEBEAT_VERSION=7.5.1 -ARG WAZUH_VERSION=3.10.2-1 +ARG WAZUH_VERSION=3.11.0-1 ENV API_USER="foo" \ API_PASS="bar" -ARG TEMPLATE_VERSION="v3.10.2" +ARG TEMPLATE_VERSION="v3.11.0" # Set repositories. RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \ @@ -77,4 +77,4 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e RUN chmod go-w /etc/filebeat/wazuh-template.json # Run all services -ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file +ENTRYPOINT ["/entrypoint.sh"]