From 9d38fd7d6453f36e1199c284185ff61e924d8613 Mon Sep 17 00:00:00 2001 From: manuasir Date: Tue, 6 Aug 2019 16:40:03 +0200 Subject: [PATCH] Demo certificates and open distro security plugin --- admin-key.pem | 28 +++++++++ admin.pem | 19 +++++++ custom-elasticsearch.yml | 23 ++++++++ docker-compose.yml | 72 ++++++++++++----------- elasticsearch/Dockerfile | 3 - elasticsearch/config/config_cluster.sh | 2 - elasticsearch/config/entrypoint.sh | 2 - kibana/Dockerfile | 2 - kibana/config/kibana_settings.sh | 1 - nginx/Dockerfile | 19 ------- nginx/config/entrypoint.sh | 79 -------------------------- node-key.pem | 28 +++++++++ node.pem | 19 +++++++ root-ca-key.pem | 27 +++++++++ root-ca.pem | 21 +++++++ root-ca.srl | 1 + 16 files changed, 205 insertions(+), 141 deletions(-) create mode 100644 admin-key.pem create mode 100644 admin.pem create mode 100644 custom-elasticsearch.yml delete mode 100644 nginx/Dockerfile delete mode 100644 nginx/config/entrypoint.sh create mode 100644 node-key.pem create mode 100644 node.pem create mode 100644 root-ca-key.pem create mode 100644 root-ca.pem create mode 100644 root-ca.srl diff --git a/admin-key.pem b/admin-key.pem new file mode 100644 index 00000000..12079bc9 --- /dev/null +++ b/admin-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDGREC7Nwg9esab +VrKmRL8nlVjrDL38YOfUt+G1sZ+ebmHmLynUMqQ3PHYDUqJoZQW5Jpmlh+V7GSfW +erKC1C75J1991U/3DsM6aZ+QZXoTwM4XwwRUOU3K/kaanCr8sOEY+NQILxNmeCdc +XOOCD9nsItkzgK01cTuWpObABVRSwu3hKEIwuGyCkPnfCDM3f/gDSvQtP9+Z6Kf0 +OEF3Le1vO47RrISSOKB3163j3zVFWC0XAmlpEBFfPB8UIi733hPOr+kRl4M/mE2k +CL1MkJYjj258sjZhuvkCAupImtuWGMuo5ieNkuUFHWACg4gImoaRy4JOP8ye2VDZ +KKxbTevzAgMBAAECggEBAIV0EaIyk8BWMPMEc3HJWmW5eEWWqRcE32dmcm4LZmaM +5Ca9Xklv4OsxLjpkV98vCKAs5ETwaT3nm9IZeqjnS8r3fqZDe/TPIgfiar4WIArF +v7Ns2DAc9kkJyNpu/dxi7tERRB9SGJvjipL4D0dPhh8VAeBR38TWOAbZblyX+b9O +OOdMNCoCUyBqQ3PTlmK43Np2AeegSkVIUzQmiJfqBGGlchnZbfqJ7ZgkKPtTBGbA +2RMMLON6OtNQ8pFuOn6qVROTsZgai0a4JfZrzVCFjdAO1ywPk2x4HUuRFKxFF4xv +zZ7xqLRfVCV/rgpJBPKZr86GUODnUmCjrQNAwL9sB5ECgYEA4ckbqjemdYpEss8k +3YupgXcZkwgp7WXT3BOmiDyzfhgQ0sBysQhkudHnvWTwXjcd0lDAmdeZ8k553WxJ +imTsLnTkp8MBWj9YziJQhWAVSSsiqp0DtbcxHbwhtkcfG6enoNs03dhmWkZ5GHRA +Tx/2n5ljxiiKGDeMkJWomalK1ukCgYEA4MxonRElJ8bo6KjcuTaL11gsUR/HyEh1 +eec1r18ypwfcPyxY6lzkvEonb3r4Jm2n1ZzvsGInA94+GtpNF4UoRixVGXCL6kiN +7mR3dhG13weRUBZbFV59PdfvNfuQvz5Z5U4NuX2CPeSUKSKYEhfD1dZ7/eoh1eZ3 +e4qq0G09GnsCgYEAsdQ0Xtdf2pmhS/fMQFW8loRYdy5p31lhCKfNdOXiNQD9VxBO +BNLoilYhoFC85GeirD//wetGi8p1PwkHzuF4B4r3gI4dJZhY+Fmcc7/eY/d+YUQz +ZM6494NyRd80SBK++vlLZSMIUjfJLpJ5CBjTpJYqOCs7wKEXq9TDqurkT+kCgYEA +n2u3IPSAwhXJJP5kEiGByMUqIJoGJ55jWYFDzEwZ8uSbKF397K7WNEXuc5vkkfQg +G1iBjzf8bTzWFFsOYwi2yBU2gKUVRKARr6emJKBot3N5dS91htEMxqf1Z/Yw7797 +JyhUiWBd1iDdhdKXv/UEmAjUw/yf5D7eK0nq24cs1zMCgYEA3GCRpCIyZaG1CXPn +F9hrYctTQKXm4GUVFSQuyq+cWbM1yyR3Q3dFmekT3HcSzBpLZpye7YNDCTzSLv+y +refufQFAWK0JaHVRbE8D5/ggCDlo1f4xnJf6C4dM/FZkVyAzYcBfHQe4zYSMzB9D +Mq1NaY1E8hefYIqKZnNhjI6iWDE= +-----END PRIVATE KEY----- diff --git a/admin.pem b/admin.pem new file mode 100644 index 00000000..f3165344 --- /dev/null +++ b/admin.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDETCCAfkCFA5ijfMasAZU95n3dLpkNLnqVfVMMA0GCSqGSIb3DQEBCwUAMEUx +CzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl +cm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMTkwODA2MTQxMzEzWhcNMTkwOTA1MTQx +MzEzWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE +CgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAxkRAuzcIPXrGm1aypkS/J5VY6wy9/GDn1LfhtbGfnm5h5i8p +1DKkNzx2A1KiaGUFuSaZpYflexkn1nqygtQu+SdffdVP9w7DOmmfkGV6E8DOF8ME +VDlNyv5Gmpwq/LDhGPjUCC8TZngnXFzjgg/Z7CLZM4CtNXE7lqTmwAVUUsLt4ShC +MLhsgpD53wgzN3/4A0r0LT/fmein9DhBdy3tbzuO0ayEkjigd9et4981RVgtFwJp +aRARXzwfFCIu994Tzq/pEZeDP5hNpAi9TJCWI49ufLI2Ybr5AgLqSJrblhjLqOYn +jZLlBR1gAoOICJqGkcuCTj/MntlQ2SisW03r8wIDAQABMA0GCSqGSIb3DQEBCwUA +A4IBAQCOEDExFNDWXU3uLUuAFEy1GBA93KCl4pqPg16DA7mWN6++ovpwfH0eQSRB +yQAPwjWApJc0KvvZv3m4FJlPGS7JAmL9TnTaPNRALa6i+t60mdM9myetKHrwfyj2 +HFRNoOE5xAAiBlKD4FE8Vu0WVbaThCquGIVp5ecysNhi5pbMwt7WgXDwr9hvwj9b +f0FxZVKvTsh31Vu6E/H7MTkKPFxDi2W8FXjk9XipE2FE5fhbq6hjzI501gYytTA6 +JNYbG/XwnKxNMtokJEQDCaUQ1Lsixug+iKKQLJ5w1pHXvyV8qjSG1PUMxGIX68of +bIlC8XXPq48Fp4RKHapLNoSE6gNN +-----END CERTIFICATE----- diff --git a/custom-elasticsearch.yml b/custom-elasticsearch.yml new file mode 100644 index 00000000..0098bb73 --- /dev/null +++ b/custom-elasticsearch.yml @@ -0,0 +1,23 @@ +network.host: 0.0.0.0 +opendistro_security.ssl.transport.pemcert_filepath: node.pem +opendistro_security.ssl.transport.pemkey_filepath: node-key.pem +opendistro_security.ssl.transport.pemtrustedcas_filepath: root-ca.pem +opendistro_security.ssl.transport.enforce_hostname_verification: false +opendistro_security.ssl.http.enabled: true +opendistro_security.ssl.http.pemcert_filepath: node.pem +opendistro_security.ssl.http.pemkey_filepath: node-key.pem +opendistro_security.ssl.http.pemtrustedcas_filepath: root-ca.pem +opendistro_security.allow_default_init_securityindex: true +opendistro_security.authcz.admin_dn: + - CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA +opendistro_security.nodes_dn: + - 'CN=N,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA' +opendistro_security.audit.type: internal_elasticsearch +opendistro_security.enable_snapshot_restore_privilege: true +opendistro_security.check_snapshot_restore_write_privileges: true +opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"] +cluster.routing.allocation.disk.threshold_enabled: false +node.max_local_storage_nodes: 3 +opendistro_security.audit.config.disabled_rest_categories: NONE +opendistro_security.audit.config.disabled_transport_categories: NONE +discovery.type: single-node \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 87fd66ac..917d57ec 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,7 +1,32 @@ -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -version: '2' - +version: '3' services: + + + elasticsearch: + build: elasticsearch + container_name: elasticsearch + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 # maximum number of open files for the Elasticsearch user, set to at least 65536 on modern systems + hard: 65536 + volumes: + - odfe-data1:/usr/share/elasticsearch/data + - ./root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem + - ./node.pem:/usr/share/elasticsearch/config/node.pem + - ./node-key.pem:/usr/share/elasticsearch/config/node-key.pem + - ./admin.pem:/usr/share/elasticsearch/config/admin.pem + - ./admin-key.pem:/usr/share/elasticsearch/config/admin-key.pem + - ./custom-elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml + ports: + - 9200:9200 + - 9600:9600 # required for Performance Analyzer + networks: + - odfe-net + + wazuh: image: wazuh/wazuh:3.9.3_7.1.1-opendistro hostname: wazuh-manager @@ -11,24 +36,11 @@ services: - "1515:1515" - "514:514/udp" - "55000:55000" - - elasticsearch: - image: wazuh/wazuh-elasticsearch:3.9.3_7.1.1-opendistro - hostname: elasticsearch - restart: always - ports: - - "9200:9200" - environment: - - "ES_JAVA_OPTS=-Xms1g -Xmx1g" - - ELASTIC_CLUSTER=false - ulimits: - memlock: - soft: -1 - hard: -1 - mem_limit: 2g + networks: + - odfe-net kibana: - image: wazuh/wazuh-kibana:3.9.3_7.1.1-opendistro + build: kibana hostname: kibana restart: always depends_on: @@ -36,17 +48,11 @@ services: links: - elasticsearch:elasticsearch - wazuh:wazuh - nginx: - image: wazuh/wazuh-nginx:3.9.3_7.1.1-opendistro - hostname: nginx - restart: always - environment: - - NGINX_PORT=443 - - NGINX_CREDENTIALS - ports: - - "80:80" - - "443:443" - depends_on: - - kibana - links: - - kibana:kibana + networks: + - odfe-net + +volumes: + odfe-data1: + +networks: + odfe-net: diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile index 5e6f37df..4952c3d8 100644 --- a/elasticsearch/Dockerfile +++ b/elasticsearch/Dockerfile @@ -41,8 +41,5 @@ RUN ${bin/elasticsearch-plugin install --batch S3_PLUGIN_URL} COPY config/configure_s3.sh ./config/configure_s3.sh RUN chmod 755 ./config/configure_s3.sh -COPY --chown=elasticsearch:elasticsearch ./config/config_cluster.sh ./ -RUN chmod +x ./config_cluster.sh - ENTRYPOINT ["/entrypoint.sh"] CMD ["elasticsearch"] diff --git a/elasticsearch/config/config_cluster.sh b/elasticsearch/config/config_cluster.sh index 9b9b78d5..27bbbd40 100644 --- a/elasticsearch/config/config_cluster.sh +++ b/elasticsearch/config/config_cluster.sh @@ -4,7 +4,6 @@ elastic_config_file="/usr/share/elasticsearch/config/elasticsearch.yml" # Disable the Open distro security plugin -sed -i '/opendistro_security/d' $elastic_config_file remove_single_node_conf(){ if grep -Fq "discovery.type" $1; then @@ -58,4 +57,3 @@ else remove_cluster_config $elastic_config_file echo "discovery.type: single-node" >> $elastic_config_file fi -echo "opendistro_security.disabled: true" >> $elastic_config_file \ No newline at end of file diff --git a/elasticsearch/config/entrypoint.sh b/elasticsearch/config/entrypoint.sh index bfbb9c82..bda8f5f9 100644 --- a/elasticsearch/config/entrypoint.sh +++ b/elasticsearch/config/entrypoint.sh @@ -21,8 +21,6 @@ run_as_other_user_if_needed() { # Run load settings script. -./config_cluster.sh - ./load_settings.sh & # Execute elasticsearch diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 2f94a831..e8ef6e70 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -60,6 +60,4 @@ RUN ./welcome_wazuh.sh RUN /usr/local/bin/kibana-docker --optimize -RUN /usr/share/kibana/bin/kibana-plugin remove opendistro_security - ENTRYPOINT ./entrypoint.sh diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh index d2f21060..85bc64fc 100644 --- a/kibana/config/kibana_settings.sh +++ b/kibana/config/kibana_settings.sh @@ -18,7 +18,6 @@ WAZUH_MAJOR=3 # Customize elasticsearch ip ############################################################################## sed -i 's|https://localhost:9200|http://elasticsearch:9200|g' /usr/share/kibana/config/kibana.yml -sed -i '/opendistro_security/d' /usr/share/kibana/config/kibana.yml if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then sed -i '/elasticsearch.hosts/d' /usr/share/kibana/config/kibana.yml diff --git a/nginx/Dockerfile b/nginx/Dockerfile deleted file mode 100644 index 2ca20d6f..00000000 --- a/nginx/Dockerfile +++ /dev/null @@ -1,19 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM nginx:latest - -ENV DEBIAN_FRONTEND noninteractive - -RUN apt-get update && apt-get install -y openssl apache2-utils - -COPY config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - -VOLUME ["/etc/nginx/conf.d"] - -ENV NGINX_NAME="foo" \ - NGINX_PWD="bar" - -ENTRYPOINT /entrypoint.sh diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh deleted file mode 100644 index 468c8a92..00000000 --- a/nginx/config/entrypoint.sh +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -# Generating certificates. -if [ ! -d /etc/nginx/conf.d/ssl ]; then - echo "Generating SSL certificates" - mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null -else - echo "SSL certificates already present" -fi - -# Setting users credentials. -# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b): -# -# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or -# export NGINX_CREDENTIALS="user1:pass1;user2:pass2" -# -# b) Set NGINX_CREDENTIALS in docker-compose.yml: -# NGINX_CREDENTIALS=user1:pass1;user2:pass2; or -# NGINX_CREDENTIALS=user1:pass1;user2:pass2 -# -if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then - echo "Setting users credentials" - if [ ! -z "$NGINX_CREDENTIALS" ]; then - IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS" - for index in "${!users[@]}" - do - IFS=':' read -r -a credentials <<< "${users[index]}" - if [ $index -eq 0 ]; then - echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null - else - echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null - fi - done - else - # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile - echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null - fi -else - echo "Kibana credentials already configured" -fi - -if [ "x${NGINX_PORT}" = "x" ]; then - NGINX_PORT=443 -fi - -if [ "x${KIBANA_HOST}" = "x" ]; then - KIBANA_HOST="kibana:5601" -fi - -echo "Configuring NGINX" -cat > /etc/nginx/conf.d/default.conf <