From 9f0643f456d7fe3a4e2cae50788579a373c6f672 Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Tue, 13 Nov 2018 14:51:14 +0100 Subject: [PATCH 1/5] Added SMTP packages We have added the SMTP packages that are missing. For its installation we have to add the universe repository. --- docker-compose.yml | 2 +- wazuh/Dockerfile | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index e910c6f3..cf906072 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '2' services: wazuh: - image: wazuh/wazuh:3.7.0_6.4.3 + build: ./wazuh hostname: wazuh-manager restart: always ports: diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index 5b636813..3595e768 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -21,10 +21,13 @@ RUN useradd -u 1000 -g 1000 -d /var/ossec ossec RUN echo "postfix postfix/mailname string wazuh-manager" | debconf-set-selections RUN echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections +# Add universe repository +RUN add-apt-repository universe + # Install packages RUN apt-get update && apt-get -y install openssl postfix bsd-mailx python-boto python-pip \ apt-transport-https vim expect nodejs python-cryptography wazuh-manager=${WAZUH_VERSION} \ - wazuh-api=${WAZUH_VERSION} + wazuh-api=${WAZUH_VERSION} mailutils libsasl2-modules # Adding first run script. ADD config/data_dirs.env /data_dirs.env From 002cf2fbffd3ddb185e248a445b39d9edf37186f Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Fri, 16 Nov 2018 09:41:36 +0100 Subject: [PATCH 2/5] ossec-init.conf must not be included As soon as it is updated, this file will show the old version. --- wazuh/config/data_dirs.env | 1 - 1 file changed, 1 deletion(-) diff --git a/wazuh/config/data_dirs.env b/wazuh/config/data_dirs.env index 8459258c..2b92d352 100644 --- a/wazuh/config/data_dirs.env +++ b/wazuh/config/data_dirs.env @@ -6,7 +6,6 @@ DATA_DIRS[((i++))]="etc/lists" DATA_DIRS[((i++))]="etc/local_internal_options.conf" DATA_DIRS[((i++))]="etc/localtime" DATA_DIRS[((i++))]="etc/ossec.conf" -DATA_DIRS[((i++))]="etc/ossec-init.conf" DATA_DIRS[((i++))]="etc/rootcheck" DATA_DIRS[((i++))]="etc/rules" DATA_DIRS[((i++))]="etc/shared" From fb0409697fd3c88388ad9bf0f33c896108c7b5e4 Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Fri, 16 Nov 2018 16:03:49 +0100 Subject: [PATCH 3/5] Update docker-compose.yml When merging the code, the build section for the wazuh container will not be necessary. --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index cf906072..e910c6f3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '2' services: wazuh: - build: ./wazuh + image: wazuh/wazuh:3.7.0_6.4.3 hostname: wazuh-manager restart: always ports: From 6f355f0405dfc938cfa0ad8f51140e84d26a3376 Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Mon, 19 Nov 2018 09:34:16 +0100 Subject: [PATCH 4/5] Add compatiblity with AWS-integration (#69) --- wazuh/Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index 3595e768..81a182c9 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -76,5 +76,11 @@ RUN mkdir /etc/service/filebeat COPY config/filebeat.runit.service /etc/service/filebeat/run RUN chmod +x /etc/service/filebeat/run +# Temporary fix for AWS integration +RUN sed -i 's/.*with open*/#wiht open/' /var/ossec/wodles/aws/aws-s3 +RUN sed -i 's/.*max_queue_buffer = int(kernel_param.read().strip())*/#max_queue_buffer/' /var/ossec/wodles/aws/aws-s3 +RUN sed -i '784imax_queue_buffer = 0' /var/ossec/wodles/aws/aws-s3 +RUN sed -i '784s/^/ /' /var/ossec/wodles/aws/aws-s3 + # Run all services ENTRYPOINT ["/entrypoint.sh"] From 322c9520f9f63c021a83f7d50d6878c7ce5f8737 Mon Sep 17 00:00:00 2001 From: AlfonsoRBJ Date: Mon, 19 Nov 2018 09:34:59 +0100 Subject: [PATCH 5/5] New repository content (#70) --- CHANGELOG.md | 28 +++++++++++++ README.md | 108 +++++++++++++++++++++++---------------------------- VERSION | 2 + 3 files changed, 79 insertions(+), 59 deletions(-) create mode 100644 CHANGELOG.md create mode 100644 VERSION diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..d3f077f8 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,28 @@ +# Change Log +All notable changes to this project will be documented in this file. + +## v3.x.x_6.x.x + +## v3.7.0_6.4.3 + +### Added + +- Allow custom scripts or commands before service start ([#58](https://github.com/wazuh/wazuh-docker/pull/58)) +- Added description for wazuh-nginx ([#59](https://github.com/wazuh/wazuh-docker/pull/59)) +- Added license file to match https://github.com/wazuh/wazuh LICENSE ([#60](https://github.com/wazuh/wazuh-docker/pull/60)) +- Added SMTP packages ([#67](https://github.com/wazuh/wazuh-docker/pull/67)) + +### Changed + +- Increased proxy buffer for NGINX Kibana ([#51](https://github.com/wazuh/wazuh-docker/pull/51)) +- Updated logstash config to remove deprecation warnings ([#55](https://github.com/wazuh/wazuh-docker/pull/55)) +- Set ossec user's home path ([#61](https://github.com/wazuh/wazuh-docker/pull/61)) + +### Fixed + +- Fixed a bug that prevents the API from starting when the Wazuh manager was updated. Change in the files that are stored in the volume. ([#65](https://github.com/wazuh/wazuh-docker/pull/65)) +- Fixed script reference ([#62](https://github.com/wazuh/wazuh-docker/pull/62/files)) + +## v3.6.1_6.4.3 + +Wazuh-Docker starting point. diff --git a/README.md b/README.md index ca997d37..0004ec03 100644 --- a/README.md +++ b/README.md @@ -14,69 +14,59 @@ In this repository you will find the containers to run: In addition, a docker-compose file is provided to launch the containers mentioned above. It also launches an Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. -## Current release - -Containers are currently tested on Wazuh version 3.7.0 and Elastic Stack version 6.4.3. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack. - -## Installation notes - -To run all docker instances you can just run ``docker-compose up``, from the directory where you have docker-compose.yml file. The following is part of the expected behavior when setting up the system: - -* Both wazuh-kibana and wazuh-logstash containers will run multiple queries to Elasticsearch API using curl, to learn when Elasticsearch is up. It is expected to see several ``Failed to connect to elasticsearch port 9200`` log messages, until Elasticesearch is started. Then the set up process will continue normally. -* Kibana container can take a few minutes to install Wazuh plugin, this takes place after ``Optimizing and caching browser bundles...`` is printed out. -* It is recommended to set Docker host preferences to give at least 4GB memory per container (this doesn't necessarily mean they all will use it, but Elasticsearch requires them to work properly). - -Once installed you can browse through the interface at: https://127.0.0.1 - -## Mount custom Wazuh configuration files - -To mount custom Wazuh configuration files in the Wazuh manager container, mount them in the `/wazuh-config-mount` folder. For example, to mount a custom `ossec.conf` file, mount it in `/wazuh-config-mount/etc/ossec.conf` and the [entrypoint.sh](wazuh/config/entrypoint.sh) script will copy the file at the right place on boot while respecting the destination file permissions. - -Here is an example of a `/wazuh-config-mount` folder used to mount some common custom configuration files: -``` -root@wazuh-manager:/# tree /wazuh-config-mount/ -/wazuh-config-mount/ -└── etc - ├── ossec.conf - ├── rules - │   └── local_rules.xml - └── shared - └── default - └── agent.conf - -4 directories, 3 files -``` - -In that case, you will see this in the Wazuh manager logs on boot: -``` -Identified Wazuh configuration files to mount... -'/wazuh-config-mount/etc/ossec.conf' -> '/var/ossec/data/etc/ossec.conf' -'/wazuh-config-mount/etc/rules/local_rules.xml' -> '/var/ossec/data/etc/rules/local_rules.xml' -'/wazuh-config-mount/etc/shared/default/agent.conf' -> '/var/ossec/data/etc/shared/default/agent.conf' -``` - -## Custom commands/scripts - -To execute commands in the Wazuh manager container after configuration is placed but _before_ the -Wazuh API and manager are started, pass the commands as the docker commands/arguments: - -```sh -docker run -it --rm wazuh/wazuh:latest "echo 'hello world'" "uname -m" "ls /var/ossec" -``` - -A more real-world example: - -```sh -docker run -it --rm wazuh/wazuh:latest "/var/ossec/bin/ossec-control enable debug" -``` - -## More documentation +## Documentation * [Wazuh full documentation](http://documentation.wazuh.com) * [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html) * [Docker hub](https://hub.docker.com/u/wazuh) -## Credits +## Current release + +Containers are currently tested on Wazuh version 3.7.0 and Elastic Stack version 6.4.3. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack. + +## Directory structure + + wazuh-docker + ├── docker-compose.yml + ├── kibana + │   ├── config + │   │   ├── entrypoint.sh + │   │   └── kibana.yml + │   └── Dockerfile + ├── LICENSE + ├── logstash + │   ├── config + │   │   ├── 01-wazuh.conf + │   │   └── run.sh + │   └── Dockerfile + ├── nginx + │   ├── config + │   │   └── entrypoint.sh + │   └── Dockerfile + ├── README.md + ├── CHANGELOG.md + ├── VERSION + ├── test.txt + └── wazuh + ├── config + │   ├── data_dirs.env + │   ├── entrypoint.sh + │   ├── filebeat.runit.service + │   ├── filebeat.yml + │   ├── init.bash + │   ├── postfix.runit.service + │   ├── wazuh-api.runit.service + │   └── wazuh.runit.service + └── Dockerfile + + +## Branches + +* `stable` branch on correspond to the last Wazuh-Docker stable version. +* `master` branch contains the latest code, be aware of possible bugs on this branch. +* `Wazuh.Version_ElsaticStack.Version` (for example 3.7.0_6.4.3) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch. + +## Credits and Thank you These Docker containers are based on: @@ -89,6 +79,6 @@ We thank you them and everyone else who has contributed to this project. Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2) -## Wazuh official website +## Web references [Wazuh website](http://wazuh.com) diff --git a/VERSION b/VERSION new file mode 100644 index 00000000..7edff192 --- /dev/null +++ b/VERSION @@ -0,0 +1,2 @@ +WAZUH-DOCKER_VERSION="3.7.0_6.4.3" +REVISION="3700"