From 6ddaecd7b5c6e2654bb931ad66e275fa4cd879c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Mon, 19 Dec 2022 14:59:35 -0300 Subject: [PATCH 01/42] Indexer password updated in README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 0e3c6e0d..a43a4766 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL INDEXER_USERNAME=admin # Wazuh indexer Username -INDEXER_PASSWORD=admin # Wazuh indexer Password +INDEXER_PASSWORD=SecretPassword # Wazuh indexer Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate From 63ceab20b04cd4c1b27c9568fd6ae7843a8990d9 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 19 Apr 2023 16:59:53 -0300 Subject: [PATCH 02/42] bump 4.3.11 version --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 2 +- build-docker-images/build-images.sh | 2 +- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 8 files changed, 20 insertions(+), 14 deletions(-) diff --git a/.env b/.env index 19a4ad90..d70f87f2 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.3.10 -WAZUH_IMAGE_VERSION=4.3.10 +WAZUH_VERSION=4.3.11 +WAZUH_IMAGE_VERSION=4.3.11 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index ed8dce51..5055f226 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.3.10-1 + - 4.3.11-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 2005e22d..fda50ea0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.3.11 +### Added + +- Update Wazuh to version [4.3.11](https://github.com/wazuh/wazuh/blob/v4.3.11/CHANGELOG.md#v4310) + ## Wazuh Docker v4.3.10 ### Added diff --git a/README.md b/README.md index 0e3c6e0d..ebf5bfc6 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.3.11 | | | | v4.3.10 | | | | v4.3.9 | | | | v4.3.8 | | | diff --git a/VERSION b/VERSION index c502bba0..16e452b0 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.3.10" +WAZUH-DOCKER_VERSION="4.3.11" REVISION="40323" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 7f2b7b5f..57bd8497 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.3.10 +WAZUH_IMAGE_VERSION=4.3.11 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 67f8810f..a6f50603 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.3.10 + image: wazuh/wazuh-manager:4.3.11 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.3.10 + image: wazuh/wazuh-manager:4.3.11 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.10 + image: wazuh/wazuh-indexer:4.3.11 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.3.10 + image: wazuh/wazuh-indexer:4.3.11 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.3.10 + image: wazuh/wazuh-indexer:4.3.11 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.10 + image: wazuh/wazuh-dashboard:4.3.11 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index a58ae704..7c4a5eff 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.3.10 + image: wazuh/wazuh-manager:4.3.11 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.3.10 + image: wazuh/wazuh-indexer:4.3.11 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.10 + image: wazuh/wazuh-dashboard:4.3.11 hostname: wazuh.dashboard restart: always ports: From 53903126cf4febf2f1e7998bda6ab37d33c7d21f Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 24 Apr 2023 09:17:02 -0300 Subject: [PATCH 03/42] change revision number --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 16e452b0..90a8562e 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.3.11" -REVISION="40323" +REVISION="40324" From 00a94ce5b0ffdf9c899ef3aa468c9ade106876a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Fri, 25 Mar 2022 10:28:14 -0300 Subject: [PATCH 04/42] Bump to 4.2.6 --- .github/.goss.yaml | 2 +- CHANGELOG.md | 67 ------ README.md | 13 -- VERSION | 4 +- build-docker-images/wazuh-manager/Dockerfile | 4 +- docker-compose.yml | 82 +++++++ kibana-odfe/Dockerfile | 59 +++++ kibana/Dockerfile | 64 ++++++ .../config/wazuh_cluster/wazuh_worker.conf | 3 + production-cluster.yml | 206 ++++++++++++++++++ .../config/wazuh_cluster/wazuh_manager.conf | 3 + xpack-compose.yml | 186 ++++++++++++++++ xpack-from-sources.yml | 192 ++++++++++++++++ 13 files changed, 801 insertions(+), 84 deletions(-) create mode 100644 docker-compose.yml create mode 100644 kibana-odfe/Dockerfile create mode 100644 kibana/Dockerfile create mode 100644 production-cluster.yml create mode 100644 xpack-compose.yml create mode 100644 xpack-from-sources.yml diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 5055f226..c0b59bda 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.3.11-1 + - 4.2.6 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index fda50ea0..60295204 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,73 +1,6 @@ # Change Log All notable changes to this project will be documented in this file. -## Wazuh Docker v4.3.11 -### Added - -- Update Wazuh to version [4.3.11](https://github.com/wazuh/wazuh/blob/v4.3.11/CHANGELOG.md#v4310) - -## Wazuh Docker v4.3.10 -### Added - -- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310) - - -## Wazuh Docker v4.3.9 -### Added - -- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439) - - -## Wazuh Docker v4.3.8 -### Added - -- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438) - -## Wazuh Docker v4.3.7 -### Added - -- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437) - -## Wazuh Docker v4.3.6 -### Added - -- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436) - -## Wazuh Docker v4.3.5 -### Added - -- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435) - -## Wazuh Docker v4.3.4 -### Added - -- Update Wazuh to version [4.3.4](https://github.com/wazuh/wazuh/blob/v4.3.4/CHANGELOG.md#v434) - -## Wazuh Docker v4.3.3 -### Added - -- Update Wazuh to version [4.3.3](https://github.com/wazuh/wazuh/blob/v4.3.3/CHANGELOG.md#v433) - -## Wazuh Docker v4.3.2 -### Added - -- Update Wazuh to version [4.3.2](https://github.com/wazuh/wazuh/blob/v4.3.2/CHANGELOG.md#v432) - -## Wazuh Docker v4.3.1 -### Added - -- Update Wazuh to version [4.3.1](https://github.com/wazuh/wazuh/blob/v4.3.1/CHANGELOG.md#v431) - -## Wazuh Docker v4.3.0 -### Added - -- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430) - -## Wazuh Docker v4.2.7 -### Added - -- Update Wazuh to version [4.2.7](https://github.com/wazuh/wazuh/blob/v4.2.7/CHANGELOG.md#v427) - ## Wazuh Docker v4.2.6 ### Added diff --git a/README.md b/README.md index 995a5575..8a4a9a80 100644 --- a/README.md +++ b/README.md @@ -195,19 +195,6 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.3.11 | | | -| v4.3.10 | | | -| v4.3.9 | | | -| v4.3.8 | | | -| v4.3.7 | | | -| v4.3.6 | | | -| v4.3.5 | | | -| v4.3.4 | | | -| v4.3.3 | | | -| v4.3.2 | | | -| v4.3.1 | | | -| v4.3.0 | | | -| v4.2.7 | 1.13.2 | 7.11.2 | | v4.2.6 | 1.13.2 | 7.11.2 | | v4.2.5 | 1.13.2 | 7.11.2 | | v4.2.4 | 1.13.2 | 7.11.2 | diff --git a/VERSION b/VERSION index 90a8562e..b7c09d4c 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.3.11" -REVISION="40324" +WAZUH-DOCKER_VERSION="4.2.6" +REVISION="40221" diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index e684f58a..d65ec583 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -8,7 +8,9 @@ ARG WAZUH_TAG_REVISION ARG TEMPLATE_VERSION=4.3 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" +ARG WAZUH_VERSION=4.2.6 +ARG TEMPLATE_VERSION="master" +ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 00000000..561d8352 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,82 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh: + image: wazuh/wazuh-odfe:4.2.6 + hostname: wazuh-manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTIC_USERNAME=admin + - ELASTIC_PASSWORD=admin + - FILEBEAT_SSL_VERIFICATION_MODE=none + volumes: + - ossec_api_configuration:/var/ossec/api/configuration + - ossec_etc:/var/ossec/etc + - ossec_logs:/var/ossec/logs + - ossec_queue:/var/ossec/queue + - ossec_var_multigroups:/var/ossec/var/multigroups + - ossec_integrations:/var/ossec/integrations + - ossec_active_response:/var/ossec/active-response/bin + - ossec_agentless:/var/ossec/agentless + - ossec_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + + elasticsearch: + image: amazon/opendistro-for-elasticsearch:1.13.2 + hostname: elasticsearch + restart: always + ports: + - "9200:9200" + environment: + - discovery.type=single-node + - cluster.name=wazuh-cluster + - network.host=0.0.0.0 + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + + kibana: + image: wazuh/wazuh-kibana-odfe:4.2.6 + hostname: kibana + restart: always + ports: + - 443:5601 + environment: + - ELASTICSEARCH_USERNAME=admin + - ELASTICSEARCH_PASSWORD=admin + - SERVER_SSL_ENABLED=true + - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert + - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key + + depends_on: + - elasticsearch + links: + - elasticsearch:elasticsearch + - wazuh:wazuh + +volumes: + ossec_api_configuration: + ossec_etc: + ossec_logs: + ossec_queue: + ossec_var_multigroups: + ossec_integrations: + ossec_active_response: + ossec_agentless: + ossec_wodles: + filebeat_etc: + filebeat_var: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile new file mode 100644 index 00000000..2071005f --- /dev/null +++ b/kibana-odfe/Dockerfile @@ -0,0 +1,59 @@ +# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) +FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 +USER kibana +ARG ELASTIC_VERSION=7.10.2 +ARG WAZUH_VERSION=4.2.6 +ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" + +WORKDIR /usr/share/kibana +RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip + +WORKDIR / +USER root +COPY config/entrypoint.sh ./entrypoint.sh +RUN chmod 755 ./entrypoint.sh + +ENV PATTERN="" \ + CHECKS_PATTERN="" \ + CHECKS_TEMPLATE="" \ + CHECKS_API="" \ + CHECKS_SETUP="" \ + EXTENSIONS_PCI="" \ + EXTENSIONS_GDPR="" \ + EXTENSIONS_HIPAA="" \ + EXTENSIONS_NIST="" \ + EXTENSIONS_TSC="" \ + EXTENSIONS_AUDIT="" \ + EXTENSIONS_OSCAP="" \ + EXTENSIONS_CISCAT="" \ + EXTENSIONS_AWS="" \ + EXTENSIONS_GCP="" \ + EXTENSIONS_VIRUSTOTAL="" \ + EXTENSIONS_OSQUERY="" \ + EXTENSIONS_DOCKER="" \ + APP_TIMEOUT="" \ + API_SELECTOR="" \ + IP_SELECTOR="" \ + IP_IGNORE="" \ + WAZUH_MONITORING_ENABLED="" \ + WAZUH_MONITORING_FREQUENCY="" \ + WAZUH_MONITORING_SHARDS="" \ + WAZUH_MONITORING_REPLICAS="" \ + ADMIN_PRIVILEGES="" + +USER kibana + +COPY ./config/custom_welcome /tmp/custom_welcome +COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ +RUN chmod +x ./welcome_wazuh.sh +ARG CHANGE_WELCOME="true" +RUN ./welcome_wazuh.sh + +COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml +COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ +RUN chmod +x ./wazuh_app_config.sh + +COPY --chown=kibana:kibana ./config/kibana_settings.sh ./ +RUN chmod +x ./kibana_settings.sh + +ENTRYPOINT ./entrypoint.sh diff --git a/kibana/Dockerfile b/kibana/Dockerfile new file mode 100644 index 00000000..1f4adede --- /dev/null +++ b/kibana/Dockerfile @@ -0,0 +1,64 @@ +# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) +FROM docker.elastic.co/kibana/kibana:7.10.2 +USER kibana +ARG ELASTIC_VERSION=7.10.2 +ARG WAZUH_VERSION=4.2.6 +ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" + +WORKDIR /usr/share/kibana +RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip + +ENV PATTERN="" \ + CHECKS_PATTERN="" \ + CHECKS_TEMPLATE="" \ + CHECKS_API="" \ + CHECKS_SETUP="" \ + EXTENSIONS_PCI="" \ + EXTENSIONS_GDPR="" \ + EXTENSIONS_HIPAA="" \ + EXTENSIONS_NIST="" \ + EXTENSIONS_TSC="" \ + EXTENSIONS_AUDIT="" \ + EXTENSIONS_OSCAP="" \ + EXTENSIONS_CISCAT="" \ + EXTENSIONS_AWS="" \ + EXTENSIONS_GCP="" \ + EXTENSIONS_VIRUSTOTAL="" \ + EXTENSIONS_OSQUERY="" \ + EXTENSIONS_DOCKER="" \ + APP_TIMEOUT="" \ + API_SELECTOR="" \ + IP_SELECTOR="" \ + IP_IGNORE="" \ + WAZUH_MONITORING_ENABLED="" \ + WAZUH_MONITORING_FREQUENCY="" \ + WAZUH_MONITORING_SHARDS="" \ + WAZUH_MONITORING_REPLICAS="" \ + ADMIN_PRIVILEGES="" \ + XPACK_CANVAS="true" \ + XPACK_LOGS="true" \ + XPACK_INFRA="true" \ + XPACK_ML="true" \ + XPACK_DEVTOOLS="true" \ + XPACK_MONITORING="true" \ + XPACK_APM="true" + +WORKDIR / +USER kibana + +COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh +RUN chmod 755 ./entrypoint.sh + +RUN printf "\nserver.defaultRoute: /app/wazuh\n" >> /usr/share/kibana/config/kibana.yml + +COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml +COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ +RUN chmod +x ./wazuh_app_config.sh + +COPY --chown=kibana:kibana ./config/kibana_settings.sh ./ +RUN chmod +x ./kibana_settings.sh + +COPY --chown=kibana:kibana ./config/xpack_config.sh ./ +RUN chmod +x ./xpack_config.sh + +ENTRYPOINT ./entrypoint.sh diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 46fceb1e..97d05a0f 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,6 +222,9 @@ 127.0.0.1 ^localhost.localdomain$ + 4.2.6.1 + 4.2.6.2 + 208.67.220.220 diff --git a/production-cluster.yml b/production-cluster.yml new file mode 100644 index 00000000..42b6d227 --- /dev/null +++ b/production-cluster.yml @@ -0,0 +1,206 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh-master: + image: wazuh/wazuh-odfe:4.2.6 + hostname: wazuh-master + restart: always + ports: + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTIC_USERNAME=admin + - ELASTIC_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ossec-api-configuration:/var/ossec/api/configuration + - ossec-etc:/var/ossec/etc + - ossec-logs:/var/ossec/logs + - ossec-queue:/var/ossec/queue + - ossec-var-multigroups:/var/ossec/var/multigroups + - ossec-integrations:/var/ossec/integrations + - ossec-active-response:/var/ossec/active-response/bin + - ossec-agentless:/var/ossec/agentless + - ossec-wodles:/var/ossec/wodles + - filebeat-etc:/etc/filebeat + - filebeat-var:/var/lib/filebeat + - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem + - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key + - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh-worker: + image: wazuh/wazuh-odfe:4.2.6 + hostname: wazuh-worker + restart: always + environment: + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTIC_USERNAME=admin + - ELASTIC_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + volumes: + - worker-ossec-api-configuration:/var/ossec/api/configuration + - worker-ossec-etc:/var/ossec/etc + - worker-ossec-logs:/var/ossec/logs + - worker-ossec-queue:/var/ossec/queue + - worker-ossec-var-multigroups:/var/ossec/var/multigroups + - worker-ossec-integrations:/var/ossec/integrations + - worker-ossec-active-response:/var/ossec/active-response/bin + - worker-ossec-agentless:/var/ossec/agentless + - worker-ossec-wodles:/var/ossec/wodles + - worker-filebeat-etc:/etc/filebeat + - worker-filebeat-var:/var/lib/filebeat + - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem + - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key + - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + + elasticsearch: + image: amazon/opendistro-for-elasticsearch:1.13.2 + hostname: elasticsearch + restart: always + ports: + - "9200:9200" + environment: + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - elastic-data-1:/usr/share/elasticsearch/data + - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem + - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key + - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem + - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem + - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key + - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml + - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + + elasticsearch-2: + image: amazon/opendistro-for-elasticsearch:1.13.2 + hostname: elasticsearch-2 + restart: always + environment: + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - elastic-data-2:/usr/share/elasticsearch/data + - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem + - ./production_cluster/ssl_certs/node2.key:/usr/share/elasticsearch/config/node2.key + - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem + - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml + - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + + elasticsearch-3: + image: amazon/opendistro-for-elasticsearch:1.13.2 + hostname: elasticsearch-3 + restart: always + environment: + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - elastic-data-3:/usr/share/elasticsearch/data + - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem + - ./production_cluster/ssl_certs/node3.key:/usr/share/elasticsearch/config/node3.key + - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem + - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml + - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + + kibana: + image: wazuh/wazuh-kibana-odfe:4.2.6 + hostname: kibana + restart: always + ports: + - 5601:5601 + environment: + - ELASTICSEARCH_USERNAME=admin + - ELASTICSEARCH_PASSWORD=SecretPassword + - SERVER_SSL_ENABLED=true + - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/cert.pem + - SERVER_SSL_KEY=/usr/share/kibana/config/key.pem + - WAZUH_API_URL="https://wazuh-master" + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./production_cluster/kibana_ssl/cert.pem:/usr/share/kibana/config/cert.pem + - ./production_cluster/kibana_ssl/key.pem:/usr/share/kibana/config/key.pem + + depends_on: + - elasticsearch + links: + - elasticsearch:elasticsearch + - wazuh-master:wazuh-master + + nginx: + image: nginx:stable + hostname: nginx + restart: always + ports: + - "80:80" + - "443:443" + - "1514:1514" + depends_on: + - wazuh-master + - wazuh-worker + - kibana + links: + - wazuh-master:wazuh-master + - wazuh-worker:wazuh-worker + - kibana:kibana + volumes: + - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro + +volumes: + ossec-api-configuration: + ossec-etc: + ossec-logs: + ossec-queue: + ossec-var-multigroups: + ossec-integrations: + ossec-active-response: + ossec-agentless: + ossec-wodles: + filebeat-etc: + filebeat-var: + worker-ossec-api-configuration: + worker-ossec-etc: + worker-ossec-logs: + worker-ossec-queue: + worker-ossec-var-multigroups: + worker-ossec-integrations: + worker-ossec-active-response: + worker-ossec-agentless: + worker-ossec-wodles: + worker-filebeat-etc: + worker-filebeat-var: + elastic-data-1: + elastic-data-2: + elastic-data-3: diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index cd432c19..f90394b6 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,6 +222,9 @@ 127.0.0.1 ^localhost.localdomain$ + 4.2.6.1 + 4.2.6.2 + 208.67.220.220 diff --git a/xpack-compose.yml b/xpack-compose.yml new file mode 100644 index 00000000..bcdaaf8a --- /dev/null +++ b/xpack-compose.yml @@ -0,0 +1,186 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh: + image: wazuh/wazuh:4.2.6 + hostname: wazuh-manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTIC_USERNAME=elastic + - ELASTIC_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=none + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt + - SSL_CERTIFICATE=/etc/ssl/wazuh.crt + - SSL_KEY=/etc/ssl/wazuh.key + volumes: + - ossec_api_configuration:/var/ossec/api/configuration + - ossec_etc:/var/ossec/etc + - ossec_logs:/var/ossec/logs + - ossec_queue:/var/ossec/queue + - ossec_var_multigroups:/var/ossec/var/multigroups + - ossec_integrations:/var/ossec/integrations + - ossec_active_response:/var/ossec/active-response/bin + - ossec_agentless:/var/ossec/agentless + - ossec_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./xpack/ca/ca.crt:/etc/ssl/ca.crt + - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt + - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key + + + elasticsearch: + image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + hostname: elasticsearch + restart: always + ports: + - "9200:9200" + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + elasticsearch2: + image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + hostname: elasticsearch2 + restart: always + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch2 + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + elasticsearch3: + image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 + hostname: elasticsearch3 + restart: always + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch3 + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + + + kibana: + image: wazuh/wazuh-kibana:4.2.6 + hostname: kibana + restart: always + ports: + - 443:5601 + environment: + - SERVERNAME=localhost + - ELASTICSEARCH_USERNAME=elastic + - ELASTICSEARCH_PASSWORD=SecretPassword + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTICSEARCH_HOSTS=https://elasticsearch:9200 + - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt + - SERVER_SSL_ENABLED=true + - XPACK_SECURITY_ENABLED=true + - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key + - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt + volumes: + - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt + - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key + - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt + depends_on: + - elasticsearch + links: + - elasticsearch:elasticsearch + - wazuh:wazuh + +volumes: + ossec_api_configuration: + ossec_etc: + ossec_logs: + ossec_queue: + ossec_var_multigroups: + ossec_integrations: + ossec_active_response: + ossec_agentless: + ossec_wodles: + filebeat_etc: + filebeat_var: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml new file mode 100644 index 00000000..9232b302 --- /dev/null +++ b/xpack-from-sources.yml @@ -0,0 +1,192 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh: + build: + context: wazuh-odfe/ + args: + - FILEBEAT_CHANNEL=filebeat + - FILEBEAT_VERSION=7.11.2 + image: wazuh/wazuh:4.2.6 + hostname: wazuh-manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTIC_USERNAME=elastic + - ELASTIC_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=none + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt + - SSL_CERTIFICATE=/etc/ssl/wazuh.crt + - SSL_KEY=/etc/ssl/wazuh.key + volumes: + - ossec_api_configuration:/var/ossec/api/configuration + - ossec_etc:/var/ossec/etc + - ossec_logs:/var/ossec/logs + - ossec_queue:/var/ossec/queue + - ossec_var_multigroups:/var/ossec/var/multigroups + - ossec_integrations:/var/ossec/integrations + - ossec_active_response:/var/ossec/active-response/bin + - ossec_agentless:/var/ossec/agentless + - ossec_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./xpack/ca/ca.crt:/etc/ssl/ca.crt + - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt + - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key + + + elasticsearch: + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 + hostname: elasticsearch + restart: always + ports: + - "9200:9200" + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + elasticsearch2: + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 + hostname: elasticsearch2 + restart: always + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch2 + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + elasticsearch3: + image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 + hostname: elasticsearch3 + restart: always + environment: + - cluster.name=wazuh-cluster + - node.name=elasticsearch3 + - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 + - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 + - ELASTIC_PASSWORD=SecretPassword + - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - bootstrap.memory_lock=true + - xpack.license.self_generated.type=basic + - xpack.security.enabled=true + - xpack.security.http.ssl.enabled=true + - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + - xpack.security.transport.ssl.enabled=true + - xpack.security.transport.ssl.verification_mode=certificate + - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt + - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key + - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt + - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key + - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt + + + + kibana: + build: kibana/ + image: wazuh/wazuh-kibana:4.2.6 + hostname: kibana + restart: always + ports: + - 443:5601 + environment: + - SERVERNAME=localhost + - ELASTICSEARCH_USERNAME=elastic + - ELASTICSEARCH_PASSWORD=SecretPassword + - ELASTICSEARCH_URL=https://elasticsearch:9200 + - ELASTICSEARCH_HOSTS=https://elasticsearch:9200 + - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt + - SERVER_SSL_ENABLED=true + - XPACK_SECURITY_ENABLED=true + - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key + - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt + volumes: + - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt + - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key + - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt + depends_on: + - elasticsearch + links: + - elasticsearch:elasticsearch + - wazuh:wazuh + +volumes: + ossec_api_configuration: + ossec_etc: + ossec_logs: + ossec_queue: + ossec_var_multigroups: + ossec_integrations: + ossec_active_response: + ossec_agentless: + ossec_wodles: + filebeat_etc: + filebeat_var: From 3525003ef7596614a0e9eb310c1694f88247ca5d Mon Sep 17 00:00:00 2001 From: Alberto R Date: Wed, 24 Nov 2021 17:01:09 +0100 Subject: [PATCH 05/42] Bumped to 4.4.0 --- .github/.goss.yaml | 2 +- CHANGELOG.md | 7 ++++++- README.md | 3 ++- VERSION | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- docker-compose.yml | 4 ++-- kibana-odfe/Dockerfile | 2 +- kibana/Dockerfile | 2 +- multi-node/config/wazuh_cluster/wazuh_manager.conf | 3 +++ multi-node/config/wazuh_cluster/wazuh_worker.conf | 4 ++-- production-cluster.yml | 6 +++--- xpack-compose.yml | 4 ++-- xpack-from-sources.yml | 4 ++-- 13 files changed, 28 insertions(+), 19 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index c0b59bda..6a6ed8eb 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.2.6 + - 4.4.0 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 60295204..73bdc6e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,12 @@ # Change Log All notable changes to this project will be documented in this file. -## Wazuh Docker v4.2.6 +## Wazuh Docker v4.4.0 +### Added + +- Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440) + +## Wazuh Docker v4.3.0 ### Added - Update Wazuh to version [4.2.6](https://github.com/wazuh/wazuh/blob/v4.2.6/CHANGELOG.md#v426) diff --git a/README.md b/README.md index 8a4a9a80..18351bd7 100644 --- a/README.md +++ b/README.md @@ -195,7 +195,8 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.2.6 | 1.13.2 | 7.11.2 | +| v4.4.0 | 1.13.2 | 7.11.2 | +| v4.3.0 | 1.13.2 | 7.11.2 | | v4.2.5 | 1.13.2 | 7.11.2 | | v4.2.4 | 1.13.2 | 7.11.2 | | v4.2.3 | 1.13.2 | 7.11.2 | diff --git a/VERSION b/VERSION index b7c09d4c..1b8da5ba 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.2.6" -REVISION="40221" +WAZUH-DOCKER_VERSION="4.4.0" +REVISION="40400" diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index d65ec583..cee005e8 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -8,7 +8,7 @@ ARG WAZUH_TAG_REVISION ARG TEMPLATE_VERSION=4.3 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.6 +ARG WAZUH_VERSION=4.4.0-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" diff --git a/docker-compose.yml b/docker-compose.yml index 561d8352..e7ed2f7d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.6 + image: wazuh/wazuh-odfe:4.4.0 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.2.6 + image: wazuh/wazuh-kibana-odfe:4.4.0 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 2071005f..d133d140 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.6 +ARG WAZUH_VERSION=4.4.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 1f4adede..d0a17f71 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.6 +ARG WAZUH_VERSION=4.4.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index aec223a1..3b3703f5 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,6 +222,9 @@ 127.0.0.1 ^localhost.localdomain$ + 4.4.0.1 + 4.4.0.2 + 208.67.220.220 diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 97d05a0f..933a3277 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,8 +222,8 @@ 127.0.0.1 ^localhost.localdomain$ - 4.2.6.1 - 4.2.6.2 + 4.4.0.1 + 4.4.0.2 208.67.220.220 diff --git a/production-cluster.yml b/production-cluster.yml index 42b6d227..64502411 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.2.6 + image: wazuh/wazuh-odfe:4.4.0 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.2.6 + image: wazuh/wazuh-odfe:4.4.0 hostname: wazuh-worker restart: always environment: @@ -134,7 +134,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.2.6 + image: wazuh/wazuh-kibana-odfe:4.4.0 hostname: kibana restart: always ports: diff --git a/xpack-compose.yml b/xpack-compose.yml index bcdaaf8a..8fdb12e7 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.2.6 + image: wazuh/wazuh:4.4.0 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.2.6 + image: wazuh/wazuh-kibana:4.4.0 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 9232b302..ff5fb355 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.2.6 + image: wazuh/wazuh:4.4.0 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.2.6 + image: wazuh/wazuh-kibana:4.4.0 hostname: kibana restart: always ports: From b33aea9ef850b41b2c9cac558374b83b8571914b Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 23 May 2022 10:58:04 -0300 Subject: [PATCH 06/42] fix whitelist --- multi-node/config/wazuh_cluster/wazuh_manager.conf | 3 --- multi-node/config/wazuh_cluster/wazuh_worker.conf | 3 --- single-node/config/wazuh_cluster/wazuh_manager.conf | 3 --- 3 files changed, 9 deletions(-) diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 3b3703f5..aec223a1 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,9 +222,6 @@ 127.0.0.1 ^localhost.localdomain$ - 4.4.0.1 - 4.4.0.2 - 208.67.220.220 diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 933a3277..46fceb1e 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,9 +222,6 @@ 127.0.0.1 ^localhost.localdomain$ - 4.4.0.1 - 4.4.0.2 - 208.67.220.220 diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index f90394b6..cd432c19 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,9 +222,6 @@ 127.0.0.1 ^localhost.localdomain$ - 4.2.6.1 - 4.2.6.2 - 208.67.220.220 From e24d17f730f3c25533a67a4cda0d0627cc43dc15 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Fri, 1 Jul 2022 17:45:23 -0300 Subject: [PATCH 07/42] disable filebeat metrics --- build-docker-images/wazuh-manager/config/filebeat.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index 8d1823af..8beed808 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -22,10 +22,3 @@ output.elasticsearch: #ssl.key: logging.metrics.enabled: false - -seccomp: - default_action: allow - syscalls: - - action: allow - names: - - rseq From 4b621466a0d3ee49e5dd5beecb08fff9f5898fed Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Wed, 6 Jul 2022 17:35:20 -0300 Subject: [PATCH 08/42] Add fix to avoid GLIBC crash --- build-docker-images/wazuh-manager/config/filebeat.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index 8beed808..fcf80c3e 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -22,3 +22,10 @@ output.elasticsearch: #ssl.key: logging.metrics.enabled: false + +seccomp: +default_action: allow +syscalls: +- action: allow + names: + - rseq From d5932ac4a1622007140e5a16365826e164429749 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Wed, 6 Jul 2022 18:01:53 -0300 Subject: [PATCH 09/42] Add fix to avoid GLIBC crash, fix identation --- build-docker-images/wazuh-manager/config/filebeat.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index fcf80c3e..8d1823af 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -24,8 +24,8 @@ output.elasticsearch: logging.metrics.enabled: false seccomp: -default_action: allow -syscalls: -- action: allow - names: - - rseq + default_action: allow + syscalls: + - action: allow + names: + - rseq From 70938d52d2fa25fa8984a4372354815a878a4ab2 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 30 Nov 2022 15:35:16 -0300 Subject: [PATCH 10/42] add 4.4 version --- .env | 5 +++++ build-docker-images/build-images.sh | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.env b/.env index d70f87f2..d3ca19e8 100755 --- a/.env +++ b/.env @@ -1,3 +1,8 @@ +<<<<<<< HEAD WAZUH_VERSION=4.3.11 WAZUH_IMAGE_VERSION=4.3.11 +======= +WAZUH_VERSION=4.4.0 +WAZUH_IMAGE_VERSION=4.4.0 +>>>>>>> 7f73635 (add 4.4 version) WAZUH_TAG_REVISION=1 diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 57bd8497..87e2bb4f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.3.11 +WAZUH_IMAGE_VERSION=4.4.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') From 6398b66e10ba51791d7764deb16ccd1c9ac71fd8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 1 Dec 2022 11:58:21 -0300 Subject: [PATCH 11/42] add 4.4 version --- build-docker-images/build-images.sh | 8 +++++ .../wazuh-dashboard/config/dl_base.sh | 33 +++++++++++++----- .../config/install_wazuh_app.sh | 30 ++++++++++++---- .../wazuh-indexer/config/config.sh | 29 +++++++++++++--- .../wazuh-manager/config/check_repository.sh | 34 +++++++++++++++---- ...Wazuh-4.3.md => Migration-to-Wazuh-4.4.md} | 6 ++-- 6 files changed, 112 insertions(+), 28 deletions(-) rename multi-node/{Migration-to-Wazuh-4.3.md => Migration-to-Wazuh-4.4.md} (99%) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 87e2bb4f..b244673d 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -3,6 +3,14 @@ WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +MAJOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f3) + +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + ## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then IMAGE_VERSION=${WAZUH_IMAGE_VERSION} diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index fdea501a..00ffe992 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -1,12 +1,29 @@ -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') && \ -WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') && \ +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) - -if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then - REPOSITORY="packages.wazuh.com" -else - REPOSITORY="packages-dev.wazuh.com" +## check version to use the correct repository +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + else + REPOSITORY="packages.wazuh.com" + fi + else + REPOSITORY="packages.wazuh.com" + fi +else + REPOSITORY="packages.wazuh.com" fi - + curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index 61264e6a..d10d97c1 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,11 +1,29 @@ ## Variables -WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') -## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip -else +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## check version to use the correct repository +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + fi + else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip + fi +else + WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi # Install Wazuh App diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 225c97e7..2c8c77a4 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -4,8 +4,6 @@ export DH_OPTIONS export NAME=wazuh-indexer export TARGET_DIR=${CURDIR}/debian/${NAME} -export WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') -export WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') # Package build options export USER=${NAME} @@ -23,10 +21,31 @@ export REPO_DIR=/unattended_installer rm -rf ${INSTALLATION_DIR}/ -if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then - REPOSITORY="packages.wazuh.com" +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + +## If wazuh manager exists in apt dev repository, change variables, if not exit 1 +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + REPOSITORY="packages-dev.wazuh.com" + else + REPOSITORY="packages.wazuh.com" + fi + else + REPOSITORY="packages.wazuh.com" + fi else - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages.wazuh.com" fi curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index 5501d326..152f07e0 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,13 +1,35 @@ ## Variables -WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) +MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) +MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) +MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) +MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) +MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) + ## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" -else +if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" +elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then + if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then + if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" + else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" + fi + else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" + fi +else + APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH + REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi apt-key adv --fetch-keys ${APT_KEY} echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.4.md similarity index 99% rename from multi-node/Migration-to-Wazuh-4.3.md rename to multi-node/Migration-to-Wazuh-4.4.md index 611e14b8..3ff10a84 100644 --- a/multi-node/Migration-to-Wazuh-4.3.md +++ b/multi-node/Migration-to-Wazuh-4.4.md @@ -1,6 +1,6 @@ # Opendistro data migration to Wazuh indexer on docker. This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2 to v4.3. +The example is migrating from v4.2 to v4.4. ## Procedure Assuming that you have a v4.2 production deployment, perform the following steps. @@ -350,9 +350,9 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` -**7. Start the 4.3 environment.** +**7. Start the 4.4 environment.** ``` -git checkout 4.3 +git checkout 4.4 cd multi-node docker-compose -f generate-indexer-certs.yml run --rm generator docker-compose up -d From e9764b0a6accd503bddc5f98c8fd9de2a6897fd4 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 1 Dec 2022 13:02:13 -0300 Subject: [PATCH 12/42] add 4.4 version --- build-docker-images/build-images.sh | 8 ------- .../wazuh-dashboard/config/dl_base.sh | 14 +++++------- .../config/install_wazuh_app.sh | 15 +++++-------- .../wazuh-indexer/config/config.sh | 17 ++++++-------- .../wazuh-manager/config/check_repository.sh | 22 +++++++------------ 5 files changed, 25 insertions(+), 51 deletions(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index b244673d..87e2bb4f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -3,14 +3,6 @@ WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') -MAJOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f1) -MID_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f2) -MINOR_BUILD=$(echo $WAZUH_IMAGE_VERSION | cut -d. -f3) - -MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) -MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) -MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) - ## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then IMAGE_VERSION=${WAZUH_IMAGE_VERSION} diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index 00ffe992..9ae9f0a8 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -1,3 +1,4 @@ +REPOSITORY="packages.wazuh.com" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -7,23 +8,18 @@ MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" - else - REPOSITORY="packages.wazuh.com" fi - else - REPOSITORY="packages.wazuh.com" fi -else - REPOSITORY="packages.wazuh.com" fi + curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 diff --git a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh index d10d97c1..a95158cb 100644 --- a/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh +++ b/build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh @@ -1,4 +1,5 @@ -## Variables +## variables +WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -8,22 +9,16 @@ MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip - else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi - else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi -else - WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip fi # Install Wazuh App diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 2c8c77a4..625f9c3f 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -21,6 +21,8 @@ export REPO_DIR=/unattended_installer rm -rf ${INSTALLATION_DIR}/ +## variables +REPOSITORY="packages.wazuh.com" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -29,25 +31,20 @@ MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) -## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +## check version to use the correct repository +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then REPOSITORY="packages-dev.wazuh.com" - else - REPOSITORY="packages.wazuh.com" fi - else - REPOSITORY="packages.wazuh.com" fi -else - REPOSITORY="packages.wazuh.com" fi + curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} tar -xf ${INDEXER_FILE} diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index 152f07e0..adc94e79 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -1,4 +1,6 @@ -## Variables +## variables +APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH +REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) @@ -7,29 +9,21 @@ MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) -## If wazuh manager exists in apt dev repository, change variables, if not exit 1 -if [ "$MAJOR_BUILD" -ge "$MAJOR_CURRENT" ]; then +## check version to use the correct repository +if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then - if [ "$MID_BUILD" -ge "$MID_CURRENT" ]; then + if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then - if [ "$MINOR_BUILD" -ge "$MINOR_CURRENT" ]; then + if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" - else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi - else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi -else - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" fi + apt-key adv --fetch-keys ${APT_KEY} echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list \ No newline at end of file From 06a1efc0943d92a88342e406a69aaa299c2a2e73 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 1 Dec 2022 13:32:43 -0300 Subject: [PATCH 13/42] add revision into versions parameter --- .github/.goss.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 6a6ed8eb..304bf1f6 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.0 + - 4.4.0-1 port: tcp:1514: listening: true From 6e7b1c2899e1ab8c592e5fa1319c9157d2d4ec08 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 1 Dec 2022 19:35:35 -0300 Subject: [PATCH 14/42] change indexer and manager configuration for 4.4 version --- build-docker-images/wazuh-indexer/Dockerfile | 7 ++-- .../wazuh-indexer/config/config.sh | 9 ++--- .../wazuh-indexer/config/entrypoint.sh | 12 +++---- .../wazuh-indexer/config/opensearch.yml | 12 +++---- .../wazuh-indexer/config/securityadmin.sh | 2 +- multi-node/config/certs.yml | 2 +- multi-node/docker-compose.yml | 34 +++++++++---------- single-node/config/certs.yml | 2 +- .../config/wazuh_cluster/wazuh_manager.conf | 6 ++-- .../config/wazuh_indexer/wazuh.indexer.yml | 14 ++++---- single-node/docker-compose.yml | 14 ++++---- single-node/generate-indexer-certs.yml | 2 +- 12 files changed, 60 insertions(+), 56 deletions(-) diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index d126d18e..696c0462 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -59,14 +59,15 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/s COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d +RUN chown -R 1000:1000 /usr/share/wazuh-indexer RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer/config && \ - chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ - chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml + chmod 700 /usr/share/wazuh-indexer && \ + chmod 600 /usr/share/wazuh-indexer/jvm.options && \ + chmod 600 /usr/share/wazuh-indexer/opensearch.yml USER wazuh-indexer diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 625f9c3f..573b33dc 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -13,7 +13,7 @@ export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} -export CONFIG_DIR=${INSTALLATION_DIR}/config +export CONFIG_DIR=${INSTALLATION_DIR} export BASE_DIR=${NAME}-* export INDEXER_FILE=wazuh-indexer-base.tar.xz export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz @@ -93,6 +93,7 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A # copy to target mkdir -p ${TARGET_DIR}${INSTALLATION_DIR} +mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ mkdir -p ${TARGET_DIR}${CONFIG_DIR} mkdir -p ${TARGET_DIR}${LIB_DIR} mkdir -p ${TARGET_DIR}${LOG_DIR} @@ -117,9 +118,9 @@ cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR} cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ # Copy Wazuh's config files for the security plugin -cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ -cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ -cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ +cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ +cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} # Copy Wazuh indexer's certificates cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 9b8747b5..2acb4aa0 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -6,7 +6,7 @@ umask 0002 export USER=wazuh-indexer export INSTALLATION_DIR=/usr/share/wazuh-indexer -export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config +export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR} export JAVA_HOME=${INSTALLATION_DIR}/jdk export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) @@ -59,7 +59,7 @@ if [[ -f bin/opensearch-users ]]; then # enabled, but we have no way of knowing which node we are yet. We'll just # honor the variable if it's present. if [[ -n "$INDEXER_PASSWORD" ]]; then - [[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) + [[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then # keystore is unencrypted if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then @@ -84,10 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then fi -if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then +#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then # run securityadmin.sh for single node with CACERT, CERT and KEY parameter - nohup /securityadmin.sh & - touch "/var/lib/wazuh-indexer/.flag" -fi +# nohup /securityadmin.sh & +# touch "/var/lib/wazuh-indexer/.flag" +#fi run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml index 4e944c89..1f0a78b3 100644 --- a/build-docker-images/wazuh-indexer/config/opensearch.yml +++ b/build-docker-images/wazuh-indexer/config/opensearch.yml @@ -4,12 +4,12 @@ path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node compatibility.override_main_response_version: true -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem plugins.security.ssl.http.enabled: true plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.resolve_hostname: false diff --git a/build-docker-images/wazuh-indexer/config/securityadmin.sh b/build-docker-images/wazuh-indexer/config/securityadmin.sh index 1fcf6467..df576cf4 100644 --- a/build-docker-images/wazuh-indexer/config/securityadmin.sh +++ b/build-docker-images/wazuh-indexer/config/securityadmin.sh @@ -1,3 +1,3 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) sleep 30 -bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9300 -icl \ No newline at end of file +bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl \ No newline at end of file diff --git a/multi-node/config/certs.yml b/multi-node/config/certs.yml index f88f5f7f..5c3f4f1d 100644 --- a/multi-node/config/certs.yml +++ b/multi-node/config/certs.yml @@ -21,4 +21,4 @@ nodes: # Wazuh dashboard node dashboard: - name: wazuh.dashboard - ip: wazuh.dashboard \ No newline at end of file + ip: wazuh.dashboard diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index a6f50603..6e7e2198 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -84,13 +84,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: image: wazuh/wazuh-indexer:4.3.11 @@ -108,11 +108,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem - - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: image: wazuh/wazuh-indexer:4.3.11 @@ -130,11 +130,11 @@ services: hard: 65536 volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem - - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.3.11 diff --git a/single-node/config/certs.yml b/single-node/config/certs.yml index 8cb8d3f2..c3e017be 100755 --- a/single-node/config/certs.yml +++ b/single-node/config/certs.yml @@ -13,4 +13,4 @@ nodes: # Wazuh dashboard node dashboard: - name: wazuh.dashboard - ip: wazuh.dashboard \ No newline at end of file + ip: wazuh.dashboard diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index cd432c19..9aea806a 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -331,14 +331,14 @@ wazuh node01 master - + aa093264ef885029653eea20dfcf51ae 1516 0.0.0.0 - NODE_IP + wazuh.manager no - yes + no diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index e87e35ea..84c3dbf9 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -3,13 +3,15 @@ node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node +http.port: 9200-9299 +transport.tcp.port: 9300-9399 compatibility.override_main_response_version: true -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem plugins.security.ssl.http.enabled: true plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.resolve_hostname: false diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 7c4a5eff..b3f9fdad 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -55,13 +55,13 @@ services: hard: 65536 volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: image: wazuh/wazuh-dashboard:4.3.11 diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml index a3398661..d10151fd 100644 --- a/single-node/generate-indexer-certs.yml +++ b/single-node/generate-indexer-certs.yml @@ -7,4 +7,4 @@ services: hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml \ No newline at end of file + - ./config/certs.yml:/config/certs.yml From 42193f4cfa70042452df2afdd4bc9c2a073463bc Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 2 Dec 2022 11:36:35 -0300 Subject: [PATCH 15/42] fix index alerts test --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 33967eef..676e6f59 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -250,7 +250,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 200 ]]; then echo "wazuh-alerts index documents: ${docs}" else From be9019a0650171576caa5c189e00b3c8b6ab085d Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 2 Dec 2022 12:42:01 -0300 Subject: [PATCH 16/42] fix index alerts test --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 676e6f59..360ef4e6 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -126,7 +126,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" if [[ $docs -gt 100 ]]; then echo "wazuh-alerts index documents: ${docs}" else From b838023509a05319c5ef1810954455cd6575d036 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 26 Dec 2022 11:12:16 -0300 Subject: [PATCH 17/42] modify base path --- build-docker-images/wazuh-dashboard/config/dl_base.sh | 8 ++++---- build-docker-images/wazuh-indexer/config/config.sh | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index 9ae9f0a8..b06cfdfa 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -9,17 +9,17 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" fi fi fi -curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz +curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1 diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 573b33dc..403c67d3 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -33,19 +33,19 @@ MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) ## check version to use the correct repository if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then - REPOSITORY="packages-dev.wazuh.com" + REPOSITORY="packages-dev.wazuh.com/pre-release" fi fi fi -curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} +curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/${BASE_FILE} tar -xf ${INDEXER_FILE} ## TOOLS From ee46520701a4116e1e6226928230181a8b530b99 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 1 Feb 2023 10:33:26 -0300 Subject: [PATCH 18/42] update docs count --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 360ef4e6..51077968 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -251,7 +251,7 @@ jobs: - name: Check documents into wazuh-alerts index run: | docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" - if [[ $docs -gt 200 ]]; then + if [[ $docs -gt 100 ]]; then echo "wazuh-alerts index documents: ${docs}" else echo "wazuh-alerts index documents: ${docs}" From 395b769b6a2a346d2809989baa4105e630bbd2d5 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 28 Mar 2023 09:07:24 -0300 Subject: [PATCH 19/42] change revision number --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 1b8da5ba..3bca231b 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.4.0" -REVISION="40400" +REVISION="40405" From fd9c09a7e540a16f83805996f1826405d9ef19ff Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 28 Mar 2023 16:59:49 -0300 Subject: [PATCH 20/42] change dashboard and indexer base repository --- build-docker-images/wazuh-dashboard/config/dl_base.sh | 2 +- build-docker-images/wazuh-indexer/config/config.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/dl_base.sh b/build-docker-images/wazuh-dashboard/config/dl_base.sh index b06cfdfa..91a289e2 100644 --- a/build-docker-images/wazuh-dashboard/config/dl_base.sh +++ b/build-docker-images/wazuh-dashboard/config/dl_base.sh @@ -1,4 +1,4 @@ -REPOSITORY="packages.wazuh.com" +REPOSITORY="packages.wazuh.com/4.x" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 403c67d3..728fc862 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -22,7 +22,7 @@ export REPO_DIR=/unattended_installer rm -rf ${INSTALLATION_DIR}/ ## variables -REPOSITORY="packages.wazuh.com" +REPOSITORY="packages.wazuh.com/4.x" WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) From 5e3676e125caa7f91fe68c3fd20bd534ed6b84ea Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 31 Mar 2023 10:27:58 -0300 Subject: [PATCH 21/42] bump 4.4.1 version --- .env | 5 ----- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 17 +++++++++++++++-- VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 8 files changed, 33 insertions(+), 20 deletions(-) diff --git a/.env b/.env index d3ca19e8..bfc67828 100755 --- a/.env +++ b/.env @@ -1,8 +1,3 @@ -<<<<<<< HEAD -WAZUH_VERSION=4.3.11 -WAZUH_IMAGE_VERSION=4.3.11 -======= WAZUH_VERSION=4.4.0 WAZUH_IMAGE_VERSION=4.4.0 ->>>>>>> 7f73635 (add 4.4 version) WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 304bf1f6..a867bac9 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.0-1 + - 4.4.1-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 73bdc6e4..2ace25ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.4.1 +### Added + +- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) + ## Wazuh Docker v4.4.0 ### Added diff --git a/README.md b/README.md index 18351bd7..c2c19801 100644 --- a/README.md +++ b/README.md @@ -195,8 +195,21 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.4.0 | 1.13.2 | 7.11.2 | -| v4.3.0 | 1.13.2 | 7.11.2 | +| v4.4.1 | | | +| v4.4.0 | | | +| v4.3.10 | | | +| v4.3.9 | | | +| v4.3.8 | | | +| v4.3.7 | | | +| v4.3.6 | | | +| v4.3.5 | | | +| v4.3.4 | | | +| v4.3.3 | | | +| v4.3.2 | | | +| v4.3.1 | | | +| v4.3.0 | | | +| v4.2.7 | 1.13.2 | 7.11.2 | +| v4.2.6 | 1.13.2 | 7.11.2 | | v4.2.5 | 1.13.2 | 7.11.2 | | v4.2.4 | 1.13.2 | 7.11.2 | | v4.2.3 | 1.13.2 | 7.11.2 | diff --git a/VERSION b/VERSION index 3bca231b..6df24e26 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.4.0" -REVISION="40405" +WAZUH-DOCKER_VERSION="4.4.1" +REVISION="40406" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 87e2bb4f..b6c23532 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.4.0 +WAZUH_IMAGE_VERSION=4.4.1 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 6e7e2198..c9667ede 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.3.11 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.3.11 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.11 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.3.11 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.3.11 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.11 + image: wazuh/wazuh-dashboard:4.4.1 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index b3f9fdad..f5e8e3f8 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.3.11 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.3.11 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.11 + image: wazuh/wazuh-dashboard:4.4.1 hostname: wazuh.dashboard restart: always ports: From 944c6aa4c800a7774e06db597635f21f57af4158 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= <33964202+teddytpc1@users.noreply.github.com> Date: Wed, 5 Apr 2023 13:46:20 -0300 Subject: [PATCH 22/42] Revert "Bump `4.4` to `4.4.1`" --- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 ----- README.md | 1 - VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 7 files changed, 13 insertions(+), 19 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index a867bac9..304bf1f6 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.1-1 + - 4.4.0-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ace25ab..73bdc6e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,11 +1,6 @@ # Change Log All notable changes to this project will be documented in this file. -## Wazuh Docker v4.4.1 -### Added - -- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) - ## Wazuh Docker v4.4.0 ### Added diff --git a/README.md b/README.md index c2c19801..c906483e 100644 --- a/README.md +++ b/README.md @@ -195,7 +195,6 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.4.1 | | | | v4.4.0 | | | | v4.3.10 | | | | v4.3.9 | | | diff --git a/VERSION b/VERSION index 6df24e26..3bca231b 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.4.1" -REVISION="40406" +WAZUH-DOCKER_VERSION="4.4.0" +REVISION="40405" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index b6c23532..87e2bb4f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.4.1 +WAZUH_IMAGE_VERSION=4.4.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index c9667ede..0f54c72d 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.4.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.4.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.4.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.4.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.4.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.1 + image: wazuh/wazuh-dashboard:4.4.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index f5e8e3f8..61b71f7d 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.4.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.4.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.1 + image: wazuh/wazuh-dashboard:4.4.0 hostname: wazuh.dashboard restart: always ports: From d6f19cebf5276f3e54056a6ce496c566ba86cc05 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 5 Apr 2023 13:55:24 -0300 Subject: [PATCH 23/42] disable cluster option --- single-node/config/wazuh_cluster/wazuh_manager.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 9aea806a..4db508d6 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -338,7 +338,7 @@ wazuh.manager no - no + yes From 638d548d74877322f27cc546e682559521a36e59 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 10 Apr 2023 10:20:48 -0300 Subject: [PATCH 24/42] bump 4.4.1 version --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 2 +- build-docker-images/build-images.sh | 2 +- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 8 files changed, 20 insertions(+), 14 deletions(-) diff --git a/.env b/.env index bfc67828..58ef3c4f 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.4.0 -WAZUH_IMAGE_VERSION=4.4.0 +WAZUH_VERSION=4.4.1 +WAZUH_IMAGE_VERSION=4.4.1 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 304bf1f6..a867bac9 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.0-1 + - 4.4.1-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 73bdc6e4..2ace25ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.4.1 +### Added + +- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) + ## Wazuh Docker v4.4.0 ### Added diff --git a/README.md b/README.md index c906483e..c2c19801 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.4.1 | | | | v4.4.0 | | | | v4.3.10 | | | | v4.3.9 | | | diff --git a/VERSION b/VERSION index 3bca231b..de800016 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.4.0" +WAZUH-DOCKER_VERSION="4.4.1" REVISION="40405" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 87e2bb4f..b6c23532 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.4.0 +WAZUH_IMAGE_VERSION=4.4.1 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 0f54c72d..c9667ede 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.4.0 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.4.0 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.4.0 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.4.0 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.4.0 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.0 + image: wazuh/wazuh-dashboard:4.4.1 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 61b71f7d..f5e8e3f8 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.4.0 + image: wazuh/wazuh-manager:4.4.1 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.4.0 + image: wazuh/wazuh-indexer:4.4.1 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.0 + image: wazuh/wazuh-dashboard:4.4.1 hostname: wazuh.dashboard restart: always ports: From 2cbf64dafa47251669f55d3f07a82bab3b7ad5ef Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 10 Apr 2023 11:20:22 -0300 Subject: [PATCH 25/42] change revision --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index de800016..6df24e26 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ WAZUH-DOCKER_VERSION="4.4.1" -REVISION="40405" +REVISION="40406" From 697b7538cc265ac17abacd791316513ac6e6c82c Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 23 May 2022 09:57:31 -0300 Subject: [PATCH 26/42] bump release 4.5.0 --- .github/.goss.yaml | 2 +- .github/workflows/push.yml | 4 ++-- CHANGELOG.md | 4 ++-- README.md | 2 +- VERSION | 4 ++-- build-docker-images/build-images.yml | 24 +++++-------------- .../wazuh-dashboard/Dockerfile | 3 +-- .../wazuh-dashboard/config/config.sh | 4 ++-- .../wazuh-indexer/config/config.sh | 6 ++--- build-docker-images/wazuh-manager/Dockerfile | 7 ++---- indexer-certs-creator/config/entrypoint.sh | 4 ++-- .../config/wazuh_cluster/wazuh_worker.conf | 3 +++ multi-node/docker-compose.yml | 12 +++++----- .../config/wazuh_cluster/wazuh_manager.conf | 3 +++ single-node/docker-compose.yml | 6 ++--- 15 files changed, 39 insertions(+), 49 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index a867bac9..76e84db8 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.4.1-1 + - 4.5.0 port: tcp:1514: listening: true diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 51077968..3c84f3f9 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -49,8 +49,8 @@ jobs: with: version: v0.3.16 - - name: Execute Goss tests (wazuh-manager) - run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} + - name: Execute Goss tests (wazuh-odfe) + run: dgoss run wazuh/wazuh-manager:4.5.0 env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ace25ab..277bb040 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,10 @@ # Change Log All notable changes to this project will be documented in this file. -## Wazuh Docker v4.4.1 +## Wazuh Docker v4.5.0 ### Added -- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) +- Update Wazuh to version [4.5.0](https://github.com/wazuh/wazuh/blob/v4.5.0/CHANGELOG.md#v450) ## Wazuh Docker v4.4.0 ### Added diff --git a/README.md b/README.md index c2c19801..cb74e3cf 100644 --- a/README.md +++ b/README.md @@ -195,7 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| -| v4.4.1 | | | +| v4.5.0 | | | | v4.4.0 | | | | v4.3.10 | | | | v4.3.9 | | | diff --git a/VERSION b/VERSION index 6df24e26..5a1911b6 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.4.1" -REVISION="40406" +WAZUH-DOCKER_VERSION="4.5.0" +REVISION="40500" diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 52984bf9..92be9b38 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -3,12 +3,8 @@ version: '3.7' services: wazuh.manager: - build: - context: wazuh-manager/ - args: - WAZUH_VERSION: ${WAZUH_VERSION} - WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} + build: wazuh-manager/ + image: wazuh/wazuh-manager:4.5.0 hostname: wazuh.manager restart: always ports: @@ -35,12 +31,8 @@ services: - filebeat_var:/var/lib/filebeat wazuh.indexer: - build: - context: wazuh-indexer/ - args: - WAZUH_VERSION: ${WAZUH_VERSION} - WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} + build: wazuh-indexer/ + image: wazuh/wazuh-indexer:4.5.0 hostname: wazuh.indexer restart: always ports: @@ -56,12 +48,8 @@ services: hard: 65536 wazuh.dashboard: - build: - context: wazuh-dashboard/ - args: - WAZUH_VERSION: ${WAZUH_VERSION} - WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} + build: wazuh-dashboard/ + image: wazuh/wazuh-dashboard:4.5.0 hostname: wazuh.dashboard restart: always ports: diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 1b95ca88..003d7d21 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,8 +1,7 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder -ARG WAZUH_VERSION -ARG WAZUH_TAG_REVISION +ARG WAZUH_VERSION=4.5.0 ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG WAZUH_UI_REVISION=1 diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index c33f8eb4..40e6ac67 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.3/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ +PACKAGES_URL=https://packages.wazuh.com/4.5/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 728fc862..ea4ec95c 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} +export VERSION=4.5.0 export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} @@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE} ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.3/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ +PACKAGES_URL=https://packages.wazuh.com/4.5/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index cee005e8..d4b1e344 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,11 +1,8 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal -RUN rm /bin/sh && ln -s /bin/bash /bin/sh - -ARG WAZUH_VERSION -ARG WAZUH_TAG_REVISION -ARG TEMPLATE_VERSION=4.3 +ARG WAZUH_VERSION=4.5.0 +ARG TEMPLATE_VERSION=4.5 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_VERSION=4.4.0-1 diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index ba7a3aa4..f5f19737 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.3/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ +PACKAGES_URL=https://packages.wazuh.com/4.5/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 46fceb1e..6d5ffd93 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,6 +222,9 @@ 127.0.0.1 ^localhost.localdomain$ + 4.5.0.1 + 4.5.0.2 + 208.67.220.220 diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index c9667ede..3f5793a9 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.5.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.5.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.5.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.5.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.5.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.1 + image: wazuh/wazuh-dashboard:4.5.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 4db508d6..25dec785 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,6 +222,9 @@ 127.0.0.1 ^localhost.localdomain$ + 4.5.0.1 + 4.5.0.2 + 208.67.220.220 diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index f5e8e3f8..0ba63872 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.4.1 + image: wazuh/wazuh-manager:4.5.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.4.1 + image: wazuh/wazuh-indexer:4.5.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.4.1 + image: wazuh/wazuh-dashboard:4.5.0 hostname: wazuh.dashboard restart: always ports: From b7bce45e8211af615356ad279526aa5feff01812 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 23 May 2022 10:02:54 -0300 Subject: [PATCH 27/42] bump release 4.5.0 --- multi-node/config/wazuh_cluster/wazuh_worker.conf | 4 ++-- single-node/config/wazuh_cluster/wazuh_manager.conf | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 6d5ffd93..933a3277 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,8 +222,8 @@ 127.0.0.1 ^localhost.localdomain$ - 4.5.0.1 - 4.5.0.2 + 4.4.0.1 + 4.4.0.2 208.67.220.220 diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 25dec785..6a622d98 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,8 +222,8 @@ 127.0.0.1 ^localhost.localdomain$ - 4.5.0.1 - 4.5.0.2 + 4.4.0.1 + 4.4.0.2 208.67.220.220 From e939010507a1e588ee4521a5c73ffcad3577f0cc Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 23 May 2022 10:45:23 -0300 Subject: [PATCH 28/42] bump release 4.5.0 --- multi-node/config/wazuh_cluster/wazuh_worker.conf | 3 --- single-node/config/wazuh_cluster/wazuh_manager.conf | 3 --- 2 files changed, 6 deletions(-) diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 933a3277..46fceb1e 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -222,9 +222,6 @@ 127.0.0.1 ^localhost.localdomain$ - 4.4.0.1 - 4.4.0.2 - 208.67.220.220 diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index 6a622d98..4db508d6 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -222,9 +222,6 @@ 127.0.0.1 ^localhost.localdomain$ - 4.4.0.1 - 4.4.0.2 - 208.67.220.220 From 7e0311e99a7234a050d0a31767026732b8192e34 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Fri, 1 Jul 2022 17:43:53 -0300 Subject: [PATCH 29/42] disable filebeat metrics --- build-docker-images/wazuh-manager/config/filebeat.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index 8d1823af..8beed808 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -22,10 +22,3 @@ output.elasticsearch: #ssl.key: logging.metrics.enabled: false - -seccomp: - default_action: allow - syscalls: - - action: allow - names: - - rseq From 02a75a76780882fb0a466c095f2c8996241f5f49 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Wed, 6 Jul 2022 17:35:35 -0300 Subject: [PATCH 30/42] Add fix to avoid GLIBC crash --- build-docker-images/wazuh-manager/config/filebeat.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index 8beed808..fcf80c3e 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -22,3 +22,10 @@ output.elasticsearch: #ssl.key: logging.metrics.enabled: false + +seccomp: +default_action: allow +syscalls: +- action: allow + names: + - rseq From ea11d66f42b564e4b50e65706e06486da0f5e9c1 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Wed, 6 Jul 2022 18:02:28 -0300 Subject: [PATCH 31/42] Add fix to avoid GLIBC crash, fix identation --- build-docker-images/wazuh-manager/config/filebeat.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml index fcf80c3e..8d1823af 100644 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -24,8 +24,8 @@ output.elasticsearch: logging.metrics.enabled: false seccomp: -default_action: allow -syscalls: -- action: allow - names: - - rseq + default_action: allow + syscalls: + - action: allow + names: + - rseq From 4caf18f12ce5fbcbc7fd79a51aa11c4956895821 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 22 Jul 2022 13:55:36 -0300 Subject: [PATCH 32/42] bump 4.3 into master --- build-docker-images/build-images.sh | 2 +- build-docker-images/build-images.yml | 16 ++++++++++++---- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index b6c23532..23b96a15 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.4.1 +WAZUH_IMAGE_VERSION=4.5.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 92be9b38..f65c26be 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -31,8 +31,12 @@ services: - filebeat_var:/var/lib/filebeat wazuh.indexer: - build: wazuh-indexer/ - image: wazuh/wazuh-indexer:4.5.0 + build: + context: wazuh-indexer/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} hostname: wazuh.indexer restart: always ports: @@ -48,8 +52,12 @@ services: hard: 65536 wazuh.dashboard: - build: wazuh-dashboard/ - image: wazuh/wazuh-dashboard:4.5.0 + build: + context: wazuh-dashboard/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} hostname: wazuh.dashboard restart: always ports: From 76a38f68b52c39d2e3ad8d72712000aa7d76a3f1 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Mon, 17 Oct 2022 10:23:59 -0300 Subject: [PATCH 33/42] bump 4.3 into master --- .env | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.env b/.env index 58ef3c4f..096b9644 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.4.1 -WAZUH_IMAGE_VERSION=4.4.1 +WAZUH_VERSION=4.5.0 +WAZUH_IMAGE_VERSION=4.5.0 WAZUH_TAG_REVISION=1 From dd46f8a2c17e13ab3f21d4223180aad1a2aa2592 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 1 Feb 2023 16:54:05 -0300 Subject: [PATCH 34/42] bump 4.6 version --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- build-docker-images/wazuh-dashboard/config/config.sh | 4 ++-- build-docker-images/wazuh-indexer/config/config.sh | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 7 +++++-- indexer-certs-creator/config/entrypoint.sh | 4 ++-- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 12 files changed, 32 insertions(+), 23 deletions(-) diff --git a/.env b/.env index 096b9644..d51cc0c4 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.5.0 -WAZUH_IMAGE_VERSION=4.5.0 +WAZUH_VERSION=4.6.0 +WAZUH_IMAGE_VERSION=4.6.0 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 76e84db8..c4244c3e 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.5.0 + - 4.6.0-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 277bb040..09bc360e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.6.0 +### Added + +- Update Wazuh to version [4.6.0](https://github.com/wazuh/wazuh/blob/v4.6.0/CHANGELOG.md#v460) + ## Wazuh Docker v4.5.0 ### Added diff --git a/README.md b/README.md index cb74e3cf..dc4848bb 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.6.0 | | | | v4.5.0 | | | | v4.4.0 | | | | v4.3.10 | | | diff --git a/VERSION b/VERSION index 5a1911b6..bcd17c34 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.5.0" -REVISION="40500" +WAZUH-DOCKER_VERSION="4.6.0" +REVISION="40600" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 23b96a15..09644c70 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.5.0 +WAZUH_IMAGE_VERSION=4.6.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 40e6ac67..94719b93 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.5/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ +PACKAGES_URL=https://packages.wazuh.com/4.6/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index ea4ec95c..e9fc21f1 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE} ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.5/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ +PACKAGES_URL=https://packages.wazuh.com/4.6/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index d4b1e344..75da6402 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,8 +1,11 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal -ARG WAZUH_VERSION=4.5.0 -ARG TEMPLATE_VERSION=4.5 +RUN rm /bin/sh && ln -s /bin/bash /bin/sh + +ARG WAZUH_VERSION +ARG WAZUH_TAG_REVISION +ARG TEMPLATE_VERSION=4.6 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_VERSION=4.4.0-1 diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index f5f19737..3f257157 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.5/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ +PACKAGES_URL=https://packages.wazuh.com/4.6/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 3f5793a9..754e990e 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.5.0 + image: wazuh/wazuh-manager:4.6.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.5.0 + image: wazuh/wazuh-manager:4.6.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.5.0 + image: wazuh/wazuh-indexer:4.6.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.5.0 + image: wazuh/wazuh-indexer:4.6.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.5.0 + image: wazuh/wazuh-indexer:4.6.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.5.0 + image: wazuh/wazuh-dashboard:4.6.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 0ba63872..1c2e4326 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.5.0 + image: wazuh/wazuh-manager:4.6.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.5.0 + image: wazuh/wazuh-indexer:4.6.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.5.0 + image: wazuh/wazuh-dashboard:4.6.0 hostname: wazuh.dashboard restart: always ports: From 57c63bc60e61cb29b4352438b7fb0d3b0e69d0a9 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 16 Feb 2023 13:08:31 -0300 Subject: [PATCH 35/42] add vuln scans --- .github/workflows/trivy-dashbaord-4-4.yml | 71 +++++++++++++++++++++++ .github/workflows/trivy-indexer-4-4.yml | 71 +++++++++++++++++++++++ .github/workflows/trivy-manager-4-4,yml | 71 +++++++++++++++++++++++ 3 files changed, 213 insertions(+) create mode 100644 .github/workflows/trivy-dashbaord-4-4.yml create mode 100644 .github/workflows/trivy-indexer-4-4.yml create mode 100644 .github/workflows/trivy-manager-4-4,yml diff --git a/.github/workflows/trivy-dashbaord-4-4.yml b/.github/workflows/trivy-dashbaord-4-4.yml new file mode 100644 index 00000000..bc8806ce --- /dev/null +++ b/.github/workflows/trivy-dashbaord-4-4.yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh dashboard + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh dashboard + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-dashboard.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-dashboard.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml new file mode 100644 index 00000000..3969ab62 --- /dev/null +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh indexer + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh indexer + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-indexer.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-indexer.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager-4-4,yml b/.github/workflows/trivy-manager-4-4,yml new file mode 100644 index 00000000..46f1d5bb --- /dev/null +++ b/.github/workflows/trivy-manager-4-4,yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh manager + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh manager + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-manager.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-manager.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file From 84a40b9eeab090085a9ac9153189317d57e08be8 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 16 Feb 2023 13:23:25 -0300 Subject: [PATCH 36/42] fix wazuh manager test name --- .../workflows/{trivy-manager-4-4,yml => trivy-manager-4-4.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{trivy-manager-4-4,yml => trivy-manager-4-4.yml} (100%) diff --git a/.github/workflows/trivy-manager-4-4,yml b/.github/workflows/trivy-manager-4-4.yml similarity index 100% rename from .github/workflows/trivy-manager-4-4,yml rename to .github/workflows/trivy-manager-4-4.yml From aec90c2f3df59fd7fe9bfe26c31f507a5303313b Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 16 Feb 2023 16:10:54 -0300 Subject: [PATCH 37/42] change schedule --- .github/workflows/trivy-dashbaord-4-4.yml | 2 +- .github/workflows/trivy-indexer-4-4.yml | 2 +- .github/workflows/trivy-manager-4-4.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy-dashbaord-4-4.yml b/.github/workflows/trivy-dashbaord-4-4.yml index bc8806ce..0740e438 100644 --- a/.github/workflows/trivy-dashbaord-4-4.yml +++ b/.github/workflows/trivy-dashbaord-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '*/30 * * * *' + - cron: '34 2 * * *' workflow_dispatch: permissions: diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml index 3969ab62..fe9c0b1b 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '*/30 * * * *' + - cron: '34 2 * * *' workflow_dispatch: permissions: diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager-4-4.yml index 46f1d5bb..c9bd289b 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '*/30 * * * *' + - cron: '34 2 * * *' workflow_dispatch: permissions: From 750aa90b91d4f05ad30d6b3c264c070f4709a619 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 17 Feb 2023 16:16:22 -0300 Subject: [PATCH 38/42] change cron schedule --- .github/workflows/trivy-dashbaord-4-4.yml | 2 +- .github/workflows/trivy-indexer-4-4.yml | 2 +- .github/workflows/trivy-manager-4-4.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy-dashbaord-4-4.yml b/.github/workflows/trivy-dashbaord-4-4.yml index 0740e438..eb3f3b4f 100644 --- a/.github/workflows/trivy-dashbaord-4-4.yml +++ b/.github/workflows/trivy-dashbaord-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '34 2 * * *' + - cron: '34 2 * * 1' workflow_dispatch: permissions: diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml index fe9c0b1b..d48d0d85 100644 --- a/.github/workflows/trivy-indexer-4-4.yml +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '34 2 * * *' + - cron: '34 2 * * 1' workflow_dispatch: permissions: diff --git a/.github/workflows/trivy-manager-4-4.yml b/.github/workflows/trivy-manager-4-4.yml index c9bd289b..8a886871 100644 --- a/.github/workflows/trivy-manager-4-4.yml +++ b/.github/workflows/trivy-manager-4-4.yml @@ -14,7 +14,7 @@ on: - master - stable schedule: - - cron: '34 2 * * *' + - cron: '34 2 * * 1' workflow_dispatch: permissions: From fed4302744e05f8993d426ae21f0d3d28068d3cd Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 17 Feb 2023 16:23:30 -0300 Subject: [PATCH 39/42] change filename --- .../{trivy-dashbaord-4-4.yml => trivy-dashboard-4-4.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{trivy-dashbaord-4-4.yml => trivy-dashboard-4-4.yml} (100%) diff --git a/.github/workflows/trivy-dashbaord-4-4.yml b/.github/workflows/trivy-dashboard-4-4.yml similarity index 100% rename from .github/workflows/trivy-dashbaord-4-4.yml rename to .github/workflows/trivy-dashboard-4-4.yml From 5abe95a0f136d44821b9814724808a30b63bc0a0 Mon Sep 17 00:00:00 2001 From: Jesse Roland Date: Tue, 18 Apr 2023 09:11:08 -0500 Subject: [PATCH 40/42] Add DASHBOARD_USERNAME and DASHBOARD_PASSWORD environment variables to the dashboard container. Resolves https://github.com/wazuh/wazuh-docker/issues/823 --- multi-node/docker-compose.yml | 2 ++ single-node/docker-compose.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 754e990e..cc04171c 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -147,6 +147,8 @@ services: - WAZUH_API_URL="https://wazuh.master" - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- + - DASHBOARD_USERNAME=kibanaserver + - DASHBOARD_PASSWORD=kibanaserver volumes: - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1c2e4326..94db30d6 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -73,6 +73,8 @@ services: - INDEXER_USERNAME=admin - INDEXER_PASSWORD=SecretPassword - WAZUH_API_URL=https://wazuh.manager + - DASHBOARD_USERNAME=kibanaserver + - DASHBOARD_PASSWORD=kibanaserver - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: From 7427eff84732d5004b13d529d383ef6bf3256c53 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno Date: Thu, 18 May 2023 22:14:26 +0200 Subject: [PATCH 41/42] Added missing config --- .github/workflows/push.yml | 4 +- CHANGELOG.md | 72 ++++++ README.md | 2 + build-docker-images/build-images.yml | 8 +- .../wazuh-dashboard/Dockerfile | 3 +- .../wazuh-indexer/config/config.sh | 2 +- build-docker-images/wazuh-manager/Dockerfile | 4 +- docker-compose.yml | 82 ------- indexer-certs-creator/config/entrypoint.sh | 4 +- kibana-odfe/Dockerfile | 59 ----- kibana/Dockerfile | 64 ------ production-cluster.yml | 206 ------------------ xpack-compose.yml | 186 ---------------- xpack-from-sources.yml | 192 ---------------- 14 files changed, 88 insertions(+), 800 deletions(-) delete mode 100644 docker-compose.yml delete mode 100644 kibana-odfe/Dockerfile delete mode 100644 kibana/Dockerfile delete mode 100644 production-cluster.yml delete mode 100644 xpack-compose.yml delete mode 100644 xpack-from-sources.yml diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3c84f3f9..51077968 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -49,8 +49,8 @@ jobs: with: version: v0.3.16 - - name: Execute Goss tests (wazuh-odfe) - run: dgoss run wazuh/wazuh-manager:4.5.0 + - name: Execute Goss tests (wazuh-manager) + run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 09bc360e..86f47246 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,14 +11,86 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.5.0](https://github.com/wazuh/wazuh/blob/v4.5.0/CHANGELOG.md#v450) +## Wazuh Docker v4.4.1 +### Added + +- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) + ## Wazuh Docker v4.4.0 ### Added - Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440) +## Wazuh Docker v4.3.11 +### Added + +- Update Wazuh to version [4.3.11](https://github.com/wazuh/wazuh/blob/v4.3.11/CHANGELOG.md#v4311) + +## Wazuh Docker v4.3.10 +### Added + +- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310) + + +## Wazuh Docker v4.3.9 +### Added + +- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439) + + +## Wazuh Docker v4.3.8 +### Added + +- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438) + +## Wazuh Docker v4.3.7 +### Added + +- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437) + +## Wazuh Docker v4.3.6 +### Added + +- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436) + +## Wazuh Docker v4.3.5 +### Added + +- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435) + +## Wazuh Docker v4.3.4 +### Added + +- Update Wazuh to version [4.3.4](https://github.com/wazuh/wazuh/blob/v4.3.4/CHANGELOG.md#v434) + +## Wazuh Docker v4.3.3 +### Added + +- Update Wazuh to version [4.3.3](https://github.com/wazuh/wazuh/blob/v4.3.3/CHANGELOG.md#v433) + +## Wazuh Docker v4.3.2 +### Added + +- Update Wazuh to version [4.3.2](https://github.com/wazuh/wazuh/blob/v4.3.2/CHANGELOG.md#v432) + +## Wazuh Docker v4.3.1 +### Added + +- Update Wazuh to version [4.3.1](https://github.com/wazuh/wazuh/blob/v4.3.1/CHANGELOG.md#v431) + ## Wazuh Docker v4.3.0 ### Added +- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430) + +## Wazuh Docker v4.2.7 +### Added + +- Update Wazuh to version [4.2.7](https://github.com/wazuh/wazuh/blob/v4.2.7/CHANGELOG.md#v427) + +## Wazuh Docker v4.2.6 +### Added + - Update Wazuh to version [4.2.6](https://github.com/wazuh/wazuh/blob/v4.2.6/CHANGELOG.md#v426) ## Wazuh Docker v4.2.5 diff --git a/README.md b/README.md index dc4848bb..6ca743d4 100644 --- a/README.md +++ b/README.md @@ -197,7 +197,9 @@ WAZUH_MONITORING_REPLICAS=0 ## |---------------|---------|--------| | v4.6.0 | | | | v4.5.0 | | | +| v4.4.1 | | | | v4.4.0 | | | +| v4.3.11 | | | | v4.3.10 | | | | v4.3.9 | | | | v4.3.8 | | | diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index f65c26be..52984bf9 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -3,8 +3,12 @@ version: '3.7' services: wazuh.manager: - build: wazuh-manager/ - image: wazuh/wazuh-manager:4.5.0 + build: + context: wazuh-manager/ + args: + WAZUH_VERSION: ${WAZUH_VERSION} + WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} hostname: wazuh.manager restart: always ports: diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 003d7d21..1b95ca88 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,7 +1,8 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) FROM ubuntu:focal AS builder -ARG WAZUH_VERSION=4.5.0 +ARG WAZUH_VERSION +ARG WAZUH_TAG_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG WAZUH_UI_REVISION=1 diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index e9fc21f1..adfae164 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=4.5.0 +export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} export LOG_DIR=/var/log/${NAME} export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 75da6402..da310bd6 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -8,9 +8,7 @@ ARG WAZUH_TAG_REVISION ARG TEMPLATE_VERSION=4.6 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.4.0-1 -ARG TEMPLATE_VERSION="master" -ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" +ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index e7ed2f7d..00000000 --- a/docker-compose.yml +++ /dev/null @@ -1,82 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh: - image: wazuh/wazuh-odfe:4.4.0 - hostname: wazuh-manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTIC_USERNAME=admin - - ELASTIC_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none - volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.13.2 - hostname: elasticsearch - restart: always - ports: - - "9200:9200" - environment: - - discovery.type=single-node - - cluster.name=wazuh-cluster - - network.host=0.0.0.0 - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - - kibana: - image: wazuh/wazuh-kibana-odfe:4.4.0 - hostname: kibana - restart: always - ports: - - 443:5601 - environment: - - ELASTICSEARCH_USERNAME=admin - - ELASTICSEARCH_PASSWORD=admin - - SERVER_SSL_ENABLED=true - - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert - - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key - - depends_on: - - elasticsearch - links: - - elasticsearch:elasticsearch - - wazuh:wazuh - -volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: - filebeat_etc: - filebeat_var: diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 3f257157..7568812a 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -54,8 +54,8 @@ cp /certificates/root-ca.key /certificates/root-ca-manager.key chown 101:101 /certificates/root-ca-manager.pem chown 101:101 /certificates/root-ca-manager.key -for i in ${node_names[@]}; -do +for i in ${node_names[@]}; +do chown 101:101 "/certificates/${i}.pem" chown 101:101 "/certificates/${i}-key.pem" done diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile deleted file mode 100644 index d133d140..00000000 --- a/kibana-odfe/Dockerfile +++ /dev/null @@ -1,59 +0,0 @@ -# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) -FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 -USER kibana -ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.4.0 -ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" - -WORKDIR /usr/share/kibana -RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip - -WORKDIR / -USER root -COPY config/entrypoint.sh ./entrypoint.sh -RUN chmod 755 ./entrypoint.sh - -ENV PATTERN="" \ - CHECKS_PATTERN="" \ - CHECKS_TEMPLATE="" \ - CHECKS_API="" \ - CHECKS_SETUP="" \ - EXTENSIONS_PCI="" \ - EXTENSIONS_GDPR="" \ - EXTENSIONS_HIPAA="" \ - EXTENSIONS_NIST="" \ - EXTENSIONS_TSC="" \ - EXTENSIONS_AUDIT="" \ - EXTENSIONS_OSCAP="" \ - EXTENSIONS_CISCAT="" \ - EXTENSIONS_AWS="" \ - EXTENSIONS_GCP="" \ - EXTENSIONS_VIRUSTOTAL="" \ - EXTENSIONS_OSQUERY="" \ - EXTENSIONS_DOCKER="" \ - APP_TIMEOUT="" \ - API_SELECTOR="" \ - IP_SELECTOR="" \ - IP_IGNORE="" \ - WAZUH_MONITORING_ENABLED="" \ - WAZUH_MONITORING_FREQUENCY="" \ - WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" - -USER kibana - -COPY ./config/custom_welcome /tmp/custom_welcome -COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ -RUN chmod +x ./welcome_wazuh.sh -ARG CHANGE_WELCOME="true" -RUN ./welcome_wazuh.sh - -COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml -COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ -RUN chmod +x ./wazuh_app_config.sh - -COPY --chown=kibana:kibana ./config/kibana_settings.sh ./ -RUN chmod +x ./kibana_settings.sh - -ENTRYPOINT ./entrypoint.sh diff --git a/kibana/Dockerfile b/kibana/Dockerfile deleted file mode 100644 index d0a17f71..00000000 --- a/kibana/Dockerfile +++ /dev/null @@ -1,64 +0,0 @@ -# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) -FROM docker.elastic.co/kibana/kibana:7.10.2 -USER kibana -ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.4.0 -ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" - -WORKDIR /usr/share/kibana -RUN ./bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-${WAZUH_APP_VERSION}-1.zip - -ENV PATTERN="" \ - CHECKS_PATTERN="" \ - CHECKS_TEMPLATE="" \ - CHECKS_API="" \ - CHECKS_SETUP="" \ - EXTENSIONS_PCI="" \ - EXTENSIONS_GDPR="" \ - EXTENSIONS_HIPAA="" \ - EXTENSIONS_NIST="" \ - EXTENSIONS_TSC="" \ - EXTENSIONS_AUDIT="" \ - EXTENSIONS_OSCAP="" \ - EXTENSIONS_CISCAT="" \ - EXTENSIONS_AWS="" \ - EXTENSIONS_GCP="" \ - EXTENSIONS_VIRUSTOTAL="" \ - EXTENSIONS_OSQUERY="" \ - EXTENSIONS_DOCKER="" \ - APP_TIMEOUT="" \ - API_SELECTOR="" \ - IP_SELECTOR="" \ - IP_IGNORE="" \ - WAZUH_MONITORING_ENABLED="" \ - WAZUH_MONITORING_FREQUENCY="" \ - WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" \ - XPACK_CANVAS="true" \ - XPACK_LOGS="true" \ - XPACK_INFRA="true" \ - XPACK_ML="true" \ - XPACK_DEVTOOLS="true" \ - XPACK_MONITORING="true" \ - XPACK_APM="true" - -WORKDIR / -USER kibana - -COPY --chown=kibana:kibana config/entrypoint.sh ./entrypoint.sh -RUN chmod 755 ./entrypoint.sh - -RUN printf "\nserver.defaultRoute: /app/wazuh\n" >> /usr/share/kibana/config/kibana.yml - -COPY --chown=kibana:kibana ./config/wazuh.yml /usr/share/kibana/data/wazuh/config/wazuh.yml -COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ -RUN chmod +x ./wazuh_app_config.sh - -COPY --chown=kibana:kibana ./config/kibana_settings.sh ./ -RUN chmod +x ./kibana_settings.sh - -COPY --chown=kibana:kibana ./config/xpack_config.sh ./ -RUN chmod +x ./xpack_config.sh - -ENTRYPOINT ./entrypoint.sh diff --git a/production-cluster.yml b/production-cluster.yml deleted file mode 100644 index 64502411..00000000 --- a/production-cluster.yml +++ /dev/null @@ -1,206 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh-master: - image: wazuh/wazuh-odfe:4.4.0 - hostname: wazuh-master - restart: always - ports: - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTIC_USERNAME=admin - - ELASTIC_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ossec-api-configuration:/var/ossec/api/configuration - - ossec-etc:/var/ossec/etc - - ossec-logs:/var/ossec/logs - - ossec-queue:/var/ossec/queue - - ossec-var-multigroups:/var/ossec/var/multigroups - - ossec-integrations:/var/ossec/integrations - - ossec-active-response:/var/ossec/active-response/bin - - ossec-agentless:/var/ossec/agentless - - ossec-wodles:/var/ossec/wodles - - filebeat-etc:/etc/filebeat - - filebeat-var:/var/lib/filebeat - - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem - - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh-worker: - image: wazuh/wazuh-odfe:4.4.0 - hostname: wazuh-worker - restart: always - environment: - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTIC_USERNAME=admin - - ELASTIC_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - volumes: - - worker-ossec-api-configuration:/var/ossec/api/configuration - - worker-ossec-etc:/var/ossec/etc - - worker-ossec-logs:/var/ossec/logs - - worker-ossec-queue:/var/ossec/queue - - worker-ossec-var-multigroups:/var/ossec/var/multigroups - - worker-ossec-integrations:/var/ossec/integrations - - worker-ossec-active-response:/var/ossec/active-response/bin - - worker-ossec-agentless:/var/ossec/agentless - - worker-ossec-wodles:/var/ossec/wodles - - worker-filebeat-etc:/etc/filebeat - - worker-filebeat-var:/var/lib/filebeat - - ./production_cluster/ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem - - ./production_cluster/ssl_certs/filebeat.key:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf - - elasticsearch: - image: amazon/opendistro-for-elasticsearch:1.13.2 - hostname: elasticsearch - restart: always - ports: - - "9200:9200" - environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - elastic-data-1:/usr/share/elasticsearch/data - - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem - - ./production_cluster/ssl_certs/node1.key:/usr/share/elasticsearch/config/node1.key - - ./production_cluster/ssl_certs/node1.pem:/usr/share/elasticsearch/config/node1.pem - - ./production_cluster/ssl_certs/admin.pem:/usr/share/elasticsearch/config/admin.pem - - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - elasticsearch-2: - image: amazon/opendistro-for-elasticsearch:1.13.2 - hostname: elasticsearch-2 - restart: always - environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - elastic-data-2:/usr/share/elasticsearch/data - - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem - - ./production_cluster/ssl_certs/node2.key:/usr/share/elasticsearch/config/node2.key - - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem - - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - elasticsearch-3: - image: amazon/opendistro-for-elasticsearch:1.13.2 - hostname: elasticsearch-3 - restart: always - environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - elastic-data-3:/usr/share/elasticsearch/data - - ./production_cluster/ssl_certs/root-ca.pem:/usr/share/elasticsearch/config/root-ca.pem - - ./production_cluster/ssl_certs/node3.key:/usr/share/elasticsearch/config/node3.key - - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem - - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml - - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - kibana: - image: wazuh/wazuh-kibana-odfe:4.4.0 - hostname: kibana - restart: always - ports: - - 5601:5601 - environment: - - ELASTICSEARCH_USERNAME=admin - - ELASTICSEARCH_PASSWORD=SecretPassword - - SERVER_SSL_ENABLED=true - - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/cert.pem - - SERVER_SSL_KEY=/usr/share/kibana/config/key.pem - - WAZUH_API_URL="https://wazuh-master" - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ./production_cluster/kibana_ssl/cert.pem:/usr/share/kibana/config/cert.pem - - ./production_cluster/kibana_ssl/key.pem:/usr/share/kibana/config/key.pem - - depends_on: - - elasticsearch - links: - - elasticsearch:elasticsearch - - wazuh-master:wazuh-master - - nginx: - image: nginx:stable - hostname: nginx - restart: always - ports: - - "80:80" - - "443:443" - - "1514:1514" - depends_on: - - wazuh-master - - wazuh-worker - - kibana - links: - - wazuh-master:wazuh-master - - wazuh-worker:wazuh-worker - - kibana:kibana - volumes: - - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro - -volumes: - ossec-api-configuration: - ossec-etc: - ossec-logs: - ossec-queue: - ossec-var-multigroups: - ossec-integrations: - ossec-active-response: - ossec-agentless: - ossec-wodles: - filebeat-etc: - filebeat-var: - worker-ossec-api-configuration: - worker-ossec-etc: - worker-ossec-logs: - worker-ossec-queue: - worker-ossec-var-multigroups: - worker-ossec-integrations: - worker-ossec-active-response: - worker-ossec-agentless: - worker-ossec-wodles: - worker-filebeat-etc: - worker-filebeat-var: - elastic-data-1: - elastic-data-2: - elastic-data-3: diff --git a/xpack-compose.yml b/xpack-compose.yml deleted file mode 100644 index 8fdb12e7..00000000 --- a/xpack-compose.yml +++ /dev/null @@ -1,186 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh: - image: wazuh/wazuh:4.4.0 - hostname: wazuh-manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTIC_USERNAME=elastic - - ELASTIC_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=none - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt - - SSL_CERTIFICATE=/etc/ssl/wazuh.crt - - SSL_KEY=/etc/ssl/wazuh.key - volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - ./xpack/ca/ca.crt:/etc/ssl/ca.crt - - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt - - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key - - - elasticsearch: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 - hostname: elasticsearch - restart: always - ports: - - "9200:9200" - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - elasticsearch2: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 - hostname: elasticsearch2 - restart: always - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch2 - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - elasticsearch3: - image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 - hostname: elasticsearch3 - restart: always - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch3 - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - - - kibana: - image: wazuh/wazuh-kibana:4.4.0 - hostname: kibana - restart: always - ports: - - 443:5601 - environment: - - SERVERNAME=localhost - - ELASTICSEARCH_USERNAME=elastic - - ELASTICSEARCH_PASSWORD=SecretPassword - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTICSEARCH_HOSTS=https://elasticsearch:9200 - - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt - - SERVER_SSL_ENABLED=true - - XPACK_SECURITY_ENABLED=true - - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key - - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt - volumes: - - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt - - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key - - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt - depends_on: - - elasticsearch - links: - - elasticsearch:elasticsearch - - wazuh:wazuh - -volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: - filebeat_etc: - filebeat_var: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml deleted file mode 100644 index ff5fb355..00000000 --- a/xpack-from-sources.yml +++ /dev/null @@ -1,192 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh: - build: - context: wazuh-odfe/ - args: - - FILEBEAT_CHANNEL=filebeat - - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.4.0 - hostname: wazuh-manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTIC_USERNAME=elastic - - ELASTIC_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=none - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/ca.crt - - SSL_CERTIFICATE=/etc/ssl/wazuh.crt - - SSL_KEY=/etc/ssl/wazuh.key - volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - ./xpack/ca/ca.crt:/etc/ssl/ca.crt - - ./xpack/wazuh/wazuh.crt:/etc/ssl/wazuh.crt - - ./xpack/wazuh/wazuh.key:/etc/ssl/wazuh.key - - - elasticsearch: - image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 - hostname: elasticsearch - restart: always - ports: - - "9200:9200" - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - elasticsearch2: - image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 - hostname: elasticsearch2 - restart: always - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch2 - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - elasticsearch3: - image: docker.elastic.co/elasticsearch/elasticsearch:7.11.2 - hostname: elasticsearch3 - restart: always - environment: - - cluster.name=wazuh-cluster - - node.name=elasticsearch3 - - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - - bootstrap.memory_lock=true - - xpack.license.self_generated.type=basic - - xpack.security.enabled=true - - xpack.security.http.ssl.enabled=true - - xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.http.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - - xpack.security.transport.ssl.enabled=true - - xpack.security.transport.ssl.verification_mode=certificate - - xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/ca.crt - - xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/elasticsearch.key - - xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/elasticsearch.crt - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key - - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - - - kibana: - build: kibana/ - image: wazuh/wazuh-kibana:4.4.0 - hostname: kibana - restart: always - ports: - - 443:5601 - environment: - - SERVERNAME=localhost - - ELASTICSEARCH_USERNAME=elastic - - ELASTICSEARCH_PASSWORD=SecretPassword - - ELASTICSEARCH_URL=https://elasticsearch:9200 - - ELASTICSEARCH_HOSTS=https://elasticsearch:9200 - - ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/ca.crt - - SERVER_SSL_ENABLED=true - - XPACK_SECURITY_ENABLED=true - - SERVER_SSL_KEY=/usr/share/kibana/config/kibana.key - - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/kibana.crt - volumes: - - ./xpack/ca/ca.crt:/usr/share/kibana/config/ca.crt - - ./xpack/kibana/kibana.key:/usr/share/kibana/config/kibana.key - - ./xpack/kibana/kibana.crt:/usr/share/kibana/config/kibana.crt - depends_on: - - elasticsearch - links: - - elasticsearch:elasticsearch - - wazuh:wazuh - -volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: - filebeat_etc: - filebeat_var: From 6a98b87b8eb3ddd032c8b94ceae60dd3be447b98 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 22 Jun 2023 17:26:55 -0300 Subject: [PATCH 42/42] bump 4.7 version --- .env | 4 ++-- .github/.goss.yaml | 2 +- CHANGELOG.md | 5 +++++ README.md | 1 + VERSION | 4 ++-- build-docker-images/build-images.sh | 2 +- build-docker-images/wazuh-dashboard/config/config.sh | 4 ++-- build-docker-images/wazuh-indexer/config/config.sh | 4 ++-- build-docker-images/wazuh-manager/Dockerfile | 2 +- indexer-certs-creator/config/entrypoint.sh | 4 ++-- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 12 files changed, 28 insertions(+), 22 deletions(-) diff --git a/.env b/.env index d51cc0c4..a4909eb4 100755 --- a/.env +++ b/.env @@ -1,3 +1,3 @@ -WAZUH_VERSION=4.6.0 -WAZUH_IMAGE_VERSION=4.6.0 +WAZUH_VERSION=4.7.0 +WAZUH_IMAGE_VERSION=4.7.0 WAZUH_TAG_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index c4244c3e..95764f97 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.6.0-1 + - 4.7.0-1 port: tcp:1514: listening: true diff --git a/CHANGELOG.md b/CHANGELOG.md index 136dd505..b240cf18 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.7.0 +### Added + +- Update Wazuh to version [4.7.0](https://github.com/wazuh/wazuh/blob/v4.7.0/CHANGELOG.md#v470) + ## Wazuh Docker v4.6.0 ### Added diff --git a/README.md b/README.md index 8a9df5c9..6356a6c4 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,7 @@ WAZUH_MONITORING_REPLICAS=0 ## | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.7.0 | | | | v4.6.0 | | | | v4.5.0 | | | | v4.4.5 | | | diff --git a/VERSION b/VERSION index bcd17c34..aa9abeed 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.6.0" -REVISION="40600" +WAZUH-DOCKER_VERSION="4.7.0" +REVISION="40700" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 09644c70..ded56d43 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.6.0 +WAZUH_IMAGE_VERSION=4.7.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 94719b93..8cdb1a01 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.6/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ +PACKAGES_URL=https://packages.wazuh.com/4.7/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index adfae164..0bdd1bef 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -53,8 +53,8 @@ tar -xf ${INDEXER_FILE} ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.6/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ +PACKAGES_URL=https://packages.wazuh.com/4.7/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index da310bd6..277b6e6c 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -5,7 +5,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -ARG TEMPLATE_VERSION=4.6 +ARG TEMPLATE_VERSION=4.7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 7568812a..03d866e7 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.6/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.6/ +PACKAGES_URL=https://packages.wazuh.com/4.7/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.7/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index cc04171c..1ecbe45f 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.6.0 + image: wazuh/wazuh-manager:4.7.0 hostname: wazuh.master restart: always ports: @@ -38,7 +38,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.6.0 + image: wazuh/wazuh-manager:4.7.0 hostname: wazuh.worker restart: always environment: @@ -67,7 +67,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.6.0 + image: wazuh/wazuh-indexer:4.7.0 hostname: wazuh1.indexer restart: always ports: @@ -93,7 +93,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.6.0 + image: wazuh/wazuh-indexer:4.7.0 hostname: wazuh2.indexer restart: always environment: @@ -115,7 +115,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.6.0 + image: wazuh/wazuh-indexer:4.7.0 hostname: wazuh3.indexer restart: always environment: @@ -137,7 +137,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.6.0 + image: wazuh/wazuh-dashboard:4.7.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 94db30d6..79919e53 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.6.0 + image: wazuh/wazuh-manager:4.7.0 hostname: wazuh.manager restart: always ports: @@ -39,7 +39,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.6.0 + image: wazuh/wazuh-indexer:4.7.0 hostname: wazuh.indexer restart: always ports: @@ -64,7 +64,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.6.0 + image: wazuh/wazuh-dashboard:4.7.0 hostname: wazuh.dashboard restart: always ports: