Using phusion/baseimage for Wazuh manager, closes #19

wazuh/Dockerfile

@@ -1,16 +1,15 @@
-FROM centos:latest
+FROM phusion/baseimage:latest
 ARG FILEBEAT_VERSION=5.6.4
-COPY config/*.repo /etc/yum.repos.d/
 
-RUN yum -y update; yum clean all;
+RUN apt-get update; apt-get -y dist-upgrade
-RUN yum -y install epel-release openssl useradd which; yum clean all
+RUN apt-get -y install openssl postfix bsd-mailx curl apt-transport-https lsb-release
-RUN yum -y install postfix mailx cyrus-sasl cyrus-sasl-plain; yum clean all
 RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
-RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - &&\
+RUN curl --silent --location https://deb.nodesource.com/setup_6.x | bash - &&\
-    yum install -y nodejs
+    apt-get install -y nodejs
-RUN yum install -y wazuh-manager wazuh-api
+RUN curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
-
+RUN echo "deb https://packages.wazuh.com/apt $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/wazuh.list
+RUN apt-get update && apt-get -y install wazuh-manager wazuh-api expect
 
 ADD config/data_dirs.env /data_dirs.env
 ADD config/init.bash /init.bash
@@ -19,10 +18,8 @@ RUN chmod 755 /init.bash &&\
   sync && /init.bash &&\
   sync && rm /init.bash
 
-RUN sed -i 's/inet_protocols = all/inet_protocols = ipv4/g' /etc/postfix/main.cf
+RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
-
+    dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm filebeat-${FILEBEAT_VERSION}-amd64.deb
-RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm &&\
-  rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm filebeat-${FILEBEAT_VERSION}-x86_64.rpm
 
 COPY config/filebeat.yml /etc/filebeat/
 

wazuh/config/run.sh

@@ -15,12 +15,31 @@ source /data_dirs.env
 FIRST_TIME_INSTALLATION=false
 DATA_PATH=/var/ossec/data
 
+print() {
+    echo -e $1
+}
+
+error_and_exit() {
+    echo "Error executing command: '$1'."
+    echo 'Exiting.'
+    exit 1
+}
+
+exec_cmd() {
+    eval $1 > /dev/null 2>&1 || error_and_exit "$1"
+}
+
+
+edit_configuration() { # $1 -> setting,  $2 -> value
+    sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${DATA_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
+}
+
 for ossecdir in "${DATA_DIRS[@]}"; do
   if [ ! -e "${DATA_PATH}/${ossecdir}" ]
   then
-    echo "Installing ${ossecdir}"
+    print "Installing ${ossecdir}"
-    mkdir -p $(dirname ${DATA_PATH}/${ossecdir})
+    exec_cmd "mkdir -p $(dirname ${DATA_PATH}/${ossecdir})"
-    cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}
+    exec_cmd "cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}"
     FIRST_TIME_INSTALLATION=true
   fi
 done
@@ -30,50 +49,45 @@ chgrp ossec ${DATA_PATH}/process_list
 chmod g+rw ${DATA_PATH}/process_list
 
 AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
+API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
 
 if [ $FIRST_TIME_INSTALLATION == true ]
 then
-
   if [ $AUTO_ENROLLMENT_ENABLED == true ]
   then
     if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
     then
-      echo "Creating ossec-authd key and cert"
+      print "Creating ossec-authd key and cert"
-      openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096
+      exec_cmd "openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096"
-      openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key\
+      exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key -out ${DATA_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
-        -out ${DATA_PATH}/etc/sslmanager.cert -days 3650\
+    fi
-        -subj /CN=${HOSTNAME}/
+  fi
+  if [ $API_GENERATE_CERTS == true ]
+  then
+    if [ ! -e ${DATA_PATH}/api/configuration/ssl/server.crt ]
+    then
+      print "Enabling Wazuh API HTTPS"
+      edit_configuration "https" "yes"
+      print "Create Wazuh API key and cert"
+      exec_cmd "openssl genrsa -out ${DATA_PATH}/api/configuration/ssl/server.key 4096"
+      exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/api/configuration/ssl/server.key -out ${DATA_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
     fi
   fi
 fi
 
 function ossec_shutdown(){
-  /var/ossec/bin/ossec-control stop;
+  ${DATA_PATH}/bin/ossec-control stop;
-  if [ $AUTO_ENROLLMENT_ENABLED == true ]
-  then
-     kill $AUTHD_PID
-  fi
 }
 
+
 # Trap exit signals and do a proper shutdown
 trap "ossec_shutdown; exit" SIGINT SIGTERM
 
 chmod -R g+rw ${DATA_PATH}
 
-if [ $AUTO_ENROLLMENT_ENABLED == true ]
+service postfix start
-then
+service wazuh-api start
-  echo "Starting ossec-authd..."
+service wazuh-manager start
-  /var/ossec/bin/ossec-authd -p 1515 -g ossec $AUTHD_OPTIONS >/dev/null 2>&1 &
+service filebeat start
-  AUTHD_PID=$!
-fi
-sleep 15 # give ossec a reasonable amount of time to start before checking status
-LAST_OK_DATE=`date +%s`
-
-## Start services
-/usr/sbin/postfix start
-/bin/node /var/ossec/api/app.js &
-/usr/bin/filebeat.sh &
-/var/ossec/bin/ossec-control restart
-
 
 tail -f /var/ossec/logs/ossec.log