fix securityadmin.sh for wazuh-indexer

wazuh-indexer/Dockerfile

@@ -52,7 +52,9 @@ WORKDIR $INSTALL_DIR
 
 COPY config/entrypoint.sh /
 
-RUN chmod 700 /entrypoint.sh
+COPY config/securityadmin.sh /
+
+RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh
 
 COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
 COPY --from=builder --chown=0:0 /tini /tini
@@ -60,7 +62,9 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/etc/init.d/wazuh-indexer /
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
 COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
-COPY --from=builder --chown=1000:10000 /debian/wazuh-indexer/etc/wazuh-indexer /etc/wazuh-indexer
+COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/etc/wazuh-indexer /etc/wazuh-indexer
+COPY config/opensearch.yml /etc/wazuh-indexer/
+RUN chmod 660 /etc/wazuh-indexer/opensearch.yml && chown 1000:1000 /etc/wazuh-indexer/opensearch.yml
 
 RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
     mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
@@ -70,7 +74,6 @@ RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer &&
 # Services ports
 EXPOSE 9700
 
-#ENTRYPOINT [ "/entrypoint.sh" ]
 
 ENTRYPOINT ["/tini", "--", "/entrypoint.sh"]
 # Dummy overridable parameter parsed by entrypoint

wazuh-indexer/config/entrypoint.sh

@@ -8,7 +8,10 @@ export USER=wazuh-indexer
 export INSTALLATION_DIR=/usr/share/wazuh-indexer
 export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
 export JAVA_HOME=${INSTALLATION_DIR}/jdk
-export FILE=${INSTALLATION_DIR}/start
+export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" /etc/wazuh-indexer/opensearch.yml)
+export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" /etc/wazuh-indexer/opensearch.yml)
+export CERT="/etc/wazuh-indexer/certs/admin.pem"
+export KEY="/etc/wazuh-indexer/certs/admin-key.pem"
 
 run_as_other_user_if_needed() {
   if [[ "$(id -u)" == "0" ]]; then
@@ -26,8 +29,6 @@ run_as_other_user_if_needed() {
 # or simply to run /bin/bash to check the image
 if [[ "$1" != "opensearchwrapper" ]]; then
   if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
-    # centos:7 chroot doesn't have the `--skip-chdir` option and
-    # changes our CWD.
     # Rewrite CMD args to replace $1 with `opensearch` explicitly,
     # so that we are backwards compatible with the docs
     # from the previous Elasticsearch versions<6
@@ -86,4 +87,9 @@ if [[ "$(id -u)" == "0" ]]; then
   fi
 fi
 
+if [[ "$DISCOVERY" == "single-node" ]]; then
+  # run securityadmin.sh for single node
+  nohup /securityadmin.sh &
+fi
+
 run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"

wazuh-indexer/config/opensearch.yml

@@ -0,0 +1,36 @@
+network.host: "0.0.0.0"
+node.name: "wazuh1.indexer"
+http.port: 9700-9799
+transport.tcp.port: 9800-9899
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+discovery.type: single-node
+compatibility.override_main_response_version: true
+###############################################################################
+#                                                                             #
+#         WARNING: Insecure demo certificates set up in this file.            #
+#                  Please change on production cluster!                       #
+#                                                                             #
+###############################################################################
+plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/demo-indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/demo-indexer-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/demo-indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/demo-indexer-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Demo,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=demo-indexer,OU=Demo,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.system_indices.enabled: true
+plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
+

wazuh-indexer/config/securityadmin.sh

@@ -0,0 +1,2 @@
+sleep 50
+bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9800 -icl