fix securityadmin.sh for wazuh-indexer

wazuh-indexer/config/entrypoint.sh

@@ -8,7 +8,10 @@ export USER=wazuh-indexer
 export INSTALLATION_DIR=/usr/share/wazuh-indexer
 export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
 export JAVA_HOME=${INSTALLATION_DIR}/jdk
-export FILE=${INSTALLATION_DIR}/start
+export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" /etc/wazuh-indexer/opensearch.yml)
+export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" /etc/wazuh-indexer/opensearch.yml)
+export CERT="/etc/wazuh-indexer/certs/admin.pem"
+export KEY="/etc/wazuh-indexer/certs/admin-key.pem"
 
 run_as_other_user_if_needed() {
   if [[ "$(id -u)" == "0" ]]; then
@@ -26,8 +29,6 @@ run_as_other_user_if_needed() {
 # or simply to run /bin/bash to check the image
 if [[ "$1" != "opensearchwrapper" ]]; then
   if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
-    # centos:7 chroot doesn't have the `--skip-chdir` option and
-    # changes our CWD.
     # Rewrite CMD args to replace $1 with `opensearch` explicitly,
     # so that we are backwards compatible with the docs
     # from the previous Elasticsearch versions<6
@@ -86,4 +87,9 @@ if [[ "$(id -u)" == "0" ]]; then
   fi
 fi
 
+if [[ "$DISCOVERY" == "single-node" ]]; then
+  # run securityadmin.sh for single node
+  nohup /securityadmin.sh &
+fi
+
 run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"

wazuh-indexer/config/opensearch.yml

@@ -0,0 +1,36 @@
+network.host: "0.0.0.0"
+node.name: "wazuh1.indexer"
+http.port: 9700-9799
+transport.tcp.port: 9800-9899
+path.data: /var/lib/wazuh-indexer
+path.logs: /var/log/wazuh-indexer
+discovery.type: single-node
+compatibility.override_main_response_version: true
+###############################################################################
+#                                                                             #
+#         WARNING: Insecure demo certificates set up in this file.            #
+#                  Please change on production cluster!                       #
+#                                                                             #
+###############################################################################
+plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/demo-indexer.pem
+plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/demo-indexer-key.pem
+plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
+plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/demo-indexer.pem
+plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/demo-indexer-key.pem
+plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
+plugins.security.ssl.http.enabled: true
+plugins.security.ssl.transport.enforce_hostname_verification: false
+plugins.security.ssl.transport.resolve_hostname: false
+plugins.security.audit.type: internal_opensearch
+plugins.security.authcz.admin_dn:
+- "CN=admin,OU=Demo,O=Wazuh,L=California,C=US"
+plugins.security.check_snapshot_restore_write_privileges: true
+plugins.security.enable_snapshot_restore_privilege: true
+plugins.security.nodes_dn:
+- "CN=demo-indexer,OU=Demo,O=Wazuh,L=California,C=US"
+plugins.security.restapi.roles_enabled:
+- "all_access"
+- "security_rest_api_access"
+plugins.security.system_indices.enabled: true
+plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
+

wazuh-indexer/config/securityadmin.sh

@@ -0,0 +1,2 @@
+sleep 50
+bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9800 -icl