diff --git a/.goss.yaml b/.github/.goss.yaml similarity index 100% rename from .goss.yaml rename to .github/.goss.yaml diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3d74554e..4baac58a 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -28,4 +28,4 @@ jobs: run: dgoss run wazuh/wazuh-manager:4.3.0 env: GOSS_SLEEP: 30 - GOSS_FILE: .goss.yaml \ No newline at end of file + GOSS_FILE: .github/.goss.yaml \ No newline at end of file diff --git a/Migration-to-indexer-dashboard.md b/Migration-to-indexer-dashboard.md deleted file mode 100644 index cc38fb9c..00000000 --- a/Migration-to-indexer-dashboard.md +++ /dev/null @@ -1,69 +0,0 @@ -# Opendistro data migration to Wazuh indexer on docker. -This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2.5 to v4.3.0. - -## Procedure -Assuming that you have a v4.2.5 production deployment, perform the following steps. - -**1. Stop 4.2.5 environment** -`docker-compose -f production-cluster.yml stop` - -**2. List Elastic volumesStop 4.2.5 environment** -`docker volume ls --filter name='wazuh-docker_elastic-data'` - -**3. Inspect Elastic volume** -`docker volume inspect wazuh-docker_elastic-data-1` - -**4. Run the volume create command:** create 3 new Indexer volumes using the `com.docker.compose.version` label value from the previous command. -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-1 \ - wazuh-docker_wazuh-indexer-data-1 -``` -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-2 \ - wazuh-docker_wazuh-indexer-data-2 -``` -``` -docker volume create \ - --label com.docker.compose.project=wazuh-docker \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-3 \ - wazuh-docker_wazuh-indexer-data-3 -``` - -**5. Copy the volume content from Elastic to Wazuh indexer volumes.** -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-1:/from \ - -v wazuh-docker_wazuh-indexer-data-1:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-2:/from \ - -v wazuh-docker_wazuh-indexer-data-2:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-3:/from \ - -v wazuh-docker_wazuh-indexer-data-3:/to \ - alpine ash -c "cd /from ; cp -av . /to" -``` - -**6. Delete the 4.2.5 environment.** -`docker-compose -f production-cluster.yml down` - -**7. Start the 4.3 environment.** -``` -git checkout 4.3 -docker-compose -f production-cluster.yml up -d -``` - -**8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file diff --git a/README.md b/README.md index 3fa14934..8419df5c 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ API_USERNAME="wazuh" # Wazuh API username API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements # (8+ length, uppercase, lowercase, specials chars) -INDEXER_URL=https://wazuh1.indexer:9200 # Wazuh indexer URL +INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL INDEXER_USERNAME=admin # Wazuh indexer Username INDEXER_PASSWORD=admin # Wazuh indexer Password FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none) @@ -87,73 +87,102 @@ ADMIN_PRIVILEGES=true # App privileges ## Directory structure - ├── build-wazuh-images.yml + ├── build-docker-images + │   ├── docker-compose.yml + │   ├── wazuh-dashboard + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── opensearch_dashboards.yml + │   │   │   ├── wazuh_app_config.sh + │   │   │   └── wazuh.yml + │   │   └── Dockerfile + │   ├── wazuh-indexer + │   │   ├── config + │   │   │   ├── config.sh + │   │   │   ├── config.yml + │   │   │   ├── entrypoint.sh + │   │   │   ├── internal_users.yml + │   │   │   ├── opensearch.yml + │   │   │   ├── roles_mapping.yml + │   │   │   ├── roles.yml + │   │   │   └── securityadmin.sh + │   │   └── Dockerfile + │   └── wazuh-manager + │   ├── config + │   │   ├── create_user.py + │   │   ├── etc + │   │   │   ├── cont-init.d + │   │   │   │   ├── 0-wazuh-init + │   │   │   │   ├── 1-config-filebeat + │   │   │   │   └── 2-manager + │   │   │   └── services.d + │   │   │   ├── filebeat + │   │   │   │   ├── finish + │   │   │   │   └── run + │   │   │   └── ossec-logs + │   │   │   └── run + │   │   ├── filebeat.yml + │   │   ├── permanent_data.env + │   │   ├── permanent_data.sh + │   │   └── wazuh.repo + │   └── Dockerfile ├── CHANGELOG.md - ├── docker-compose.yml - ├── generate-indexer-certs.yml - ├── indexer_certs_creator - │ ├── config - │ │ └── entrypoint.sh - │ └── Dockerfile + ├── indexer-certs-creator + │   ├── config + │   │   └── entrypoint.sh + │   └── Dockerfile ├── LICENSE - ├── production_cluster - │ ├── nginx - │ │ ├── nginx.conf - │ │ └── ssl - │ │ └── generate-self-signed-cert.sh - │ ├── wazuh_cluster - │ │ ├── wazuh_manager.conf - │ │ └── wazuh_worker.conf - │ ├── wazuh_dashboard - │ │ ├── opensearch_dashboards.yml - │ │ └── wazuh.yml - │ ├── wazuh-indexer - │ │ ├── internal_users.yml - │ │ ├── wazuh1.indexer.yml - │ │ ├── wazuh2.indexer.yml - │ │ └── wazuh3.indexer.yml - │ └── wazuh_indexer_ssl_certs - │ └── certs.yml - ├── production-cluster.yml + ├── multi-node + │   ├── config + │   │   ├── nginx + │   │   │   └── nginx.conf + │   │   ├── wazuh_cluster + │   │   │   ├── wazuh_manager.conf + │   │   │   └── wazuh_worker.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   ├── wazuh1.indexer.yml + │   │   │   ├── wazuh2.indexer.yml + │   │   │   └── wazuh3.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   └── certs.yml + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   ├── Migration-to-Wazuh-4.3.md + │   └── volume-migrator.sh ├── README.md - ├── VERSION - ├── wazuh-dashboard - │ ├── config - │ │ ├── entrypoint.sh - │ │ ├── opensearch_dashboards.yml - │ │ ├── wazuh_app_config.sh - │ │ └── wazuh.yml - │ └── Dockerfile - ├── wazuh-indexer - │ ├── config - │ │ ├── config.sh - │ │ ├── config.yml - │ │ ├── entrypoint.sh - │ │ ├── internal_users.yml - │ │ ├── opensearch.yml - │ │ ├── roles_mapping.yml - │ │ ├── roles.yml - │ │ └── securityadmin.sh - │ └── Dockerfile - └── wazuh-manager - ├── config - │ ├── create_user.py - │ ├── etc - │ │ ├── cont-init.d - │ │ │ ├── 0-wazuh-init - │ │ │ ├── 1-config-filebeat - │ │ │ └── 2-manager - │ │ └── services.d - │ │ ├── filebeat - │ │ │ ├── finish - │ │ │ └── run - │ │ └── ossec-logs - │ │ └── run - │ ├── filebeat.yml - │ ├── permanent_data.env - │ ├── permanent_data.sh - │ └── wazuh.repo - └── Dockerfile + ├── single-node + │   ├── config + │   │   ├── wazuh_cluster + │   │   │   └── wazuh_manager.conf + │   │   ├── wazuh_dashboard + │   │   │   ├── opensearch_dashboards.yml + │   │   │   └── wazuh.yml + │   │   ├── wazuh_indexer + │   │   │   ├── internal_users.yml + │   │   │   └── wazuh.indexer.yml + │   │   └── wazuh_indexer_ssl_certs + │   │   ├── admin-key.pem + │   │   ├── admin.pem + │   │   ├── certs.yml + │   │   ├── root-ca.key + │   │   ├── root-ca.pem + │   │   ├── wazuh.dashboard-key.pem + │   │   ├── wazuh.dashboard.pem + │   │   ├── wazuh.indexer-key.pem + │   │   ├── wazuh.indexer.pem + │   │   ├── wazuh.manager-key.pem + │   │   └── wazuh.manager.pem + │   ├── docker-compose.yml + │   ├── generate-indexer-certs.yml + │   └── README.md + └── VERSION + ## Branches diff --git a/build-docker-images/README.md b/build-docker-images/README.md new file mode 100644 index 00000000..d7a09f6d --- /dev/null +++ b/build-docker-images/README.md @@ -0,0 +1,16 @@ +# Wazuh Docker Image Builder + +By executing this stack, the Docker images of Wazuh manager, indexer and dashboard are created. +This process can be used in case of any problem accessing the Docker images that are hosted on Docker Hub. + +To execute this process, the following command must be executed: + +``` +$ docker-compose up -d --build +``` + +Once the image creation process is finished, a Wazuh test stack will also be executed, which must be terminated with the following command: + +``` +$ docker-compose down +``` \ No newline at end of file diff --git a/build-wazuh-images.yml b/build-docker-images/docker-compose.yml similarity index 62% rename from build-wazuh-images.yml rename to build-docker-images/docker-compose.yml index e6ec7ed7..0d9b9524 100644 --- a/build-wazuh-images.yml +++ b/build-docker-images/docker-compose.yml @@ -13,27 +13,27 @@ services: - "514:514/udp" - "55000:55000" environment: - - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_URL=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - FILEBEAT_SSL_VERIFICATION_MODE=none volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat - wazuh1.indexer: + wazuh.indexer: build: wazuh-indexer/ image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer + hostname: wazuh.indexer restart: always ports: - "9200:9200" @@ -60,20 +60,20 @@ services: - SERVER_SSL_ENABLED=false - WAZUH_API_URL=https://wazuh.manager depends_on: - - wazuh1.indexer + - wazuh.indexer links: - - wazuh1.indexer:wazuh1.indexer + - wazuh.indexer:wazuh.indexer - wazuh.manager:wazuh.manager volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: filebeat_etc: filebeat_var: diff --git a/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile similarity index 100% rename from wazuh-dashboard/Dockerfile rename to build-docker-images/wazuh-dashboard/Dockerfile diff --git a/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh similarity index 100% rename from wazuh-dashboard/config/config.sh rename to build-docker-images/wazuh-dashboard/config/config.sh diff --git a/wazuh-dashboard/config/config.yml b/build-docker-images/wazuh-dashboard/config/config.yml similarity index 100% rename from wazuh-dashboard/config/config.yml rename to build-docker-images/wazuh-dashboard/config/config.yml diff --git a/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh similarity index 100% rename from wazuh-dashboard/config/entrypoint.sh rename to build-docker-images/wazuh-dashboard/config/entrypoint.sh diff --git a/wazuh-dashboard/config/opensearch_dashboards.yml b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml similarity index 93% rename from wazuh-dashboard/config/opensearch_dashboards.yml rename to build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml index f7d70cce..bf8dc374 100644 --- a/wazuh-dashboard/config/opensearch_dashboards.yml +++ b/build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml @@ -1,6 +1,6 @@ server.host: 0.0.0.0 server.port: 443 -opensearch.hosts: https://wazuh1.indexer:9200 +opensearch.hosts: https://wazuh.indexer:9200 opensearch.ssl.verificationMode: none opensearch.requestHeadersWhitelist: [ authorization,securitytenant ] opensearch_security.multitenancy.enabled: true diff --git a/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml similarity index 100% rename from wazuh-dashboard/config/wazuh.yml rename to build-docker-images/wazuh-dashboard/config/wazuh.yml diff --git a/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh similarity index 100% rename from wazuh-dashboard/config/wazuh_app_config.sh rename to build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh diff --git a/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile similarity index 100% rename from wazuh-indexer/Dockerfile rename to build-docker-images/wazuh-indexer/Dockerfile diff --git a/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh similarity index 100% rename from wazuh-indexer/config/config.sh rename to build-docker-images/wazuh-indexer/config/config.sh diff --git a/wazuh-indexer/config/config.yml b/build-docker-images/wazuh-indexer/config/config.yml similarity index 100% rename from wazuh-indexer/config/config.yml rename to build-docker-images/wazuh-indexer/config/config.yml diff --git a/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh similarity index 100% rename from wazuh-indexer/config/entrypoint.sh rename to build-docker-images/wazuh-indexer/config/entrypoint.sh diff --git a/wazuh-indexer/config/internal_users.yml b/build-docker-images/wazuh-indexer/config/internal_users.yml similarity index 100% rename from wazuh-indexer/config/internal_users.yml rename to build-docker-images/wazuh-indexer/config/internal_users.yml diff --git a/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml similarity index 98% rename from wazuh-indexer/config/opensearch.yml rename to build-docker-images/wazuh-indexer/config/opensearch.yml index 915fe5a2..922e86e5 100644 --- a/wazuh-indexer/config/opensearch.yml +++ b/build-docker-images/wazuh-indexer/config/opensearch.yml @@ -1,5 +1,5 @@ network.host: "0.0.0.0" -node.name: "wazuh1.indexer" +node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node diff --git a/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml similarity index 100% rename from wazuh-indexer/config/roles.yml rename to build-docker-images/wazuh-indexer/config/roles.yml diff --git a/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml similarity index 100% rename from wazuh-indexer/config/roles_mapping.yml rename to build-docker-images/wazuh-indexer/config/roles_mapping.yml diff --git a/wazuh-indexer/config/securityadmin.sh b/build-docker-images/wazuh-indexer/config/securityadmin.sh similarity index 100% rename from wazuh-indexer/config/securityadmin.sh rename to build-docker-images/wazuh-indexer/config/securityadmin.sh diff --git a/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile similarity index 100% rename from wazuh-manager/Dockerfile rename to build-docker-images/wazuh-manager/Dockerfile diff --git a/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py similarity index 100% rename from wazuh-manager/config/create_user.py rename to build-docker-images/wazuh-manager/config/create_user.py diff --git a/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/0-wazuh-init rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init diff --git a/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/1-config-filebeat rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat diff --git a/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager similarity index 100% rename from wazuh-manager/config/etc/cont-init.d/2-manager rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager diff --git a/wazuh-manager/config/etc/services.d/filebeat/finish b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/finish rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish diff --git a/wazuh-manager/config/etc/services.d/filebeat/run b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run similarity index 100% rename from wazuh-manager/config/etc/services.d/filebeat/run rename to build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run diff --git a/wazuh-manager/config/etc/services.d/ossec-logs/run b/build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run similarity index 100% rename from wazuh-manager/config/etc/services.d/ossec-logs/run rename to build-docker-images/wazuh-manager/config/etc/services.d/ossec-logs/run diff --git a/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml similarity index 91% rename from wazuh-manager/config/filebeat.yml rename to build-docker-images/wazuh-manager/config/filebeat.yml index 37003366..e9874fb4 100644 --- a/wazuh-manager/config/filebeat.yml +++ b/build-docker-images/wazuh-manager/config/filebeat.yml @@ -13,7 +13,7 @@ setup.template.json.name: 'wazuh' setup.template.overwrite: true setup.ilm.enabled: false output.elasticsearch: - hosts: ['https://wazuh1.indexer:9200'] + hosts: ['https://wazuh.indexer:9200'] #username: #password: #ssl.verification_mode: diff --git a/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env similarity index 100% rename from wazuh-manager/config/permanent_data.env rename to build-docker-images/wazuh-manager/config/permanent_data.env diff --git a/wazuh-manager/config/permanent_data.sh b/build-docker-images/wazuh-manager/config/permanent_data.sh similarity index 100% rename from wazuh-manager/config/permanent_data.sh rename to build-docker-images/wazuh-manager/config/permanent_data.sh diff --git a/wazuh-manager/config/wazuh.repo b/build-docker-images/wazuh-manager/config/wazuh.repo similarity index 100% rename from wazuh-manager/config/wazuh.repo rename to build-docker-images/wazuh-manager/config/wazuh.repo diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index 49515e47..00000000 --- a/docker-compose.yml +++ /dev/null @@ -1,75 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.manager: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.manager - restart: always - ports: - - "1514:1514" - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none - volumes: - - ossec_api_configuration:/var/ossec/api/configuration - - ossec_etc:/var/ossec/etc - - ossec_logs:/var/ossec/logs - - ossec_queue:/var/ossec/queue - - ossec_var_multigroups:/var/ossec/var/multigroups - - ossec_integrations:/var/ossec/integrations - - ossec_active_response:/var/ossec/active-response/bin - - ossec_agentless:/var/ossec/agentless - - ossec_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 - hostname: wazuh.dashboard - restart: always - ports: - - 443:443 - environment: - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=admin - - WAZUH_API_URL=https://wazuh.manager - depends_on: - - wazuh1.indexer - links: - - wazuh1.indexer:wazuh1.indexer - - wazuh.manager:wazuh.manager - -volumes: - ossec_api_configuration: - ossec_etc: - ossec_logs: - ossec_queue: - ossec_var_multigroups: - ossec_integrations: - ossec_active_response: - ossec_agentless: - ossec_wodles: - filebeat_etc: - filebeat_var: diff --git a/indexer_certs_creator/Dockerfile b/indexer-certs-creator/Dockerfile similarity index 100% rename from indexer_certs_creator/Dockerfile rename to indexer-certs-creator/Dockerfile diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md new file mode 100644 index 00000000..b7dbc565 --- /dev/null +++ b/indexer-certs-creator/README.md @@ -0,0 +1,9 @@ +# Certificate creation image build + +The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks. + +To create the image, the following command must be executed: + +``` +$ docker build -t wazuh/wazuh-certs-generator:0.0.1 . +``` diff --git a/indexer_certs_creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh similarity index 100% rename from indexer_certs_creator/config/entrypoint.sh rename to indexer-certs-creator/config/entrypoint.sh diff --git a/multi-node/Migration-to-Wazuh-4.3.md b/multi-node/Migration-to-Wazuh-4.3.md new file mode 100644 index 00000000..20351ca8 --- /dev/null +++ b/multi-node/Migration-to-Wazuh-4.3.md @@ -0,0 +1,360 @@ +# Opendistro data migration to Wazuh indexer on docker. +This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. +The example is migrating from v4.2 to v4.3. + +## Procedure +Assuming that you have a v4.2 production deployment, perform the following steps. + +**1. Stop 4.2 environment** +`docker-compose -f production-cluster.yml stop` + +**2. List Elastic volumesStop 4.2 environment** +`docker volume ls --filter name='wazuh-docker_elastic-data'` + +**3. Inspect Elastic volume** +`docker volume inspect wazuh-docker_elastic-data-1` + +**4. down the 4.2 environment.** +`docker-compose -f production-cluster.yml down` + +**5. Run the volume create command:** create new Indexer and Wazuh Manager volumes using the `com.docker.compose.version` label value from the previous command. +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + multi-node_wazuh-indexer-data-1 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + multi-node_wazuh-indexer-data-2 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + multi-node_wazuh-indexer-data-3 +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master_wazuh_api_configuration \ + multi-node_master_wazuh_api_configuration +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master_wazuh_etc \ + multi-node_docker_wazuh_etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-logs \ + multi-node_master-wazuh-logs +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-queue \ + multi-node_master-wazuh-queue +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-var-multigroups \ + multi-node_master-wazuh-var-multigroups +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-integrations \ + multi-node_master-wazuh-integrations +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-active-response \ + multi-node_master-wazuh-active-response +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-agentless \ + multi-node_master-wazuh-agentless +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-wazuh-wodles \ + multi-node_master-wazuh-wodles +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-filebeat-etc \ + multi-node_master-filebeat-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=master-filebeat-var \ + multi-node_master-filebeat-var +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker_wazuh_api_configuration \ + multi-node_worker_wazuh_api_configuration +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker_wazuh_etc \ + multi-node_worker-wazuh-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-logs \ + multi-node_worker-wazuh-logs +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-queue \ + multi-node_worker-wazuh-queue +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-var-multigroups \ + multi-node_worker-wazuh-var-multigroups +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-integrations \ + multi-node_worker-wazuh-integrations +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-active-response \ + multi-node_worker-wazuh-active-response +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-agentless \ + multi-node_worker-wazuh-agentless +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-wazuh-wodles \ + multi-node_worker-wazuh-wodles +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + multi-node_worker-filebeat-etc +``` +``` +docker volume create \ + --label com.docker.compose.project=multi-node \ + --label com.docker.compose.version=1.25.0 \ + --label com.docker.compose.volume=worker-filebeat-var \ + multi-node_worker-filebeat-var +``` +**6. Copy the volume content from Elastic to Wazuh indexer volumes and old Wazuh Manager content to new volumes.** +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v multi-node_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v multi-node_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v multi-node_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-api-configuration:/from \ + -v multi-node_master-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-etc:/from \ + -v multi-node_master-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-logs:/from \ + -v multi-node_master-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-queue:/from \ + -v multi-node_master-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-var-multigroups:/from \ + -v multi-node_master-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-integrations:/from \ + -v multi-node_master-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-active-response:/from \ + -v multi-node_master-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-agentless:/from \ + -v multi-node_master-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_ossec-wodles:/from \ + -v multi-node_master-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_filebeat-etc:/from \ + -v multi-node_master-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_filebeat-var:/from \ + -v multi-node_master-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-api-configuration:/from \ + -v multi-node_worker-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-etc:/from \ + -v multi-node_worker-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-logs:/from \ + -v multi-node_worker-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-queue:/from \ + -v multi-node_worker-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-var-multigroups:/from \ + -v multi-node_worker-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-integrations:/from \ + -v multi-node_worker-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-active-response:/from \ + -v multi-node_worker-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-agentless:/from \ + -v multi-node_worker-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-wodles:/from \ + -v multi-node_worker-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v multi-node_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` +``` +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v multi-node_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" +``` + +**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker Version and project name as parameters.** + +Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node + +**7. Start the 4.3 environment.** +``` +git checkout 4.3 +cd multi-node +docker-compose -f generate-indexer-certs.yml run --rm generator +docker-compose up -d +``` + +**8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working. \ No newline at end of file diff --git a/multi-node/README.md b/multi-node/README.md new file mode 100644 index 00000000..b646c5e0 --- /dev/null +++ b/multi-node/README.md @@ -0,0 +1,31 @@ +# Deploy Wazuh Docker in multi node configuration + +This deployment generates a Docker Compose stack with 2 Wazuh Manager container, 3 Wazuh Indexer container and 1 Wazuh Dashboard container. + +For the next deployment, the following steps must be performed: + +1) Increase max_map_count on your host (Linux) +``` +$ sysctl -w vm.max_map_count=262144 +``` + This command must be run with root permissions + + +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the stack with docker-compose: + + In Foregroud: +``` +$ docker-compose up +``` + + In Background: +``` +$ docker-compose up -d +``` + + +The stack takes about 1 minute to get up for the first time, since Wazuh Indexer must be started for the first time and the Indexes and Index Patterns must be generated. \ No newline at end of file diff --git a/production_cluster/nginx/nginx.conf b/multi-node/config/nginx/nginx.conf similarity index 59% rename from production_cluster/nginx/nginx.conf rename to multi-node/config/nginx/nginx.conf index b2103bb0..92deb263 100644 --- a/production_cluster/nginx/nginx.conf +++ b/multi-node/config/nginx/nginx.conf @@ -28,27 +28,6 @@ http { server_tokens off; gzip on; - # Dashboard UI - server { - listen 80; - listen [::]:80; - return 301 https://$host:443$request_uri; - } - - server { - listen 443 default_server ssl http2; - listen [::]:443 ssl http2; - ssl_certificate /etc/nginx/ssl/cert.pem; - ssl_certificate_key /etc/nginx/ssl/key.pem; - location / { - proxy_pass https://wazuh.dashboard:443/; - proxy_ssl_verify off; - proxy_buffer_size 128k; - proxy_buffers 4 256k; - proxy_busy_buffers_size 256k; - } - } - } diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_manager.conf rename to multi-node/config/wazuh_cluster/wazuh_manager.conf index 8b6c33cb..fddb7fc6 100644 --- a/production_cluster/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf similarity index 99% rename from production_cluster/wazuh_cluster/wazuh_worker.conf rename to multi-node/config/wazuh_cluster/wazuh_worker.conf index a91e6e16..30670045 100644 --- a/production_cluster/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -332,7 +332,7 @@ 1516 0.0.0.0 - wazuh-master + wazuh.master no no diff --git a/production_cluster/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml similarity index 100% rename from production_cluster/wazuh_dashboard/opensearch_dashboards.yml rename to multi-node/config/wazuh_dashboard/opensearch_dashboards.yml diff --git a/production_cluster/wazuh_dashboard/wazuh.yml b/multi-node/config/wazuh_dashboard/wazuh.yml similarity index 100% rename from production_cluster/wazuh_dashboard/wazuh.yml rename to multi-node/config/wazuh_dashboard/wazuh.yml diff --git a/production_cluster/wazuh-indexer/internal_users.yml b/multi-node/config/wazuh_indexer/internal_users.yml similarity index 100% rename from production_cluster/wazuh-indexer/internal_users.yml rename to multi-node/config/wazuh_indexer/internal_users.yml diff --git a/production_cluster/wazuh-indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh1.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh1.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh2.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh2.indexer.yml diff --git a/production_cluster/wazuh-indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml similarity index 100% rename from production_cluster/wazuh-indexer/wazuh3.indexer.yml rename to multi-node/config/wazuh_indexer/wazuh3.indexer.yml diff --git a/production_cluster/wazuh_indexer_ssl_certs/certs.yml b/multi-node/config/wazuh_indexer_ssl_certs/certs.yml similarity index 100% rename from production_cluster/wazuh_indexer_ssl_certs/certs.yml rename to multi-node/config/wazuh_indexer_ssl_certs/certs.yml diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml new file mode 100644 index 00000000..7707f76b --- /dev/null +++ b/multi-node/docker-compose.yml @@ -0,0 +1,204 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh.master: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.master + restart: always + ports: + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - master-wazuh-api-configuration:/var/ossec/api/configuration + - master-wazuh-etc:/var/ossec/etc + - master-wazuh-logs:/var/ossec/logs + - master-wazuh-queue:/var/ossec/queue + - master-wazuh-var-multigroups:/var/ossec/var/multigroups + - master-wazuh-integrations:/var/ossec/integrations + - master-wazuh-active-response:/var/ossec/active-response/bin + - master-wazuh-agentless:/var/ossec/agentless + - master-wazuh-wodles:/var/ossec/wodles + - master-filebeat-etc:/etc/filebeat + - master-filebeat-var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh.worker: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.worker + restart: always + environment: + - INDEXER_URL=https://wazuh1.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + volumes: + - worker-wazuh-api-configuration:/var/ossec/api/configuration + - worker-wazuh-etc:/var/ossec/etc + - worker-wazuh-logs:/var/ossec/logs + - worker-wazuh-queue:/var/ossec/queue + - worker-wazuh-var-multigroups:/var/ossec/var/multigroups + - worker-wazuh-integrations:/var/ossec/integrations + - worker-wazuh-active-response:/var/ossec/active-response/bin + - worker-wazuh-agentless:/var/ossec/agentless + - worker-wazuh-wodles:/var/ossec/wodles + - worker-filebeat-etc:/etc/filebeat + - worker-filebeat-var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh1.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh1.indexer + restart: always + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-1:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh2.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh2.indexer + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-2:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem + - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh3.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh3.indexer + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-3:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem + - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: wazuh.dashboard + restart: always + ports: + - 443:443 + environment: + - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200" + - WAZUH_API_URL="https://wazuh.master" + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + depends_on: + - wazuh1.indexer + links: + - wazuh1.indexer:wazuh1.indexer + - wazuh.master:wazuh.master + + nginx: + image: nginx:stable + hostname: nginx + restart: always + ports: + - "1514:1514" + depends_on: + - wazuh.master + - wazuh.worker + - wazuh.dashboard + links: + - wazuh.master:wazuh.master + - wazuh.worker:wazuh.worker + - wazuh.dashboard:wazuh.dashboard + volumes: + - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + +volumes: + master-wazuh-api-configuration: + master-wazuh-etc: + master-wazuh-logs: + master-wazuh-queue: + master-wazuh-var-multigroups: + master-wazuh-integrations: + master-wazuh-active-response: + master-wazuh-agentless: + master-wazuh-wodles: + master-filebeat-etc: + master-filebeat-var: + worker-wazuh-api-configuration: + worker-wazuh-etc: + worker-wazuh-logs: + worker-wazuh-queue: + worker-wazuh-var-multigroups: + worker-wazuh-integrations: + worker-wazuh-active-response: + worker-wazuh-agentless: + worker-wazuh-wodles: + worker-filebeat-etc: + worker-filebeat-var: + wazuh-indexer-data-1: + wazuh-indexer-data-2: + wazuh-indexer-data-3: diff --git a/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml similarity index 56% rename from generate-indexer-certs.yml rename to multi-node/generate-indexer-certs.yml index ce8a0174..c29c50d6 100644 --- a/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -6,5 +6,5 @@ services: image: wazuh/wazuh-certs-generator:0.0.1 hostname: wazuh-certs-generator volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml - - ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh new file mode 100755 index 00000000..f11a1da6 --- /dev/null +++ b/multi-node/volume-migrator.sh @@ -0,0 +1,279 @@ +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-1 \ + $2_wazuh-indexer-data-1 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-2 \ + $2_wazuh-indexer-data-2 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=wazuh-indexer-data-3 \ + $2_wazuh-indexer-data-3 + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_api_configuration \ + $2_master_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master_wazuh_etc \ + $2_docker_wazuh_etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-logs \ + $2_master-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-queue \ + $2_master-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-var-multigroups \ + $2_master-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-integrations \ + $2_master-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-active-response \ + $2_master-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-agentless \ + $2_master-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-wazuh-wodles \ + $2_master-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-etc \ + $2_master-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=master-filebeat-var \ + $2_master-filebeat-var + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_api_configuration \ + $2_worker_wazuh_api_configuration + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker_wazuh_etc \ + $2_worker-wazuh-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-logs \ + $2_worker-wazuh-logs + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-queue \ + $2_worker-wazuh-queue + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-var-multigroups \ + $2_worker-wazuh-var-multigroups + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-integrations \ + $2_worker-wazuh-integrations + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-active-response \ + $2_worker-wazuh-active-response + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-agentless \ + $2_worker-wazuh-agentless + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-wazuh-wodles \ + $2_worker-wazuh-wodles + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-etc \ + $2_worker-filebeat-etc + +docker volume create \ + --label com.docker.compose.project=$2 \ + --label com.docker.compose.version=$1 \ + --label com.docker.compose.volume=worker-filebeat-var \ + $2_worker-filebeat-var + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-1:/from \ + -v $2_wazuh-indexer-data-1:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-2:/from \ + -v $2_wazuh-indexer-data-2:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_elastic-data-3:/from \ + -v $2_wazuh-indexer-data-3:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-api-configuration:/from \ + -v $2_master-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-etc:/from \ + -v $2_master-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-logs:/from \ + -v $2_master-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-queue:/from \ + -v $2_master-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-var-multigroups:/from \ + -v $2_master-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-integrations:/from \ + -v $2_master-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-active-response:/from \ + -v $2_master-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-agentless:/from \ + -v $2_master-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_ossec-wodles:/from \ + -v $2_master-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-etc:/from \ + -v $2_master-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_filebeat-var:/from \ + -v $2_master-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-api-configuration:/from \ + -v $2_worker-wazuh-api-configuration:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-etc:/from \ + -v $2_worker-wazuh-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-logs:/from \ + -v $2_worker-wazuh-logs:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-queue:/from \ + -v $2_worker-wazuh-queue:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-var-multigroups:/from \ + -v $2_worker-wazuh-var-multigroups:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-integrations:/from \ + -v $2_worker-wazuh-integrations:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-active-response:/from \ + -v $2_worker-wazuh-active-response:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-agentless:/from \ + -v $2_worker-wazuh-agentless:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-ossec-wodles:/from \ + -v $2_worker-wazuh-wodles:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-etc:/from \ + -v $2_worker-filebeat-etc:/to \ + alpine ash -c "cd /from ; cp -avp . /to" + +docker container run --rm -it \ + -v wazuh-docker_worker-filebeat-var:/from \ + -v $2_worker-filebeat-var:/to \ + alpine ash -c "cd /from ; cp -avp . /to" diff --git a/production-cluster.yml b/production-cluster.yml deleted file mode 100644 index 18c59a9a..00000000 --- a/production-cluster.yml +++ /dev/null @@ -1,205 +0,0 @@ -# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) -version: '3.7' - -services: - wazuh.master: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.master - restart: always - ports: - - "1515:1515" - - "514:514/udp" - - "55000:55000" - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ossec-api-configuration:/var/ossec/api/configuration - - ossec-etc:/var/ossec/etc - - ossec-logs:/var/ossec/logs - - ossec-queue:/var/ossec/queue - - ossec-var-multigroups:/var/ossec/var/multigroups - - ossec-integrations:/var/ossec/integrations - - ossec-active-response:/var/ossec/active-response/bin - - ossec-agentless:/var/ossec/agentless - - ossec-wodles:/var/ossec/wodles - - filebeat-etc:/etc/filebeat - - filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh.worker: - image: wazuh/wazuh-manager:4.3.0 - hostname: wazuh.worker - restart: always - environment: - - INDEXER_URL=https://wazuh1.indexer:9200 - - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key - volumes: - - worker-ossec-api-configuration:/var/ossec/api/configuration - - worker-ossec-etc:/var/ossec/etc - - worker-ossec-logs:/var/ossec/logs - - worker-ossec-queue:/var/ossec/queue - - worker-ossec-var-multigroups:/var/ossec/var/multigroups - - worker-ossec-integrations:/var/ossec/integrations - - worker-ossec-active-response:/var/ossec/active-response/bin - - worker-ossec-agentless:/var/ossec/agentless - - worker-ossec-wodles:/var/ossec/wodles - - worker-filebeat-etc:/etc/filebeat - - worker-filebeat-var:/var/lib/filebeat - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf - - wazuh1.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh1.indexer - restart: always - ports: - - "9200:9200" - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem - - ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem - - ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh2.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh2.indexer - restart: always - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh3.indexer: - image: wazuh/wazuh-indexer:4.3.0 - hostname: wazuh3.indexer - restart: always - environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" - ulimits: - memlock: - soft: -1 - hard: -1 - nofile: - soft: 65536 - hard: 65536 - volumes: - - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem - - ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml - - wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.3.0 - hostname: wazuh.dashboard - restart: always - environment: - - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200" - - WAZUH_API_URL="https://wazuh.master" - - API_USERNAME=acme-user - - API_PASSWORD=MyS3cr37P450r.*- - volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/opensearch_dashboards.yml - - ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml - depends_on: - - wazuh1.indexer - links: - - wazuh1.indexer:wazuh1.indexer - - wazuh.master:wazuh.master - - nginx: - image: nginx:stable - hostname: nginx - restart: always - ports: - - "80:80" - - "443:443" - - "1514:1514" - depends_on: - - wazuh.master - - wazuh.worker - - wazuh.dashboard - links: - - wazuh.master:wazuh.master - - wazuh.worker:wazuh.worker - - wazuh.dashboard:wazuh.dashboard - volumes: - - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro - -volumes: - ossec-api-configuration: - ossec-etc: - ossec-logs: - ossec-queue: - ossec-var-multigroups: - ossec-integrations: - ossec-active-response: - ossec-agentless: - ossec-wodles: - filebeat-etc: - filebeat-var: - worker-ossec-api-configuration: - worker-ossec-etc: - worker-ossec-logs: - worker-ossec-queue: - worker-ossec-var-multigroups: - worker-ossec-integrations: - worker-ossec-active-response: - worker-ossec-agentless: - worker-ossec-wodles: - worker-filebeat-etc: - worker-filebeat-var: - wazuh-indexer-data-1: - wazuh-indexer-data-2: - wazuh-indexer-data-3: diff --git a/production_cluster/nginx/ssl/generate-self-signed-cert.sh b/production_cluster/nginx/ssl/generate-self-signed-cert.sh deleted file mode 100644 index 6fc8d08d..00000000 --- a/production_cluster/nginx/ssl/generate-self-signed-cert.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -cd $DIR - -if [ -s key.pem ] -then - echo "Certificate already exists" - exit -else - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem -fi \ No newline at end of file diff --git a/single-node/README.md b/single-node/README.md new file mode 100644 index 00000000..a89039e9 --- /dev/null +++ b/single-node/README.md @@ -0,0 +1,33 @@ +# Deploy Wazuh Docker in single node configuration + +This deployment generates a Docker Compose stack with 1 Wazuh Manager container, 1 Wazuh Indexer container and 1 Wazuh Dashboard container. + +In case of upgrading from 4.2, the deployment hosted in the multi-node directory should be reviewed + +For the next deployment, the following steps must be performed: + +1) Increase max_map_count on your host (Linux) +``` +$ sysctl -w vm.max_map_count=262144 +``` + This command must be run with root permissions + + +2) Run the certificate creation script: +``` +$ docker-compose -f generate-indexer-certs.yml run --rm generator +``` +3) Start the stack with docker-compose: + + In Foregroud: +``` +$ docker-compose up +``` + + In Background: +``` +$ docker-compose up -d +``` + + +The stack takes about 1 minute to get up for the first time, since Wazuh Indexer must be started for the first time and the Indexes and Index Patterns must be generated. \ No newline at end of file diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf new file mode 100644 index 00000000..aff1af9d --- /dev/null +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -0,0 +1,353 @@ + + + yes + yes + no + no + no + smtp.example.wazuh.com + wazuh@example.wazuh.com + recipient@example.wazuh.com + 12 + alerts.log + 10m + 0 + + + + 3 + 12 + + + + + plain + + + + secure + 1514 + tcp + 131072 + + + + + no + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + etc/rootcheck/rootkit_files.txt + etc/rootcheck/rootkit_trojans.txt + + yes + + + + yes + 1800 + 1d + yes + + wodles/java + wodles/ciscat + + + + + yes + yes + /var/log/osquery/osqueryd.results.log + /etc/osquery/osquery.conf + yes + + + + + no + 1h + yes + yes + yes + yes + yes + yes + yes + + + + 10 + + + + + yes + yes + 12h + yes + + + + no + 5m + 6h + yes + + + + no + trusty + xenial + bionic + focal + 1h + + + + + no + stretch + buster + bullseye + 1h + + + + + no + 5 + 6 + 7 + 8 + 1h + + + + + no + amazon-linux + amazon-linux-2 + 1h + + + + + no + 1h + + + + + yes + 1h + + + + + yes + 2010 + 1h + + + + + + + no + + + 43200 + + yes + + + yes + + + no + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 1h + 10 + + + + + + 127.0.0.1 + ^localhost.localdomain$ + 10.0.0.106 + + + + disable-account + disable-account + yes + + + + restart-wazuh + restart-wazuh + + + + firewall-drop + firewall-drop + yes + + + + host-deny + host-deny + yes + + + + route-null + route-null + yes + + + + win_route-null + route-null.exe + yes + + + + netsh + netsh.exe + yes + + + + + + + command + df -P + 360 + + + + full_command + netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d + netstat listening ports + 360 + + + + full_command + last -n 20 + 360 + + + + + ruleset/decoders + ruleset/rules + 0215-policy_rules.xml + etc/lists/audit-keys + etc/lists/amazon/aws-eventnames + etc/lists/security-eventchannel + + + etc/decoders + etc/rules + + + + yes + 1 + 64 + 15m + + + + + no + 1515 + no + yes + no + HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH + + no + etc/sslmanager.cert + etc/sslmanager.key + no + + + + wazuh + node01 + master + + 1516 + 0.0.0.0 + + NODE_IP + + no + yes + + + + + + + syslog + /var/ossec/logs/active-responses.log + + + diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml new file mode 100644 index 00000000..d56fe86b --- /dev/null +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -0,0 +1,12 @@ +server.host: 0.0.0.0 +server.port: 443 +opensearch.hosts: https://wazuh.indexer:9200 +opensearch.ssl.verificationMode: certificate +opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch_security.multitenancy.enabled: false +opensearch_security.readonly_mode.roles: ["kibana_read_only"] +server.ssl.enabled: true +server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" +server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" +opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] +uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global diff --git a/single-node/config/wazuh_dashboard/wazuh.yml b/single-node/config/wazuh_dashboard/wazuh.yml new file mode 100644 index 00000000..75ba953c --- /dev/null +++ b/single-node/config/wazuh_dashboard/wazuh.yml @@ -0,0 +1,7 @@ +hosts: + - 1513629884013: + url: "https://wazuh.manager" + port: 55000 + username: acme-user + password: MyS3cr37P450r.*- + run_as: false diff --git a/single-node/config/wazuh_indexer/internal_users.yml b/single-node/config/wazuh_indexer/internal_users.yml new file mode 100644 index 00000000..d9f05b34 --- /dev/null +++ b/single-node/config/wazuh_indexer/internal_users.yml @@ -0,0 +1,56 @@ +--- +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +_meta: + type: "internalusers" + config_version: 2 + +# Define your internal users here + +## Demo users + +admin: + hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" + reserved: true + backend_roles: + - "admin" + description: "Demo admin user" + +kibanaserver: + hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." + reserved: true + description: "Demo kibanaserver user" + +kibanaro: + hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" + reserved: false + backend_roles: + - "kibanauser" + - "readall" + attributes: + attribute1: "value1" + attribute2: "value2" + attribute3: "value3" + description: "Demo kibanaro user" + +logstash: + hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" + reserved: false + backend_roles: + - "logstash" + description: "Demo logstash user" + +readall: + hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" + reserved: false + backend_roles: + - "readall" + description: "Demo readall user" + +snapshotrestore: + hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" + reserved: false + backend_roles: + - "snapshotrestore" + description: "Demo snapshotrestore user" diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml new file mode 100644 index 00000000..ec3220ef --- /dev/null +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -0,0 +1,27 @@ +network.host: "0.0.0.0" +node.name: "wazuh.indexer" +path.data: /var/lib/wazuh-indexer +path.logs: /var/log/wazuh-indexer +discovery.type: single-node +compatibility.override_main_response_version: true +plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem +plugins.security.ssl.http.enabled: true +plugins.security.ssl.transport.enforce_hostname_verification: false +plugins.security.ssl.transport.resolve_hostname: false +plugins.security.audit.type: internal_opensearch +plugins.security.authcz.admin_dn: +- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.check_snapshot_restore_write_privileges: true +plugins.security.enable_snapshot_restore_privilege: true +plugins.security.nodes_dn: +- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" +plugins.security.restapi.roles_enabled: +- "all_access" +- "security_rest_api_access" +plugins.security.system_indices.enabled: true +plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] diff --git a/single-node/config/wazuh_indexer_ssl_certs/certs.yml b/single-node/config/wazuh_indexer_ssl_certs/certs.yml new file mode 100644 index 00000000..34059eeb --- /dev/null +++ b/single-node/config/wazuh_indexer_ssl_certs/certs.yml @@ -0,0 +1,16 @@ +nodes: + # Wazuh indexer server nodes + indexer: + name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + name: wazuh.dashboard + ip: wazuh.dashboard \ No newline at end of file diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml new file mode 100644 index 00000000..356160ea --- /dev/null +++ b/single-node/docker-compose.yml @@ -0,0 +1,102 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh.manager: + image: wazuh/wazuh-manager:4.3.0 + hostname: wazuh.manager + restart: always + ports: + - "1514:1514" + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - INDEXER_URL=https://wazuh.indexer:9200 + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=SecretPassword + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - wazuh_api_configuration:/var/ossec/api/configuration + - wazuh_etc:/var/ossec/etc + - wazuh_logs:/var/ossec/logs + - wazuh_queue:/var/ossec/queue + - wazuh_var_multigroups:/var/ossec/var/multigroups + - wazuh_integrations:/var/ossec/integrations + - wazuh_active_response:/var/ossec/active-response/bin + - wazuh_agentless:/var/ossec/agentless + - wazuh_wodles:/var/ossec/wodles + - filebeat_etc:/etc/filebeat + - filebeat_var:/var/lib/filebeat + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh.indexer: + image: wazuh/wazuh-indexer:4.3.0 + hostname: wazuh.indexer + restart: always + ports: + - "9200:9200" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data:/var/lib/wazuh-indexer + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.key + - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.pem + - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem + - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem + - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml + - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh.dashboard: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: wazuh.dashboard + restart: always + ports: + - 443:443 + environment: + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=admin + - WAZUH_API_URL=https://wazuh.manager + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem + - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem + - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem + - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml + - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + depends_on: + - wazuh.indexer + links: + - wazuh.indexer:wazuh.indexer + - wazuh.manager:wazuh.manager + +volumes: + wazuh_api_configuration: + wazuh_etc: + wazuh_logs: + wazuh_queue: + wazuh_var_multigroups: + wazuh_integrations: + wazuh_active_response: + wazuh_agentless: + wazuh_wodles: + filebeat_etc: + filebeat_var: + wazuh-indexer-data: diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml new file mode 100644 index 00000000..c29c50d6 --- /dev/null +++ b/single-node/generate-indexer-certs.yml @@ -0,0 +1,10 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3' + +services: + generator: + image: wazuh/wazuh-certs-generator:0.0.1 + hostname: wazuh-certs-generator + volumes: + - ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml + - ./config/wazuh_indexer_ssl_certs/:/certificates/ \ No newline at end of file