From b2de947ee983c563635a9834c10895176fe10387 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 28 Oct 2025 22:53:03 +0700 Subject: [PATCH] dashboard --- .env | 2 +- .../wazuh-dashboard/Dockerfile | 3 +- .../wazuh-dashboard/config/config.sh | 71 ++++++-- .../wazuh-dashboard/config/config.yml | 5 - .../wazuh-dashboard/config/wazuh.yml | 155 ------------------ .../config/wazuh_app_config.sh | 8 - build-docker-images/wazuh-indexer/Dockerfile | 56 ------- .../wazuh-indexer/config/config.sh | 8 +- 8 files changed, 63 insertions(+), 245 deletions(-) delete mode 100644 build-docker-images/wazuh-dashboard/config/config.yml delete mode 100644 build-docker-images/wazuh-dashboard/config/wazuh.yml diff --git a/.env b/.env index e2c2fa20..6680c681 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ WAZUH_VERSION=4.14.0 WAZUH_IMAGE_VERSION=4.14.0 WAZUH_TAG_REVISION=1 -FILEBEAT_TEMPLATE_BRANCH=4.14.0 +FILEBEAT_TEMPLATE_BRANCH=v4.14.0 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 18f3976a..4cb0f5d9 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -20,13 +20,11 @@ RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs -COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node # Generate certificates COPY config/config.sh . -COPY config/config.yml / RUN bash config.sh ################################################################################ @@ -82,6 +80,7 @@ RUN chown 1000:1000 /*.sh # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR +COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config # Create custom directory RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 6c787e4c..8aba1cdd 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,26 +9,67 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.14/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/ +CERT_CONFIG_FILE=config.yml +CERT_TOOL_VERSION="4.14" +PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ -## Check if the cert tool exists in S3 buckets -CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') -CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') +download_package() { + local url=$1 + local package=$2 + local output=$2 + echo "Checking $url$package ..." + if curl -fsL "$url$package" -o "$output"; then + echo "Downloaded $package from $url" + return 0 + else + return 1 + fi +} -## If cert tool exists in some bucket, download it, if not exit 1 -if [ "$CERT_TOOL_PACKAGES" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL - echo "Cert tool exists in Packages bucket" -elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL - echo "Cert tool exists in Packages-dev bucket" +# Download the tool to create the certificates +echo "Downloading the tool to create the certificates..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_TOOL"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then + : else - echo "Cert tool does not exist in any bucket" - exit 1 + echo "The tool to create the certificates does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 fi -chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A +# Download the config file for the certificate tool +echo "Downloading the config file for the certificate tool..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then + : +else + echo "The config file for the certificate tool does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 +fi + +awk ' +/^ dashboard:/ {dashboard=1} +/^ # Wazuh server nodes/ {dashboard=0} +dashboard && /^[[:space:]]*[^#].*name:/ {sub(/name:.*/, "name: dashboard")} +dashboard && /^[[:space:]]*[^#].*ip:/ {sub(/ip:.*/, "ip: \"127.0.0.1\"")} + +{print} +' config.yml > config.yml.tmp && mv config.yml config.yml.bak && mv config.yml.tmp config.yml + +sed -i \ + -e 's/^ *ip: ""$/ ip: "127.0.0.1"/' \ + -e 's/^ *ip: ""$/ ip: "127.0.0.1"/' \ + config.yaml + +chmod 700 "$CERT_CONFIG_FILE" +# Create the certificates +chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A # Create certs directory mkdir -p ${CONFIG_DIR}/certs diff --git a/build-docker-images/wazuh-dashboard/config/config.yml b/build-docker-images/wazuh-dashboard/config/config.yml deleted file mode 100644 index 24764d54..00000000 --- a/build-docker-images/wazuh-dashboard/config/config.yml +++ /dev/null @@ -1,5 +0,0 @@ -nodes: - # Wazuh dashboard server nodes - dashboard: - - name: demo.dashboard - ip: demo.dashboard \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml deleted file mode 100644 index 8e5f9447..00000000 --- a/build-docker-images/wazuh-dashboard/config/wazuh.yml +++ /dev/null @@ -1,155 +0,0 @@ ---- -# -# Wazuh app - App configuration file -# Copyright (C) 2017, Wazuh Inc. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# Find more information about this on the LICENSE file. -# -# ======================== Wazuh app configuration file ======================== -# -# Please check the documentation for more information on configuration options: -# https://documentation.wazuh.com/current/installation-guide/index.html -# -# Also, you can check our repository: -# https://github.com/wazuh/wazuh-dashboard-plugins -# -# ------------------------------- Index patterns ------------------------------- -# -# Default index pattern to use. -#pattern: wazuh-alerts-* -# -# ----------------------------------- Checks ----------------------------------- -# -# Defines which checks must to be consider by the healthcheck -# step once the Wazuh app starts. Values must to be true or false. -#checks.pattern : true -#checks.template: true -#checks.api : true -#checks.setup : true -#checks.metaFields: true -# -# --------------------------------- Extensions --------------------------------- -# -# Defines which extensions should be activated when you add a new API entry. -# You can change them after Wazuh app starts. -# Values must to be true or false. -#extensions.pci : true -#extensions.gdpr : true -#extensions.hipaa : true -#extensions.nist : true -#extensions.tsc : true -#extensions.audit : true -#extensions.oscap : false -#extensions.ciscat : false -#extensions.aws : false -#extensions.gcp : false -#extensions.virustotal: false -#extensions.osquery : false -#extensions.docker : false -# -# ---------------------------------- Time out ---------------------------------- -# -# Defines maximum timeout to be used on the Wazuh app requests. -# It will be ignored if it is bellow 1500. -# It means milliseconds before we consider a request as failed. -# Default: 20000 -#timeout: 20000 -# -# -------------------------------- API selector -------------------------------- -# -# Defines if the user is allowed to change the selected -# API directly from the Wazuh app top menu. -# Default: true -#api.selector: true -# -# --------------------------- Index pattern selector --------------------------- -# -# Defines if the user is allowed to change the selected -# index pattern directly from the Wazuh app top menu. -# Default: true -#ip.selector: true -# -# List of index patterns to be ignored -#ip.ignore: [] -# -# ------------------------------ wazuh-monitoring ------------------------------ -# -# Custom setting to enable/disable wazuh-monitoring indices. -# Values: true, false, worker -# If worker is given as value, the app will show the Agents status -# visualization but won't insert data on wazuh-monitoring indices. -# Default: true -#wazuh.monitoring.enabled: true -# -# Custom setting to set the frequency for wazuh-monitoring indices cron task. -# Default: 900 (s) -#wazuh.monitoring.frequency: 900 -# -# Configure wazuh-monitoring-* indices shards and replicas. -#wazuh.monitoring.shards: 2 -#wazuh.monitoring.replicas: 0 -# -# Configure wazuh-monitoring-* indices custom creation interval. -# Values: h (hourly), d (daily), w (weekly), m (monthly) -# Default: d -#wazuh.monitoring.creation: d -# -# Default index pattern to use for Wazuh monitoring -#wazuh.monitoring.pattern: wazuh-monitoring-* -# -# --------------------------------- wazuh-cron ---------------------------------- -# -# Customize the index prefix of predefined jobs -# This change is not retroactive, if you change it new indexes will be created -# cron.prefix: test -# -# ------------------------------ wazuh-statistics ------------------------------- -# -# Custom setting to enable/disable statistics tasks. -#cron.statistics.status: true -# -# Enter the ID of the APIs you want to save data from, leave this empty to run -# the task on all configured APIs -#cron.statistics.apis: [] -# -# Define the frequency of task execution using cron schedule expressions -#cron.statistics.interval: 0 0 * * * * -# -# Define the name of the index in which the documents are to be saved. -#cron.statistics.index.name: statistics -# -# Define the interval in which the index will be created -#cron.statistics.index.creation: w -# -# ------------------------------- App privileges -------------------------------- -#admin: true -# -# ---------------------------- Hide manager alerts ------------------------------ -# Hide the alerts of the manager in all dashboards and discover -#hideManagerAlerts: false -# -# ------------------------------- App logging level ----------------------------- -# Set the logging level for the Wazuh App log files. -# Default value: info -# Allowed values: info, debug -#logs.level: info -# -# -------------------------------- Enrollment DNS ------------------------------- -# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment. -# Default value: '' -#enrollment.dns: '' -# -#-------------------------------- API entries ----------------------------------- -#The following configuration is the default structure to define an API entry. -# -#hosts: -# - : -# url: http(s):// -# port: -# username: -# password: diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 76ecdc7f..e98a8b46 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -32,11 +32,6 @@ do fi done - -grep -q 1513629884013 $dashboard_config_file -_config_exists=$? - -if [[ $_config_exists -ne 0 ]]; then cat << EOF >> $dashboard_config_file hosts: - 1513629884013: @@ -46,7 +41,4 @@ hosts: password: $api_password run_as: $api_run_as EOF -else - echo "Wazuh APP already configured" -fi diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 6491605c..737750de 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -24,59 +24,3 @@ RUN bash config.sh # Add entrypoint ################################################################################ - -FROM amazonlinux:2023 - -ENV USER="wazuh-indexer" \ - GROUP="wazuh-indexer" \ - NAME="wazuh-indexer" \ - INSTALL_DIR="/usr/share/wazuh-indexer" - -RUN yum install curl-minimal shadow-utils findutils hostname -y - -RUN getent group $GROUP || groupadd -r -g 1000 $GROUP - -RUN useradd --system \ - --uid 1000 \ - --no-create-home \ - --home-dir $INSTALL_DIR \ - --gid $GROUP \ - --shell /sbin/nologin \ - --comment "$USER user" \ - $USER - -WORKDIR $INSTALL_DIR - -COPY config/entrypoint.sh / - -COPY config/securityadmin.sh / - -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ - mkdir -p /usr/share/wazuh-indexer && \ - chown 1000:1000 /usr/share/wazuh-indexer && \ - chown 1000:1000 /*.sh - -COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer -COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config -COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d - -RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ - mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ - mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer/config && \ - chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ - chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml - -USER wazuh-indexer - -# Services ports -EXPOSE 9200 - -ENTRYPOINT ["/entrypoint.sh"] -# Dummy overridable parameter parsed by entrypoint -CMD ["opensearchwrapper"] \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index ebe2a8ee..daff5923 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -74,6 +74,10 @@ in_indexer && /^[[:space:]]*[^#].*name:/ {sub(/name:.*/, "name: indexer")} {print} ' config.yml > config.yml.tmp && mv config.yml config.yml.bak && mv config.yml.tmp config.yml +sed -i \ + -e 's/^ *ip: ""$/ ip: "127.0.0.1"/' \ + -e 's/^ *ip: ""$/ ip: "127.0.0.1"/' \ + config.yaml chmod 700 "$CERT_CONFIG_FILE" # Create the certificates @@ -88,10 +92,8 @@ cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem -# Delete xms and xmx parameters in jvm.options -sed '/-Xms/d' -i /etc/wazuh-indexer/jvm.options -sed '/-Xmx/d' -i /etc/wazuh-indexer/jvm.options sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options +sed -i 's|/etc/wazuh-indexer|/usr/share/wazuh-indexer/config|g' /etc/wazuh-indexer/opensearch.yml chown -R ${USER}:${GROUP} ${CONFIG_DIR} chmod -R 500 ${CONFIG_DIR}/certs