yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #2393 from wazuh/change/2375-change-uid-gid-on-wazuh-images

Browse Source 
Unification of user UID and GID
This commit is contained in:
Gonzalo Acuña
2026-05-13 14:08:04 -03:00
committed by GitHub
parent 388b2c2225 03a27b5645
commit b5c43c34e7
13 changed files with 131 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1 -1
View File
@@ -12,7 +12,7 @@ multi-node/wazuh-certificates/*
multi-node/wazuh-certificates-tool.log
multi-node/wazuh-certs-tool*.sh
multi-node/config*.yml
multi-node/config/wazuh*
multi-node/config/*/certs
# Documentation
docs/book/
CHANGELOG.md
+1
View File
@@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file.
### Changed
- Unification of user UID and GID ([#2393](https://github.com/wazuh/wazuh-docker/pull/2393))
- Add Wazuh indexer engine start on entrypoint ([#2390](https://github.com/wazuh/wazuh-docker/pull/2390))
- Image build process update ([#2358](https://github.com/wazuh/wazuh-docker/pull/2358))
- Add new path on artifact_urls file ([#2344](https://github.com/wazuh/wazuh-docker/pull/2344))
build-docker-images/wazuh-agent/Dockerfile
+20 -4
View File
@@ -14,8 +14,21 @@ ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
ARG TARGETARCH
ARG wazuh_agent_x86_64_rpm
ARG wazuh_agent_aarch64_rpm
ARG WAZUH_UID=101
ARG WAZUH_GID=101
RUN RPM_ARCH="x86_64" && \
# Install only runtime dependencies
RUN dnf install procps shadow-utils -y && \
dnf clean all && \
getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
getent passwd wazuh || useradd --system \
--no-create-home \
--home-dir /var/ossec \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh && \
RPM_ARCH="x86_64" && \
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \
agent_url="${!URL_VAR}" && \
@@ -38,17 +51,20 @@ RUN curl --fail --silent -L \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
# Install only runtime dependencies
RUN dnf install procps shadow-utils -y && \
dnf clean all && \
getent group wazuh || groupadd -r -g 999 wazuh && \
getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
getent passwd wazuh || useradd --system \
--uid 999 \
--no-create-home \
--home-dir /var/ossec \
--gid wazuh \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh
build-docker-images/wazuh-dashboard/Dockerfile
+29 -7
View File
@@ -7,9 +7,28 @@ ARG TARGETARCH
ARG wazuh_dashboard_x86_64_rpm
ARG wazuh_dashboard_aarch64_rpm
ARG wazuh_config_yml
ARG WAZUH_UID=101
ARG WAZUH_GID=101
# Set environment variables
ENV USER="wazuh-dashboard" \
GROUP="wazuh-dashboard" \
NAME="wazuh-dashboard" \
INSTALL_DIR="/usr/share/wazuh-dashboard"
# Update and install dependencies
RUN RPM_ARCH="x86_64" && \
RUN yum install shadow-utils -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid $GROUP \
--shell /sbin/nologin \
--comment "$USER user" \
$USER && \
RPM_ARCH="x86_64" && \
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
URL_VAR="wazuh_dashboard_${RPM_ARCH}_rpm" && \
dashboard_url="${!URL_VAR}" && \
@@ -34,6 +53,9 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
# Set environment variables
ENV USER="wazuh-dashboard" \
GROUP="wazuh-dashboard" \
@@ -60,9 +82,9 @@ COPY config/wazuh_dashboard_config.sh /
# Update and install dependencies
RUN yum install shadow-utils -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid 1000 \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid $GROUP \
@@ -72,13 +94,13 @@ RUN yum install shadow-utils -y && \
chmod 700 /entrypoint.sh && \
chmod 700 /wazuh_dashboard_config.sh && \
mkdir -p $INSTALL_DIR && \
chown 1000:1000 $INSTALL_DIR && \
chown 1000:1000 /*.sh && \
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
# Copy Install dir from builder to current image
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
COPY --from=builder $INSTALL_DIR $INSTALL_DIR
COPY --from=builder /etc/wazuh-dashboard $INSTALL_DIR/config/
# Set workdir and user
WORKDIR $INSTALL_DIR
build-docker-images/wazuh-indexer/Dockerfile
+32 -11
View File
@@ -7,10 +7,28 @@ ARG wazuh_indexer_x86_64_rpm
ARG wazuh_indexer_aarch64_rpm
ARG wazuh_certs_tool
ARG wazuh_config_yml
ARG WAZUH_UID=101
ARG WAZUH_GID=101
ENV USER="wazuh-indexer" \
GROUP="wazuh-indexer" \
NAME="wazuh-indexer" \
INSTALL_DIR="/usr/share/wazuh-indexer"
COPY config/config.sh .
RUN RPM_ARCH="x86_64" && \
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
--comment "$USER user" \
$USER && \
RPM_ARCH="x86_64" && \
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \
indexer_url="${!URL_VAR}" && \
@@ -29,6 +47,9 @@ RUN RPM_ARCH="x86_64" && \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
ENV USER="wazuh-indexer" \
GROUP="wazuh-indexer" \
NAME="wazuh-indexer" \
@@ -41,25 +62,25 @@ COPY config/securityadmin.sh /
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid 1000 \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid $GROUP \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
--comment "$USER user" \
$USER && \
chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
mkdir -p $INSTALL_DIR && \
chown 1000:1000 $INSTALL_DIR && \
chown 1000:1000 /*.sh && \
mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \
mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \
mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
COPY --from=builder $INSTALL_DIR $INSTALL_DIR
RUN chmod 700 $INSTALL_DIR && \
chmod 700 $INSTALL_DIR/config && \
build-docker-images/wazuh-indexer/config/config.sh
+2
View File
@@ -13,7 +13,9 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
# Modify opensearch.yml config paths
if [ -d "/etc/wazuh-indexer" ]; then
mkdir -p ${CONFIG_DIR}
chown ${USER}:${GROUP} ${CONFIG_DIR}
mkdir -p ${CONFIG_DIR}/certs
chown ${USER}:${GROUP} ${CONFIG_DIR}/certs
mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
rmdir /etc/wazuh-indexer
fi
build-docker-images/wazuh-manager/Dockerfile
+20 -5
View File
@@ -12,15 +12,27 @@ ARG TINI_VERSION="v0.19.0"
ARG TARGETARCH
ARG wazuh_manager_x86_64_rpm
ARG wazuh_manager_aarch64_rpm
ARG WAZUH_UID=101
ARG WAZUH_GID=101
# Prepare permanent data config needed by permanent_data.sh at build time
COPY config/permanent_data.env config/permanent_data.sh /
RUN RPM_ARCH="x86_64" && \
RUN dnf install openssl findutils procps shadow-utils -y && \
dnf clean all && \
getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
getent passwd wazuh-manager || useradd --system \
--no-create-home \
--home-dir /var/wazuh-manager \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh-manager && \
RPM_ARCH="x86_64" && \
if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \
URL_VAR="wazuh_manager_${RPM_ARCH}_rpm" && \
manager_url="${!URL_VAR}" && \
dnf install curl-minimal xz gnupg tar gzip openssl findutils procps shadow-utils -y && \
dnf install curl-minimal xz gnupg tar gzip -y && \
dnf clean all && \
curl -o /wazuh-manager.rpm "${manager_url}" && \
dnf install /wazuh-manager.rpm -y && \
@@ -53,17 +65,20 @@ RUN curl --fail --silent -L \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
# Install only runtime dependencies (no curl, tar, gzip, xz, or full dnf stack)
RUN dnf install openssl findutils procps shadow-utils -y && \
dnf clean all && \
getent group wazuh-manager || groupadd -r -g 999 wazuh-manager && \
getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
getent passwd wazuh-manager || useradd --system \
--uid 999 \
--no-create-home \
--home-dir /var/wazuh-manager \
--gid wazuh-manager \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh-manager
build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+3 -3
View File
@@ -252,9 +252,9 @@ configure_permissions() {
##############################################################################
set_correct_permOwner() {
find /var/wazuh-manager/ -group 997 -exec chown :999 {} +;
find /var/wazuh-manager/ -group 101 -exec chown :999 {} +;
find /var/wazuh-manager/ -user 101 -exec chown 999 {} +;
find /var/wazuh-manager/ -group 997 -exec chown :101 {} +;
find /var/wazuh-manager/ -group 999 -exec chown :101 {} +;
find /var/wazuh-manager/ -user 999 -exec chown 101:{} +;
}
##############################################################################
multi-node/Migration-to-Wazuh-4.4.md
-283
View File
@@ -1,283 +0,0 @@
# Opendistro data migration to Wazuh indexer on docker.
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
The example is migrating from v4.2 to v4.4.
## Procedure
Assuming that you have a v4.2 production deployment, perform the following steps.
**1. Stop 4.2 environment**
`docker-compose -f production-cluster.yml stop`
**2. List elasticsearch volumes**
`docker volume ls --filter name='wazuh-docker_elastic-data'`
**3. Inspect elasticsearch volume**
`docker volume inspect wazuh-docker_elastic-data-1`
**4. Spin down the 4.2 environment.**
`docker-compose -f production-cluster.yml down`
**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker compose version and project name as parameters.**
Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command.
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=wazuh-indexer-data-1 \
multi-node_wazuh-indexer-data-1
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=wazuh-indexer-data-2 \
multi-node_wazuh-indexer-data-2
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=wazuh-indexer-data-3 \
multi-node_wazuh-indexer-data-3
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master_wazuh_api_configuration \
multi-node_master_wazuh_api_configuration
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master_wazuh_etc \
multi-node_docker_wazuh_etc
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-logs \
multi-node_master-wazuh-logs
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-queue \
multi-node_master-wazuh-queue
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-var-multigroups \
multi-node_master-wazuh-var-multigroups
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-active-response \
multi-node_master-wazuh-active-response
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-etc \
multi-node_master-wazuh-etc
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-var \
multi-node_master-wazuh-var
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker_wazuh_api_configuration \
multi-node_worker_wazuh_api_configuration
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker_wazuh_etc \
multi-node_worker-wazuh-etc
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-logs \
multi-node_worker-wazuh-logs
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-queue \
multi-node_worker-wazuh-queue
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
multi-node_worker-wazuh-var-multigroups
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-active-response \
multi-node_worker-wazuh-active-response
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-etc \
multi-node_worker-wazuh-etc
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-var \
multi-node_worker-wazuh-var
```
**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
```
docker container run --rm -it \
-v wazuh-docker_elastic-data-1:/from \
-v multi-node_wazuh-indexer-data-1:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_elastic-data-2:/from \
-v multi-node_wazuh-indexer-data-2:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_elastic-data-3:/from \
-v multi-node_wazuh-indexer-data-3:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-api-configuration:/from \
-v multi-node_master-wazuh-api-configuration:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-etc:/from \
-v multi-node_master-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-logs:/from \
-v multi-node_master-wazuh-logs:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-queue:/from \
-v multi-node_master-wazuh-queue:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-var-multigroups:/from \
-v multi-node_master-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-active-response:/from \
-v multi-node_master-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker-etc:/from \
-v multi-node_master-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker-var:/from \
-v multi-node_master-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-api-configuration:/from \
-v multi-node_worker-wazuh-api-configuration:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-etc:/from \
-v multi-node_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-logs:/from \
-v multi-node_worker-wazuh-logs:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-queue:/from \
-v multi-node_worker-wazuh-queue:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-var-multigroups:/from \
-v multi-node_worker-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-active-response:/from \
-v multi-node_worker-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-etc:/from \
-v multi-node_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-var:/from \
-v multi-node_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
**7. Start the 4.4 environment.**
```
git checkout 4.4
cd multi-node
docker-compose -f generate-indexer-certs.yml run --rm generator
docker-compose up -d
```
**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data.
multi-node/docker-compose.yml
+6 -6
View File
@@ -38,7 +38,7 @@ services:
- master-wazuh-logs:/var/wazuh-manager/logs
- master-wazuh-queue:/var/wazuh-manager/queue
- master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -77,7 +77,7 @@ services:
- worker-wazuh-logs:/var/wazuh-manager/logs
- worker-wazuh-queue:/var/wazuh-manager/queue
- worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups
- ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -113,7 +113,7 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
- ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
@@ -153,7 +153,7 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
- ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
@@ -191,7 +191,7 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
- ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
@@ -223,7 +223,7 @@ services:
volumes:
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
multi-node/volume-migrator.sh
-213
View File
@@ -1,213 +0,0 @@
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=wazuh-indexer-data-1 \
$2_wazuh-indexer-data-1
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=wazuh-indexer-data-2 \
$2_wazuh-indexer-data-2
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=wazuh-indexer-data-3 \
$2_wazuh-indexer-data-3
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master_wazuh_api_configuration \
$2_master_wazuh_api_configuration
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master_wazuh_etc \
$2_docker_wazuh_etc
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-logs \
$2_master-wazuh-logs
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-queue \
$2_master-wazuh-queue
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-var-multigroups \
$2_master-wazuh-var-multigroups
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-active-response \
$2_master-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-etc \
$2_master-wazuh-etc
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-var \
$2_master-wazuh-var
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker_wazuh_api_configuration \
$2_worker_wazuh_api_configuration
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker_wazuh_etc \
$2_worker-wazuh-etc
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-logs \
$2_worker-wazuh-logs
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-queue \
$2_worker-wazuh-queue
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
$2_worker-wazuh-var-multigroups
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-active-response \
$2_worker-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-etc \
$2_worker-wazuh-etc
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-var \
$2_worker-wazuh-var
docker container run --rm -it \
-v wazuh-docker_worker-var:/from \
-v $2_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_elastic-data-1:/from \
-v $2_wazuh-indexer-data-1:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_elastic-data-2:/from \
-v $2_wazuh-indexer-data-2:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_elastic-data-3:/from \
-v $2_wazuh-indexer-data-3:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-api-configuration:/from \
-v $2_master-wazuh-api-configuration:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-etc:/from \
-v $2_master-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-logs:/from \
-v $2_master-wazuh-logs:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-queue:/from \
-v $2_master-wazuh-queue:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-var-multigroups:/from \
-v $2_master-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-active-response:/from \
-v $2_master-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker-etc:/from \
-v $2_master-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker-var:/from \
-v $2_master-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-api-configuration:/from \
-v $2_worker-wazuh-api-configuration:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-etc:/from \
-v $2_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-logs:/from \
-v $2_worker-wazuh-logs:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-queue:/from \
-v $2_worker-wazuh-queue:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-var-multigroups:/from \
-v $2_worker-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-active-response:/from \
-v $2_worker-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-etc:/from \
-v $2_worker-wazuh-etc:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-var:/from \
-v $2_worker-wazuh-var:/to \
alpine ash -c "cd /from ; cp -avp . /to"
single-node/docker-compose.yml
+3 -3
View File
@@ -38,7 +38,7 @@ services:
- wazuh_logs:/var/wazuh-manager/logs
- wazuh_queue:/var/wazuh-manager/queue
- wazuh_var_multigroups:/var/wazuh-manager/var/multigroups
- ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem
- ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem
- ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
@@ -73,7 +73,7 @@ services:
start_period: 60s
volumes:
- wazuh-indexer-data:/var/lib/wazuh-indexer
- ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem
- ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
- ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
@@ -107,7 +107,7 @@ services:
volumes:
- ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem
- ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
tools/utils/deployment/certificates-conf.sh
+14 -9
View File
@@ -77,6 +77,8 @@ node_to_dir() {
# ---------------------------------------------------------------------------
# Parse config.yml
export WAZUH_UID=101
export WAZUH_GID=101
if $DO_COPY || $DO_PRIV; then
if [ ! -f "$CONFIG_FILE" ]; then
echo "Error: Configuration file $CONFIG_FILE not found."
@@ -102,7 +104,6 @@ if $DO_COPY; then
echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
if $FIRST_INDEXER; then
cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
FIRST_INDEXER=false
@@ -114,7 +115,6 @@ if $DO_COPY; then
echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
for node in "${DASHBOARD_NODES[@]}"; do
@@ -122,32 +122,37 @@ if $DO_COPY; then
echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
echo "Copying root-ca certificates -> config/root-ca/certs/"
mkdir -p "./config/root-ca/certs"
cp "$OUTPUT_DIR"/root-ca* "./config/root-ca/certs/"
fi
# 3. Set ownership and permissions
if $DO_PRIV; then
for node in "${INDEXER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for indexer $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
echo "Setting permissions for indexer $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${MANAGER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for manager $node (999:999)"
chown -R 999:999 "./config/$dir_name/certs"
echo "Setting permissions for manager $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${DASHBOARD_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for dashboard $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
echo "Setting permissions for dashboard $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
echo "Setting permissions for root-ca certificates (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/root-ca/certs"
chmod 400 "./config/root-ca/certs/"*
fi
echo "Process completed."