diff --git a/.gitignore b/.gitignore index 36cabbb5..3d9c887e 100644 --- a/.gitignore +++ b/.gitignore @@ -12,7 +12,7 @@ multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log multi-node/wazuh-certs-tool*.sh multi-node/config*.yml -multi-node/config/wazuh* +multi-node/config/*/certs # Documentation docs/book/ diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f9ad51c..b132c301 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Unification of user UID and GID ([#2393](https://github.com/wazuh/wazuh-docker/pull/2393)) - Add Wazuh indexer engine start on entrypoint ([#2390](https://github.com/wazuh/wazuh-docker/pull/2390)) - Image build process update ([#2358](https://github.com/wazuh/wazuh-docker/pull/2358)) - Add new path on artifact_urls file ([#2344](https://github.com/wazuh/wazuh-docker/pull/2344)) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index d68e3539..7cb8ea35 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -14,8 +14,21 @@ ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME' ARG TARGETARCH ARG wazuh_agent_x86_64_rpm ARG wazuh_agent_aarch64_rpm +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 -RUN RPM_ARCH="x86_64" && \ +# Install only runtime dependencies +RUN dnf install procps shadow-utils -y && \ + dnf clean all && \ + getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \ + getent passwd wazuh || useradd --system \ + --no-create-home \ + --home-dir /var/ossec \ + --uid ${WAZUH_UID} \ + --gid ${WAZUH_GID} \ + --shell /sbin/nologin \ + wazuh && \ + RPM_ARCH="x86_64" && \ if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \ URL_VAR="wazuh_agent_${RPM_ARCH}_rpm" && \ agent_url="${!URL_VAR}" && \ @@ -38,17 +51,20 @@ RUN curl --fail --silent -L \ ################################################################################ FROM amazonlinux:2023 +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + RUN rm /bin/sh && ln -s /bin/bash /bin/sh # Install only runtime dependencies RUN dnf install procps shadow-utils -y && \ dnf clean all && \ - getent group wazuh || groupadd -r -g 999 wazuh && \ + getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \ getent passwd wazuh || useradd --system \ - --uid 999 \ --no-create-home \ --home-dir /var/ossec \ - --gid wazuh \ + --uid ${WAZUH_UID} \ + --gid ${WAZUH_GID} \ --shell /sbin/nologin \ wazuh diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 98729e54..40c287ef 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -7,9 +7,28 @@ ARG TARGETARCH ARG wazuh_dashboard_x86_64_rpm ARG wazuh_dashboard_aarch64_rpm ARG wazuh_config_yml +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + +# Set environment variables +ENV USER="wazuh-dashboard" \ + GROUP="wazuh-dashboard" \ + NAME="wazuh-dashboard" \ + INSTALL_DIR="/usr/share/wazuh-dashboard" # Update and install dependencies -RUN RPM_ARCH="x86_64" && \ +RUN yum install shadow-utils -y && \ + yum clean all && \ + getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \ + useradd --system \ + --uid ${WAZUH_UID} \ + --no-create-home \ + --home-dir $INSTALL_DIR \ + --gid $GROUP \ + --shell /sbin/nologin \ + --comment "$USER user" \ + $USER && \ + RPM_ARCH="x86_64" && \ if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \ URL_VAR="wazuh_dashboard_${RPM_ARCH}_rpm" && \ dashboard_url="${!URL_VAR}" && \ @@ -34,6 +53,9 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node ################################################################################ FROM amazonlinux:2023 +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + # Set environment variables ENV USER="wazuh-dashboard" \ GROUP="wazuh-dashboard" \ @@ -60,9 +82,9 @@ COPY config/wazuh_dashboard_config.sh / # Update and install dependencies RUN yum install shadow-utils -y && \ yum clean all && \ - getent group $GROUP || groupadd -r -g 1000 $GROUP && \ + getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \ useradd --system \ - --uid 1000 \ + --uid ${WAZUH_UID} \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ @@ -72,13 +94,13 @@ RUN yum install shadow-utils -y && \ chmod 700 /entrypoint.sh && \ chmod 700 /wazuh_dashboard_config.sh && \ mkdir -p $INSTALL_DIR && \ - chown 1000:1000 $INSTALL_DIR && \ - chown 1000:1000 /*.sh && \ + chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \ + chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \ mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom # Copy Install dir from builder to current image -COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR -COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/ +COPY --from=builder $INSTALL_DIR $INSTALL_DIR +COPY --from=builder /etc/wazuh-dashboard $INSTALL_DIR/config/ # Set workdir and user WORKDIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index a12262b6..80c528e3 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -7,10 +7,28 @@ ARG wazuh_indexer_x86_64_rpm ARG wazuh_indexer_aarch64_rpm ARG wazuh_certs_tool ARG wazuh_config_yml +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + +ENV USER="wazuh-indexer" \ + GROUP="wazuh-indexer" \ + NAME="wazuh-indexer" \ + INSTALL_DIR="/usr/share/wazuh-indexer" COPY config/config.sh . -RUN RPM_ARCH="x86_64" && \ +RUN yum install curl-minimal shadow-utils findutils hostname -y && \ + yum clean all && \ + getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \ + useradd --system \ + --uid ${WAZUH_UID} \ + --no-create-home \ + --home-dir $INSTALL_DIR \ + --gid ${WAZUH_GID} \ + --shell /sbin/nologin \ + --comment "$USER user" \ + $USER && \ + RPM_ARCH="x86_64" && \ if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \ URL_VAR="wazuh_indexer_${RPM_ARCH}_rpm" && \ indexer_url="${!URL_VAR}" && \ @@ -29,6 +47,9 @@ RUN RPM_ARCH="x86_64" && \ ################################################################################ FROM amazonlinux:2023 +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ NAME="wazuh-indexer" \ @@ -41,25 +62,25 @@ COPY config/securityadmin.sh / RUN yum install curl-minimal shadow-utils findutils hostname -y && \ yum clean all && \ - getent group $GROUP || groupadd -r -g 1000 $GROUP && \ + getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \ useradd --system \ - --uid 1000 \ + --uid ${WAZUH_UID} \ --no-create-home \ --home-dir $INSTALL_DIR \ - --gid $GROUP \ + --gid ${WAZUH_GID} \ --shell /sbin/nologin \ --comment "$USER user" \ $USER && \ chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ mkdir -p $INSTALL_DIR && \ - chown 1000:1000 $INSTALL_DIR && \ - chown 1000:1000 /*.sh && \ - mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ - mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \ - mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer + chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \ + chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \ + mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \ + mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \ + mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \ + mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer -COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR +COPY --from=builder $INSTALL_DIR $INSTALL_DIR RUN chmod 700 $INSTALL_DIR && \ chmod 700 $INSTALL_DIR/config && \ diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 2f34484a..6c6fcce1 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -13,7 +13,9 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config # Modify opensearch.yml config paths if [ -d "/etc/wazuh-indexer" ]; then mkdir -p ${CONFIG_DIR} + chown ${USER}:${GROUP} ${CONFIG_DIR} mkdir -p ${CONFIG_DIR}/certs + chown ${USER}:${GROUP} ${CONFIG_DIR}/certs mv /etc/wazuh-indexer/* ${CONFIG_DIR}/ rmdir /etc/wazuh-indexer fi diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 35adb246..6e7a5181 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -12,15 +12,27 @@ ARG TINI_VERSION="v0.19.0" ARG TARGETARCH ARG wazuh_manager_x86_64_rpm ARG wazuh_manager_aarch64_rpm +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 # Prepare permanent data config needed by permanent_data.sh at build time COPY config/permanent_data.env config/permanent_data.sh / -RUN RPM_ARCH="x86_64" && \ +RUN dnf install openssl findutils procps shadow-utils -y && \ + dnf clean all && \ + getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \ + getent passwd wazuh-manager || useradd --system \ + --no-create-home \ + --home-dir /var/wazuh-manager \ + --uid ${WAZUH_UID} \ + --gid ${WAZUH_GID} \ + --shell /sbin/nologin \ + wazuh-manager && \ + RPM_ARCH="x86_64" && \ if [ "${TARGETARCH}" = "arm64" ]; then RPM_ARCH="aarch64"; fi && \ URL_VAR="wazuh_manager_${RPM_ARCH}_rpm" && \ manager_url="${!URL_VAR}" && \ - dnf install curl-minimal xz gnupg tar gzip openssl findutils procps shadow-utils -y && \ + dnf install curl-minimal xz gnupg tar gzip -y && \ dnf clean all && \ curl -o /wazuh-manager.rpm "${manager_url}" && \ dnf install /wazuh-manager.rpm -y && \ @@ -53,17 +65,20 @@ RUN curl --fail --silent -L \ ################################################################################ FROM amazonlinux:2023 +ARG WAZUH_UID=101 +ARG WAZUH_GID=101 + RUN rm /bin/sh && ln -s /bin/bash /bin/sh # Install only runtime dependencies (no curl, tar, gzip, xz, or full dnf stack) RUN dnf install openssl findutils procps shadow-utils -y && \ dnf clean all && \ - getent group wazuh-manager || groupadd -r -g 999 wazuh-manager && \ + getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \ getent passwd wazuh-manager || useradd --system \ - --uid 999 \ --no-create-home \ --home-dir /var/wazuh-manager \ - --gid wazuh-manager \ + --uid ${WAZUH_UID} \ + --gid ${WAZUH_GID} \ --shell /sbin/nologin \ wazuh-manager diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 7813fa22..6721da43 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -252,9 +252,9 @@ configure_permissions() { ############################################################################## set_correct_permOwner() { - find /var/wazuh-manager/ -group 997 -exec chown :999 {} +; - find /var/wazuh-manager/ -group 101 -exec chown :999 {} +; - find /var/wazuh-manager/ -user 101 -exec chown 999 {} +; + find /var/wazuh-manager/ -group 997 -exec chown :101 {} +; + find /var/wazuh-manager/ -group 999 -exec chown :101 {} +; + find /var/wazuh-manager/ -user 999 -exec chown 101:{} +; } ############################################################################## diff --git a/multi-node/Migration-to-Wazuh-4.4.md b/multi-node/Migration-to-Wazuh-4.4.md deleted file mode 100644 index 71f5b3c6..00000000 --- a/multi-node/Migration-to-Wazuh-4.4.md +++ /dev/null @@ -1,283 +0,0 @@ -# Opendistro data migration to Wazuh indexer on docker. -This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. -The example is migrating from v4.2 to v4.4. - -## Procedure -Assuming that you have a v4.2 production deployment, perform the following steps. - -**1. Stop 4.2 environment** -`docker-compose -f production-cluster.yml stop` - -**2. List elasticsearch volumes** -`docker volume ls --filter name='wazuh-docker_elastic-data'` - -**3. Inspect elasticsearch volume** -`docker volume inspect wazuh-docker_elastic-data-1` - -**4. Spin down the 4.2 environment.** -`docker-compose -f production-cluster.yml down` - -**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker compose version and project name as parameters.** - -Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node - -**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command. - -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-1 \ - multi-node_wazuh-indexer-data-1 -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-2 \ - multi-node_wazuh-indexer-data-2 -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=wazuh-indexer-data-3 \ - multi-node_wazuh-indexer-data-3 -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master_wazuh_api_configuration \ - multi-node_master_wazuh_api_configuration -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master_wazuh_etc \ - multi-node_docker_wazuh_etc -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-logs \ - multi-node_master-wazuh-logs -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-queue \ - multi-node_master-wazuh-queue -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-var-multigroups \ - multi-node_master-wazuh-var-multigroups -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-active-response \ - multi-node_master-wazuh-active-response -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-etc \ - multi-node_master-wazuh-etc -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-var \ - multi-node_master-wazuh-var -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker_wazuh_api_configuration \ - multi-node_worker_wazuh_api_configuration -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker_wazuh_etc \ - multi-node_worker-wazuh-etc -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-logs \ - multi-node_worker-wazuh-logs -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-queue \ - multi-node_worker-wazuh-queue -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-var-multigroups \ - multi-node_worker-wazuh-var-multigroups -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-active-response \ - multi-node_worker-wazuh-active-response -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-etc \ - multi-node_worker-wazuh-etc -``` -``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-var \ - multi-node_worker-wazuh-var -``` -**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.** -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-1:/from \ - -v multi-node_wazuh-indexer-data-1:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-2:/from \ - -v multi-node_wazuh-indexer-data-2:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_elastic-data-3:/from \ - -v multi-node_wazuh-indexer-data-3:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-api-configuration:/from \ - -v multi-node_master-wazuh-api-configuration:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-etc:/from \ - -v multi-node_master-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-logs:/from \ - -v multi-node_master-wazuh-logs:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-queue:/from \ - -v multi-node_master-wazuh-queue:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-var-multigroups:/from \ - -v multi-node_master-wazuh-var-multigroups:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_ossec-active-response:/from \ - -v multi-node_master-wazuh-active-response:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker-etc:/from \ - -v multi-node_master-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker-var:/from \ - -v multi-node_master-wazuh-var:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-api-configuration:/from \ - -v multi-node_worker-wazuh-api-configuration:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-etc:/from \ - -v multi-node_worker-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-logs:/from \ - -v multi-node_worker-wazuh-logs:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-queue:/from \ - -v multi-node_worker-wazuh-queue:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-var-multigroups:/from \ - -v multi-node_worker-wazuh-var-multigroups:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-active-response:/from \ - -v multi-node_worker-wazuh-active-response:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-etc:/from \ - -v multi-node_worker-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` -docker container run --rm -it \ - -v wazuh-docker_worker-var:/from \ - -v multi-node_worker-wazuh-var:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` - -**7. Start the 4.4 environment.** -``` -git checkout 4.4 -cd multi-node -docker-compose -f generate-indexer-certs.yml run --rm generator -docker-compose up -d -``` - -**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data. diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 3076d6b0..ddbca606 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -38,7 +38,7 @@ services: - master-wazuh-logs:/var/wazuh-manager/logs - master-wazuh-queue:/var/wazuh-manager/queue - master-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_master/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./config/wazuh_master/certs/wazuh.master.pem:/var/wazuh-manager/etc/certs/manager.pem - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem @@ -77,7 +77,7 @@ services: - worker-wazuh-logs:/var/wazuh-manager/logs - worker-wazuh-queue:/var/wazuh-manager/queue - worker-wazuh-var-multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_worker/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./config/wazuh_worker/certs/wazuh.worker.pem:/var/wazuh-manager/etc/certs/manager.pem - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem @@ -113,7 +113,7 @@ services: start_period: 60s volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./config/wazuh1_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh1_indexer/certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - ./config/wazuh1_indexer/certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - ./config/wazuh1_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem @@ -153,7 +153,7 @@ services: start_period: 60s volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./config/wazuh2_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh2_indexer/certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem @@ -191,7 +191,7 @@ services: start_period: 60s volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./config/wazuh3_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh3_indexer/certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem @@ -223,7 +223,7 @@ services: volumes: - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem - - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh deleted file mode 100755 index 757065c2..00000000 --- a/multi-node/volume-migrator.sh +++ /dev/null @@ -1,213 +0,0 @@ -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=wazuh-indexer-data-1 \ - $2_wazuh-indexer-data-1 - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=wazuh-indexer-data-2 \ - $2_wazuh-indexer-data-2 - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=wazuh-indexer-data-3 \ - $2_wazuh-indexer-data-3 - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master_wazuh_api_configuration \ - $2_master_wazuh_api_configuration - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master_wazuh_etc \ - $2_docker_wazuh_etc - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-logs \ - $2_master-wazuh-logs - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-queue \ - $2_master-wazuh-queue - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-var-multigroups \ - $2_master-wazuh-var-multigroups - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-active-response \ - $2_master-wazuh-active-response - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-etc \ - $2_master-wazuh-etc - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-var \ - $2_master-wazuh-var - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker_wazuh_api_configuration \ - $2_worker_wazuh_api_configuration - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker_wazuh_etc \ - $2_worker-wazuh-etc - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-logs \ - $2_worker-wazuh-logs - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-queue \ - $2_worker-wazuh-queue - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-var-multigroups \ - $2_worker-wazuh-var-multigroups - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-active-response \ - $2_worker-wazuh-active-response - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-etc \ - $2_worker-wazuh-etc - -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-var \ - $2_worker-wazuh-var - -docker container run --rm -it \ - -v wazuh-docker_worker-var:/from \ - -v $2_worker-wazuh-var:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_elastic-data-1:/from \ - -v $2_wazuh-indexer-data-1:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_elastic-data-2:/from \ - -v $2_wazuh-indexer-data-2:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_elastic-data-3:/from \ - -v $2_wazuh-indexer-data-3:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-api-configuration:/from \ - -v $2_master-wazuh-api-configuration:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-etc:/from \ - -v $2_master-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-logs:/from \ - -v $2_master-wazuh-logs:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-queue:/from \ - -v $2_master-wazuh-queue:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-var-multigroups:/from \ - -v $2_master-wazuh-var-multigroups:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_ossec-active-response:/from \ - -v $2_master-wazuh-active-response:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker-etc:/from \ - -v $2_master-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker-var:/from \ - -v $2_master-wazuh-var:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-api-configuration:/from \ - -v $2_worker-wazuh-api-configuration:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-etc:/from \ - -v $2_worker-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-logs:/from \ - -v $2_worker-wazuh-logs:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-queue:/from \ - -v $2_worker-wazuh-queue:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-var-multigroups:/from \ - -v $2_worker-wazuh-var-multigroups:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-active-response:/from \ - -v $2_worker-wazuh-active-response:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-etc:/from \ - -v $2_worker-wazuh-etc:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - -docker container run --rm -it \ - -v wazuh-docker_worker-var:/from \ - -v $2_worker-wazuh-var:/to \ - alpine ash -c "cd /from ; cp -avp . /to" diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8365ed62..b650d905 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -38,7 +38,7 @@ services: - wazuh_logs:/var/wazuh-manager/logs - wazuh_queue:/var/wazuh-manager/queue - wazuh_var_multigroups:/var/wazuh-manager/var/multigroups - - ./config/wazuh_manager/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/var/wazuh-manager/etc/certs/root-ca.pem - ./config/wazuh_manager/certs/wazuh.manager.pem:/var/wazuh-manager/etc/certs/manager.pem - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem @@ -73,7 +73,7 @@ services: start_period: 60s volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./config/wazuh_indexer/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - ./config/wazuh_indexer/certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem - ./config/wazuh_indexer/certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem - ./config/wazuh_indexer/certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem @@ -107,7 +107,7 @@ services: volumes: - ./config/wazuh_dashboard/certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem - ./config/wazuh_dashboard/certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - - ./config/wazuh_dashboard/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem + - ./config/root-ca/certs/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: diff --git a/tools/utils/deployment/certificates-conf.sh b/tools/utils/deployment/certificates-conf.sh index a058eac4..5cb5b6f6 100644 --- a/tools/utils/deployment/certificates-conf.sh +++ b/tools/utils/deployment/certificates-conf.sh @@ -77,6 +77,8 @@ node_to_dir() { # --------------------------------------------------------------------------- # Parse config.yml +export WAZUH_UID=101 +export WAZUH_GID=101 if $DO_COPY || $DO_PRIV; then if [ ! -f "$CONFIG_FILE" ]; then echo "Error: Configuration file $CONFIG_FILE not found." @@ -102,7 +104,6 @@ if $DO_COPY; then echo "Copying certificates for indexer: $node -> config/$dir_name/certs/" mkdir -p "./config/$dir_name/certs" cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" - cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" if $FIRST_INDEXER; then cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/" FIRST_INDEXER=false @@ -114,7 +115,6 @@ if $DO_COPY; then echo "Copying certificates for manager: $node -> config/$dir_name/certs/" mkdir -p "./config/$dir_name/certs" cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" - cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" done for node in "${DASHBOARD_NODES[@]}"; do @@ -122,32 +122,37 @@ if $DO_COPY; then echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/" mkdir -p "./config/$dir_name/certs" cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/" - cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/" done + echo "Copying root-ca certificates -> config/root-ca/certs/" + mkdir -p "./config/root-ca/certs" + cp "$OUTPUT_DIR"/root-ca* "./config/root-ca/certs/" fi # 3. Set ownership and permissions if $DO_PRIV; then for node in "${INDEXER_NODES[@]}"; do dir_name=$(node_to_dir "$node") - echo "Setting permissions for indexer $node (1000:1000)" - chown -R 1000:1000 "./config/$dir_name/certs" + echo "Setting permissions for indexer $node (${WAZUH_UID}:${WAZUH_GID})" + chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs" chmod 400 "./config/$dir_name/certs/"* done for node in "${MANAGER_NODES[@]}"; do dir_name=$(node_to_dir "$node") - echo "Setting permissions for manager $node (999:999)" - chown -R 999:999 "./config/$dir_name/certs" + echo "Setting permissions for manager $node (${WAZUH_UID}:${WAZUH_GID})" + chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs" chmod 400 "./config/$dir_name/certs/"* done for node in "${DASHBOARD_NODES[@]}"; do dir_name=$(node_to_dir "$node") - echo "Setting permissions for dashboard $node (1000:1000)" - chown -R 1000:1000 "./config/$dir_name/certs" + echo "Setting permissions for dashboard $node (${WAZUH_UID}:${WAZUH_GID})" + chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs" chmod 400 "./config/$dir_name/certs/"* done + echo "Setting permissions for root-ca certificates (${WAZUH_UID}:${WAZUH_GID})" + chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/root-ca/certs" + chmod 400 "./config/root-ca/certs/"* fi echo "Process completed."