yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Change UID and GID of owner users

Browse Source
This commit is contained in:
Victor Carlos Erenu
2026-05-12 21:04:22 +07:00
parent 388b2c2225
commit c137354203
6 changed files with 55 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build-docker-images/wazuh-agent/Dockerfile
+8 -5
View File
@@ -38,25 +38,28 @@ RUN curl --fail --silent -L \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
# Install only runtime dependencies
RUN dnf install procps shadow-utils -y && \
dnf clean all && \
getent group wazuh || groupadd -r -g 999 wazuh && \
getent group wazuh || groupadd -r -g ${WAZUH_GID} wazuh && \
getent passwd wazuh || useradd --system \
--uid 999 \
--no-create-home \
--home-dir /var/ossec \
--gid wazuh \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh
# Copy Wazuh Agent installation from builder
COPY --from=builder /var/ossec /var/ossec
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /var/ossec /var/ossec
# Copy tini static binary
COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /usr/local/bin/tini /usr/local/bin/tini
# Copy entrypoint and init scripts
COPY config/entrypoint.sh /entrypoint.sh
build-docker-images/wazuh-dashboard/Dockerfile
+9 -6
View File
@@ -34,6 +34,9 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
# Set environment variables
ENV USER="wazuh-dashboard" \
GROUP="wazuh-dashboard" \
@@ -60,9 +63,9 @@ COPY config/wazuh_dashboard_config.sh /
# Update and install dependencies
RUN yum install shadow-utils -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid 1000 \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid $GROUP \
@@ -72,13 +75,13 @@ RUN yum install shadow-utils -y && \
chmod 700 /entrypoint.sh && \
chmod 700 /wazuh_dashboard_config.sh && \
mkdir -p $INSTALL_DIR && \
chown 1000:1000 $INSTALL_DIR && \
chown 1000:1000 /*.sh && \
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
# Copy Install dir from builder to current image
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR $INSTALL_DIR
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /etc/wazuh-dashboard $INSTALL_DIR/config/
# Set workdir and user
WORKDIR $INSTALL_DIR
build-docker-images/wazuh-indexer/Dockerfile
+13 -10
View File
@@ -29,6 +29,9 @@ RUN RPM_ARCH="x86_64" && \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
ENV USER="wazuh-indexer" \
GROUP="wazuh-indexer" \
NAME="wazuh-indexer" \
@@ -41,25 +44,25 @@ COPY config/securityadmin.sh /
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
yum clean all && \
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
getent group $GROUP || groupadd -r -g ${WAZUH_GID} $GROUP && \
useradd --system \
--uid 1000 \
--uid ${WAZUH_UID} \
--no-create-home \
--home-dir $INSTALL_DIR \
--gid $GROUP \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
--comment "$USER user" \
$USER && \
chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
mkdir -p $INSTALL_DIR && \
chown 1000:1000 $INSTALL_DIR && \
chown 1000:1000 /*.sh && \
mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR && \
chown ${WAZUH_UID}:${WAZUH_GID} /*.sh && \
mkdir -p /var/lib/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/lib/wazuh-indexer && \
mkdir -p $INSTALL_DIR/logs && chown ${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR/logs && \
mkdir -p /run/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown ${WAZUH_UID}:${WAZUH_GID} /var/log/wazuh-indexer
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} $INSTALL_DIR $INSTALL_DIR
RUN chmod 700 $INSTALL_DIR && \
chmod 700 $INSTALL_DIR/config && \
build-docker-images/wazuh-manager/Dockerfile
+8 -5
View File
@@ -53,25 +53,28 @@ RUN curl --fail --silent -L \
################################################################################
FROM amazonlinux:2023
ARG WAZUH_UID=101
ARG WAZUH_GID=101
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
# Install only runtime dependencies (no curl, tar, gzip, xz, or full dnf stack)
RUN dnf install openssl findutils procps shadow-utils -y && \
dnf clean all && \
getent group wazuh-manager || groupadd -r -g 999 wazuh-manager && \
getent group wazuh-manager || groupadd -r -g ${WAZUH_GID} wazuh-manager && \
getent passwd wazuh-manager || useradd --system \
--uid 999 \
--no-create-home \
--home-dir /var/wazuh-manager \
--gid wazuh-manager \
--uid ${WAZUH_UID} \
--gid ${WAZUH_GID} \
--shell /sbin/nologin \
wazuh-manager
# Copy Wazuh Manager installation (includes permanent data snapshot)
COPY --from=builder /var/wazuh-manager /var/wazuh-manager
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /var/wazuh-manager /var/wazuh-manager
# Copy tini static binary
COPY --from=builder /usr/local/bin/tini /usr/local/bin/tini
COPY --from=builder --chown=${WAZUH_UID}:${WAZUH_GID} /usr/local/bin/tini /usr/local/bin/tini
# Copy entrypoint, init scripts and runtime config
COPY config/entrypoint.sh /entrypoint.sh
build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init
+3 -3
View File
@@ -252,9 +252,9 @@ configure_permissions() {
##############################################################################
set_correct_permOwner() {
find /var/wazuh-manager/ -group 997 -exec chown :999 {} +;
find /var/wazuh-manager/ -group 101 -exec chown :999 {} +;
find /var/wazuh-manager/ -user 101 -exec chown 999 {} +;
find /var/wazuh-manager/ -group 997 -exec chown :101 {} +;
find /var/wazuh-manager/ -group 999 -exec chown :101 {} +;
find /var/wazuh-manager/ -user 999 -exec chown 101:{} {} +;
}
##############################################################################
tools/utils/deployment/certificates-conf.sh
+14 -9
View File
@@ -77,6 +77,8 @@ node_to_dir() {
# ---------------------------------------------------------------------------
# Parse config.yml
export WAZUH_UID=101
export WAZUH_GID=101
if $DO_COPY || $DO_PRIV; then
if [ ! -f "$CONFIG_FILE" ]; then
echo "Error: Configuration file $CONFIG_FILE not found."
@@ -102,7 +104,6 @@ if $DO_COPY; then
echo "Copying certificates for indexer: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
if $FIRST_INDEXER; then
cp "$OUTPUT_DIR"/admin* "./config/$dir_name/certs/"
FIRST_INDEXER=false
@@ -114,7 +115,6 @@ if $DO_COPY; then
echo "Copying certificates for manager: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
for node in "${DASHBOARD_NODES[@]}"; do
@@ -122,32 +122,37 @@ if $DO_COPY; then
echo "Copying certificates for dashboard: $node -> config/$dir_name/certs/"
mkdir -p "./config/$dir_name/certs"
cp "$OUTPUT_DIR/${node}"* "./config/$dir_name/certs/"
cp "$OUTPUT_DIR"/root-ca* "./config/$dir_name/certs/"
done
echo "Copying root-ca certificates -> config/root-ca/certs/"
mkdir -p "./config/root-ca/certs"
cp "$OUTPUT_DIR"/root-ca* "./config/root-ca/certs/"
fi
# 3. Set ownership and permissions
if $DO_PRIV; then
for node in "${INDEXER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for indexer $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
echo "Setting permissions for indexer $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${MANAGER_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for manager $node (999:999)"
chown -R 999:999 "./config/$dir_name/certs"
echo "Setting permissions for manager $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
for node in "${DASHBOARD_NODES[@]}"; do
dir_name=$(node_to_dir "$node")
echo "Setting permissions for dashboard $node (1000:1000)"
chown -R 1000:1000 "./config/$dir_name/certs"
echo "Setting permissions for dashboard $node (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/$dir_name/certs"
chmod 400 "./config/$dir_name/certs/"*
done
echo "Setting permissions for root-ca certificates (${WAZUH_UID}:${WAZUH_GID})"
chown -R ${WAZUH_UID}:${WAZUH_GID} "./config/root-ca/certs"
chmod 400 "./config/root-ca/certs/"*
fi
echo "Process completed."