From cd8253845fc6b7c46162b9fcd20c8b00266f8fad Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 11 Nov 2025 20:24:45 +0700 Subject: [PATCH] Modify cert generation process --- .../Procedure_push_docker_images.yml | 2 + build-docker-images/build-images.yml | 6 +++ .../wazuh-dashboard/Dockerfile | 2 + .../wazuh-dashboard/config/config.sh | 49 +++---------------- build-docker-images/wazuh-indexer/Dockerfile | 2 + .../wazuh-indexer/config/config.sh | 47 ++---------------- build-docker-images/wazuh-manager/Dockerfile | 6 +++ .../wazuh-manager/config/config.sh | 28 +++++++++++ 8 files changed, 59 insertions(+), 83 deletions(-) create mode 100644 build-docker-images/wazuh-manager/config/config.sh diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index c6b17fe0..49292201 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -146,6 +146,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" + wazuh_cert_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" + wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 9ed60754..a6478b17 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -8,6 +8,8 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm} wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager restart: always @@ -49,6 +51,8 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm} wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer restart: always @@ -73,6 +77,8 @@ services: WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm} wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard restart: always diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 780f28f6..8184853f 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -8,6 +8,8 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml # Update and install dependencies RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \ diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 23879717..4b6a2fcd 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -7,51 +7,18 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -## Variables -CERT_TOOL=wazuh-certs-tool.sh -CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" -PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ - -download_package() { - local url=$1 - local package=$2 - local output=$2 - echo "Checking $url$package ..." - if curl -fsL "$url$package" -o "$output"; then - echo "Downloaded $package from $url" - return 0 - else - return 1 - fi -} - +############################################################################## +# Downloading Cert Gen Tool +############################################################################## +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_TOOL"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then - : -else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi - +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then - : -else - echo "The config file for the certificate tool does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index ada8d8d6..51ca78d0 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -6,6 +6,8 @@ ARG WAZUH_TAG_REVISION ARG TARGETARCH ARG wazuh_indexer_url_amd64_rpm ARG wazuh_indexer_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml COPY config/config.sh . diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 4ff30da5..7bcd68de 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -18,52 +18,15 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ############################################################################## # Downloading Cert Gen Tool ############################################################################## - -## Variables -CERT_TOOL=wazuh-certs-tool.sh -CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" -PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ - -download_package() { - local url=$1 - local package=$2 - local output=$2 - echo "Checking $url$package ..." - if curl -fsL "$url$package" -o "$output"; then - echo "Downloaded $package from $url" - return 0 - else - return 1 - fi -} - +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_TOOL"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then - : -else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi - +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then - : -else - echo "The config file for the certificate tool does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 64c7059f..d7969b15 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,6 +9,10 @@ ARG S6_VERSION="v2.2.0.3" ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml + +COPY config/config.sh . RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ manager_url="${!URL_VAR}" && \ @@ -18,6 +22,8 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf install /wazuh-manager.rpm -y && \ rm -rf /wazuh-manager.rpm && \ dnf clean all && \ + chmod 755 /config.sh && \ + /config.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh new file mode 100644 index 00000000..5bfd2d4c --- /dev/null +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -0,0 +1,28 @@ +############################################################################## +# Downloading Cert Gen Tool +############################################################################## +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" +CERT_DIR=/var/ossec/etc/certs/ +# Download the tool to create the certificates +echo "Downloading the tool to create the certificates..." +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL +# Download the config file for the certificate tool +echo "Downloading the config file for the certificate tool..." +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE + +# Modify the config file to set the IP to localhost +sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE + +chmod 700 "$CERT_CONFIG_FILE" +# Create the certificates +chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A + +# Copy Wazuh manager certs +cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem +cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem +cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key +cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem +cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem +cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem \ No newline at end of file