forked from wazuh/wazuh-docker
Change services names and build certs generator
This commit is contained in:
vcerenu
@@ -20,9 +20,9 @@ RUN sha256sum -c ${tini_bin}.sha256sum && \
|
||||
#COPY config/opensearch.yml config/log4j2.properties config/
|
||||
#RUN chmod 0660 config/opensearch.yml config/log4j2.properties
|
||||
COPY config/unattended_installer.tar.gz /
|
||||
COPY config/config2.sh .
|
||||
COPY config/config.sh .
|
||||
RUN tar -xzvf /unattended_installer.tar.gz
|
||||
RUN bash config2.sh
|
||||
RUN bash config.sh
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual OpenSearch image):
|
||||
@@ -50,9 +50,9 @@ RUN useradd --system \
|
||||
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
COPY config/entrypoint_OS.sh /
|
||||
COPY config/entrypoint.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint_OS.sh
|
||||
RUN chmod 700 /entrypoint.sh
|
||||
|
||||
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /tini /tini
|
||||
@@ -72,6 +72,6 @@ EXPOSE 9700
|
||||
|
||||
#ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
|
||||
ENTRYPOINT ["/tini", "--", "/entrypoint_OS.sh"]
|
||||
ENTRYPOINT ["/tini", "--", "/entrypoint.sh"]
|
||||
# Dummy overridable parameter parsed by entrypoint
|
||||
CMD ["opensearchwrapper"]
|
||||
@@ -1,23 +0,0 @@
|
||||
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
FROM centos:8
|
||||
|
||||
ARG WAZUH_VERSION=4.3.0-1
|
||||
|
||||
USER root
|
||||
|
||||
# Update and install dependecies
|
||||
RUN yum install initscripts -y
|
||||
|
||||
#Download and install Wazuh indexer
|
||||
RUN curl https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/pre-release/yum/wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm --output wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm && \
|
||||
rpm -i wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm && \
|
||||
yum clean all && rm -rf /var/cache/yum && rm -rf wazuh-indexer-${WAZUH_VERSION}.x86_64.rpm
|
||||
|
||||
COPY config/entrypoint.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint.sh
|
||||
|
||||
# Services ports
|
||||
EXPOSE 9700
|
||||
|
||||
ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
@@ -1,20 +0,0 @@
|
||||
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
FROM ubuntu:20.04
|
||||
|
||||
ARG WAZUH_VERSION=4.3.0-1
|
||||
|
||||
# Update and install dependecies
|
||||
RUN apt-get update && apt install curl -y
|
||||
|
||||
#Download and install Wazuh indexer
|
||||
RUN curl https://packages-dev.wazuh.com/pre-release/apt/pool/main/w/wazuh-indexer/wazuh-indexer_${WAZUH_VERSION}_amd64.deb --output wazuh-indexer_${WAZUH_VERSION}_amd64.deb && \
|
||||
dpkg -i wazuh-indexer_${WAZUH_VERSION}_amd64.deb
|
||||
|
||||
COPY config/entrypoint.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint.sh
|
||||
|
||||
# Services ports
|
||||
EXPOSE 9700
|
||||
|
||||
ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
+48
-958
File diff suppressed because it is too large
Load Diff
@@ -1,53 +0,0 @@
|
||||
# This has to be exported to make some magic below work.
|
||||
export DH_OPTIONS
|
||||
|
||||
export NAME=wazuh-indexer
|
||||
export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
|
||||
# Package build options
|
||||
export USER=${NAME}
|
||||
export GROUP=${NAME}
|
||||
export CONFIG_DIR=/etc/${NAME}
|
||||
export LOG_DIR=/var/log/${NAME}
|
||||
export LIB_DIR=/var/lib/${NAME}
|
||||
export PID_DIR=/run/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export BASE_DIR=${NAME}-*
|
||||
export INDEXER_FILE=wazuh-indexer-base-linux-x64.tar.gz
|
||||
export REPO_DIR=/unattended_installer
|
||||
|
||||
|
||||
rm -rf ${INSTALLATION_DIR}/
|
||||
|
||||
curl -o ${INDEXER_FILE} https://s3.amazonaws.com/warehouse.wazuh.com/indexer/${INDEXER_FILE}
|
||||
tar -zvxf ${INDEXER_FILE}
|
||||
|
||||
# copy to target
|
||||
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
mkdir -p ${TARGET_DIR}${CONFIG_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LIB_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LOG_DIR}
|
||||
mkdir -p ${TARGET_DIR}/etc/init.d
|
||||
mkdir -p ${TARGET_DIR}/etc/default
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
|
||||
# Move configuration files for wazuh-indexer
|
||||
mv -f ${BASE_DIR}/etc/init.d/${NAME} ${TARGET_DIR}/etc/init.d/${NAME}
|
||||
mv -f ${BASE_DIR}/etc/wazuh-indexer/* ${TARGET_DIR}${CONFIG_DIR}
|
||||
mv -f ${BASE_DIR}/etc/sysconfig/${NAME} ${TARGET_DIR}/etc/default/
|
||||
mv -f ${BASE_DIR}/usr/lib/tmpfiles.d/* ${TARGET_DIR}/usr/lib/tmpfiles.d/
|
||||
mv -f ${BASE_DIR}/usr/lib/sysctl.d/* ${TARGET_DIR}/usr/lib/sysctl.d/
|
||||
mv -f ${BASE_DIR}/usr/lib/systemd/system/* ${TARGET_DIR}/usr/lib/systemd/system/
|
||||
rm -rf ${BASE_DIR}/etc
|
||||
rm -rf ${BASE_DIR}/usr
|
||||
# Copy installation files to final location
|
||||
cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
# Copy the security tools
|
||||
cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/config.yml
|
||||
# Copy Wazuh's config files for the security plugin
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
@@ -1,56 +1,89 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
##############################################################################
|
||||
# Start Wazuh indexer
|
||||
##############################################################################
|
||||
# Files created by Elasticsearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export FILE=${INSTALLATION_DIR}/start
|
||||
|
||||
sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml
|
||||
|
||||
if [ -f $FILE ]
|
||||
then
|
||||
echo "second or more start"
|
||||
else
|
||||
if [ "$NODE_TYPE" == "worker" ]
|
||||
then
|
||||
echo "node_type start"
|
||||
echo $NODE_TYPE
|
||||
echo "node_type end"
|
||||
rm -rf /var/lib/wazuh-indexer/*
|
||||
sleep 70
|
||||
echo "worker restart"
|
||||
touch $FILE
|
||||
else
|
||||
echo "hostname start"
|
||||
echo $HOSTNAME
|
||||
echo "hostname end"
|
||||
echo "node_type start"
|
||||
echo $NODE_TYPE
|
||||
echo "node_type end"
|
||||
runuser wazuh-indexer --shell="/bin/bash" --command="/usr/share/wazuh-indexer/bin/opensearch -p /run/wazuh-indexer/wazuh-indexer.pid -d"
|
||||
sleep 60
|
||||
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h $HOSTNAME
|
||||
tail -100f /usr/share/wazuh-indexer/logs/wazuh-cluster.log
|
||||
touch $FILE
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
|
||||
#sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml
|
||||
|
||||
#CLK_TK=`getconf CLK_TCK` runuser ${USER} --shell="/bin/bash" --command="${INSTALLATION_DIR}/bin/opensearch"
|
||||
|
||||
if [ -f /var/log/wazuh-indexer/wazuh-cluster.log ]
|
||||
then
|
||||
tail -f /var/log/wazuh-indexer/wazuh-cluster.log
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000:0 / "${@}"
|
||||
else
|
||||
while true; do sleep 1000; done
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "opensearchwrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
|
||||
# centos:7 chroot doesn't have the `--skip-chdir` option and
|
||||
# changes our CWD.
|
||||
# Rewrite CMD args to replace $1 with `opensearch` explicitly,
|
||||
# so that we are backwards compatible with the docs
|
||||
# from the previous Elasticsearch versions<6
|
||||
# and configuration option D:
|
||||
# https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink
|
||||
# Without this, user could specify `opensearch -E x.y=z` but
|
||||
# `bin/opensearch -E x.y=z` would not work.
|
||||
set -- "opensearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000 / GID 0
|
||||
exec chroot --userspec=1000:0 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# Allow environment variables to be set by creating a file with the
|
||||
# contents, and setting an environment variable with the suffix _FILE to
|
||||
# point to it. This can be used to provide secrets to a container, without
|
||||
# the values being specified explicitly when running the container.
|
||||
#
|
||||
# This is also sourced in opensearch-env, and is only needed here
|
||||
# as well because we use ELASTIC_PASSWORD below. Sourcing this script
|
||||
# is idempotent.
|
||||
source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
|
||||
|
||||
if [[ -f bin/opensearch-users ]]; then
|
||||
# Check for the ELASTIC_PASSWORD environment variable to set the
|
||||
# bootstrap password for Security.
|
||||
#
|
||||
# This is only required for the first node in a cluster with Security
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$ELASTIC_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
(run_as_other_user_if_needed echo "$ELASTIC_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
else
|
||||
# keystore requires password
|
||||
if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
|
||||
| opensearch-keystore list | grep -q '^bootstrap.password$') ; then
|
||||
COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$ELASTIC_PASSWORD")"
|
||||
(run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
@@ -1,89 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
# Files created by Elasticsearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export FILE=${INSTALLATION_DIR}/start
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000:0 / "${@}"
|
||||
else
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "opensearchwrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
|
||||
# centos:7 chroot doesn't have the `--skip-chdir` option and
|
||||
# changes our CWD.
|
||||
# Rewrite CMD args to replace $1 with `opensearch` explicitly,
|
||||
# so that we are backwards compatible with the docs
|
||||
# from the previous Elasticsearch versions<6
|
||||
# and configuration option D:
|
||||
# https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink
|
||||
# Without this, user could specify `opensearch -E x.y=z` but
|
||||
# `bin/opensearch -E x.y=z` would not work.
|
||||
set -- "opensearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000 / GID 0
|
||||
exec chroot --userspec=1000:0 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Allow environment variables to be set by creating a file with the
|
||||
# contents, and setting an environment variable with the suffix _FILE to
|
||||
# point to it. This can be used to provide secrets to a container, without
|
||||
# the values being specified explicitly when running the container.
|
||||
#
|
||||
# This is also sourced in opensearch-env, and is only needed here
|
||||
# as well because we use ELASTIC_PASSWORD below. Sourcing this script
|
||||
# is idempotent.
|
||||
source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
|
||||
|
||||
if [[ -f bin/opensearch-users ]]; then
|
||||
# Check for the ELASTIC_PASSWORD environment variable to set the
|
||||
# bootstrap password for Security.
|
||||
#
|
||||
# This is only required for the first node in a cluster with Security
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$ELASTIC_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
(run_as_other_user_if_needed echo "$ELASTIC_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
else
|
||||
# keystore requires password
|
||||
if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
|
||||
| opensearch-keystore list | grep -q '^bootstrap.password$') ; then
|
||||
COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$ELASTIC_PASSWORD")"
|
||||
(run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
@@ -1,7 +0,0 @@
|
||||
[wazuh_repo]
|
||||
gpgcheck=1
|
||||
gpgkey=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
enabled=1
|
||||
name=Wazuh repository
|
||||
baseurl=https://packages-dev.wazuh.com/trash/yum/
|
||||
protect=1
|
||||
Reference in New Issue
Block a user