Merge pull request #321 from wazuh/feature-original-nginx

Use original nginx image
2020-04-01 10:54:43 +02:00
parent 3a2568879a b4e82984b4
commit d9264606ef
7 changed files with 87 additions and 113 deletions
@@ -9,10 +9,10 @@ In this repository you will find the containers to run:

 * wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack)
 * wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
-* wazuh-nginx: Proxies the Kibana container, adding HTTPS (via self-signed SSL certificate) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme).
-* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** 
+* nginx: Proxies the Kibana container, adding HTTPS (via your [own certificate or self-signed](nginx_conf/README.md)) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). **It is required to set up SSL certificate before deploying**
+* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**

-In addition, a docker-compose file is provided to launch the containers mentioned above. 
+In addition, a docker-compose file is provided to launch the containers mentioned above.

 * Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml).

@@ -22,6 +22,13 @@ In addition, a docker-compose file is provided to launch the containers mentione
 * [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html)
 * [Docker hub](https://hub.docker.com/u/wazuh)

+### Setup SSL certificate and Basic Authentication
+
+Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth.
+
+Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md).
+
+
 ## Directory structure

    wazuh-docker
@@ -43,10 +50,11 @@ In addition, a docker-compose file is provided to launch the containers mentione
    │   │   └── xpack_config.sh
    │   └── Dockerfile
    ├── LICENSE
-    ├── nginx
-    │   ├── config
-    │   │   └── entrypoint.sh
-    │   └── Dockerfile
+    ├── nginx_conf
+    │   ├── kibana-web.conf
+    │   ├── README.md
+    │   └── ssl
+    │       └── generate-self-signed-cert.sh
    ├── README.md
    ├── VERSION
    └── wazuh
@@ -59,17 +67,14 @@ In addition, a docker-compose file is provided to launch the containers mentione
        │   │   │   └── 2-manager
        │   │   └── services.d
        │   │       ├── api
-        │   │       │   ├── finish
-        │   │       │   └── run
        │   │       └── filebeat
-        │   │           ├── finish
-        │   │           └── run
-        │   ├── init.bash
+        │   ├── filebeat.yml
+        │   ├── permanent_data.env
+        │   ├── permanent_data.sh
        │   └── wazuh.repo
        └── Dockerfile


-
 ## Branches

 * `stable` branch on correspond to the latest Wazuh-Docker stable version.
@@ -47,12 +47,9 @@ services:
      - elasticsearch:elasticsearch
      - wazuh:wazuh
  nginx:
-    build: nginx
+    image: nginx:stable
    hostname: nginx
    restart: always
-    environment:
-      - NGINX_PORT=443
-      - NGINX_CREDENTIALS
    ports:
      - "80:80"
      - "443:443"
@@ -60,6 +57,8 @@ services:
      - kibana
    links:
      - kibana:kibana
+    volumes:
+      - ./nginx_conf:/etc/nginx/conf.d:ro

 volumes:
  ossec_api_configuration:
@@ -1,18 +0,0 @@
-# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM nginx:latest
-
-ENV DEBIAN_FRONTEND noninteractive
-
-RUN apt-get update && apt-get install -y openssl apache2-utils && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-COPY config/entrypoint.sh /entrypoint.sh
-
-RUN chmod 755 /entrypoint.sh
-
-VOLUME ["/etc/nginx/conf.d"]
-
-ENV NGINX_NAME="foo" \
-    NGINX_PWD="bar"
-
-ENTRYPOINT [ "/entrypoint.sh" ]
@@ -1,78 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-
-set -e
-
-# Generating certificates.
-if [ ! -d /etc/nginx/conf.d/ssl ]; then
-  echo "Generating SSL certificates"
-  mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private
-  openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null
-else
-  echo "SSL certificates already present"
-fi
-
-# Setting users credentials.
-# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b):
-#
-# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or
-#    export NGINX_CREDENTIALS="user1:pass1;user2:pass2"
-#
-# b) Set NGINX_CREDENTIALS in docker-compose.yml:
-#    NGINX_CREDENTIALS=user1:pass1;user2:pass2; or
-#    NGINX_CREDENTIALS=user1:pass1;user2:pass2
-#
-if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
-  echo "Setting users credentials"
-  if [ ! -z "$NGINX_CREDENTIALS" ]; then
-    IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS"
-    for index in "${!users[@]}"
-    do
-      IFS=':' read -r -a credentials <<< "${users[index]}"
-      if [ $index -eq 0 ]; then
-        htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null
-      else
-        htpasswd -b /etc/nginx/conf.d/kibana.htpasswd  ${credentials[0]} ${credentials[1]} >/dev/null
-      fi
-    done
-  else
-    # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile 
-    htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null
-  fi
-else
-  echo "Kibana credentials already configured"
-fi
-
-if [ "x${NGINX_PORT}" = "x" ]; then
-  NGINX_PORT=443
-fi
-
-if [ "x${KIBANA_HOST}" = "x" ]; then
-  KIBANA_HOST="kibana:5601"
-fi
-
-echo "Configuring NGINX"
-cat > /etc/nginx/conf.d/default.conf <<EOF
-server {
-    listen 80;
-    listen [::]:80;
-    return 301 https://\$host:${NGINX_PORT}\$request_uri;
-}
-
-server {
-    listen ${NGINX_PORT} default_server ssl http2;
-    listen [::]:${NGINX_PORT} ssl http2;
-    ssl_certificate /etc/nginx/conf.d/ssl/certs/kibana-access.pem;
-    ssl_certificate_key /etc/nginx/conf.d/ssl/private/kibana-access.key;
-    location / {
-        auth_basic "Restricted";
-        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
-        proxy_pass http://${KIBANA_HOST}/;
-        proxy_buffer_size          128k;
-        proxy_buffers              4 256k;
-        proxy_busy_buffers_size    256k;
-    }
-}
-EOF
-
-exec nginx -g 'daemon off;'
@@ -0,0 +1,34 @@
+
+### Enable SSL Traffic
+
+Our Nginx config has SSL enabled by default, but it does require you to provide your certificate first, copy here your certificate files as `kibana-access.pem` and `kibana-access.key`.
+
+The final tree should be like this:
+
+```
+nginx_conf/
+├── kibana.htpasswd
+├── kibana-web.conf
+└── ssl
+    ├── kibana-access.key
+    └── kibana-access.pem
+```
+
+
+
+#### Using a Self Signed Certificate
+
+In case you want to use a self-signed certificate we provided a script to generate one.
+
+Execute `bash generate-self-signed-cert.sh` inside the `ssl` directory and it will be generated. You must install `openssl` first.
+
+
+### Setup Basic Authentication
+
+The nginx configuration expects the file `kibana.htpasswd`.
+
+This file can be generated with the `htpasswd` command.
+
+```bash
+htpasswd -c kibana.htpasswd username
+```
@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    listen [::]:80;
+    return 301 https://$host:443$request_uri;
+}
+
+server {
+    listen 443 default_server ssl http2;
+    listen [::]:443 ssl http2;
+    ssl_certificate /etc/nginx/conf.d/ssl/kibana-access.pem;
+    ssl_certificate_key /etc/nginx/conf.d/ssl/kibana-access.key;
+    location / {
+        auth_basic "Restricted Access";
+        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+        proxy_pass http://kibana:5601/;
+        proxy_buffer_size          128k;
+        proxy_buffers              4 256k;
+        proxy_busy_buffers_size    256k;
+    }
+} 
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+cd $DIR
+
+if [ -s kibana-access.key ]
+then
+    echo "Aborting. Certificate already exists"
+    exit
+else
+    openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout kibana-access.key -out kibana-access.pem
+fi