diff --git a/README.md b/README.md index 6d7a8096..dbe25c0b 100644 --- a/README.md +++ b/README.md @@ -9,10 +9,10 @@ In this repository you will find the containers to run: * wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack) * wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status. -* wazuh-nginx: Proxies the Kibana container, adding HTTPS (via self-signed SSL certificate) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). -* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** +* nginx: Proxies the Kibana container, adding HTTPS (via your [own certificate or self-signed](nginx_conf/README.md)) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). **It is required to set up SSL certificate before deploying** +* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** -In addition, a docker-compose file is provided to launch the containers mentioned above. +In addition, a docker-compose file is provided to launch the containers mentioned above. * Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml). @@ -22,6 +22,13 @@ In addition, a docker-compose file is provided to launch the containers mentione * [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html) * [Docker hub](https://hub.docker.com/u/wazuh) +### Setup SSL certificate and Basic Authentication + +Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. + +Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md). + + ## Directory structure wazuh-docker @@ -43,10 +50,11 @@ In addition, a docker-compose file is provided to launch the containers mentione │   │   └── xpack_config.sh │   └── Dockerfile ├── LICENSE - ├── nginx - │   ├── config - │   │   └── entrypoint.sh - │   └── Dockerfile + ├── nginx_conf + │   ├── kibana-web.conf + │   ├── README.md + │   └── ssl + │   └── generate-self-signed-cert.sh ├── README.md ├── VERSION └── wazuh @@ -59,17 +67,14 @@ In addition, a docker-compose file is provided to launch the containers mentione │   │   │   └── 2-manager │   │   └── services.d │   │   ├── api - │   │   │   ├── finish - │   │   │   └── run │   │   └── filebeat - │   │   ├── finish - │   │   └── run - │   ├── init.bash + │   ├── filebeat.yml + │   ├── permanent_data.env + │   ├── permanent_data.sh │   └── wazuh.repo └── Dockerfile - ## Branches * `stable` branch on correspond to the latest Wazuh-Docker stable version. diff --git a/docker-compose.yml b/docker-compose.yml index c754699d..7f069a80 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -47,12 +47,9 @@ services: - elasticsearch:elasticsearch - wazuh:wazuh nginx: - build: nginx + image: nginx:stable hostname: nginx restart: always - environment: - - NGINX_PORT=443 - - NGINX_CREDENTIALS ports: - "80:80" - "443:443" @@ -60,6 +57,8 @@ services: - kibana links: - kibana:kibana + volumes: + - ./nginx_conf:/etc/nginx/conf.d:ro volumes: ossec_api_configuration: diff --git a/nginx/Dockerfile b/nginx/Dockerfile deleted file mode 100644 index b1f0e986..00000000 --- a/nginx/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM nginx:latest - -ENV DEBIAN_FRONTEND noninteractive - -RUN apt-get update && apt-get install -y openssl apache2-utils && \ - apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - -COPY config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -VOLUME ["/etc/nginx/conf.d"] - -ENV NGINX_NAME="foo" \ - NGINX_PWD="bar" - -ENTRYPOINT [ "/entrypoint.sh" ] diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh deleted file mode 100644 index b7c23c64..00000000 --- a/nginx/config/entrypoint.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -# Generating certificates. -if [ ! -d /etc/nginx/conf.d/ssl ]; then - echo "Generating SSL certificates" - mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null -else - echo "SSL certificates already present" -fi - -# Setting users credentials. -# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b): -# -# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or -# export NGINX_CREDENTIALS="user1:pass1;user2:pass2" -# -# b) Set NGINX_CREDENTIALS in docker-compose.yml: -# NGINX_CREDENTIALS=user1:pass1;user2:pass2; or -# NGINX_CREDENTIALS=user1:pass1;user2:pass2 -# -if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then - echo "Setting users credentials" - if [ ! -z "$NGINX_CREDENTIALS" ]; then - IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS" - for index in "${!users[@]}" - do - IFS=':' read -r -a credentials <<< "${users[index]}" - if [ $index -eq 0 ]; then - htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null - else - htpasswd -b /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null - fi - done - else - # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile - htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null - fi -else - echo "Kibana credentials already configured" -fi - -if [ "x${NGINX_PORT}" = "x" ]; then - NGINX_PORT=443 -fi - -if [ "x${KIBANA_HOST}" = "x" ]; then - KIBANA_HOST="kibana:5601" -fi - -echo "Configuring NGINX" -cat > /etc/nginx/conf.d/default.conf </dev/null 2>&1 && pwd )" +cd $DIR + +if [ -s kibana-access.key ] +then + echo "Aborting. Certificate already exists" + exit +else + openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout kibana-access.key -out kibana-access.pem +fi