From 2e08f91f6255c751b842eac92a7f72c70b6df80e Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Wed, 5 Feb 2020 18:02:25 +0100 Subject: [PATCH 1/6] Replace nginx rebuild with nginx_conf --- nginx/Dockerfile | 18 ----- nginx/config/entrypoint.sh | 78 --------------------- nginx_conf/kibana-web.conf | 20 ++++++ nginx_conf/kibana.htpasswd | 1 + nginx_conf/ssl/README.md | 23 ++++++ nginx_conf/ssl/generate-self-signed-cert.sh | 9 +++ 6 files changed, 53 insertions(+), 96 deletions(-) delete mode 100644 nginx/Dockerfile delete mode 100644 nginx/config/entrypoint.sh create mode 100644 nginx_conf/kibana-web.conf create mode 100644 nginx_conf/kibana.htpasswd create mode 100644 nginx_conf/ssl/README.md create mode 100644 nginx_conf/ssl/generate-self-signed-cert.sh diff --git a/nginx/Dockerfile b/nginx/Dockerfile deleted file mode 100644 index b1f0e986..00000000 --- a/nginx/Dockerfile +++ /dev/null @@ -1,18 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM nginx:latest - -ENV DEBIAN_FRONTEND noninteractive - -RUN apt-get update && apt-get install -y openssl apache2-utils && \ - apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - -COPY config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -VOLUME ["/etc/nginx/conf.d"] - -ENV NGINX_NAME="foo" \ - NGINX_PWD="bar" - -ENTRYPOINT [ "/entrypoint.sh" ] diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh deleted file mode 100644 index b7c23c64..00000000 --- a/nginx/config/entrypoint.sh +++ /dev/null @@ -1,78 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -# Generating certificates. -if [ ! -d /etc/nginx/conf.d/ssl ]; then - echo "Generating SSL certificates" - mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null -else - echo "SSL certificates already present" -fi - -# Setting users credentials. -# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b): -# -# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or -# export NGINX_CREDENTIALS="user1:pass1;user2:pass2" -# -# b) Set NGINX_CREDENTIALS in docker-compose.yml: -# NGINX_CREDENTIALS=user1:pass1;user2:pass2; or -# NGINX_CREDENTIALS=user1:pass1;user2:pass2 -# -if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then - echo "Setting users credentials" - if [ ! -z "$NGINX_CREDENTIALS" ]; then - IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS" - for index in "${!users[@]}" - do - IFS=':' read -r -a credentials <<< "${users[index]}" - if [ $index -eq 0 ]; then - htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null - else - htpasswd -b /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null - fi - done - else - # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile - htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null - fi -else - echo "Kibana credentials already configured" -fi - -if [ "x${NGINX_PORT}" = "x" ]; then - NGINX_PORT=443 -fi - -if [ "x${KIBANA_HOST}" = "x" ]; then - KIBANA_HOST="kibana:5601" -fi - -echo "Configuring NGINX" -cat > /etc/nginx/conf.d/default.conf < Date: Wed, 5 Feb 2020 18:04:38 +0100 Subject: [PATCH 2/6] Switch to nginx:stable on docker-compose --- docker-compose.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index c754699d..7f069a80 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -47,12 +47,9 @@ services: - elasticsearch:elasticsearch - wazuh:wazuh nginx: - build: nginx + image: nginx:stable hostname: nginx restart: always - environment: - - NGINX_PORT=443 - - NGINX_CREDENTIALS ports: - "80:80" - "443:443" @@ -60,6 +57,8 @@ services: - kibana links: - kibana:kibana + volumes: + - ./nginx_conf:/etc/nginx/conf.d:ro volumes: ossec_api_configuration: From 10225496e1792317e8ed54f0395d0a579b1badc2 Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Wed, 5 Feb 2020 18:21:24 +0100 Subject: [PATCH 3/6] Enable nginx settings --- nginx_conf/kibana-web.conf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nginx_conf/kibana-web.conf b/nginx_conf/kibana-web.conf index be3fa5b0..b3821747 100644 --- a/nginx_conf/kibana-web.conf +++ b/nginx_conf/kibana-web.conf @@ -13,8 +13,8 @@ server { auth_basic "Restricted Access"; auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd; proxy_pass http://kibana:5601/; -# proxy_buffer_size 128k; -# proxy_buffers 4 256k; -# proxy_busy_buffers_size 256k; + proxy_buffer_size 128k; + proxy_buffers 4 256k; + proxy_busy_buffers_size 256k; } } From 1eb4a53c539808af14a19b371776ff887ff7e94b Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Wed, 5 Feb 2020 18:21:52 +0100 Subject: [PATCH 4/6] Update docs --- README.md | 2 +- nginx_conf/ssl/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6d7a8096..1280fc93 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ In this repository you will find the containers to run: * wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack) * wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status. -* wazuh-nginx: Proxies the Kibana container, adding HTTPS (via self-signed SSL certificate) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). +* nginx: Proxies the Kibana container, adding HTTPS (via your [own certificate or self-signed](nginx_conf/ssl/README.md)) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). **It is required to set up SSL certificate before deploying** * wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** In addition, a docker-compose file is provided to launch the containers mentioned above. diff --git a/nginx_conf/ssl/README.md b/nginx_conf/ssl/README.md index 9c44ff23..e6233613 100644 --- a/nginx_conf/ssl/README.md +++ b/nginx_conf/ssl/README.md @@ -18,6 +18,6 @@ nginx_conf/ #### Using a Self Signed Certificate -In case you want to use a self-signed certificate we provided a script to generate one. You may create your own with more relevant information. +In case you want to use a self-signed certificate we provided a script to generate one. Execute `bash generate-self-signed-cert.sh` on this same directory and the right files will be generated. You must have installed `openssl` locally. From 9564adf54a759cdcbaea7daab223bcbec33be98f Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Tue, 31 Mar 2020 19:48:06 +0200 Subject: [PATCH 5/6] Update nginx_conf Readme --- nginx_conf/{ssl => }/README.md | 13 ++++++++++++- nginx_conf/kibana.htpasswd | 1 - nginx_conf/ssl/generate-self-signed-cert.sh | 3 +++ 3 files changed, 15 insertions(+), 2 deletions(-) rename nginx_conf/{ssl => }/README.md (61%) delete mode 100644 nginx_conf/kibana.htpasswd diff --git a/nginx_conf/ssl/README.md b/nginx_conf/README.md similarity index 61% rename from nginx_conf/ssl/README.md rename to nginx_conf/README.md index e6233613..aef42766 100644 --- a/nginx_conf/ssl/README.md +++ b/nginx_conf/README.md @@ -20,4 +20,15 @@ nginx_conf/ In case you want to use a self-signed certificate we provided a script to generate one. -Execute `bash generate-self-signed-cert.sh` on this same directory and the right files will be generated. You must have installed `openssl` locally. +Execute `bash generate-self-signed-cert.sh` inside the `ssl` directory and it will be generated. You must install `openssl` first. + + +### Setup Basic Authentication + +The nginx configuration expects the file `kibana.htpasswd`. + +This file can be generated with the `htpasswd` command. + +```bash +htpasswd -c kibana.htpasswd username +``` diff --git a/nginx_conf/kibana.htpasswd b/nginx_conf/kibana.htpasswd deleted file mode 100644 index 5008c153..00000000 --- a/nginx_conf/kibana.htpasswd +++ /dev/null @@ -1 +0,0 @@ -foo:$apr1$WwUDPA87$v9Bj8DS5KF9u1wBTtHH.A/ diff --git a/nginx_conf/ssl/generate-self-signed-cert.sh b/nginx_conf/ssl/generate-self-signed-cert.sh index cf0a56f0..f30fd69d 100644 --- a/nginx_conf/ssl/generate-self-signed-cert.sh +++ b/nginx_conf/ssl/generate-self-signed-cert.sh @@ -1,5 +1,8 @@ #!/bin/bash +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" +cd $DIR + if [ -s kibana-access.key ] then echo "Aborting. Certificate already exists" From b4e82984b4de926e75add9abde497e49097fdaab Mon Sep 17 00:00:00 2001 From: Manuel Gutierrez Date: Tue, 31 Mar 2020 19:48:39 +0200 Subject: [PATCH 6/6] Insert reference to nginx_conf Readme --- README.md | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 1280fc93..dbe25c0b 100644 --- a/README.md +++ b/README.md @@ -9,10 +9,10 @@ In this repository you will find the containers to run: * wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack) * wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status. -* nginx: Proxies the Kibana container, adding HTTPS (via your [own certificate or self-signed](nginx_conf/ssl/README.md)) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). **It is required to set up SSL certificate before deploying** -* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** +* nginx: Proxies the Kibana container, adding HTTPS (via your [own certificate or self-signed](nginx_conf/README.md)) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme). **It is required to set up SSL certificate before deploying** +* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** -In addition, a docker-compose file is provided to launch the containers mentioned above. +In addition, a docker-compose file is provided to launch the containers mentioned above. * Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml). @@ -22,6 +22,13 @@ In addition, a docker-compose file is provided to launch the containers mentione * [Wazuh documentation for Docker](https://documentation.wazuh.com/current/docker/index.html) * [Docker hub](https://hub.docker.com/u/wazuh) +### Setup SSL certificate and Basic Authentication + +Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed) and setup the basic auth. + +Documentation on how to provide these two can be found at [nginx_conf/README.md](nginx_conf/README.md). + + ## Directory structure wazuh-docker @@ -43,10 +50,11 @@ In addition, a docker-compose file is provided to launch the containers mentione │   │   └── xpack_config.sh │   └── Dockerfile ├── LICENSE - ├── nginx - │   ├── config - │   │   └── entrypoint.sh - │   └── Dockerfile + ├── nginx_conf + │   ├── kibana-web.conf + │   ├── README.md + │   └── ssl + │   └── generate-self-signed-cert.sh ├── README.md ├── VERSION └── wazuh @@ -59,17 +67,14 @@ In addition, a docker-compose file is provided to launch the containers mentione │   │   │   └── 2-manager │   │   └── services.d │   │   ├── api - │   │   │   ├── finish - │   │   │   └── run │   │   └── filebeat - │   │   ├── finish - │   │   └── run - │   ├── init.bash + │   ├── filebeat.yml + │   ├── permanent_data.env + │   ├── permanent_data.sh │   └── wazuh.repo └── Dockerfile - ## Branches * `stable` branch on correspond to the latest Wazuh-Docker stable version.