From c1120c1995c396bb3fa38c2529b8cd1b34277238 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 Dec 2021 09:23:36 -0300 Subject: [PATCH 1/5] log4j workaround --- production-cluster.yml | 3 +++ production_cluster/elastic_opendistro/disabledlog4j.options | 1 + xpack-compose.yml | 4 +++- xpack/disabledlog4j.options | 1 + 4 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 production_cluster/elastic_opendistro/disabledlog4j.options create mode 100644 xpack/disabledlog4j.options diff --git a/production-cluster.yml b/production-cluster.yml index df0d2250..2e36d701 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -90,6 +90,7 @@ services: - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch-2: image: amazon/opendistro-for-elasticsearch:1.13.2 @@ -111,6 +112,7 @@ services: - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch-3: image: amazon/opendistro-for-elasticsearch:1.13.2 @@ -132,6 +134,7 @@ services: - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options kibana: image: wazuh/wazuh-kibana-odfe:4.3.0 diff --git a/production_cluster/elastic_opendistro/disabledlog4j.options b/production_cluster/elastic_opendistro/disabledlog4j.options new file mode 100644 index 00000000..c3d67115 --- /dev/null +++ b/production_cluster/elastic_opendistro/disabledlog4j.options @@ -0,0 +1 @@ +-Dlog4j2.formatMsgNoLookups=true \ No newline at end of file diff --git a/xpack-compose.yml b/xpack-compose.yml index f741a7ce..96e68985 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -72,6 +72,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt + - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch2: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -107,6 +108,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt + - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch3: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -142,7 +144,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt - + - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options kibana: diff --git a/xpack/disabledlog4j.options b/xpack/disabledlog4j.options new file mode 100644 index 00000000..c3d67115 --- /dev/null +++ b/xpack/disabledlog4j.options @@ -0,0 +1 @@ +-Dlog4j2.formatMsgNoLookups=true \ No newline at end of file From b395bcab40eb4a563a1286bd78d9fb0d490bc036 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 Dec 2021 12:18:07 -0300 Subject: [PATCH 2/5] log4j workaround --- production_cluster/elastic_opendistro/disabledlog4j.options | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 production_cluster/elastic_opendistro/disabledlog4j.options diff --git a/production_cluster/elastic_opendistro/disabledlog4j.options b/production_cluster/elastic_opendistro/disabledlog4j.options old mode 100644 new mode 100755 From e3ee599f83d77083d2bb5ecbc4b26d0a6a5e3c49 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 14 Dec 2021 12:24:12 -0300 Subject: [PATCH 3/5] log4j workaround --- xpack/disabledlog4j.options | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 xpack/disabledlog4j.options diff --git a/xpack/disabledlog4j.options b/xpack/disabledlog4j.options old mode 100644 new mode 100755 From da2f257f00615712ec89f11e9038685df030599e Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Dec 2021 10:08:27 -0300 Subject: [PATCH 4/5] log4j workaround --- .../disabledlog4j.options => disabledlog4j.options | 0 production-cluster.yml | 6 +++--- xpack-compose.yml | 6 +++--- xpack/disabledlog4j.options | 1 - 4 files changed, 6 insertions(+), 7 deletions(-) rename production_cluster/elastic_opendistro/disabledlog4j.options => disabledlog4j.options (100%) delete mode 100755 xpack/disabledlog4j.options diff --git a/production_cluster/elastic_opendistro/disabledlog4j.options b/disabledlog4j.options similarity index 100% rename from production_cluster/elastic_opendistro/disabledlog4j.options rename to disabledlog4j.options diff --git a/production-cluster.yml b/production-cluster.yml index 2e36d701..12855122 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -90,7 +90,7 @@ services: - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch-2: image: amazon/opendistro-for-elasticsearch:1.13.2 @@ -112,7 +112,7 @@ services: - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch-3: image: amazon/opendistro-for-elasticsearch:1.13.2 @@ -134,7 +134,7 @@ services: - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./production_cluster/elastic_opendistro/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options kibana: image: wazuh/wazuh-kibana-odfe:4.3.0 diff --git a/xpack-compose.yml b/xpack-compose.yml index 96e68985..33bf97b5 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -72,7 +72,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch2: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -108,7 +108,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch3: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -144,7 +144,7 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./xpack/disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options + - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options kibana: diff --git a/xpack/disabledlog4j.options b/xpack/disabledlog4j.options deleted file mode 100755 index c3d67115..00000000 --- a/xpack/disabledlog4j.options +++ /dev/null @@ -1 +0,0 @@ --Dlog4j2.formatMsgNoLookups=true \ No newline at end of file From f769c5371605fa54acb0c74b53827a4278fa096e Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 15 Dec 2021 11:03:50 -0300 Subject: [PATCH 5/5] log4j workaround --- disabledlog4j.options | 1 - production-cluster.yml | 13 +++++-------- xpack-compose.yml | 9 +++------ 3 files changed, 8 insertions(+), 15 deletions(-) delete mode 100755 disabledlog4j.options diff --git a/disabledlog4j.options b/disabledlog4j.options deleted file mode 100755 index c3d67115..00000000 --- a/disabledlog4j.options +++ /dev/null @@ -1 +0,0 @@ --Dlog4j2.formatMsgNoLookups=true \ No newline at end of file diff --git a/production-cluster.yml b/production-cluster.yml index 12855122..8f1b1872 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -73,7 +73,7 @@ services: ports: - "9200:9200" environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" ulimits: memlock: soft: -1 @@ -90,14 +90,13 @@ services: - ./production_cluster/ssl_certs/admin.key:/usr/share/elasticsearch/config/admin.key - ./production_cluster/elastic_opendistro/elasticsearch-node1.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch-2: image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-2 restart: always environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" ulimits: memlock: soft: -1 @@ -112,14 +111,13 @@ services: - ./production_cluster/ssl_certs/node2.pem:/usr/share/elasticsearch/config/node2.pem - ./production_cluster/elastic_opendistro/elasticsearch-node2.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options - + elasticsearch-3: image: amazon/opendistro-for-elasticsearch:1.13.2 hostname: elasticsearch-3 restart: always environment: - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" ulimits: memlock: soft: -1 @@ -134,8 +132,7 @@ services: - ./production_cluster/ssl_certs/node3.pem:/usr/share/elasticsearch/config/node3.pem - ./production_cluster/elastic_opendistro/elasticsearch-node3.yml:/usr/share/elasticsearch/config/elasticsearch.yml - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options - + kibana: image: wazuh/wazuh-kibana-odfe:4.3.0 hostname: kibana diff --git a/xpack-compose.yml b/xpack-compose.yml index 33bf97b5..28849a66 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -48,7 +48,7 @@ services: - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" - bootstrap.memory_lock=true - xpack.license.self_generated.type=basic - xpack.security.enabled=true @@ -72,7 +72,6 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch2: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -84,7 +83,7 @@ services: - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" - bootstrap.memory_lock=true - xpack.license.self_generated.type=basic - xpack.security.enabled=true @@ -108,7 +107,6 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch2/elasticsearch2.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch2/elasticsearch2.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options elasticsearch3: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 @@ -120,7 +118,7 @@ services: - discovery.seed_hosts=elasticsearch,elasticsearch2,elasticsearch3 - cluster.initial_master_nodes=elasticsearch,elasticsearch2,elasticsearch3 - ELASTIC_PASSWORD=SecretPassword - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true" - bootstrap.memory_lock=true - xpack.license.self_generated.type=basic - xpack.security.enabled=true @@ -144,7 +142,6 @@ services: - ./xpack/ca/ca.crt:/usr/share/elasticsearch/config/ca.crt - ./xpack/elasticsearch3/elasticsearch3.key:/usr/share/elasticsearch/config/elasticsearch.key - ./xpack/elasticsearch3/elasticsearch3.crt:/usr/share/elasticsearch/config/elasticsearch.crt - - ./disabledlog4j.options:/etc/elasticsearch/jvm.options.d/disabledlog4j.options kibana: