diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile index db6bab07..a5822f74 100644 --- a/wazuh/Dockerfile +++ b/wazuh/Dockerfile @@ -2,37 +2,74 @@ FROM phusion/baseimage:latest ARG FILEBEAT_VERSION=6.2.3 ARG WAZUH_VERSION=3.2.1-1 -RUN apt-get update; apt-get -y dist-upgrade -RUN apt-get -y install openssl postfix bsd-mailx curl apt-transport-https lsb-release +# Updating image +RUN apt-get update && apt-get upgrade -y -o Dpkg::Options::="--force-confold" + +# Set Wazuh repository. +RUN echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list +RUN curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - + +# Set nodejs repository. +RUN curl --silent --location https://deb.nodesource.com/setup_6.x | bash - + +# Creating ossec user as uid:gid 1000:1000 RUN groupadd -g 1000 ossec RUN useradd -u 1000 -g 1000 ossec -RUN curl --silent --location https://deb.nodesource.com/setup_6.x | bash - &&\ - apt-get install -y nodejs -RUN curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - -RUN echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list -RUN apt-get update && apt-get -y install wazuh-manager=${WAZUH_VERSION} wazuh-api=${WAZUH_VERSION} expect && apt-get clean +# Configure postfix +RUN echo "postfix postfix/mailname string wazuh-manager" | debconf-set-selections +RUN echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections + +# Install packages +RUN apt-get update && apt-get -y install openssl postfix bsd-mailx \ + apt-transport-https vim expect nodejs python-cryptography wazuh-manager=${WAZUH_VERSION} \ + wazuh-api=${WAZUH_VERSION} + +# Adding first run script. ADD config/data_dirs.env /data_dirs.env ADD config/init.bash /init.bash # Sync calls are due to https://github.com/docker/docker/issues/9547 RUN chmod 755 /init.bash &&\ - sync && /init.bash &&\ - sync && rm /init.bash + sync && /init.bash &&\ + sync && rm /init.bash +# Installing and configuring fiebeat RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\ - dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm filebeat-${FILEBEAT_VERSION}-amd64.deb - + dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb COPY config/filebeat.yml /etc/filebeat/ -ADD config/run.sh /tmp/run.sh -RUN chmod 755 /tmp/run.sh +# Adding entrypoint +ADD config/entrypoint.sh /entrypoint.sh +RUN chmod 755 /entrypoint.sh +# Setting volumes VOLUME ["/var/ossec/data"] VOLUME ["/etc/filebeat"] +VOLUME ["/etc/postfix"] +# Services ports EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp -# Run supervisord so that the container will stay alive +# Clean up +RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* -ENTRYPOINT ["/tmp/run.sh"] +# Adding services +RUN mkdir /etc/service/wazuh +COPY config/wazuh.runit.service /etc/service/wazuh/run +RUN chmod +x /etc/service/wazuh/run + +RUN mkdir /etc/service/wazuh-api +COPY config/wazuh-api.runit.service /etc/service/wazuh-api/run +RUN chmod +x /etc/service/wazuh-api/run + +RUN mkdir /etc/service/postfix +COPY config/postfix.runit.service /etc/service/postfix/run +RUN chmod +x /etc/service/postfix/run + +RUN mkdir /etc/service/filebeat +COPY config/filebeat.runit.service /etc/service/filebeat/run +RUN chmod +x /etc/service/filebeat/run + +# Run all services +ENTRYPOINT ["/entrypoint.sh"] diff --git a/wazuh/config/run.sh b/wazuh/config/entrypoint.sh similarity index 96% rename from wazuh/config/run.sh rename to wazuh/config/entrypoint.sh index f4670864..4887e666 100644 --- a/wazuh/config/run.sh +++ b/wazuh/config/entrypoint.sh @@ -112,9 +112,4 @@ trap "ossec_shutdown; exit" SIGINT SIGTERM chmod -R g+rw ${DATA_PATH} -service postfix start -service wazuh-api start -service wazuh-manager start -service filebeat start - -tail -f /var/ossec/logs/ossec.log +/sbin/my_init diff --git a/wazuh/config/filebeat.runit.service b/wazuh/config/filebeat.runit.service new file mode 100644 index 00000000..2a46f7b0 --- /dev/null +++ b/wazuh/config/filebeat.runit.service @@ -0,0 +1,3 @@ +#!/bin/sh +service filebeat start +tail -f /var/log/filebeat/filebeat diff --git a/wazuh/config/postfix.runit.service b/wazuh/config/postfix.runit.service new file mode 100644 index 00000000..02856a35 --- /dev/null +++ b/wazuh/config/postfix.runit.service @@ -0,0 +1,3 @@ +#!/bin/sh +service postfix start +tail -f /var/log/mail.log diff --git a/wazuh/config/wazuh-api.runit.service b/wazuh/config/wazuh-api.runit.service new file mode 100644 index 00000000..e24b8f8d --- /dev/null +++ b/wazuh/config/wazuh-api.runit.service @@ -0,0 +1,4 @@ +#!/bin/sh +service wazuh-api start +tail -f /var/ossec/data/logs/api.log + diff --git a/wazuh/config/wazuh.runit.service b/wazuh/config/wazuh.runit.service new file mode 100644 index 00000000..28a2a5b0 --- /dev/null +++ b/wazuh/config/wazuh.runit.service @@ -0,0 +1,4 @@ +#!/bin/sh +service wazuh-manager start +tail -f /var/ossec/data/logs/ossec.log +