From efed32f99706b8b1e8f35cdd5f87accf379e4f1c Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 4 Feb 2022 17:37:58 -0300 Subject: [PATCH] Add Wazuh indexer cluster configuration --- docker-compose.yml | 7 +- generate-indexer-certs.yml | 4 +- production-cluster.yml | 13 +- production_cluster/kibana_ssl/cert.pem | 21 -- production_cluster/kibana_ssl/key.pem | 28 --- production_cluster/nginx/ssl/cert.pem | 21 -- production_cluster/nginx/ssl/key.pem | 28 --- .../wazuh-indexer/opensearch-node1.yml | 16 +- .../wazuh-indexer/opensearch-node2 copy.yml | 40 ---- .../wazuh-indexer/opensearch-node2.yml | 16 +- .../wazuh-indexer/opensearch-node3.yml | 16 +- test-cluster.yml.yml | 209 ++++++++++++++++++ wazuh-dashboard/config/entrypoint.sh | 2 +- wazuh-dashboard/config/entrypoint_prueba.sh | 59 ----- wazuh-dashboard/config/wazuh-dashboard.yml | 14 -- wazuh-indexer/Dockerfile_new | 57 ++++- wazuh-indexer/config/config.sh | 50 +++-- wazuh-indexer/config/config2.sh | 53 +++++ wazuh-indexer/config/entrypoint.sh | 21 +- wazuh-indexer/config/entrypoint_OS.sh | 89 ++++++++ wazuh-indexer/config/entrypoint_odfe.sh | 103 --------- wazuh-indexer/config/tarball.sh | 33 --- .../config/unattended_installer.tar.gz | Bin 0 -> 8865 bytes 23 files changed, 484 insertions(+), 416 deletions(-) delete mode 100644 production_cluster/kibana_ssl/cert.pem delete mode 100644 production_cluster/kibana_ssl/key.pem delete mode 100644 production_cluster/nginx/ssl/cert.pem delete mode 100644 production_cluster/nginx/ssl/key.pem delete mode 100644 production_cluster/wazuh-indexer/opensearch-node2 copy.yml create mode 100644 test-cluster.yml.yml delete mode 100644 wazuh-dashboard/config/entrypoint_prueba.sh delete mode 100644 wazuh-dashboard/config/wazuh-dashboard.yml create mode 100644 wazuh-indexer/config/config2.sh create mode 100644 wazuh-indexer/config/entrypoint_OS.sh delete mode 100644 wazuh-indexer/config/entrypoint_odfe.sh delete mode 100644 wazuh-indexer/config/tarball.sh create mode 100644 wazuh-indexer/config/unattended_installer.tar.gz diff --git a/docker-compose.yml b/docker-compose.yml index 73d82ce4..58513581 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.5 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-manager restart: always ports: @@ -30,7 +30,7 @@ services: - filebeat_var:/var/lib/filebeat wazuh-indexer: - image: wazuh-indexer + image: test-indexer hostname: node1 restart: always ports: @@ -39,7 +39,8 @@ services: - discovery.type=single-node - cluster.name=wazuh-cluster - network.host=0.0.0.0 - - "ES_JAVA_OPTS=-Xms512m -Xmx512m" + - plugins.security.allow_default_init_securityindex=true + - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" - bootstrap.memory_lock=true ulimits: memlock: diff --git a/generate-indexer-certs.yml b/generate-indexer-certs.yml index acc05e81..01503c55 100644 --- a/generate-indexer-certs.yml +++ b/generate-indexer-certs.yml @@ -3,8 +3,8 @@ version: '3' services: generator: - image: certs_creator #wazuh/opendistro-certs-generator:0.1 + image: wazuh/opendistro-certs-generator:0.1 hostname: opendistro-certs-generator volumes: - - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/tools/config.yml + - ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/usr/src/config/myconf.yml - ./production_cluster/wazuh_indexer_ssl_certs/:/usr/src/certs/out/ \ No newline at end of file diff --git a/production-cluster.yml b/production-cluster.yml index e5248381..ae431ba2 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -73,8 +73,9 @@ services: ports: - "9700:9700" environment: - - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "NODE_TYPE=master" + - "bootstrap.memory_lock=true" ulimits: memlock: soft: -1 @@ -97,8 +98,9 @@ services: hostname: wazuh-indexer-2 restart: always environment: - - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "NODE_TYPE=worker" + - "bootstrap.memory_lock=true" ulimits: memlock: soft: -1 @@ -113,14 +115,15 @@ services: - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.pem:/etc/wazuh-indexer/certs/wazuh-indexer-2.pem - ./production_cluster/wazuh-indexer/opensearch-node2.yml:/etc/wazuh-indexer/opensearch.yml - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - + wazuh-indexer-3: image: wazuh-indexer hostname: wazuh-indexer-3 restart: always environment: - - "ES_JAVA_OPTS=-Xms1g -Xmx1g" + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - "NODE_TYPE=worker" + - "bootstrap.memory_lock=true" ulimits: memlock: soft: -1 @@ -135,7 +138,7 @@ services: - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.pem:/etc/wazuh-indexer/certs/wazuh-indexer-3.pem - ./production_cluster/wazuh-indexer/opensearch-node3.yml:/etc/wazuh-indexer/opensearch.yml - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml - + kibana: image: wazuh/wazuh-dashboard:4.3.0 hostname: kibana diff --git a/production_cluster/kibana_ssl/cert.pem b/production_cluster/kibana_ssl/cert.pem deleted file mode 100644 index 92da3280..00000000 --- a/production_cluster/kibana_ssl/cert.pem +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDazCCAlOgAwIBAgIUaIlPP3pCoqvkHYK4/3ATalS/l4MwDQYJKoZIhvcNAQEL -BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM -GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMjAxMjgxODE1MDRaFw0yMzAx -MjgxODE1MDRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw -HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB -AQUAA4IBDwAwggEKAoIBAQDtxUl6m3HlUPeTIXQu+BVCOiscwtVXTlSaIlOhz/cu -Py5ptLRMHdO1vTIawPag9Y1bLaLpkPuGSVUIXFhhfvc20OlQ0HaHMVu+zA6B+pV0 -uZTg4HAX7NJhGMh9qv1APtoeTx7wbG48f6+udV2bbay4a/+jQ8wkYeeTcRNSs7cz -zN30ToPUul/41ekROqvCwl7ss7BF0V/9V2ZgMnwdix7ogEZckYEvDkDccud+cF+f -CRBABKlueFL5C2+d5AkhQef8BqzjnwsRSlWSRulfcU4G0pkmVG+v59PnGaOuKVs/ -g6zOfvCmb3nKSMmJJs5sJfEN0JD1Xir6nJlEQMukRBKZAgMBAAGjUzBRMB0GA1Ud -DgQWBBRH3Gak7M/uyi4SvAv8sd3oX3uHADAfBgNVHSMEGDAWgBRH3Gak7M/uyi4S -vAv8sd3oX3uHADAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBv -1wBbjz5JSBU9UfJh5IPxTudOTtHQgU1N55M8Qz0cNBpc6dtyL/+xc85UoTKo9BEH -ZluycPDyFeIjEyvCTLTdJLkRY4gqKGgnI9JtR4nOGLjX2le1o78uL6aayYTHaQVF -Q/5K7q+JOwDXu4haBupKl43fZSFQhMQOpsKt9+PHymBXSxP35FrLNVG+UQcQNiwT -2u9Vm0K36TEmTc+eeVPo6L2bTqhWbURSJpsnMXEGssIUVuzHu2iPjsJpf6rW93DD -ZI41gjPBBuDrOPxuNQ5M9wz5j9Ckv3CHBXwg868qUAklv6tj+7bovbngof67HL4W -GzUBqvUWcjo4dV/ZkA1Z ------END CERTIFICATE----- diff --git a/production_cluster/kibana_ssl/key.pem b/production_cluster/kibana_ssl/key.pem deleted file mode 100644 index 9fd51c8a..00000000 --- a/production_cluster/kibana_ssl/key.pem +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDtxUl6m3HlUPeT -IXQu+BVCOiscwtVXTlSaIlOhz/cuPy5ptLRMHdO1vTIawPag9Y1bLaLpkPuGSVUI -XFhhfvc20OlQ0HaHMVu+zA6B+pV0uZTg4HAX7NJhGMh9qv1APtoeTx7wbG48f6+u -dV2bbay4a/+jQ8wkYeeTcRNSs7czzN30ToPUul/41ekROqvCwl7ss7BF0V/9V2Zg -Mnwdix7ogEZckYEvDkDccud+cF+fCRBABKlueFL5C2+d5AkhQef8BqzjnwsRSlWS -RulfcU4G0pkmVG+v59PnGaOuKVs/g6zOfvCmb3nKSMmJJs5sJfEN0JD1Xir6nJlE -QMukRBKZAgMBAAECggEANp+sUc6ES/pd5h85YdD8kUprvR/Fg1krdn2MWRA96RH6 -x64L/bCcgpQEfsD15+SBpQDG/IGiRydxsYoFg+B3StCTyU0a7dQZD6wxaQr4auh3 -m3H0TorJiiT3amdt5uSJl4z1vqYqbRuocJvl9V8s3vFwuUFKFNGpMeY4WjePTwbA -SoVvXHsatA6QPNfIYJXIdWD5DdPMIABWuFThm/hDfq1n57DsKQa3/pvyj4tMqKw9 -K0cgVJWqCFqAlza7WErn9NDvGOZxJqzmgAbjnj9l18VRHp1uzKn0oZBM50zuvykU -HpEoe+GCktNy8PhDx3w60gxftKgFilgRyHvVNYwAAQKBgQD/IghMwhWTrNlzxj20 -oQ2NwUnPNJjsu0ZklAAp4axekipu3kI5bNyoBBBTg1uJwHnfLOJxmCPuCBzvqcA+ -kr8jUH7DuKAHEdDyt6rGAyAnLHKI9+WRztXJqBwhk/CmHoxM/cT5sdEog3Z8WAes -sm7IPnI1J/0BevrcmDDwrot2AQKBgQDulCY3lZgpWj9PSKzkwxBYMGwVDKYwin38 -NY4a/jf+PzIXVrZSeLDmSgkNqgvsHCnjrzfI6dC+wG3wjblgM4ocAM3C6eG8Obnp -Bv+llfDGsndO9VO0oLeycyPkukrVBnG90KL+FEdJleLMb8Zcw8f8xF09lks5gmSX -ZEfv4mKMmQKBgQC9Csp7lZPHSFwXnNw76tnQH1hBYAev4VPXUpKMddryd/tZCvam -9jLJi7lNKBe7ihLDes6OvNxik0BdlLoNo05dLFfBThvFIT5hmhW/grFgVV7IfmZs -E4X1VcsCVkwJyrjKk35QRaFlE4PHvrJxFAVh+mNFX8voPOeEbIBW1f4gAQKBgBK1 -NUX4igT8GajK5xvNG/P+YAtKgaGeyoBDZtBBDPz30aK43vUal6yHM6yJoAO0tagv -7izoAMFkb3qEcnvTrsnBWmElW9kZobVfIh7G4imChw5++EBatezdUHw4C3Qm3DZp -LM7Fok1n3m/vd9uAUqdEcpdIuL9atS6V43oxA09JAoGBALO0H5n/jQxfzS1FzAR8 -ywA093adt4v84C8BsVj/nsMk56mqTquWtAuEgur7sWk2sBosb9qKsN0VmWG8h4nk -aV/nJopx77c8GAWzyiJ5W34mhS0LiTfax8L0FBx79eis+/lXr2bujgNJkGE7JHOu -zNDYtcVvKModj/du4hXIKExr ------END PRIVATE KEY----- diff --git a/production_cluster/nginx/ssl/cert.pem b/production_cluster/nginx/ssl/cert.pem deleted file mode 100644 index 25dfcf89..00000000 --- a/production_cluster/nginx/ssl/cert.pem +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDazCCAlOgAwIBAgIUKLi6nm5vryQ/9xCQOJsSZpsxT5MwDQYJKoZIhvcNAQEL -BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM -GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMjAxMjcxOTQ3MDhaFw0yMzAx -MjcxOTQ3MDhaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw -HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB -AQUAA4IBDwAwggEKAoIBAQCbp1+YDLidHAF/7qfVN8kLixNgclux6FNcupmSo7om -gtS42zAfimDvlukhRTL/keV4yis2WwhLq/CP/FGvPVoSLnqXUx9oyW4X7zCHastq -dHj62wI+SgcbqTZidTqFdPt4WnJ17UauUuBGLqeDZALwUD2l45aYPPj6N+LjjdBW -Ag2Q6g3iWJM2uAY3Qu5IHf8yngkGWuFsKYleyGSdRWzSr6OUKsDj0ZljD3fKhWB1 -5+KFL/n9uRoHGrT/1O1FJFxUzX7PCO+6c16NN9tO1BP4dwiP+u8kORiiVoJ7xWlU -BJd88rfIV1Rds94nBGAl1H9eJMEe0dbdFCQEzhPf0KB3AgMBAAGjUzBRMB0GA1Ud -DgQWBBTRbzcDxJ1bHGdtqtvYUAGAV1xFGzAfBgNVHSMEGDAWgBTRbzcDxJ1bHGdt -qtvYUAGAV1xFGzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBr -uuCdm/zj5BfGD6Dg3V0nPOHeHv4b4UN4husPFRSb0YanZWTHpENfrbhRFknM9Ut1 -k6ces6c0m9UvDJQtIGkXQM57EXe2PYbDhPeP3GWvc1ymQoPoHwPmKtnrd2vTV0ni -MxAkr2BwX9Az0NrEef0ccAgyYXm+JBnQK4ZxTln4bBkK6+aZ34w9lGUSql33pdk4 -v9wySOffEOkaCFqXH6xZ1P4pJqcydaM75JXMuMg8DteSixARjuI5Ce6cyiki1Yte -nK8GqZC8lsM/s8ag3dHq0FT9gP0VGonKATqdknGa5bxCo/NolUhcyPgYPiTpz4s9 -w8668jDUM62W84lvKa6P ------END CERTIFICATE----- diff --git a/production_cluster/nginx/ssl/key.pem b/production_cluster/nginx/ssl/key.pem deleted file mode 100644 index 8f62f328..00000000 --- a/production_cluster/nginx/ssl/key.pem +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCbp1+YDLidHAF/ -7qfVN8kLixNgclux6FNcupmSo7omgtS42zAfimDvlukhRTL/keV4yis2WwhLq/CP -/FGvPVoSLnqXUx9oyW4X7zCHastqdHj62wI+SgcbqTZidTqFdPt4WnJ17UauUuBG -LqeDZALwUD2l45aYPPj6N+LjjdBWAg2Q6g3iWJM2uAY3Qu5IHf8yngkGWuFsKYle -yGSdRWzSr6OUKsDj0ZljD3fKhWB15+KFL/n9uRoHGrT/1O1FJFxUzX7PCO+6c16N -N9tO1BP4dwiP+u8kORiiVoJ7xWlUBJd88rfIV1Rds94nBGAl1H9eJMEe0dbdFCQE -zhPf0KB3AgMBAAECggEAFJRvnjHoYtVmGV0bkaRbj4wm1rSoDQCzrOn7DhlZrmfT -6lEIrtLj+CmSz1RP5tyKY4sPZZNpqF+mYdMxlaLd+tNsX/+cgoVHaiC04OKs3Hlj -2X8Fb+jnwa+AwknPn/+UlBgZVCA4HSpV/tGCUmvxu4ZQcFOEAMLnBGZJOF7ysbxE -9Q08spPjQQgYfScS9pRhKRj8PG+qepifpMAg4GtiT9u70r2DC+IbxmE15MUtA/qM -vqHhGLaH3LiuEI0sBEvU95mgQAGaScDiJR1uQ7VrRHQJlxYnxoNywe+8cvpi+qjK -E3NvQpI0NP1/BroDMP2je2FYedWipolR9vNpRK5FyQKBgQDLnI1jqMyl86xMzePi -G7gp/9IAi+5xwCs4o8THmozi3ktn0ma5hlg2RjP19tdslr39I47L9RMPnis+SYIE -Qzdol+wV0VhQmBt7yot+EnPgPqz1zxhGmeji+wImGgV+1acBV++YaDYimI8Ux1uG -Z4faczDrhpAG8TaECr5PCcieFQKBgQDDs/MzI0hVs+xzgLlcTrA7jgZnCVxtAVBa -NAEN0tJ1AC2lL5nYlcfd0x2ebRmluRCGmS8HfZ/3lTTARTE+HED/Vf2C0svStSwx -aDEu9zFYgxCI5ZYzwxcubvlpoEUaLS9jJPAiW/rSuImAinA3hDDq92VJwcr4qFu0 -WrB7iMlzWwKBgQCwkEZvmI42jnLoe1ZU2dK+4O87uByCmbEhQaq/qH7psPjUxDh+ -Q0i1b/VZIr+2k5WXMUGADjqEPZWkQtwzVBJ1aeC5Hrulz/FtTLvgDKJdYBxeYELd -3lN8mUxIvCHt1donqRjFIgFnyMGytBnjGF5PibpvU1YMHxo2MJbNNV+57QKBgQCo -nly2O/kwNqVNY6TSHs6Dkbx8fLlRBmfIQLSDx5kjzDKH+DqTPYKG40bK4O/PNWRC -xKubxabV+I4J99QU0t1B40JZvOx3MTjRnRd7gurWe578hOxkzvwjOuTVGI1Rn4sL -3qC0yhGUDAIVabKEcvZ/DQgNg9cxZkYVYGpdFh+UrwKBgGGb0yr7dBuvzVaJ5fLj -ITwJr6kqD41JVd0MKpGzIDGubMaGTtdc6N6GjIyNzgJAQ9VDv0l45BUYfjKtNp90 -al8RIfH0xUdPGHT/7JBgyEWZqBF88dC9Kn4JVfKzoaQK89a2RM554MxKuQOKw2Yr -q6EnyW8xKHg3z06lzZeFF51C ------END PRIVATE KEY----- diff --git a/production_cluster/wazuh-indexer/opensearch-node1.yml b/production_cluster/wazuh-indexer/opensearch-node1.yml index 3ef82d19..aba06f5c 100644 --- a/production_cluster/wazuh-indexer/opensearch-node1.yml +++ b/production_cluster/wazuh-indexer/opensearch-node1.yml @@ -1,8 +1,14 @@ network.host: wazuh-indexer node.name: wazuh-indexer -cluster.initial_master_nodes: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +cluster.initial_master_nodes: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 cluster.name: "wazuh-cluster" -discovery.seed_hosts: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +discovery.seed_hosts: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 http.port: 9700-9799 transport.tcp.port: 9800-9899 node.max_local_storage_nodes: "3" @@ -36,5 +42,7 @@ plugins.security.nodes_dn: plugins.security.restapi.roles_enabled: - "all_access" - "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false +opendistro_security.audit.config.disabled_rest_categories: NONE +opendistro_security.audit.config.disabled_transport_categories: NONE diff --git a/production_cluster/wazuh-indexer/opensearch-node2 copy.yml b/production_cluster/wazuh-indexer/opensearch-node2 copy.yml deleted file mode 100644 index 3a57f906..00000000 --- a/production_cluster/wazuh-indexer/opensearch-node2 copy.yml +++ /dev/null @@ -1,40 +0,0 @@ -network.host: wazuh-indexer-2 -node.name: wazuh-indexer-2 -cluster.initial_master_nodes: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 -cluster.name: "wazuh-cluster" -discovery.seed_hosts: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 -http.port: 9700-9799 -transport.tcp.port: 9800-9899 -node.max_local_storage_nodes: "3" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -############################################################################### -# # -# WARNING: Insecure demo certificates set up in this file. # -# Please change on production cluster! # -# # -############################################################################### -plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/wazuh-indexer-2.pem -plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/wazuh-indexer-2.key -plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/wazuh-indexer-2.pem -plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/wazuh-indexer-2.key -plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.audit.type: internal_opensearch -plugins.security.authcz.admin_dn: -- 'CN=admin,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- 'CN=wazuh-indexer,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -- 'CN=wazuh-indexer-2,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -- 'CN=wazuh-indexer-3,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -- 'CN=filebeat,OU=Ops,O=Example\, Inc.,DC=example,DC=com' -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] diff --git a/production_cluster/wazuh-indexer/opensearch-node2.yml b/production_cluster/wazuh-indexer/opensearch-node2.yml index a20cbf57..7e4e1db7 100644 --- a/production_cluster/wazuh-indexer/opensearch-node2.yml +++ b/production_cluster/wazuh-indexer/opensearch-node2.yml @@ -1,8 +1,14 @@ network.host: wazuh-indexer-2 node.name: wazuh-indexer-2 -cluster.initial_master_nodes: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +cluster.initial_master_nodes: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 cluster.name: "wazuh-cluster" -discovery.seed_hosts: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +discovery.seed_hosts: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 http.port: 9700-9799 transport.tcp.port: 9800-9899 node.max_local_storage_nodes: "3" @@ -36,5 +42,7 @@ plugins.security.nodes_dn: plugins.security.restapi.roles_enabled: - "all_access" - "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false +opendistro_security.audit.config.disabled_rest_categories: NONE +opendistro_security.audit.config.disabled_transport_categories: NONE \ No newline at end of file diff --git a/production_cluster/wazuh-indexer/opensearch-node3.yml b/production_cluster/wazuh-indexer/opensearch-node3.yml index 49257c7f..96d840e9 100644 --- a/production_cluster/wazuh-indexer/opensearch-node3.yml +++ b/production_cluster/wazuh-indexer/opensearch-node3.yml @@ -1,8 +1,14 @@ network.host: wazuh-indexer-3 node.name: wazuh-indexer-3 -cluster.initial_master_nodes: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +cluster.initial_master_nodes: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 cluster.name: "wazuh-cluster" -discovery.seed_hosts: wazuh-indexer,wazuh-indexer-2,wazuh-indexer-3 +discovery.seed_hosts: + - wazuh-indexer + - wazuh-indexer-2 + - wazuh-indexer-3 http.port: 9700-9799 transport.tcp.port: 9800-9899 node.max_local_storage_nodes: "3" @@ -36,5 +42,7 @@ plugins.security.nodes_dn: plugins.security.restapi.roles_enabled: - "all_access" - "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] +plugins.security.allow_default_init_securityindex: true +cluster.routing.allocation.disk.threshold_enabled: false +opendistro_security.audit.config.disabled_rest_categories: NONE +opendistro_security.audit.config.disabled_transport_categories: NONE \ No newline at end of file diff --git a/test-cluster.yml.yml b/test-cluster.yml.yml new file mode 100644 index 00000000..7069fae0 --- /dev/null +++ b/test-cluster.yml.yml @@ -0,0 +1,209 @@ +# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) +version: '3.7' + +services: + wazuh-master: + image: wazuh/wazuh-odfe:4.3.0 + hostname: wazuh-master + restart: always + ports: + - "1515:1515" + - "514:514/udp" + - "55000:55000" + environment: + - ELASTICSEARCH_URL=https://wazuh-indexer:9700 + - ELASTIC_USERNAME=admin + - ELASTIC_PASSWORD=admin + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ossec-api-configuration:/var/ossec/api/configuration + - ossec-etc:/var/ossec/etc + - ossec-logs:/var/ossec/logs + - ossec-queue:/var/ossec/queue + - ossec-var-multigroups:/var/ossec/var/multigroups + - ossec-integrations:/var/ossec/integrations + - ossec-active-response:/var/ossec/active-response/bin + - ossec-agentless:/var/ossec/agentless + - ossec-wodles:/var/ossec/wodles + - filebeat-etc:/etc/filebeat + - filebeat-var:/var/lib/filebeat + - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem + - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.key:/etc/ssl/filebeat.key + - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh-worker: + image: wazuh/wazuh-odfe:4.3.0 + hostname: wazuh-worker + restart: always + environment: + - ELASTICSEARCH_URL=https://wazuh-indexer:9700 + - ELASTIC_USERNAME=admin + - ELASTIC_PASSWORD=admin + - FILEBEAT_SSL_VERIFICATION_MODE=full + - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem + - SSL_CERTIFICATE=/etc/ssl/filebeat.pem + - SSL_KEY=/etc/ssl/filebeat.key + volumes: + - worker-ossec-api-configuration:/var/ossec/api/configuration + - worker-ossec-etc:/var/ossec/etc + - worker-ossec-logs:/var/ossec/logs + - worker-ossec-queue:/var/ossec/queue + - worker-ossec-var-multigroups:/var/ossec/var/multigroups + - worker-ossec-integrations:/var/ossec/integrations + - worker-ossec-active-response:/var/ossec/active-response/bin + - worker-ossec-agentless:/var/ossec/agentless + - worker-ossec-wodles:/var/ossec/wodles + - worker-filebeat-etc:/etc/filebeat + - worker-filebeat-var:/var/lib/filebeat + - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem + - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.pem:/etc/ssl/filebeat.pem + - ./production_cluster/wazuh_indexer_ssl_certs/filebeat.key:/etc/ssl/filebeat.key + - ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + + wazuh-indexer: + image: test-indexer + hostname: wazuh-indexer + restart: always + ports: + - "9700:9700" + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-1:/var/lib/wazuh-indexer + - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.key:/etc/wazuh-indexer/certs/wazuh-indexer.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer.pem:/etc/wazuh-indexer/certs/wazuh-indexer.pem + - ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/etc/wazuh-indexer/certs/admin.pem + - ./production_cluster/wazuh_indexer_ssl_certs/admin.key:/etc/wazuh-indexer/certs/admin-key.pem + - ./production_cluster/wazuh-indexer/opensearch-node1.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml + + wazuh-indexer-2: + image: test-indexer + hostname: wazuh-indexer-2 + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-2:/var/lib/wazuh-indexer + - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.key:/etc/wazuh-indexer/certs/wazuh-indexer-2.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-2.pem:/etc/wazuh-indexer/certs/wazuh-indexer-2.pem + - ./production_cluster/wazuh-indexer/opensearch-node2.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + + wazuh-indexer-3: + image: test-indexer + hostname: wazuh-indexer-3 + restart: always + environment: + - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - "bootstrap.memory_lock=true" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + volumes: + - wazuh-indexer-data-3:/var/lib/wazuh-indexer + - ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/wazuh-indexer/certs/root-ca.pem + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.key:/etc/wazuh-indexer/certs/wazuh-indexer-3.key + - ./production_cluster/wazuh_indexer_ssl_certs/wazuh-indexer-3.pem:/etc/wazuh-indexer/certs/wazuh-indexer-3.pem + - ./production_cluster/wazuh-indexer/opensearch-node3.yml:/etc/wazuh-indexer/opensearch.yml + - ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml + + kibana: + image: wazuh/wazuh-dashboard:4.3.0 + hostname: kibana + restart: always + ports: + - 5601:5601 + environment: + - ELASTICSEARCH_USERNAME=admin + - ELASTICSEARCH_PASSWORD=admin + - SERVER_SSL_ENABLED=true + - SERVER_SSL_CERTIFICATE=/etc/wazuh-dashboard/certs/cert.pem + - SERVER_SSL_KEY=/etc/wazuh-dashboard/certs/key.pem + - WAZUH_API_URL="https://wazuh-master" + - API_USERNAME=acme-user + - API_PASSWORD=MyS3cr37P450r.*- + volumes: + - ./production_cluster/wazuh_dashboard_ssl/cert.pem:/etc/wazuh-dashboard/certs/cert.pem + - ./production_cluster/wazuh_dashboard_ssl/key.pem:/etc/wazuh-dashboard/certs/key.pem + + depends_on: + - wazuh-indexer + links: + - wazuh-indexer:wazuh-indexer + - wazuh-master:wazuh-master + + nginx: + image: nginx:stable + hostname: nginx + restart: always + ports: + - "80:80" + - "443:443" + - "1514:1514" + depends_on: + - wazuh-master + - wazuh-worker + - kibana + links: + - wazuh-master:wazuh-master + - wazuh-worker:wazuh-worker + - kibana:kibana + volumes: + - ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro + - ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro + +volumes: + ossec-api-configuration: + ossec-etc: + ossec-logs: + ossec-queue: + ossec-var-multigroups: + ossec-integrations: + ossec-active-response: + ossec-agentless: + ossec-wodles: + filebeat-etc: + filebeat-var: + worker-ossec-api-configuration: + worker-ossec-etc: + worker-ossec-logs: + worker-ossec-queue: + worker-ossec-var-multigroups: + worker-ossec-integrations: + worker-ossec-active-response: + worker-ossec-agentless: + worker-ossec-wodles: + worker-filebeat-etc: + worker-filebeat-var: + wazuh-indexer-data-1: + wazuh-indexer-data-2: + wazuh-indexer-data-3: diff --git a/wazuh-dashboard/config/entrypoint.sh b/wazuh-dashboard/config/entrypoint.sh index 0169fb29..c0d98a53 100644 --- a/wazuh-dashboard/config/entrypoint.sh +++ b/wazuh-dashboard/config/entrypoint.sh @@ -5,7 +5,7 @@ # Start Wazuh dashboard ############################################################################## -sed -i 's/:9700/wazuh-indexer:9700/' /etc/wazuh-dashboard/dashboard.yml +sed -i 's/localhost:9700/wazuh-indexer:9700/' /etc/wazuh-dashboard/dashboard.yml sed -i 's//0.0.0.0/' /etc/wazuh-dashboard/dashboard.yml sed -i '/logging.dest:/d' /etc/wazuh-dashboard/dashboard.yml diff --git a/wazuh-dashboard/config/entrypoint_prueba.sh b/wazuh-dashboard/config/entrypoint_prueba.sh deleted file mode 100644 index 91e44dc1..00000000 --- a/wazuh-dashboard/config/entrypoint_prueba.sh +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2) - -set -e - -############################################################################## -# Waiting for indexer -############################################################################## - -if [ "x${ELASTICSEARCH_URL}" == "x" ]; then - if [[ ${ENABLED_SECURITY} == "false" ]]; then - export el_url="http://elasticsearch:9200" - else - export el_url="https://elasticsearch:9200" - fi -else - export el_url="${ELASTICSEARCH_URL}" -fi - -if [[ ${ENABLED_SECURITY} == "false" || "x${ELASTICSEARCH_USERNAME}" == "x" || "x${ELASTICSEARCH_PASSWORD}" == "x" ]]; then - auth="" - # remove security plugin from kibana if elasticsearch is not using it either - /usr/share/kibana/bin/kibana-plugin remove opendistro_security -else - export auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} -k" -fi - -until curl -XGET $el_url ${auth}; do - >&2 echo "Elastic is unavailable - sleeping" - sleep 5 -done - -sleep 2 - ->&2 echo "Elasticsearch is up." - - -############################################################################## -# Waiting for wazuh alerts template -############################################################################## - -strlen=0 - -while [[ $strlen -eq 0 ]] -do - template=$(curl ${auth} $el_url/_cat/templates/wazuh -s) - strlen=${#template} - >&2 echo "Wazuh alerts template not loaded - sleeping." - sleep 2 -done - -chown wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs/* - -sleep 5 - -./wazuh_app_config.sh - - -while true; do sleep 1000; done diff --git a/wazuh-dashboard/config/wazuh-dashboard.yml b/wazuh-dashboard/config/wazuh-dashboard.yml deleted file mode 100644 index 8786ea4c..00000000 --- a/wazuh-dashboard/config/wazuh-dashboard.yml +++ /dev/null @@ -1,14 +0,0 @@ -server.host: 0.0.0.0 -server.port: 443 -opensearch.hosts: https://localhost:9700 -opensearch.ssl.verificationMode: certificate -opensearch.username: kibanaserver -opensearch.password: kibanaserver -opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] -opensearch_security.multitenancy.enabled: false -opensearch_security.readonly_mode.roles: ["kibana_read_only"] -server.ssl.enabled: true -server.ssl.key: "/etc/wazuh-dashboard/certs/wazuh-dashboard-key.pem" -server.ssl.certificate: "/etc/wazuh-dashboard/certs/wazuh-dashboard.pem" -opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"] -logging.dest: "/var/log/wazuh-dashboard/wazuh-dashboard.log" \ No newline at end of file diff --git a/wazuh-indexer/Dockerfile_new b/wazuh-indexer/Dockerfile_new index 63276d9b..cbfe2087 100644 --- a/wazuh-indexer/Dockerfile_new +++ b/wazuh-indexer/Dockerfile_new @@ -1,8 +1,8 @@ -FROM centos:7 AS builder +FROM ubuntu:focal AS builder ENV tini_bin="tini-amd64" -RUN yum install initscripts curl -y +RUN apt-get update -y && apt-get install curl -y RUN curl --retry 8 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin} RUN curl --retry 8 -S -L -O https://github.com/krallin/tini/releases/download/v0.19.0/${tini_bin}.sha256sum @@ -19,8 +19,10 @@ RUN sha256sum -c ${tini_bin}.sha256sum && \ #RUN chmod 0775 config config/jvm.options.d data logs #COPY config/opensearch.yml config/log4j2.properties config/ #RUN chmod 0660 config/opensearch.yml config/log4j2.properties -COPY config/config.sh . -RUN bash config.sh +COPY config/unattended_installer.tar.gz / +COPY config/config2.sh . +RUN tar -xzvf /unattended_installer.tar.gz +RUN bash config2.sh ################################################################################ # Build stage 1 (the actual OpenSearch image): @@ -28,15 +30,48 @@ RUN bash config.sh # Copy opensearch from stage 0 # Add entrypoint ################################################################################ -FROM alpine +FROM ubuntu:focal + ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN addgroup --system --gid 1000 $GROUP && \ - adduser -u 1000 -G $GROUP -D -h $INSTALL_DIR $USER && \ - chmod 0775 $INSTALL_DIR - #chown -R 1000:0 $INSTALL_DIR + +RUN getent group $GROUP || groupadd -r -g 1000 $GROUP + +RUN useradd --system \ + --uid 1000 \ + --no-create-home \ + --home-dir $INSTALL_DIR \ + --gid $GROUP \ + --shell /sbin/nologin \ + --comment "$USER user" \ + $USER + WORKDIR $INSTALL_DIR -COPY --from=builder --chown=1000:0 /usr/share/wazuh-indexer /usr/share/wazuh-indexer -COPY --from=builder --chown=0:0 /tini /tini \ No newline at end of file + +COPY config/entrypoint_OS.sh / + +RUN chmod 700 /entrypoint_OS.sh + +COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer +COPY --from=builder --chown=0:0 /tini /tini +COPY --from=builder --chown=0:0 /debian/wazuh-indexer/etc/init.d/wazuh-indexer /etc/init.d/wazuh-indexer +COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd +COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d +COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d +COPY --from=builder --chown=1000:10000 /debian/wazuh-indexer/etc/wazuh-indexer /etc/wazuh-indexer + +RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ + mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ + mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ + mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer + +# Services ports +EXPOSE 9700 + +#ENTRYPOINT [ "/entrypoint.sh" ] + +ENTRYPOINT ["/tini", "--", "/entrypoint_OS.sh"] +# Dummy overridable parameter parsed by entrypoint +CMD ["opensearchwrapper"] \ No newline at end of file diff --git a/wazuh-indexer/config/config.sh b/wazuh-indexer/config/config.sh index 93bb459a..d803a536 100644 --- a/wazuh-indexer/config/config.sh +++ b/wazuh-indexer/config/config.sh @@ -26,44 +26,46 @@ if ! id $USER &> /dev/null; then fi # Create directories -mkdir -p ${RPM_BUILD_ROOT}${INSTALL_DIR} -mkdir -p ${RPM_BUILD_ROOT}/etc -mkdir -p ${RPM_BUILD_ROOT}${LOG_DIR} -mkdir -p ${RPM_BUILD_ROOT}${LIB_DIR} -mkdir -p ${RPM_BUILD_ROOT}${SYS_DIR} +mkdir -p ${INSTALL_DIR} +mkdir -p /etc +mkdir -p ${LOG_DIR} +mkdir -p ${LIB_DIR} +mkdir -p ${SYS_DIR} # Download required sources curl -kOL https://s3.amazonaws.com/warehouse.wazuh.com/stack/indexer/wazuh-indexer-base-linux-x64.tar.gz tar -xzf wazuh-indexer-*.tar.gz && rm -f wazuh-indexer-*.tar.gz chown -R ${USER}:${GROUP} wazuh-indexer-*/* -# Copy base files into RPM_BUILD_ROOT directory -mv wazuh-indexer-*/etc/ ${RPM_BUILD_ROOT}/etc/ -cp -r wazuh-indexer-*${SYS_DIR}/* ${RPM_BUILD_ROOT}${SYS_DIR}/ -rm -rf wazuh-indexer-*/etc -rm -rf wazuh-indexer-*/usr -cp -pr wazuh-indexer-*/* ${RPM_BUILD_ROOT}${INSTALL_DIR}/ +# Copy base files into directories +cp -rf wazuh-indexer-*/etc/wazuh.indexer /etc/ +cp -rf wazuh-indexer-*/etc/init.d/* /etc/init.d/ +cp -rf wazuh-indexer-*/etc/sysconfig/* /etc/sysconfig/ +cp -rf wazuh-indexer-*${SYS_DIR}/* ${SYS_DIR}/ +#rm -rf wazuh-indexer-*/etc +#rm -rf wazuh-indexer-*/usr +cp -pr wazuh-indexer-*/* ${INSTALL_DIR}/ # Download demo certificates curl -kOL https://s3.amazonaws.com/warehouse.wazuh.com/stack/demo-certs.tar.gz tar xzf demo-certs.tar.gz && rm -f demo-certs.tar.gz chown -R ${USER}:${GROUP} certs -mkdir -p ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ -cp certs/admin.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ -cp certs/admin-key.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ -cp certs/demo-indexer.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ -cp certs/demo-indexer-key.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ -cp certs/root-ca.pem ${RPM_BUILD_ROOT}${CONFIG_DIR}/certs/ +mkdir -p ${CONFIG_DIR}/certs/ +cp certs/admin.pem ${CONFIG_DIR}/certs/ +cp certs/admin-key.pem ${CONFIG_DIR}/certs/ +cp certs/demo-indexer.pem ${CONFIG_DIR}/certs/ +cp certs/demo-indexer-key.pem ${CONFIG_DIR}/certs/ +cp certs/root-ca.pem ${CONFIG_DIR}/certs/ -#cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/ -#cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/ -#cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/tools/config.yml +#cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${INSTALL_DIR}/plugins/opensearch-security/tools/ +#cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${INSTALL_DIR}/plugins/opensearch-security/tools/ +#cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${INSTALL_DIR}/plugins/opensearch-security/tools/config.yml -#cp ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ -#cp ${REPO_DIR}/config/opensearch/roles/roles.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ -#cp ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${RPM_BUILD_ROOT}${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ +#cp ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ +#cp ${REPO_DIR}/config/opensearch/roles/roles.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ +#cp ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${INSTALL_DIR}/plugins/opensearch-security/securityconfig/ -#chmod 0660 "/etc/sysconfig/${NAME}" && chown root:${GROUP} "/etc/sysconfig/${NAME}" +chmod 0660 "/etc/sysconfig/${NAME}" && chown root:${GROUP} "/etc/sysconfig/${NAME}" chmod 400 ${CONFIG_DIR}/certs/admin.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/admin.pem chmod 400 ${CONFIG_DIR}/certs/admin-key.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/admin-key.pem chmod 400 ${CONFIG_DIR}/certs/demo-indexer.pem && chown ${USER}:${GROUP} ${CONFIG_DIR}/certs/demo-indexer.pem diff --git a/wazuh-indexer/config/config2.sh b/wazuh-indexer/config/config2.sh new file mode 100644 index 00000000..93aa41ee --- /dev/null +++ b/wazuh-indexer/config/config2.sh @@ -0,0 +1,53 @@ +# This has to be exported to make some magic below work. +export DH_OPTIONS + +export NAME=wazuh-indexer +export TARGET_DIR=${CURDIR}/debian/${NAME} + +# Package build options +export USER=${NAME} +export GROUP=${NAME} +export CONFIG_DIR=/etc/${NAME} +export LOG_DIR=/var/log/${NAME} +export LIB_DIR=/var/lib/${NAME} +export PID_DIR=/run/${NAME} +export INSTALLATION_DIR=/usr/share/${NAME} +export BASE_DIR=${NAME}-* +export INDEXER_FILE=wazuh-indexer-base-linux-x64.tar.gz +export REPO_DIR=/unattended_installer + + +rm -rf ${INSTALLATION_DIR}/ + +curl -o ${INDEXER_FILE} https://s3.amazonaws.com/warehouse.wazuh.com/indexer/${INDEXER_FILE} +tar -zvxf ${INDEXER_FILE} + +# copy to target +mkdir -p ${TARGET_DIR}${INSTALLATION_DIR} +mkdir -p ${TARGET_DIR}${CONFIG_DIR} +mkdir -p ${TARGET_DIR}${LIB_DIR} +mkdir -p ${TARGET_DIR}${LOG_DIR} +mkdir -p ${TARGET_DIR}/etc/init.d +mkdir -p ${TARGET_DIR}/etc/default +mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d +mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d +mkdir -p ${TARGET_DIR}/usr/lib/systemd/system +# Move configuration files for wazuh-indexer +mv -f ${BASE_DIR}/etc/init.d/${NAME} ${TARGET_DIR}/etc/init.d/${NAME} +mv -f ${BASE_DIR}/etc/wazuh-indexer/* ${TARGET_DIR}${CONFIG_DIR} +mv -f ${BASE_DIR}/etc/sysconfig/${NAME} ${TARGET_DIR}/etc/default/ +mv -f ${BASE_DIR}/usr/lib/tmpfiles.d/* ${TARGET_DIR}/usr/lib/tmpfiles.d/ +mv -f ${BASE_DIR}/usr/lib/sysctl.d/* ${TARGET_DIR}/usr/lib/sysctl.d/ +mv -f ${BASE_DIR}/usr/lib/systemd/system/* ${TARGET_DIR}/usr/lib/systemd/system/ +rm -rf ${BASE_DIR}/etc +rm -rf ${BASE_DIR}/usr +# Copy installation files to final location +cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR} +# Copy the security tools +cp ${REPO_DIR}/install_functions/wazuh-cert-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ +cp ${REPO_DIR}/install_functions/wazuh-passwords-tool.sh ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ +cp ${REPO_DIR}/config/opensearch/certificate/config_aio.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/config.yml +# Copy Wazuh's config files for the security plugin +cp -pr ${REPO_DIR}/config/opensearch/roles/roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ +cp -pr ${REPO_DIR}/config/opensearch/roles/roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ +cp -pr ${REPO_DIR}/config/opensearch/roles/internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ diff --git a/wazuh-indexer/config/entrypoint.sh b/wazuh-indexer/config/entrypoint.sh index 9b0ec833..30bccb0b 100644 --- a/wazuh-indexer/config/entrypoint.sh +++ b/wazuh-indexer/config/entrypoint.sh @@ -6,16 +6,18 @@ ############################################################################## export USER=wazuh-indexer -export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer export INSTALLATION_DIR=/usr/share/wazuh-indexer +export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer export JAVA_HOME=${INSTALLATION_DIR}/jdk export FILE=${INSTALLATION_DIR}/start +sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml + if [ -f $FILE ] then echo "second or more start" else - if [ $NODE_TYPE == "worker" ] + if [ "$NODE_TYPE" == "worker" ] then echo "node_type start" echo $NODE_TYPE @@ -31,24 +33,21 @@ if [ -f $FILE ] echo "node_type start" echo $NODE_TYPE echo "node_type end" - service wazuh-indexer start - sleep 5 - service wazuh-indexer status - sleep 55 - /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h $HOSTNAME + runuser wazuh-indexer --shell="/bin/bash" --command="/usr/share/wazuh-indexer/bin/opensearch -p /run/wazuh-indexer/wazuh-indexer.pid -d" + sleep 60 + bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -icl -p 9800 -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig -nhnv -cacert /etc/wazuh-indexer/certs/root-ca.pem -cert /etc/wazuh-indexer/certs/admin.pem -key /etc/wazuh-indexer/certs/admin-key.pem -h $HOSTNAME + tail -100f /usr/share/wazuh-indexer/logs/wazuh-cluster.log touch $FILE fi fi -sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml +#sed -i '/path.logs:/d' /etc/wazuh-indexer/opensearch.yml -service wazuh-indexer stop -service wazuh-indexer start #CLK_TK=`getconf CLK_TCK` runuser ${USER} --shell="/bin/bash" --command="${INSTALLATION_DIR}/bin/opensearch" -if [ -f /var/log/wazuh-indexer/wazuh-cluster.log ] +if [ -f /var/log/wazuh-indexer/wazuh-cluster.log ] then tail -f /var/log/wazuh-indexer/wazuh-cluster.log else diff --git a/wazuh-indexer/config/entrypoint_OS.sh b/wazuh-indexer/config/entrypoint_OS.sh new file mode 100644 index 00000000..69736c1e --- /dev/null +++ b/wazuh-indexer/config/entrypoint_OS.sh @@ -0,0 +1,89 @@ +#!/usr/bin/env bash +set -e + +# Files created by Elasticsearch should always be group writable too +umask 0002 + +export USER=wazuh-indexer +export INSTALLATION_DIR=/usr/share/wazuh-indexer +export OPENSEARCH_PATH_CONF=/etc/wazuh-indexer +export JAVA_HOME=${INSTALLATION_DIR}/jdk +export FILE=${INSTALLATION_DIR}/start + +run_as_other_user_if_needed() { + if [[ "$(id -u)" == "0" ]]; then + # If running as root, drop to specified UID and run command + exec chroot --userspec=1000:0 / "${@}" + else + # Either we are running in Openshift with random uid and are a member of the root group + # or with a custom --user + exec "${@}" + fi +} + +# Allow user specify custom CMD, maybe bin/opensearch itself +# for example to directly specify `-E` style parameters for opensearch on k8s +# or simply to run /bin/bash to check the image +if [[ "$1" != "opensearchwrapper" ]]; then + if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then + # centos:7 chroot doesn't have the `--skip-chdir` option and + # changes our CWD. + # Rewrite CMD args to replace $1 with `opensearch` explicitly, + # so that we are backwards compatible with the docs + # from the previous Elasticsearch versions<6 + # and configuration option D: + # https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink + # Without this, user could specify `opensearch -E x.y=z` but + # `bin/opensearch -E x.y=z` would not work. + set -- "opensearch" "${@:2}" + # Use chroot to switch to UID 1000 / GID 0 + exec chroot --userspec=1000:0 / "$@" + else + # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?) + exec "$@" + fi +fi + +# Allow environment variables to be set by creating a file with the +# contents, and setting an environment variable with the suffix _FILE to +# point to it. This can be used to provide secrets to a container, without +# the values being specified explicitly when running the container. +# +# This is also sourced in opensearch-env, and is only needed here +# as well because we use ELASTIC_PASSWORD below. Sourcing this script +# is idempotent. +source /usr/share/wazuh-indexer/bin/opensearch-env-from-file + +if [[ -f bin/opensearch-users ]]; then + # Check for the ELASTIC_PASSWORD environment variable to set the + # bootstrap password for Security. + # + # This is only required for the first node in a cluster with Security + # enabled, but we have no way of knowing which node we are yet. We'll just + # honor the variable if it's present. + if [[ -n "$ELASTIC_PASSWORD" ]]; then + [[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) + if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then + # keystore is unencrypted + if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then + (run_as_other_user_if_needed echo "$ELASTIC_PASSWORD" | opensearch-keystore add -x 'bootstrap.password') + fi + else + # keystore requires password + if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \ + | opensearch-keystore list | grep -q '^bootstrap.password$') ; then + COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$ELASTIC_PASSWORD")" + (run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password') + fi + fi + fi +fi + +if [[ "$(id -u)" == "0" ]]; then + # If requested and running as root, mutate the ownership of bind-mounts + if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then + chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs} + fi +fi + +run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file diff --git a/wazuh-indexer/config/entrypoint_odfe.sh b/wazuh-indexer/config/entrypoint_odfe.sh deleted file mode 100644 index 0519f90c..00000000 --- a/wazuh-indexer/config/entrypoint_odfe.sh +++ /dev/null @@ -1,103 +0,0 @@ -#!/bin/bash -set -e - -# Files created by OpenDistroForElasticsearch should always be group writable too -umask 0002 - -run_as_other_user_if_needed() { - if [[ "$(id -u)" == "0" ]]; then - # If running as root, drop to specified UID and run command - exec chroot --userspec=1000 / "${@}" - else - # Either we are running in Openshift with random uid and are a member of the root group - # or with a custom --user - exec "${@}" - fi -} - -# Allow user specify custom CMD, maybe bin/elasticsearch itself -# for example to directly specify `-E` style parameters for elasticsearch on k8s -# or simply to run /bin/bash to check the image -if [[ "$1" != "eswrapper" ]]; then - if [[ "$(id -u)" == "0" && $(basename "$1") == "elasticsearch" ]]; then - # centos:7 chroot doesn't have the `--skip-chdir` option and - # changes our CWD. - # Rewrite CMD args to replace $1 with `elasticsearch` explicitly, - # so that we are backwards compatible with the docs - # from the previous Elasticsearch versions<6 - # and configuration option D: - # https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html#_d_override_the_image_8217_s_default_ulink_url_https_docs_docker_com_engine_reference_run_cmd_default_command_or_options_cmd_ulink - # Without this, user could specify `elasticsearch -E x.y=z` but - # `bin/elasticsearch -E x.y=z` would not work. - set -- "elasticsearch" "${@:2}" - # Use chroot to switch to UID 1000 - exec chroot --userspec=1000 / "$@" - else - # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?) - exec "$@" - fi -fi - -# Parse Docker env vars to customize Elasticsearch -# -# e.g. Setting the env var cluster.name=testcluster -# -# will cause Elasticsearch to be invoked with -Ecluster.name=testcluster -# -# see https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html#_setting_default_settings - -declare -a es_opts - -while IFS='=' read -r envvar_key envvar_value -do - # Elasticsearch settings need to have at least two dot separated lowercase - # words, e.g. `cluster.name`, except for `processors` which we handle - # specially - if [[ "$envvar_key" =~ ^[a-z0-9_]+\.[a-z0-9_]+ || "$envvar_key" == "processors" ]]; then - if [[ ! -z $envvar_value ]]; then - es_opt="-E${envvar_key}=${envvar_value}" - es_opts+=("${es_opt}") - fi - fi -done < <(env) - -# The virtual file /proc/self/cgroup should list the current cgroup -# membership. For each hierarchy, you can follow the cgroup path from -# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and -# introspect the statistics for the cgroup for the given -# hierarchy. Alas, Docker breaks this by mounting the container -# statistics at the root while leaving the cgroup paths as the actual -# paths. Therefore, Elasticsearch provides a mechanism to override -# reading the cgroup path from /proc/self/cgroup and instead uses the -# cgroup path defined the JVM system property -# es.cgroups.hierarchy.override. Therefore, we set this value here so -# that cgroup statistics are available for the container this process -# will run in. -export ES_JAVA_OPTS="-Des.cgroups.hierarchy.override=/ $ES_JAVA_OPTS" - -if [[ "$(id -u)" == "0" ]]; then - # If requested and running as root, mutate the ownership of bind-mounts - if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then - chown -R 1000:0 /usr/share/elasticsearch/{data,logs} - fi -fi - -if [[ -d "/usr/share/elasticsearch/plugins/opendistro_security" && "$DISABLE_INSTALL_DEMO_CONFIG" != "true" ]]; then - # Install Demo certifactes for Security Plugin and update the elasticsearch.yml - # file to use those certificates. - /usr/share/elasticsearch/plugins/opendistro_security/tools/install_demo_configuration.sh -y -i -s -fi - -if [[ -d "/usr/share/elasticsearch/plugins/opendistro-performance-analyzer" ]]; then - CLK_TCK=`/usr/bin/getconf CLK_TCK` - ES_JAVA_OPTS="-Dclk.tck=$CLK_TCK -Djdk.attach.allowAttachSelf=true $ES_JAVA_OPTS" - if [[ -d "/usr/share/elasticsearch/performance-analyzer-rca" ]]; then - ES_JAVA_OPTS="-Djava.security.policy=file:///usr/share/elasticsearch/performance-analyzer-rca/pa_config/es_security.policy $ES_JAVA_OPTS" - /usr/bin/supervisord -c /usr/share/elasticsearch/performance-analyzer-rca/pa_config/supervisord.conf - else - ES_JAVA_OPTS="-Djava.security.policy=file:///usr/share/elasticsearch/plugins/opendistro-performance-analyzer/pa_config/es_security.policy $ES_JAVA_OPTS" - /usr/bin/supervisord -c /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/pa_config/supervisord.conf - fi -fi - -run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch "${es_opts[@]}" \ No newline at end of file diff --git a/wazuh-indexer/config/tarball.sh b/wazuh-indexer/config/tarball.sh deleted file mode 100644 index 2cb1dd64..00000000 --- a/wazuh-indexer/config/tarball.sh +++ /dev/null @@ -1,33 +0,0 @@ -export NAME=wazuh-indexer -export VERSION=4.3.0 -export RELEASE=1 -export USER=$NAME -export GROUP=$NAME -export CONFIG_DIR=/etc/$NAME -export LOG_DIR=/var/log/$NAME -export LIB_DIR=/var/lib/$NAME -export SYS_DIR=/usr/lib -export INSTALL_DIR=/usr/share/$NAME -export REPO_DIR=/root/unattended_installer - -mkdir -p ${INSTALL_DIR} -mkdir -p /etc -mkdir -p ${LOG_DIR} -mkdir -p ${LIB_DIR} -mkdir -p ${SYS_DIR} - -curl -kOL https://artifacts.opensearch.org/releases/bundle/opensearch/1.2.4/opensearch-${1}-linux-x64.tar.gz -tar zxf opensearch-${1}-linux-x64.tar.gz && rm -f opensearch-${1}.tar.gz -chown -R ${USER}:${GROUP} opensearch-${1}/* -mkdir -p /etc/wazuh-indexer && chown -R ${USER}:${GROUP} /etc/wazuh-indexer && cp opensearch-${1}/config/* /etc/wazuh-indexer/ -#etc/init.d directory not found -#etc/sysconfig directory not found -#usr directory not found -cp -pr opensearch-*/LICENSE.txt ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/NOTICE.txt ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/jdk ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/plugins ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/performance-analyzer-rca ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/modules ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/lib ${RPM_BUILD_ROOT}${INSTALL_DIR}/ -cp -pr opensearch-*/bin ${RPM_BUILD_ROOT}${INSTALL_DIR}/ diff --git a/wazuh-indexer/config/unattended_installer.tar.gz b/wazuh-indexer/config/unattended_installer.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..e3b05292cc06a0d9c7a55602dc9e47e5fceb71dc GIT binary patch literal 8865 zcmV;SB3|7eiwFP!000001MEF}U)#pA`Sr zZl4A`>+5Uyx4FL7NdA@2gXU^;eZAFcJzjkTV#wPWs6Bf3c zRsRotLY4eY*Xi25J5z)C<^OnfwRJE5Z}Ci%zdNFiPYuuPf0-)GE&o zls^nUu)DTt1ay8~m|y-YjkT3~`G1S&7V_t{ZNqkJm%~8`94O$&k5>!j-&$SE$baqe z`sxGH`0As7@c&-^j%!hWqe2KB7=B=zT;5nfh+_=tM!JHP+oKKAY^~QC@Lv;3CdO6R zZ~N36Q_oL!?b-v{p+=zWbzyf5$4EBkC5py>HIx3uPs#c3xdZCo)(e>5{x{c~_x}Gk zdFGNo`?ozbMkCwll{EejX4?N&3!MFo{co+W-`oFh@#wl<`JNm&BjyqD4Tp3nK_#FT30!gnT0(YgKk!^~O3l!-gG<7C)d2D_^@g_Z z+pYu9U5~Z4cw+(CqlD{Q=m9|65q&|sDwXz-25gB4E=RCHXsk-;p9aOk6~T1}Fl>-k z1yJtLuI*5A>4u)bA$pKLh!9#}lcAfgt5iVs+lFaUpDke?W$T#*iYEfVTz%cS5@1 zU_dxT2HznJB3nf*GO#ZwNR!JEiva7u?SY#6{qiG|J)kpRmfHxfe1F~v`)HYAac@D^ zLc7fJ`>(Q7|+!0Cx z3cN5YUf!BFhR%X5HfMygci*-w>J(8$-hae4I7!8Op6ijm=I|4o;_W=dn6AA1?~E*| z3`!FIY76=Ae&$;LZ6`pJGGGGpOFIBF*8i22od37Bit(TO_5bTXeEolei$DAimklXo zHcyFV1V#s}1ZzY|AC?3%HU=TZ<_77Q-sLFZ#pojl@1RE=>KOs7MiV>elhGjT*-kxh z-GN`nwl%+>U)&{Prd*{~_Y|pqW_f32u&hgSig*D_wPjSBt?FBId#BfL9qwE-)?e-& zHoQ-Jo!7N3Yqj~u+mrgc7cb4;{-|-b=lE+ccP@wHTJ6ozo~AN?bNB^}F76kIl`Cn4 z^F*$0nZ2!G<@4m|H^bUm^Vd3qSC8p<<;l_SJBR(@5%qUncV&g12i_m8!^S)BY-PWu zBvL^~5_Os!&&`wa^5yC8hut^sd)r#+#Wd|MBv)uy6@tLCJ7GXYY$5vH1oD_JHnns`OIEZp6)Uo0r9e26 z0g@p}$0^N_uzA`)Ssko~&res*#%oWGjn?H_tr`9row4|etH$r{ z+b4dnf7&X~kl6oH(kZJ+-UCXLY0%Y6b8;b6S~jcL8JHX_~mZT+G}okzr5XT9KHVh)_&0ql@qm$ zGnJSSzP`rXTK4 z?6)V*sUI|JgX4qN>qc$w_!bpkfgv&}#_T)vAQ<0bR@TxW1e#x|Y6KYnNo>?;GUD)S00 zFfbk0@GNL0qx@pCj7vlt`zp4U!snD`fSl}}z9C!32Qv17w4xgd#IQ(|;rn*aA^wP( zcvdBdi~}WR-*9?7HWI<~X%N^>4_#l+4SRi7D-qQyu?d2aw~djl3=v6cS$M`5cmW|} z$Ix|bSV;UwxYz(L#ugq?Ghng>eue!3A~-V&5r9mB+$GYpDBc$eyDhji2Y;8bEejW_0E-G-5XYuh4QoqvnThKs&B`;a42__H|S_0$(3M!EAoV?ThF~Rf)*Ys7O4RJ5Z8o#F@aX zfX*|VaAeKd!=eK^Uyo9gI4hAN6=A-XJ8=ds{5YW_7nekj|K;wzgL?Z_v__z*OEe{w zC)ceMLu9WZc;t0C;`#W(3i-QkVNB6x6Fp+rS7lO+aK7;-`rVSfe-EjkL6CAtn*+)I zuVM@oY%FUP6kW@j2Sr!cX#rnQw0VoK zqlpSc-^OX#zyqB+8aLtJsW&mqY_j;LrDR*=Q!5zub^L1u!??RK{{gj%03KXaa$n7R zd3dca^D_o(06;YU-W^DQgbcx#29b1aIGS^*?3|-6aUP2KGL3KSwClE7aG~$oF!!xqS zl28WZIP45;6FR>F2grdnU{M@ukk%47H)MqMejhxY&L!*o;`9Y9EiaI!Q$Z8-e>x z76`Agya3FV-PG!1!>hxu%nacZ1j@CFMLS`yjTM{PvuC7wE&AS&*0Ud)TE*^?_e6Jy zR$VmRA#MtYJ|>spa7iN{pCUmHTkQNxzm119n;O(<6*^FNyt*908d%tuS7V-KAp~O- z=-^rvf)Mo#M%S)XxUL+FkuNThYu17N6JxmM&A_bOqyaNm0c2`p?k}|aE>gJn|NHSq zi`rPOfGM8@?9?3ONS#xa$BBG`52Q64Wy&kkO@dhY#)%elCANtfY;t0dKmVL+Fjd+o zZ`q|3uZRooz}l=X_B=Wwnk0KeBXt^>bqOeXVX|II0r8AYF#J(ZqNz~;S@OMJuX@H! zx*aALK$}HW<^`szF)^gJtUXE)M-~JuEV)_GmTpjI3+Y`-W1?o?Wy}POz?Wy!Mw&KZ zc;at(!6|3}_zgspO|_(urErsiWpY(2Q9`2o2YVqS}R+3rXF`jjNPi&*{pqrPIt9q#c@j`2Y;Z_nAf`3`J=(z6Sb)i2AlYbmh1D7iW zOSXWug%4{X^n*&)?t^JZZwp`Zy5^9v!jl7N{<8{4S)l`^vu-GRl?zsSzy>6zQW=yzpS z^0bsz*^=y0>9WE%_;O9=Ky%ub#WklE-x6w}1}9i?RcZrvHQkxIDr*}CZm)-DCa{JR z9Xx#)wBx1l5IOcQL8}-Hx@P!-z9W0d_>agcDLA%y zVok_L?qjEFF6bqzDToK)Vbd12Gg$^{vMLeb5U)v(?!F(LVjs`NMq%l)@ zSR9n!KOsZl3*MabLI-1#9>6Zp7-kA24QH^oh-pZL(RgqKLugNl<)(Ek5jsJOz_%<) z)dI|Z;BPjwj9@X5+%#m3OH3O~>+acO>WE8*F6DEF0VoemQfl23SC|&-8cOHt>Vimbo^W(tsOjuo0xIsBGRd; z;vf*P!g!WaEXdi)Auh-g9d$1iqfG2Ee%m@ZJUHA-n_@nSA2%1P*Nm8(r39@GRkPzb z&4c*vuAD2$6{-{?V-9^yj!fmoOl4LnG^&>zKFeh`V2QG7TGk*&%FGoyQpV}5%`sM3 zG+CTFK*=h%j1`tuY*=$GcNmE!9)c_Zsr*csHyVnzfk$-9BwPBqp7R#N zuXi&=k_u+SC=yPpjU}R!*DMVwaX2nNZX`AX{QN?jitqH@;nDHw!D%_1?~jh(92^~< zew+?;XZLjbYTS0V#|!I<=2KQSREHVgqh6gDE5 ziDU-!F3jJ!ySP}0U#SW>EID0>A#EKfUD>gY*jOXzKg+i{$4n;?g^!|b1iKQ+zP;hH z%k99~vSgWDJJ6y0*>l4HR0K_hp7;c4c?uZ-OejH8xyebuDM`^qL=if*MMR;;dsl=J zfTh*SQ8#APfeG$_uFb%I+Q%$gL}|Li5#}|@{U7}dE)SCw5H<>fve>%}JNs^1q(ICF z;!b@QJLJqxr}>~I!xB(sU+mIs9?4*EXTaPwO#W30w)_Eu`^K1xugkgK&Y9bf3rRm6A$LeTX>&3`c_T} zTKh~@`mhw1(o#i3@soKia%nxJ0nl}^@A`>g$icCUM(KTzXbx{v!>@pClnXL(cjRz? zGu>IliU7Wb8`*ljdblrkWRc7KUhHu()Y)KPkZmZ!KL}#rn#KU(rX2EwPZy8KaVIb& zyzoJOTzF{J9}epe-;sy=8xLP^JUkU)N)y&=Qf=aNiSTGT)zWV0kf%}Yo}3(=Y@|0A zL+bnBR>0s|>58XM696Y_fMOGL3y{l7cn60sjtYS_mB6TPn6b)KfoY`5pur#B6+HET zQt&|%iExbTL&J8E-Gt;K-OXstZTM!5W4T<<$fn^FhrLfvTd{Enq#Cd-vfNGn1vD3l4yC6lsd4KxqC zfN&Y;yaV|1z4RdFaf6;wT0Es$g7s6^|ASoKKDknJ%TxOM;nQRF1d9^(`&B>j{!59N$io|LZrpAt9< zK%tGzf=j|m@3Uefm^chgw2cqT66P{_MM+Zz};rJiin! zVkrQCa+2U$E3`G5X^E@}C^B8oqh=6AEsn2DvhZPRkwu<9_{%J+1b;tFeuRIcfDydE zj}D>QAM}q{yY%CS^92&k`lWa`E0T-^vKyW!(wy&5iA9DmVZvDmcx=re0-y}ARVoJ} zp(Go7+o+t0OY%HS#*Tj~$p~1KY0vCLx^?orDb*=i5g$2L{u9e0H7R@?13$_V{FWy| zf@M)27(YxPe%SE?Z;@16k4WZguVnX)DWup1)zGd_q@cRY?FhKkOLjD}REa=9yepX8xn znx5Ptt{;wYqeQJu`SF4HDSHqcThnavQi23!h{<#b%ZjpE9?=^5lz8DWspw zJ-Ae+MZ{3d!jxbz4O4uMAmy~qmGhUCw<4`7%bB7ytIQzO*WJ3d{51RK;!?Uaq5Mmg zzk!0}Zw6*KF(n%?Jyez`km{O`8RXdz^-8Ihy60W!R#LV8{+bp2$|;jHu-CBwP}FgQ zq?Nr+^E}-!8%IsJtC_{$Ppw1xb6Ae~=df>;t|VW?2b2{zC*zzYjwb%C>005^)JQE& zjU~OASoxxLiLXhKvy;55q)IAU95LDcNhl-XzaPkQ^8=|Z^L%Bix|CNBp7_Wcn883^ zh$7Wy%@>!V6q$t)+IbVQs@Ki`-lUTY8NQiGS-AxC)XK=g3P|bOTM6%ZI+O6jSj8M- zZZkHiS@mi&X45~KHzdQJ&tjaO38Rb#iyP@;o}}CUdl)01*_)v(c?@EWz#d7?ApV6T z4;H@ADR+rLnzzhueoB7yE7!0vLob;<;tR9sr;?=2*_XDL@5ESsqeN@dx*KZ$PMO%- zkv6d}T(bO=}Q-49j_V;Av3g>#-9N_F9bliusP z{QsGT#9ubRTQ&=cfaJo0nk$n;_N`3!A}9aX-u3^cu_N)HuYZM)$7!Jn1VUQ9mxjCM zDA7f)mqZsuCtb)xTUeUC2MfnS(zMC{elugQ*WUGhg;dp3sFcF4zs%U<@z^u|*qJ%A zPy7Zsj^3z+zMzqray%S^+Y(L*Llbxo0^ZrnhX8Y$6dT8yr*Z8!mRGRvuCk5 zzXqKrBQsd_{mU)Pf5cBA{5PE2ib228CmsK-^QO~^-v4{h>Ac+k@?Aa={I?5% z$_83Y#x|2V5pJ~miax>#nuEIuk)eY#iBNF+e?%xa#aWE;`UsGE8=2SSb3{BDyGtI^ zU&HN)DHw(5rh!GhKqwIx?{IiIwM=m>6G1}}@S1uCR)&A*wn7q4T{w~nqYg{sh8?~z zuYEmRF5UA z2@-Mf5=UZ08eVLW;#Yp=AKzK8UIiMCji!$6p>s&t8`4Z;y(jqnFU^s^lqNAg)0Qo1 z8U5w7Tt<|EGC8G_umQ`+1^F5yrQlQ_HU|a{;6abe%a75$qpuOXK)NQ(pBgqpgy}&` zqTsYV6sRAQk1bI`%TcFEDeWaL_q)aA%H|K|1L^M<^MSt0z~xYg1m;=#Hfzk+tDHi) z-#Yj?S-yjE7r&4EpJ5^Gp<9z(^#4g!gg?+=%~c)fz{T%Sk~ilU**5Ol?BehJ#^pbb z+l|hL{$)1prm+;KcSdp9BJ3oylw(D&g??Dcdt{N%2Dc!P2tdp8@y8_sO_ z&czGZKCj6v8ItAD#p;If7cvj_-_ZF2c0B>1Lx#J~5c25jJEGiNQpidVGGATFpC938 zC}Z;RIXwQih$RqDuHX^MU0Bi?JQ-@#QC1^IBt zyRPrAm7q50D0kEYPFG8t4j%%M$A>4!A20hd4P?9`Mc0KU{p`ZrbLoDD#m{=_>_R_z z|8f@Vu}hM$i;4T*$X(omAqiFQ(lyxX6Im<{KWDT$p03V#*Sxo(Bautrz@~f`@_BmE zY-7W?i&uX_nUXeO1RXDIK19Q#Uskm(An%f8wXPiDQQ_`Vq?^ed8=ubch`jq1>8!e7 zmEW#gjbCoQwRbyDgJ$;ks+byG|HIj(1OVFCOSBtbj~oBNJmJ>{=6~CMQeM{nb_hlD z-#6d(cc1Dz)e5V}ch!)7ldsp%x?wM1>xy4ibw6+WmT6&uIRn2s2n;o?b9}JYM2Wp|Gg58E{Z(DlBu;RDn=4 zPcGUbMO`$9vx`b*h*N`$O?`!<=57XC?Oh%m9~^wbd|DJNM#v@WCXINO7Pct}+T{7GVOxaa;!&UO%S} zNTVi)4oJ(Mtpn0?Ka&o~Ci(m8fK-~YbwG}GETaRGhbMn;9;AFTu;>sKTZl@wTw_z* zc)szVjF-blqx$?ghoQ0l9OKWJFMHr6WP7F&mqO(CA8KY|vd36jlReu6n=TexoLLcf z6Phrx1DP>qF_US;8U_ZJl9Izi>*$O$)RFo&Ua(mgY~E=*dR9tTMOtce#H+Z+SE61C z1RH8z1gx3p?m^*q)U*^3YY?0WL)yL*hY^mGp|Ng4vymli z1ILD=%NTT+0cD0#Z31O8;{=qt$UTnP9RYlHGY>IYgv4y^6iNbzU1@4!vAt=OCGNB*Q6roav6Q@yU+Wku= zEO9C?LRT34oJLrD$0M06gB_JZkTxeO!!5r^WlDekzR%SUIoc!)3zM_CYECWeCCvE` z_H3%IK}WEpTr8c5`z1iW;?Ml9b$xy4FQBT!o151byN3tTuQ|jg6F+c{zJFXT*?VRU zTAhR7h`Tc;E3M)`{x+yp{XzZkanOFOuz}Wx4K)S)y&u%8{$bU>9#pKGL9O|EP^Yi( zx(fNL6MwLee>#tgyhZU+j0Iqv)gu)`H&vd%3ub)_Mb<-KKI_WEjP3f~eyHs4aOdEf zC%S=DRplK9o7U(gFr|V9$Fl-1T}FxN;Q_xZJ}Bkp=}8?bwV=vQ9rCn-u%)o-Zl&^0 z)Y5IeW9|_z7ryQ6Kx#-(yYuR`p!9mJGOX0~Bja>#b5g7P#m9f$0el%$1|IrEttyuZ ztFn9N?GoGoP!h7o3wpA22@3~OGz@PNcuGaEsA1aTn;X?yD5gx$qWWGbZIYLyTVpB3 zgjau!9e)@p1H&R7Np>xNFDXTLZ_lc;7&%Fs#YM=8lwlwzo+5#q*cMk2I)cmw0+d&> z=IoAf7aMeoyGZX8cagtK3KF815GN%1K1XL1q(EeiS1n&8b%TL>45QpcAcHb8q%uer zr;K9&)VS(l7HAyLiXD}Tx*Z-VcH_^rY6}%AqLI|U;os|O>*n2PXXlCa&pt455!dJm zs>GQmBg#O+v?kgVv>~@%OgZe2A*P$4V0`0A-9!^8C-dkN**5E<%xy3ZMQzS@s{gk% z<7uT9W<3_7zpXA$@J4T&^RitY=X)zXZuTmcX4qIe znH{V_mVT-TR&vtpP9}JEZN>djICysq^Ih-r)Cp?#LU&4Dnh_wg1kJGG z{<2u+5kl6kr-G1322Z^JlP~NhPF%7mRAii-Cay6q=w|4&6ys}LNN>k jbkdC2%!!^P{O{#h`pf6#^YVH5Z2I{>Z6H%z0LTCUs=+KJ literal 0 HcmV?d00001