forked from wazuh/wazuh-docker
Conflicts resolution
This commit is contained in:
Gonzalo Acuña
@@ -19,14 +19,6 @@ COPY config/config.sh .
|
||||
|
||||
COPY config/config.yml /
|
||||
|
||||
COPY config/action_groups.yml /
|
||||
|
||||
COPY config/internal_users.yml /
|
||||
|
||||
COPY config/roles_mapping.yml /
|
||||
|
||||
COPY config/roles.yml /
|
||||
|
||||
RUN bash config.sh
|
||||
|
||||
################################################################################
|
||||
@@ -43,6 +35,15 @@ ENV USER="wazuh-indexer" \
|
||||
NAME="wazuh-indexer" \
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
|
||||
# Set $JAVA_HOME
|
||||
RUN echo "export JAVA_HOME=$INSTALL_DIR/jdk" >> /etc/profile.d/java_home.sh && \
|
||||
echo "export PATH=\$PATH:\$JAVA_HOME/bin" >> /etc/profile.d/java_home.sh
|
||||
ENV JAVA_HOME="$INSTALL_DIR/jdk"
|
||||
ENV PATH=$PATH:$JAVA_HOME/bin:$INSTALL_DIR/bin
|
||||
|
||||
# Add k-NN lib directory to library loading path variable
|
||||
ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$INSTALL_DIR/plugins/opensearch-knn/lib"
|
||||
|
||||
RUN yum install curl-minimal shadow-utils findutils hostname -y
|
||||
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
_meta:
|
||||
type: "actiongroups"
|
||||
config_version: 2
|
||||
|
||||
# ISM API permissions group
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
allowed_actions:
|
||||
- "cluster:admin/opendistro/ism/*"
|
||||
static: false
|
||||
@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/5.0/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
|
||||
PACKAGES_URL=https://packages.wazuh.com/6.0/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/6.0/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
@@ -7,12 +7,272 @@ umask 0002
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CERT="${OPENSEARCH_PATH_CONF}/certs/admin.pem"
|
||||
export KEY="${OPENSEARCH_PATH_CONF}/certs/admin-key.pem"
|
||||
|
||||
opensearch_vars=(
|
||||
cluster.name
|
||||
node.name
|
||||
node.roles
|
||||
path.data
|
||||
path.logs
|
||||
bootstrap.memory_lock
|
||||
network.host
|
||||
http.port
|
||||
transport.port
|
||||
network.bind_host
|
||||
network.publish_host
|
||||
transport.tcp.port
|
||||
compatibility.override_main_response_version
|
||||
http.host
|
||||
http.bind_host
|
||||
http.publish_host
|
||||
http.compression
|
||||
transport.host
|
||||
transport.bind_host
|
||||
transport.publish_host
|
||||
discovery.seed_hosts
|
||||
discovery.seed_providers
|
||||
discovery.type
|
||||
cluster.initial_cluster_manager_nodes
|
||||
cluster.initial_master_nodes
|
||||
node.max_local_storage_nodes
|
||||
gateway.recover_after_nodes
|
||||
gateway.recover_after_data_nodes
|
||||
gateway.expected_data_nodes
|
||||
gateway.recover_after_time
|
||||
plugins.security.nodes_dn
|
||||
plugins.security.nodes_dn_dynamic_config_enabled
|
||||
plugins.security.authcz.admin_dn
|
||||
plugins.security.roles_mapping_resolution
|
||||
plugins.security.dls.mode
|
||||
plugins.security.compliance.salt
|
||||
config.dynamic.http.anonymous_auth_enabled
|
||||
plugins.security.restapi.roles_enabled
|
||||
plugins.security.restapi.password_validation_regex
|
||||
plugins.security.restapi.password_validation_error_message
|
||||
plugins.security.restapi.password_min_length
|
||||
plugins.security.restapi.password_score_based_validation_strength
|
||||
plugins.security.unsupported.restapi.allow_securityconfig_modification
|
||||
plugins.security.authcz.impersonation_dn
|
||||
plugins.security.authcz.rest_impersonation_user
|
||||
plugins.security.allow_default_init_securityindex
|
||||
plugins.security.allow_unsafe_democertificates
|
||||
plugins.security.system_indices.permission.enabled
|
||||
plugins.security.config_index_name
|
||||
plugins.security.cert.oid
|
||||
plugins.security.cert.intercluster_request_evaluator_class
|
||||
plugins.security.enable_snapshot_restore_privilege
|
||||
plugins.security.check_snapshot_restore_write_privileges
|
||||
plugins.security.cache.ttl_minutes
|
||||
plugins.security.protected_indices.enabled
|
||||
plugins.security.protected_indices.roles
|
||||
plugins.security.protected_indices.indices
|
||||
plugins.security.system_indices.enabled
|
||||
plugins.security.system_indices.indices
|
||||
plugins.security.audit.enable_rest
|
||||
plugins.security.audit.enable_transport
|
||||
plugins.security.audit.resolve_bulk_requests
|
||||
plugins.security.audit.config.disabled_categories
|
||||
plugins.security.audit.ignore_requests
|
||||
plugins.security.audit.threadpool.size
|
||||
plugins.security.audit.threadpool.max_queue_len
|
||||
plugins.security.audit.ignore_users
|
||||
plugins.security.audit.type
|
||||
plugins.security.audit.config.http_endpoints
|
||||
plugins.security.audit.config.index
|
||||
plugins.security.audit.config.type
|
||||
plugins.security.audit.config.username
|
||||
plugins.security.audit.config.password
|
||||
plugins.security.audit.config.enable_ssl
|
||||
plugins.security.audit.config.verify_hostnames
|
||||
plugins.security.audit.config.enable_ssl_client_auth
|
||||
plugins.security.audit.config.cert_alias
|
||||
plugins.security.audit.config.pemkey_filepath
|
||||
plugins.security.audit.config.pemkey_content
|
||||
plugins.security.audit.config.pemkey_password
|
||||
plugins.security.audit.config.pemcert_filepath
|
||||
plugins.security.audit.config.pemcert_content
|
||||
plugins.security.audit.config.pemtrustedcas_filepath
|
||||
plugins.security.audit.config.pemtrustedcas_content
|
||||
plugins.security.audit.config.webhook.url
|
||||
plugins.security.audit.config.webhook.format
|
||||
plugins.security.audit.config.webhook.ssl.verify
|
||||
plugins.security.audit.config.webhook.ssl.pemtrustedcas_filepath
|
||||
plugins.security.audit.config.webhook.ssl.pemtrustedcas_content
|
||||
plugins.security.audit.config.log4j.logger_name
|
||||
plugins.security.audit.config.log4j.level
|
||||
opendistro_security.audit.config.disabled_rest_categories
|
||||
opendistro_security.audit.config.disabled_transport_categories
|
||||
plugins.security.ssl.transport.enforce_hostname_verification
|
||||
plugins.security.ssl.transport.resolve_hostname
|
||||
plugins.security.ssl.http.clientauth_mode
|
||||
plugins.security.ssl.http.enabled_ciphers
|
||||
plugins.security.ssl.http.enabled_protocols
|
||||
plugins.security.ssl.transport.enabled_ciphers
|
||||
plugins.security.ssl.transport.enabled_protocols
|
||||
plugins.security.ssl.transport.keystore_type
|
||||
plugins.security.ssl.transport.keystore_filepath
|
||||
plugins.security.ssl.transport.keystore_alias
|
||||
plugins.security.ssl.transport.keystore_password
|
||||
plugins.security.ssl.transport.truststore_type
|
||||
plugins.security.ssl.transport.truststore_filepath
|
||||
plugins.security.ssl.transport.truststore_alias
|
||||
plugins.security.ssl.transport.truststore_password
|
||||
plugins.security.ssl.http.enabled
|
||||
plugins.security.ssl.http.keystore_type
|
||||
plugins.security.ssl.http.keystore_filepath
|
||||
plugins.security.ssl.http.keystore_alias
|
||||
plugins.security.ssl.http.keystore_password
|
||||
plugins.security.ssl.http.truststore_type
|
||||
plugins.security.ssl.http.truststore_filepath
|
||||
plugins.security.ssl.http.truststore_alias
|
||||
plugins.security.ssl.http.truststore_password
|
||||
plugins.security.ssl.transport.enable_openssl_if_available
|
||||
plugins.security.ssl.http.enable_openssl_if_available
|
||||
plugins.security.ssl.transport.pemkey_filepath
|
||||
plugins.security.ssl.transport.pemkey_password
|
||||
plugins.security.ssl.transport.pemcert_filepath
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath
|
||||
plugins.security.ssl.http.pemkey_filepath
|
||||
plugins.security.ssl.http.pemkey_password
|
||||
plugins.security.ssl.http.pemcert_filepath
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath
|
||||
plugins.security.ssl.transport.enabled
|
||||
plugins.security.ssl.transport.client.pemkey_password
|
||||
plugins.security.ssl.transport.keystore_keypassword
|
||||
plugins.security.ssl.transport.server.keystore_keypassword
|
||||
plugins.sercurity.ssl.transport.server.keystore_alias
|
||||
plugins.sercurity.ssl.transport.client.keystore_alias
|
||||
plugins.sercurity.ssl.transport.server.truststore_alias
|
||||
plugins.sercurity.ssl.transport.client.truststore_alias
|
||||
plugins.security.ssl.client.external_context_id
|
||||
plugins.secuirty.ssl.transport.principal_extractor_class
|
||||
plugins.security.ssl.http.crl.file_path
|
||||
plugins.security.ssl.http.crl.validate
|
||||
plugins.security.ssl.http.crl.prefer_crlfile_over_ocsp
|
||||
plugins.security.ssl.http.crl.check_only_end_entitites
|
||||
plugins.security.ssl.http.crl.disable_ocsp
|
||||
plugins.security.ssl.http.crl.disable_crldp
|
||||
plugins.security.ssl.allow_client_initiated_renegotiation
|
||||
indices.breaker.total.use_real_memory
|
||||
indices.breaker.total.limit
|
||||
indices.breaker.fielddata.limit
|
||||
indices.breaker.fielddata.overhead
|
||||
indices.breaker.request.limit
|
||||
indices.breaker.request.overhead
|
||||
network.breaker.inflight_requests.limit
|
||||
network.breaker.inflight_requests.overhead
|
||||
cluster.routing.allocation.enable
|
||||
cluster.routing.allocation.node_concurrent_incoming_recoveries
|
||||
cluster.routing.allocation.node_concurrent_outgoing_recoveries
|
||||
cluster.routing.allocation.node_concurrent_recoveries
|
||||
cluster.routing.allocation.node_initial_primaries_recoveries
|
||||
cluster.routing.allocation.same_shard.host
|
||||
cluster.routing.rebalance.enable
|
||||
cluster.routing.allocation.allow_rebalance
|
||||
cluster.routing.allocation.cluster_concurrent_rebalance
|
||||
cluster.routing.allocation.balance.shard
|
||||
cluster.routing.allocation.balance.index
|
||||
cluster.routing.allocation.balance.threshold
|
||||
cluster.routing.allocation.balance.prefer_primary
|
||||
cluster.routing.allocation.disk.threshold_enabled
|
||||
cluster.routing.allocation.disk.watermark.low
|
||||
cluster.routing.allocation.disk.watermark.high
|
||||
cluster.routing.allocation.disk.watermark.flood_stage
|
||||
cluster.info.update.interval
|
||||
cluster.routing.allocation.shard_movement_strategy
|
||||
cluster.blocks.read_only
|
||||
cluster.blocks.read_only_allow_delete
|
||||
cluster.max_shards_per_node
|
||||
cluster.persistent_tasks.allocation.enable
|
||||
cluster.persistent_tasks.allocation.recheck_interval
|
||||
cluster.search.request.slowlog.threshold.warn
|
||||
cluster.search.request.slowlog.threshold.info
|
||||
cluster.search.request.slowlog.threshold.debug
|
||||
cluster.search.request.slowlog.threshold.trace
|
||||
cluster.search.request.slowlog.level
|
||||
cluster.fault_detection.leader_check.timeout
|
||||
cluster.fault_detection.follower_check.timeout
|
||||
action.auto_create_index
|
||||
action.destructive_requires_name
|
||||
cluster.default.index.refresh_interval
|
||||
cluster.minimum.index.refresh_interval
|
||||
cluster.indices.close.enable
|
||||
indices.recovery.max_bytes_per_sec
|
||||
indices.recovery.max_concurrent_file_chunks
|
||||
indices.recovery.max_concurrent_operations
|
||||
indices.recovery.max_concurrent_remote_store_streams
|
||||
indices.time_series_index.default_index_merge_policy
|
||||
indices.fielddata.cache.size
|
||||
index.number_of_shards
|
||||
index.number_of_routing_shards
|
||||
index.shard.check_on_startup
|
||||
index.codec
|
||||
index.codec.compression_level
|
||||
index.routing_partition_size
|
||||
index.soft_deletes.retention_lease.period
|
||||
index.load_fixed_bitset_filters_eagerly
|
||||
index.hidden
|
||||
index.merge.policy
|
||||
index.merge_on_flush.enabled
|
||||
index.merge_on_flush.max_full_flush_merge_wait_time
|
||||
index.merge_on_flush.policy
|
||||
index.check_pending_flush.enabled
|
||||
index.number_of_replicas
|
||||
index.auto_expand_replicas
|
||||
index.search.idle.after
|
||||
index.refresh_interval
|
||||
index.max_result_window
|
||||
index.max_inner_result_window
|
||||
index.max_rescore_window
|
||||
index.max_docvalue_fields_search
|
||||
index.max_script_fields
|
||||
index.max_ngram_diff
|
||||
index.max_shingle_diff
|
||||
index.max_refresh_listeners
|
||||
index.analyze.max_token_count
|
||||
index.highlight.max_analyzed_offset
|
||||
index.max_terms_count
|
||||
index.max_regex_length
|
||||
index.query.default_field
|
||||
index.query.max_nested_depth
|
||||
index.routing.allocation.enable
|
||||
index.routing.rebalance.enable
|
||||
index.gc_deletes
|
||||
index.default_pipeline
|
||||
index.final_pipeline
|
||||
index.optimize_doc_id_lookup.fuzzy_set.enabled
|
||||
index.optimize_doc_id_lookup.fuzzy_set.false_positive_probability
|
||||
search.max_buckets
|
||||
search.phase_took_enabled
|
||||
search.allow_expensive_queries
|
||||
search.default_allow_partial_results
|
||||
search.cancel_after_time_interval
|
||||
search.default_search_timeout
|
||||
search.default_keep_alive
|
||||
search.keep_alive_interval
|
||||
search.max_keep_alive
|
||||
search.low_level_cancellation
|
||||
search.max_open_scroll_context
|
||||
search.request_stats_enabled
|
||||
search.highlight.term_vector_multi_value
|
||||
snapshot.max_concurrent_operations
|
||||
cluster.remote_store.translog.buffer_interval
|
||||
remote_store.moving_average_window_size
|
||||
opensearch.notifications.core.allowed_config_types
|
||||
opensearch.notifications.core.email.minimum_header_length
|
||||
opensearch.notifications.core.email.size_limit
|
||||
opensearch.notifications.core.http.connection_timeout
|
||||
opensearch.notifications.core.http.host_deny_list
|
||||
opensearch.notifications.core.http.max_connection_per_route
|
||||
opensearch.notifications.core.http.max_connections
|
||||
opensearch.notifications.core.http.socket_timeout
|
||||
opensearch.notifications.core.tooltip_support
|
||||
opensearch.notifications.general.filter_by_backend_roles
|
||||
)
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
@@ -24,6 +284,37 @@ run_as_other_user_if_needed() {
|
||||
fi
|
||||
}
|
||||
|
||||
function buildOpensearchConfig {
|
||||
echo "" >> $OPENSEARCH_PATH_CONF/opensearch.yml
|
||||
for opensearch_var in ${opensearch_vars[*]}; do
|
||||
env_var=$(echo ${opensearch_var^^} | tr . _)
|
||||
value=${!env_var}
|
||||
if [[ -n $value ]]; then
|
||||
if grep -q $opensearch_var $OPENSEARCH_PATH_CONF/opensearch.yml; then
|
||||
lineNum="$(grep -n "$opensearch_var" $OPENSEARCH_PATH_CONF/opensearch.yml | head -n 1 | cut -d: -f1)"
|
||||
sed -i "${lineNum}d" $OPENSEARCH_PATH_CONF/opensearch.yml
|
||||
charline=$(awk "NR == ${lineNum}" $OPENSEARCH_PATH_CONF/opensearch.yml | head -c 1)
|
||||
fi
|
||||
while :
|
||||
do
|
||||
case "$charline" in
|
||||
"-"| "#" |" ") sed -i "${lineNum}d" $OPENSEARCH_PATH_CONF/opensearch.yml;;
|
||||
*) break;;
|
||||
esac
|
||||
charline=$(awk "NR == ${lineNum}" $OPENSEARCH_PATH_CONF/opensearch.yml | head -c 1)
|
||||
done
|
||||
longoptfile="${opensearch_var}: ${value}"
|
||||
if grep -q $opensearch_var $OPENSEARCH_PATH_CONF/opensearch.yml; then
|
||||
sed -i "/${opensearch_var}/ s|^.*$|${longoptfile}|" $OPENSEARCH_PATH_CONF/opensearch.yml
|
||||
else
|
||||
echo $longoptfile >> $OPENSEARCH_PATH_CONF/opensearch.yml
|
||||
fi
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
buildOpensearchConfig
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
@@ -84,10 +375,4 @@ if [[ "$(id -u)" == "0" ]]; then
|
||||
fi
|
||||
|
||||
|
||||
#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
|
||||
# run securityadmin.sh for single node with CACERT, CERT and KEY parameter
|
||||
# nohup /securityadmin.sh &
|
||||
# touch "/var/lib/wazuh-indexer/.flag"
|
||||
#fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
@@ -1,74 +0,0 @@
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Define your internal users here
|
||||
|
||||
## Demo users
|
||||
|
||||
admin:
|
||||
hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Demo admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
||||
reserved: true
|
||||
description: "Demo kibanaserver user"
|
||||
|
||||
kibanaro:
|
||||
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
- "readall"
|
||||
attributes:
|
||||
attribute1: "value1"
|
||||
attribute2: "value2"
|
||||
attribute3: "value3"
|
||||
description: "Demo kibanaro user"
|
||||
|
||||
logstash:
|
||||
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
description: "Demo logstash user"
|
||||
|
||||
readall:
|
||||
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
description: "Demo readall user"
|
||||
|
||||
snapshotrestore:
|
||||
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
description: "Demo snapshotrestore user"
|
||||
|
||||
wazuh_admin:
|
||||
hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu"
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
attributes: {}
|
||||
opendistro_security_roles: []
|
||||
static: false
|
||||
|
||||
wazuh_user:
|
||||
hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO"
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
attributes: {}
|
||||
opendistro_security_roles: []
|
||||
static: false
|
||||
@@ -1,26 +0,0 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
plugins.security.authcz.admin_dn:
|
||||
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.nodes_dn:
|
||||
- "CN=demo.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
|
||||
@@ -1,171 +0,0 @@
|
||||
_meta:
|
||||
type: "roles"
|
||||
config_version: 2
|
||||
|
||||
# Restrict users so they can only view visualization and dashboards on kibana
|
||||
kibana_read_only:
|
||||
reserved: true
|
||||
|
||||
# The security REST API access role is used to assign specific users access to change the security settings through the REST API.
|
||||
security_rest_api_access:
|
||||
reserved: true
|
||||
|
||||
# Allows users to view monitors, destinations and alerts
|
||||
alerting_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/alerting/alerts/get'
|
||||
- 'cluster:admin/opendistro/alerting/destination/get'
|
||||
- 'cluster:admin/opendistro/alerting/monitor/get'
|
||||
- 'cluster:admin/opendistro/alerting/monitor/search'
|
||||
|
||||
# Allows users to view and acknowledge alerts
|
||||
alerting_ack_alerts:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/alerting/alerts/*'
|
||||
|
||||
# Allows users to use all alerting functionality
|
||||
alerting_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster_monitor'
|
||||
- 'cluster:admin/opendistro/alerting/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices_monitor'
|
||||
- 'indices:admin/aliases/get'
|
||||
- 'indices:admin/mappings/get'
|
||||
|
||||
# Allow users to read Anomaly Detection detectors and results
|
||||
anomaly_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/ad/detector/info'
|
||||
- 'cluster:admin/opendistro/ad/detector/search'
|
||||
- 'cluster:admin/opendistro/ad/detectors/get'
|
||||
- 'cluster:admin/opendistro/ad/result/search'
|
||||
- 'cluster:admin/opendistro/ad/tasks/search'
|
||||
|
||||
# Allows users to use all Anomaly Detection functionality
|
||||
anomaly_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster_monitor'
|
||||
- 'cluster:admin/opendistro/ad/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices_monitor'
|
||||
- 'indices:admin/aliases/get'
|
||||
- 'indices:admin/mappings/get'
|
||||
|
||||
# Allows users to read Notebooks
|
||||
notebooks_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/notebooks/list'
|
||||
- 'cluster:admin/opendistro/notebooks/get'
|
||||
|
||||
# Allows users to all Notebooks functionality
|
||||
notebooks_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/notebooks/create'
|
||||
- 'cluster:admin/opendistro/notebooks/update'
|
||||
- 'cluster:admin/opendistro/notebooks/delete'
|
||||
- 'cluster:admin/opendistro/notebooks/get'
|
||||
- 'cluster:admin/opendistro/notebooks/list'
|
||||
|
||||
# Allows users to read and download Reports
|
||||
reports_instances_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to read and download Reports and Report-definitions
|
||||
reports_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/definition/get'
|
||||
- 'cluster:admin/opendistro/reports/definition/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to all Reports functionality
|
||||
reports_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/definition/create'
|
||||
- 'cluster:admin/opendistro/reports/definition/update'
|
||||
- 'cluster:admin/opendistro/reports/definition/on_demand'
|
||||
- 'cluster:admin/opendistro/reports/definition/delete'
|
||||
- 'cluster:admin/opendistro/reports/definition/get'
|
||||
- 'cluster:admin/opendistro/reports/definition/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to use all asynchronous-search functionality
|
||||
asynchronous_search_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/asynchronous_search/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices:data/read/search*'
|
||||
|
||||
# Allows users to read stored asynchronous-search results
|
||||
asynchronous_search_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/asynchronous_search/get'
|
||||
|
||||
wazuh_ui_user:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions: []
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- "wazuh-*"
|
||||
dls: ""
|
||||
fls: []
|
||||
masked_fields: []
|
||||
allowed_actions:
|
||||
- "read"
|
||||
tenant_permissions: []
|
||||
static: false
|
||||
|
||||
wazuh_ui_admin:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions: []
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- "wazuh-*"
|
||||
dls: ""
|
||||
fls: []
|
||||
masked_fields: []
|
||||
allowed_actions:
|
||||
- "read"
|
||||
- "delete"
|
||||
- "manage"
|
||||
- "index"
|
||||
tenant_permissions: []
|
||||
static: false
|
||||
|
||||
# ISM API permissions role
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions:
|
||||
- "manage_ism"
|
||||
static: false
|
||||
@@ -1,78 +0,0 @@
|
||||
---
|
||||
# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles.
|
||||
# Permissions for Wazuh indexer roles are configured in roles.yml
|
||||
|
||||
_meta:
|
||||
type: "rolesmapping"
|
||||
config_version: 2
|
||||
|
||||
# Define your roles mapping here
|
||||
|
||||
## Demo roles mapping
|
||||
|
||||
all_access:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Maps admin to all_access"
|
||||
|
||||
own_index:
|
||||
reserved: false
|
||||
users:
|
||||
- "*"
|
||||
description: "Allow full access to an index named like the username"
|
||||
|
||||
logstash:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
|
||||
kibana_user:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
users:
|
||||
- "wazuh_user"
|
||||
- "wazuh_admin"
|
||||
description: "Maps kibanauser to kibana_user"
|
||||
|
||||
readall:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
|
||||
manage_snapshots:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
|
||||
kibana_server:
|
||||
reserved: true
|
||||
users:
|
||||
- "kibanaserver"
|
||||
|
||||
wazuh_ui_admin:
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
hosts: []
|
||||
users:
|
||||
- "wazuh_admin"
|
||||
- "kibanaserver"
|
||||
and_backend_roles: []
|
||||
|
||||
wazuh_ui_user:
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
hosts: []
|
||||
users:
|
||||
- "wazuh_user"
|
||||
and_backend_roles: []
|
||||
|
||||
# ISM API permissions role mapping
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
users:
|
||||
- "kibanaserver"
|
||||
Reference in New Issue
Block a user