diff --git a/README.md b/README.md index 4635ac1b..0d124511 100644 --- a/README.md +++ b/README.md @@ -26,31 +26,30 @@ In addition, a docker-compose file is provided to launch the containers mentione wazuh-docker ├── docker-compose.yml - ├── kibana - │   ├── config - │   │   ├── entrypoint.sh - │   │   └── kibana.yml - │   └── Dockerfile ├── LICENSE - ├── nginx - │   ├── config - │   │   └── entrypoint.sh - │   └── Dockerfile ├── README.md ├── CHANGELOG.md ├── VERSION ├── test.txt └── wazuh - ├── config - │   ├── data_dirs.env - │   ├── entrypoint.sh - │   ├── filebeat.runit.service - │   ├── filebeat.yml - │   ├── init.bash - │   ├── postfix.runit.service - │   ├── wazuh-api.runit.service - │   └── wazuh.runit.service - └── Dockerfile + ├── config + │ ├── 00-decrypt_credentials.sh + │ ├── 01-wazuh.sh + │ ├── 02-set_filebeat_destination.sh + │ ├── 03-config_filebeat.sh + │ ├── 20-ossec-configuration.sh + │ ├── 25-backups.sh + │ ├── 35-remove_credentials_file.sh + │ ├── 85-save_wazuh_version.sh + │ ├── create_user.py + │ ├── entrypoint.sh + │ ├── filebeat_to_elasticsearch.yml + │ ├── filebeat_to_logstash.yml + │ ├── filebeat.runit.service + │ ├── permanent_data.env + │ ├── postfix.runit.service + │ └── wazuh.runit.service + └── Dockerfile ## Branches diff --git a/elasticsearch/Dockerfile b/elasticsearch/Dockerfile deleted file mode 100644 index 8c441371..00000000 --- a/elasticsearch/Dockerfile +++ /dev/null @@ -1,96 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -ARG ELASTIC_VERSION=7.4.2 -FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION} -ARG TEMPLATE_VERSION=v3.11.4 - -ENV ELASTICSEARCH_URL="http://elasticsearch:9200" - -ENV API_USER="foo" \ - API_PASS="bar" - -ENV XPACK_ML="true" - -ENV ENABLE_CONFIGURE_S3="false" - -ENV WAZUH_ALERTS_SHARDS="1" \ - WAZUH_ALERTS_REPLICAS="0" - -ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /usr/share/elasticsearch/config - -RUN yum install epel-release -y && \ - yum install jq -y - -# This CA is created for testing. Please set your own CA zip containing the key and the signed certificate. -# command: $ docker build --build-arg SECURITY_CA_PEM_LOCATION= --build-arg SECURITY_CA_KEY_LOCATION= -# ENV variables are necessary: SECURITY_CA_PEM, SECURITY_CA_KEY, SECURITY_CA_TRUST, SECURITY_OPENSSL_CONF -# Example: -# ARG SECURITY_CA_PEM_LOCATION="config/server.TEST-CA-signed.pem" -# ARG SECURITY_CA_KEY_LOCATION="config/server.TEST-CA.key" -# ARG SECURITY_OPENSSL_CONF_LOCATION="config/TEST_openssl.cnf" -# ARG SECURITY_CA_TRUST_LOCATION="config/server.TEST-CA-signed.pem" -ARG SECURITY_CA_PEM_LOCATION="" -ARG SECURITY_CA_KEY_LOCATION="" -ARG SECURITY_OPENSSL_CONF_LOCATION="" -ARG SECURITY_CA_TRUST_LOCATION="" - -# Elasticearch cluster configuration environment variables -# If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration -# CLUSTER_INITIAL_MASTER_NODES set to own node by default. -ENV ELASTIC_CLUSTER="false" \ - CLUSTER_NAME="wazuh" \ - CLUSTER_NODE_MASTER="false" \ - CLUSTER_NODE_DATA="true" \ - CLUSTER_NODE_INGEST="true" \ - CLUSTER_MEMORY_LOCK="true" \ - CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" \ - CLUSTER_NUMBER_OF_MASTERS="2" \ - CLUSTER_MAX_NODES="1" \ - CLUSTER_DELAYED_TIMEOUT="1m" \ - CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch" \ - CLUSTER_DISCOVERY_SEED="elasticsearch" - -# CA cert for Transport SSL -ADD $SECURITY_CA_PEM_LOCATION /usr/share/elasticsearch/config -ADD $SECURITY_CA_KEY_LOCATION /usr/share/elasticsearch/config -ADD $SECURITY_OPENSSL_CONF_LOCATION /usr/share/elasticsearch/config -ADD $SECURITY_CA_TRUST_LOCATION /usr/share/elasticsearch/config - -RUN mkdir /entrypoint-scripts - -COPY config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -RUN bin/elasticsearch-plugin install repository-s3 -b - -COPY --chown=elasticsearch:elasticsearch ./config/10-config_cluster.sh /entrypoint-scripts/10-config_cluster.sh -COPY --chown=elasticsearch:elasticsearch ./config/15-get_CA_key.sh /entrypoint-scripts/15-get_CA_key.sh -COPY --chown=elasticsearch:elasticsearch ./config/20-security_instances.sh /entrypoint-scripts/20-security_instances.sh -COPY --chown=elasticsearch:elasticsearch ./config/22-security_certs.sh /entrypoint-scripts/22-security_certs.sh -COPY --chown=elasticsearch:elasticsearch ./config/24-security_configuration.sh /entrypoint-scripts/24-security_configuration.sh -COPY --chown=elasticsearch:elasticsearch ./config/26-security_keystore.sh /entrypoint-scripts/26-security_keystore.sh -COPY --chown=elasticsearch:elasticsearch ./config/30-decrypt_credentials.sh /entrypoint-scripts/30-decrypt_credentials.sh -COPY --chown=elasticsearch:elasticsearch ./config/35-entrypoint.sh /entrypoint-scripts/35-entrypoint.sh -COPY --chown=elasticsearch:elasticsearch ./config/35-entrypoint_load_settings.sh ./ -COPY config/35-load_settings_configure_s3.sh ./config/35-load_settings_configure_s3.sh -COPY --chown=elasticsearch:elasticsearch ./config/35-load_settings_users_management.sh ./ -COPY --chown=elasticsearch:elasticsearch ./config/35-load_settings_policies.sh ./ -COPY --chown=elasticsearch:elasticsearch ./config/35-load_settings_templates.sh ./ -COPY --chown=elasticsearch:elasticsearch ./config/35-load_settings_aliases.sh ./ -RUN chmod +x /entrypoint-scripts/10-config_cluster.sh && \ - chmod +x /entrypoint-scripts/15-get_CA_key.sh && \ - chmod +x /entrypoint-scripts/20-security_instances.sh && \ - chmod +x /entrypoint-scripts/22-security_certs.sh && \ - chmod +x /entrypoint-scripts/24-security_configuration.sh && \ - chmod +x /entrypoint-scripts/26-security_keystore.sh && \ - chmod +x /entrypoint-scripts/30-decrypt_credentials.sh && \ - chmod +x /entrypoint-scripts/35-entrypoint.sh && \ - chmod +x ./35-entrypoint_load_settings.sh && \ - chmod 755 ./config/35-load_settings_configure_s3.sh && \ - chmod +x ./35-load_settings_users_management.sh && \ - chmod +x ./35-load_settings_policies.sh && \ - chmod +x ./35-load_settings_templates.sh && \ - chmod +x ./35-load_settings_aliases.sh - -ENTRYPOINT ["/entrypoint.sh"] -CMD ["elasticsearch"] diff --git a/elasticsearch/config/10-config_cluster.sh b/elasticsearch/config/10-config_cluster.sh deleted file mode 100644 index b68d59ae..00000000 --- a/elasticsearch/config/10-config_cluster.sh +++ /dev/null @@ -1,93 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -elastic_config_file="/usr/share/elasticsearch/config/elasticsearch.yml" -original_file="/usr/share/elasticsearch/config/original-elasticsearch.yml" -ELASTIC_HOSTAME=`hostname` - -echo "CLUSTER: - Prepare Configuration" -echo "CLUSTER: - Hostname" -echo $ELASTIC_HOSTAME -echo "CLUSTER: - Security main node" -echo $SECURITY_MAIN_NODE -echo "CLUSTER: - Discovery seed" -echo $CLUSTER_DISCOVERY_SEED -echo "CLUSTER: - Elastic cluster flag" -echo $ELASTIC_CLUSTER -echo "CLUSTER: - Node Master" -echo $CLUSTER_NODE_MASTER -echo "CLUSTER: - Node Data" -echo $CLUSTER_NODE_DATA -echo "CLUSTER: - Node Ingest" -echo $CLUSTER_NODE_INGEST - -cp $elastic_config_file $original_file - -remove_single_node_conf(){ - if grep -Fq "discovery.type" $1; then - sed -i '/discovery.type\: /d' $1 - fi -} - -remove_cluster_config(){ - sed -i '/# cluster node/,/# end cluster config/d' $1 -} - -# If Elasticsearch cluster is enable, then set up the elasticsearch.yml -if [[ $ELASTIC_CLUSTER == "true" && $CLUSTER_NODE_MASTER != "" && $CLUSTER_NODE_DATA != "" && $CLUSTER_NODE_INGEST != "" && $ELASTIC_HOSTAME != "" ]]; then - # Remove the old configuration - remove_single_node_conf $elastic_config_file - remove_cluster_config $elastic_config_file - echo "CLUSTER: - Remove old configuration" - -if [[ $ELASTIC_HOSTAME == $SECURITY_MAIN_NODE ]]; then -# Add the master configuration -# cluster.initial_master_nodes for bootstrap the cluster -echo "CLUSTER: - Add the master configuration" - -cat > $elastic_config_file << EOF -# cluster node -cluster.name: $CLUSTER_NAME -bootstrap.memory_lock: $CLUSTER_MEMORY_LOCK -network.host: 0.0.0.0 -node.name: $ELASTIC_HOSTAME -node.master: $CLUSTER_NODE_MASTER -node.data: $CLUSTER_NODE_DATA -node.ingest: $CLUSTER_NODE_INGEST -node.max_local_storage_nodes: $CLUSTER_MAX_NODES -cluster.initial_master_nodes: - - $ELASTIC_HOSTAME -# end cluster config" -EOF - -elif [[ $CLUSTER_DISCOVERY_SEED != "" ]]; then -# Remove the old configuration -remove_single_node_conf $elastic_config_file -remove_cluster_config $elastic_config_file -echo "CLUSTER: - Add standard cluster configuration." - -cat > $elastic_config_file << EOF -# cluster node -cluster.name: $CLUSTER_NAME -bootstrap.memory_lock: $CLUSTER_MEMORY_LOCK -network.host: 0.0.0.0 -node.name: $ELASTIC_HOSTAME -node.master: $CLUSTER_NODE_MASTER -node.data: $CLUSTER_NODE_DATA -node.ingest: $CLUSTER_NODE_INGEST -node.max_local_storage_nodes: $CLUSTER_MAX_NODES -discovery.seed_hosts: - - $CLUSTER_DISCOVERY_SEED -# end cluster config" -EOF -fi -# If the cluster is disabled, then set a single-node configuration -else - # Remove the old configuration - remove_single_node_conf $elastic_config_file - remove_cluster_config $elastic_config_file - echo "discovery.type: single-node" >> $elastic_config_file - echo "CLUSTER: - Discovery type: single-node" -fi - -echo "CLUSTER: - Configured" \ No newline at end of file diff --git a/elasticsearch/config/15-get_CA_key.sh b/elasticsearch/config/15-get_CA_key.sh deleted file mode 100644 index e555bcf1..00000000 --- a/elasticsearch/config/15-get_CA_key.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Decrypt credentials. -# If the CA key is encrypted, it must be decrypted for later use. -############################################################################## - -echo "TO DO" - -# TO DO \ No newline at end of file diff --git a/elasticsearch/config/20-security_instances.sh b/elasticsearch/config/20-security_instances.sh deleted file mode 100644 index 3ff7e3e5..00000000 --- a/elasticsearch/config/20-security_instances.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# instances.yml -# This file is necessary for the creation of the Elasticsaerch certificate. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - echo "SECURITY - Setting Elasticserach security." - - # instance.yml to be added by the user. - # Example: - # echo " - # instances: - # - name: \"elasticsearch\" - # dns: - # - \"elasticsearch\" - # " > /user/share/elasticsearch/instances.yml - -fi \ No newline at end of file diff --git a/elasticsearch/config/22-security_certs.sh b/elasticsearch/config/22-security_certs.sh deleted file mode 100644 index 57614912..00000000 --- a/elasticsearch/config/22-security_certs.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Creation and management of certificates. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - echo "SECURITY - Elasticserach security certificates." - - # Creation of the certificate for Elasticsearch. - # After the execution of this script will have generated - # the Elasticsearch certificate and related keys and passphrase. - # Example: TO DO - -fi diff --git a/elasticsearch/config/24-security_configuration.sh b/elasticsearch/config/24-security_configuration.sh deleted file mode 100644 index 58be15c2..00000000 --- a/elasticsearch/config/24-security_configuration.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Adapt elasticsearch.yml configuration file -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - echo "SECURITY - Elasticserach security configuration." - - echo "SECURITY - Setting configuration options." - - # Settings for elasticsearch.yml to be added by the user. - # Example: - # echo " - # # Required to set the passwords and TLS options - # xpack.security.enabled: true - # xpack.security.transport.ssl.enabled: true - # xpack.security.transport.ssl.verification_mode: certificate - # xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/elasticsearch/elasticsearch.key - # xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/elasticsearch.cert.pem - # xpack.security.transport.ssl.certificate_authorities: [\"/usr/share/elasticsearch/config/ca.cert.pem\"] - - # # HTTP layer - # xpack.security.http.ssl.enabled: true - # xpack.security.http.ssl.verification_mode: certificate - # xpack.security.http.ssl.key: /usr/share/elasticsearch/config/elasticsearch/elasticsearch.key - # xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/elasticsearch.cert.pem - # xpack.security.http.ssl.certificate_authorities: [\"/usr/share/elasticsearch/config/ca.cert.pem\"] - # " >> /usr/share/elasticsearch/config/elasticsearch.yml - -fi diff --git a/elasticsearch/config/26-security_keystore.sh b/elasticsearch/config/26-security_keystore.sh deleted file mode 100644 index cc4d73d1..00000000 --- a/elasticsearch/config/26-security_keystore.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Adapt elasticsearch.yml keystore management -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - echo "SECURITY - Elasticserach keystore management." - - # Create keystore - # /usr/share/elasticsearch/bin/elasticsearch-keystore create - - # Add keys to keystore by the user. - # Example - # echo -e "$abcd_1234" | /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.secure_key_passphrase --stdin - # echo -e "$abcd_1234" | /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.http.ssl.secure_key_passphrase --stdin - -else - echo "SECURITY - Elasticsearch security not established." -fi \ No newline at end of file diff --git a/elasticsearch/config/30-decrypt_credentials.sh b/elasticsearch/config/30-decrypt_credentials.sh deleted file mode 100644 index 1f348e5f..00000000 --- a/elasticsearch/config/30-decrypt_credentials.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Decrypt credentials. -# If the credentials of the users to be created are encrypted, -# they must be decrypted for later use. -############################################################################## - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "Security credentials file not used. Nothing to do." -else - echo "TO DO" -fi -# TO DO \ No newline at end of file diff --git a/elasticsearch/config/35-entrypoint.sh b/elasticsearch/config/35-entrypoint.sh deleted file mode 100644 index 318e7f01..00000000 --- a/elasticsearch/config/35-entrypoint.sh +++ /dev/null @@ -1,70 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -# For more information https://github.com/elastic/elasticsearch-docker/blob/6.8.1/build/elasticsearch/bin/docker-entrypoint.sh - -set -e - -# Files created by Elasticsearch should always be group writable too -umask 0002 - -run_as_other_user_if_needed() { - if [[ "$(id -u)" == "0" ]]; then - # If running as root, drop to specified UID and run command - exec chroot --userspec=1000 / "${@}" - else - # Either we are running in Openshift with random uid and are a member of the root group - # or with a custom --user - exec "${@}" - fi -} - - -#Disabling xpack features - -elasticsearch_config_file="/usr/share/elasticsearch/config/elasticsearch.yml" -if grep -Fq "#xpack features" "$elasticsearch_config_file" ; -then - declare -A CONFIG_MAP=( - [xpack.ml.enabled]=$XPACK_ML - ) - for i in "${!CONFIG_MAP[@]}" - do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $elasticsearch_config_file - fi - done -else - echo " -#xpack features -xpack.ml.enabled: $XPACK_ML - " >> $elasticsearch_config_file -fi - -# Run load settings script. - -bash /usr/share/elasticsearch/35-entrypoint_load_settings.sh & - -# Execute elasticsearch - - -if [[ $SECURITY_ENABLED == "yes" ]]; then - echo "Change Elastic password" - if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - run_as_other_user_if_needed echo "$SECURITY_ELASTIC_PASSWORD" | elasticsearch-keystore add -xf 'bootstrap.password' - else - input=${SECURITY_CREDENTIALS_FILE} - ELASTIC_PASSWORD_FROM_FILE="" - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASSWORD_FROM_FILE=${arrIN[1]} - fi - done < "$input" - run_as_other_user_if_needed echo "$ELASTIC_PASSWORD_FROM_FILE" | elasticsearch-keystore add -xf 'bootstrap.password' - fi - echo "Elastic password changed" -fi - -run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch \ No newline at end of file diff --git a/elasticsearch/config/35-entrypoint_load_settings.sh b/elasticsearch/config/35-entrypoint_load_settings.sh deleted file mode 100644 index 449b6093..00000000 --- a/elasticsearch/config/35-entrypoint_load_settings.sh +++ /dev/null @@ -1,172 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -############################################################################## -# Set Elasticsearch API url and Wazuh API url. -############################################################################## - -if [[ "x${ELASTICSEARCH_PROTOCOL}" = "x" || "x${ELASTICSEARCH_IP}" = "x" || "x${ELASTICSEARCH_PORT}" = "x" ]]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" -fi - -if [[ "x${WAZUH_API_URL}" = "x" ]]; then - wazuh_url="https://wazuh" -else - wazuh_url="${WAZUH_API_URL}" -fi - -echo "LOAD SETTINGS - Elasticsearch url: $el_url" - - -############################################################################## -# If Elasticsearch security is enabled get the elastic user password and -# WAZUH API credentials. -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -############################################################################## -# Set authentication for curl if Elasticsearch security is enabled. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-uelastic:${ELASTIC_PASS} -k" - echo "LOAD SETTINGS - authentication for curl established." -elif [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" - echo "LOAD SETTINGS - authentication for curl not established." -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" - echo "LOAD SETTINGS - authentication for curl established." -fi - - -############################################################################## -# Wait until Elasticsearch is active. -############################################################################## - -until curl ${auth} -XGET $el_url; do - >&2 echo "LOAD SETTINGS - Elastic is unavailable - sleeping" - sleep 5 -done - ->&2 echo "LOAD SETTINGS - Elastic is up - executing command" - - -############################################################################## -# Configure S3 repository for Elasticsearch snapshots. -############################################################################## - -if [ $ENABLE_CONFIGURE_S3 ]; then - #Wait for Elasticsearch to be ready to create the repository - sleep 10 - >&2 echo "S3 - Configure S3" - if [ "x$S3_PATH" != "x" ]; then - >&2 echo "S3 - Path: $S3_PATH" - if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then - >&2 echo "S3 - Elasticsearch major version: $S3_ELASTIC_MAJOR" - echo "LOAD SETTINGS - Run 35-load_settings_configure_s3.sh." - bash /usr/share/elasticsearch/config/35-load_settings_configure_s3.sh $el_url $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR - else - >&2 echo "S3 - Elasticserach major version not given." - echo "LOAD SETTINGS - Run 35-load_settings_configure_s3.sh." - bash /usr/share/elasticsearch/config/35-load_settings_configure_s3.sh $el_url $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME - fi - - fi - -fi - - -############################################################################## -# Load custom policies. -############################################################################## - -echo "LOAD SETTINGS - Loading custom Elasticsearch policies." -bash /usr/share/elasticsearch/35-load_settings_policies.sh - - -############################################################################## -# Modify wazuh-alerts template shards and replicas -############################################################################## - -echo "LOAD SETTINGS - Change shards and replicas of wazuh-alerts template." -sed -i 's:"index.number_of_shards"\: "3":"index.number_of_shards"\: "'$WAZUH_ALERTS_SHARDS'":g' /usr/share/elasticsearch/config/wazuh-template.json -sed -i 's:"index.number_of_replicas"\: "0":"index.number_of_replicas"\: "'$WAZUH_ALERTS_REPLICAS'":g' /usr/share/elasticsearch/config/wazuh-template.json - - -############################################################################## -# Load default templates -############################################################################## - -echo "LOAD SETTINGS - Loading wazuh-alerts template" -bash /usr/share/elasticsearch/35-load_settings_templates.sh - - -############################################################################## -# Load custom aliases. -############################################################################## - -echo "LOAD SETTINGS - Loading custom Elasticsearch aliases." -bash /usr/share/elasticsearch/35-load_settings_aliases.sh - - -############################################################################## -# Elastic Stack users creation. -# Only security main node can manage users. -############################################################################## - -echo "LOAD SETTINGS - Run users_management.sh." -MY_HOSTNAME=`hostname` -echo "LOAD SETTINGS - Hostname: $MY_HOSTNAME" -if [[ $SECURITY_MAIN_NODE == $MY_HOSTNAME ]]; then - bash /usr/share/elasticsearch/35-load_settings_users_management.sh & -fi - - -############################################################################## -# Enable xpack.monitoring.collection -############################################################################## - -curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d' -{ - "persistent": { - "xpack.monitoring.collection.enabled": true - } -} -' - - -############################################################################## -# Set cluster delayed timeout when node falls -############################################################################## - -curl -X PUT "$el_url/_all/_settings" ${auth} -H 'Content-Type: application/json' -d' -{ - "settings": { - "index.unassigned.node_left.delayed_timeout": "'"$CLUSTER_DELAYED_TIMEOUT"'" - } -} -' -echo "LOAD SETTINGS - cluster delayed timeout changed." - -echo "LOAD SETTINGS - Elasticsearch is ready." diff --git a/elasticsearch/config/35-load_settings_aliases.sh b/elasticsearch/config/35-load_settings_aliases.sh deleted file mode 100644 index cf67d7b1..00000000 --- a/elasticsearch/config/35-load_settings_aliases.sh +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - - -############################################################################## -# Set Elasticsearch API url -############################################################################## - -if [[ "x${ELASTICSEARCH_PROTOCOL}" = "x" || "x${ELASTICSEARCH_IP}" = "x" || "x${ELASTICSEARCH_PORT}" = "x" ]]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" -fi - -echo "ALIASES - Elasticsearch url: $el_url" - - -############################################################################## -# If Elasticsearch security is enabled get the elastic user password. -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -############################################################################## -# If Elasticsearch security is enabled get the users credentials. -############################################################################## - -# The user must get the credentials of the users. -# TO DO. - -############################################################################## -# Set authentication for curl if Elasticsearch security is enabled. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-uelastic:${ELASTIC_PASS} -k" - echo "ALIASES - authentication for curl established." -elif [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" - echo "ALIASES - authentication for curl not established." -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" - echo "ALIASES - authentication for curl established." -fi - - -############################################################################## -# Wait until Elasticsearch is active. -############################################################################## - -until curl ${auth} -XGET $el_url; do - >&2 echo "ALIASES - Elastic is unavailable - sleeping" - sleep 5 -done - ->&2 echo "ALIASES - Elastic is up - executing command" - - -############################################################################## -# Add custom aliases. -############################################################################## - -# The user must add the credentials of the users. -# TO DO. -# Example -# echo "ALIASES - Add custom_user password and role:" -# curl ${auth} -k -XPOST -H 'Content-Type: application/json' 'https://localhost:9200/_ilm/policy/my_policy?pretty' -d' -# { "policy": { "phases": { "hot": { "actions": { "rollover": {"max_size": "50GB", "max_age": "5m"}}}}}}' - diff --git a/elasticsearch/config/35-load_settings_configure_s3.sh b/elasticsearch/config/35-load_settings_configure_s3.sh deleted file mode 100644 index 259bf9da..00000000 --- a/elasticsearch/config/35-load_settings_configure_s3.sh +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - - -############################################################################## -# If Secure access to Kibana is enabled, we must set the credentials for -# monitoring -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} - -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-u elastic:${ELASTIC_PASS} -k" -else - auth="" -fi - -# Check number of arguments passed to configure_s3.sh. If it is different from 4 or 5, the process will finish with error. -# param 1: number of arguments passed to configure_s3.sh - -function CheckArgs() -{ - if [ $1 != 4 ] && [ $1 != 5 ];then - echo "Use: configure_s3.sh (By default is added to the path and the repository name)" - echo "or use: configure_s3.sh " - exit 1 - - fi -} - -# Create S3 repository from base_path / (if there is no argument, current version is added) -# Repository name would be - (if there is no argument, current version is added) -# param 1: -# param 2: -# param 3: -# param 4: -# param 5: Optional -# output: It will show "acknowledged" if the repository has been successfully created - -function CreateRepo() -{ - - elastic_ip_port="$2" - bucket_name="$3" - path="$4" - repository_name="$5" - - if [ $1 == 5 ];then - version="$6" - else - version=`curl ${auth} -s $elastic_ip_port | grep number | cut -d"\"" -f4 | cut -c1` - fi - - if ! [[ "$version" =~ ^[0-9]+$ ]];then - echo "Elasticsearch major version must be an integer" - exit 1 - fi - - repository="$repository_name-$version" - s3_path="$path/$version" - - >&2 echo "Create S3 repository" - - until curl ${auth} -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d' {"type": "s3", "settings": { "bucket": "'$bucket_name'", "base_path": "'$s3_path'"} }'; do - >&2 echo "Elastic is unavailable, S3 repository not created - sleeping" - sleep 5 - done - - >&2 echo "S3 repository created" - - -} - -# Run functions CheckArgs and CreateRepo -# param 1: number of arguments passed to configure_s3.sh -# param 2: -# param 3: -# param 4: -# param 5: -# param 6: Optional - -function Main() -{ - CheckArgs $1 - - CreateRepo $1 $2 $3 $4 $5 $6 -} - -Main $# $1 $2 $3 $4 $5 \ No newline at end of file diff --git a/elasticsearch/config/35-load_settings_policies.sh b/elasticsearch/config/35-load_settings_policies.sh deleted file mode 100644 index 3e89e4c5..00000000 --- a/elasticsearch/config/35-load_settings_policies.sh +++ /dev/null @@ -1,86 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - - -############################################################################## -# Set Elasticsearch API url -############################################################################## - -if [[ "x${ELASTICSEARCH_PROTOCOL}" = "x" || "x${ELASTICSEARCH_IP}" = "x" || "x${ELASTICSEARCH_PORT}" = "x" ]]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" -fi - -echo "POLICIES - Elasticsearch url: $el_url" - - -############################################################################## -# If Elasticsearch security is enabled get the elastic user password. -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -############################################################################## -# If Elasticsearch security is enabled get the users credentials. -############################################################################## - -# The user must get the credentials of the users. -# TO DO. - -############################################################################## -# Set authentication for curl if Elasticsearch security is enabled. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-uelastic:${ELASTIC_PASS} -k" - echo "POLICIES - authentication for curl established." -elif [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" - echo "POLICIES - authentication for curl not established." -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" - echo "POLICIES - authentication for curl established." -fi - - -############################################################################## -# Wait until Elasticsearch is active. -############################################################################## - -until curl ${auth} -XGET $el_url; do - >&2 echo "POLICIES - Elastic is unavailable - sleeping" - sleep 5 -done - ->&2 echo "POLICIES - Elastic is up - executing command" - - -############################################################################## -# Add custom policies. -############################################################################## - -# The user must add the credentials of the users. -# TO DO. -# Example -# echo "POLICIES - Add custom_user password and role:" -# curl ${auth} -k -XPOST -H 'Content-Type: application/json' 'https://localhost:9200/_ilm/policy/my_policy?pretty' -d' -# { "policy": { "phases": { "hot": { "actions": { "rollover": {"max_size": "50GB", "max_age": "5m"}}}}}}' - diff --git a/elasticsearch/config/35-load_settings_templates.sh b/elasticsearch/config/35-load_settings_templates.sh deleted file mode 100644 index dcee8ef8..00000000 --- a/elasticsearch/config/35-load_settings_templates.sh +++ /dev/null @@ -1,81 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - - -############################################################################## -# Set Elasticsearch API url -############################################################################## - -if [[ "x${ELASTICSEARCH_PROTOCOL}" = "x" || "x${ELASTICSEARCH_IP}" = "x" || "x${ELASTICSEARCH_PORT}" = "x" ]]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" -fi - -echo "TEMPLATES - Elasticsearch url: $el_url" - - -############################################################################## -# If Elasticsearch security is enabled get the elastic user password. -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -############################################################################## -# If Elasticsearch security is enabled get the users credentials. -############################################################################## - -# The user must get the credentials of the users. -# TO DO. - -############################################################################## -# Set authentication for curl if Elasticsearch security is enabled. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-uelastic:${ELASTIC_PASS} -k" - echo "TEMPLATES - authentication for curl established." -elif [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" - echo "TEMPLATES - authentication for curl not established." -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" - echo "TEMPLATES - authentication for curl established." -fi - - -############################################################################## -# Wait until Elasticsearch is active. -############################################################################## - -until curl ${auth} -XGET $el_url; do - >&2 echo "TEMPLATES - Elastic is unavailable - sleeping" - sleep 5 -done - ->&2 echo "TEMPLATES - Elastic is up - executing command" - - -############################################################################## -# Add wazuh-alerts templates. -############################################################################## - -echo "TEMPLATES - Loading default wazuh-alerts template." -cat /usr/share/elasticsearch/config/wazuh-template.json | curl -XPUT "$el_url/_template/wazuh" ${auth} -H 'Content-Type: application/json' -d @- diff --git a/elasticsearch/config/35-load_settings_users_management.sh b/elasticsearch/config/35-load_settings_users_management.sh deleted file mode 100644 index 98a5add2..00000000 --- a/elasticsearch/config/35-load_settings_users_management.sh +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - - -############################################################################## -# Set Elasticsearch API url -############################################################################## - -if [[ "x${ELASTICSEARCH_PROTOCOL}" = "x" || "x${ELASTICSEARCH_IP}" = "x" || "x${ELASTICSEARCH_PORT}" = "x" ]]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_PROTOCOL}://${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}" -fi - -echo "USERS - Elasticsearch url: $el_url" - - -############################################################################## -# If Elasticsearch security is enabled get the elastic user password. -############################################################################## - -ELASTIC_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - ELASTIC_PASS=${SECURITY_ELASTIC_PASSWORD} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"ELASTIC_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - ELASTIC_PASS=${arrIN[1]} - fi - done < "$input" - -fi - - -############################################################################## -# If Elasticsearch security is enabled get the users credentials. -############################################################################## - -# The user must get the credentials of the users. -# TO DO. - -############################################################################## -# Set authentication for curl if Elasticsearch security is enabled. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-uelastic:${ELASTIC_PASS} -k" - echo "USERS - authentication for curl established." -elif [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" - echo "USERS - authentication for curl not established." -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" - echo "USERS - authentication for curl established." -fi - - -############################################################################## -# Wait until Elasticsearch is active. -############################################################################## - -until curl ${auth} -XGET $el_url; do - >&2 echo "USERS - Elastic is unavailable - sleeping" - sleep 5 -done - ->&2 echo "USERS - Elastic is up - executing command" - - -############################################################################## -# Setup passwords for Elastic Stack users. -############################################################################## - -# The user must add the credentials of the users. -# TO DO. -# Example -# echo "USERS - Add custom_user password and role:" -# curl ${auth} -k -XPOST -H 'Content-Type: application/json' 'https://localhost:9200/_xpack/security/role/custom_user_role ' -d ' -# { "indices": [ { "names": [ ".kibana*" ], "privileges": ["read"] }, { "names": [ "wazuh-monitoring*"], "privileges": ["all"] }] }' -# curl ${auth} -k -XPOST -H 'Content-Type: application/json' 'https://localhost:9200/_xpack/security/user/custom_user' -d ' -# { "password":"'$CUSTOM_USER_PASSWORD'", "roles" : [ "kibana_system", "custom_user_role"], "full_name" : "Custom User" }' - - -############################################################################## -# Remove credentials file. -############################################################################## - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "USERS - Security credentials file not used. Nothing to do." -else - shred -zvu ${SECURITY_CREDENTIALS_FILE} - echo "USERS - Security credentials file removed." -fi - diff --git a/elasticsearch/config/TEST_openssl.cnf b/elasticsearch/config/TEST_openssl.cnf deleted file mode 100644 index f6d58fc7..00000000 --- a/elasticsearch/config/TEST_openssl.cnf +++ /dev/null @@ -1,132 +0,0 @@ -# OpenSSL intermediate CA configuration file. -# Copy to `/root/ca/intermediate/openssl.cnf`. - -[ ca ] -# `man ca` -default_ca = CA_default - -[ CA_default ] -# Directory and file locations. -dir = /root/ca/intermediate -certs = $dir/certs -crl_dir = $dir/crl -new_certs_dir = $dir/newcerts -database = $dir/index.txt -serial = $dir/serial -RANDFILE = $dir/private/.rand - -# The root key and root certificate. -private_key = $dir/private/intermediate.key.pem -certificate = $dir/certs/intermediate.cert.pem - -# For certificate revocation lists. -crlnumber = $dir/crlnumber -crl = $dir/crl/intermediate.crl.pem -crl_extensions = crl_ext -default_crl_days = 30 - -# SHA-1 is deprecated, so use SHA-2 instead. -default_md = sha256 - -name_opt = ca_default -cert_opt = ca_default -default_days = 375 -preserve = no -policy = policy_loose - -[ policy_strict ] -# The root CA should only sign intermediate certificates that match. -# See the POLICY FORMAT section of `man ca`. -countryName = match -stateOrProvinceName = match -organizationName = match -organizationalUnitName = optional -commonName = supplied -emailAddress = optional - -[ policy_loose ] -# Allow the intermediate CA to sign a more diverse range of certificates. -# See the POLICY FORMAT section of the `ca` man page. -countryName = optional -stateOrProvinceName = optional -localityName = optional -organizationName = optional -organizationalUnitName = optional -commonName = supplied -emailAddress = optional - -[ req ] -# Options for the `req` tool (`man req`). -default_bits = 2048 -distinguished_name = req_distinguished_name -string_mask = utf8only - -# SHA-1 is deprecated, so use SHA-2 instead. -default_md = sha256 - -# Extension to add when the -x509 option is used. -x509_extensions = v3_ca - -[ req_distinguished_name ] -# See . -countryName = Country Name (2 letter code) -stateOrProvinceName = State or Province Name -localityName = Locality Name -0.organizationName = Organization Name -organizationalUnitName = Organizational Unit Name -commonName = Common Name -emailAddress = Email Address - -# Optionally, specify some defaults. -countryName_default = GB -stateOrProvinceName_default = England -localityName_default = -0.organizationName_default = Alice Ltd -organizationalUnitName_default = -emailAddress_default = - -[ v3_ca ] -# Extensions for a typical CA (`man x509v3_config`). -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid:always,issuer -basicConstraints = critical, CA:true -keyUsage = critical, digitalSignature, cRLSign, keyCertSign - -[ v3_intermediate_ca ] -# Extensions for a typical intermediate CA (`man x509v3_config`). -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid:always,issuer -basicConstraints = critical, CA:true, pathlen:0 -keyUsage = critical, digitalSignature, cRLSign, keyCertSign - -[ usr_cert ] -# Extensions for client certificates (`man x509v3_config`). -basicConstraints = CA:FALSE -nsCertType = client, email -nsComment = "OpenSSL Generated Client Certificate" -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid,issuer -keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment -extendedKeyUsage = clientAuth, emailProtection - -[ server_cert ] -# Extensions for server certificates (`man x509v3_config`). -basicConstraints = CA:FALSE -nsCertType = server -nsComment = "OpenSSL Generated Server Certificate" -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid,issuer:always -keyUsage = critical, digitalSignature, keyEncipherment -extendedKeyUsage = serverAuth - -[ crl_ext ] -# Extension for CRLs (`man x509v3_config`). -authorityKeyIdentifier=keyid:always - -[ ocsp ] -# Extension for OCSP signing certificates (`man ocsp`). -basicConstraints = CA:FALSE -subjectKeyIdentifier = hash -authorityKeyIdentifier = keyid,issuer -keyUsage = critical, digitalSignature -extendedKeyUsage = critical, OCSPSigning \ No newline at end of file diff --git a/elasticsearch/config/entrypoint.sh b/elasticsearch/config/entrypoint.sh deleted file mode 100644 index e64d5b9b..00000000 --- a/elasticsearch/config/entrypoint.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -# It will run every .sh script located in entrypoint-scripts folder in lexicographical order -for script in `ls /entrypoint-scripts/*.sh | sort -n`; do - bash "$script" - -done \ No newline at end of file diff --git a/kibana/Dockerfile b/kibana/Dockerfile deleted file mode 100644 index 9eb892b3..00000000 --- a/kibana/Dockerfile +++ /dev/null @@ -1,101 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM docker.elastic.co/kibana/kibana:7.4.2 -ARG ELASTIC_VERSION=7.4.2 -ARG WAZUH_VERSION=3.11.5 -ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" - -USER root - -COPY config/wazuhapp-${WAZUH_APP_VERSION}.zip /tmp -USER kibana -#RUN /usr/share/kibana/bin/kibana-plugin install --allow-root https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip -RUN /usr/share/kibana/bin/kibana-plugin install --allow-root file:///tmp/wazuhapp-${WAZUH_APP_VERSION}.zip -USER root -RUN rm -rf /tmp/wazuhapp-${WAZUH_APP_VERSION}.zip - -COPY config/entrypoint.sh ./entrypoint.sh -RUN chmod 755 ./entrypoint.sh -RUN mkdir /entrypoint-scripts - -USER kibana - -ENV CONFIGURATION_FROM_FILE="false" - -ENV PATTERN="" \ - CHECKS_PATTERN="" \ - CHECKS_TEMPLATE="" \ - CHECKS_API="" \ - CHECKS_SETUP="" \ - EXTENSIONS_PCI="" \ - EXTENSIONS_GDPR="" \ - EXTENSIONS_AUDIT="" \ - EXTENSIONS_OSCAP="" \ - EXTENSIONS_CISCAT="" \ - EXTENSIONS_AWS="" \ - EXTENSIONS_VIRUSTOTAL="" \ - EXTENSIONS_OSQUERY="" \ - APP_TIMEOUT="" \ - WAZUH_SHARDS="" \ - WAZUH_REPLICAS="" \ - WAZUH_VERSION_SHARDS="" \ - WAZUH_VERSION_REPLICAS="" \ - IP_SELECTOR="" \ - IP_IGNORE="" \ - XPACK_RBAC_ENABLED="" \ - WAZUH_MONITORING_ENABLED="" \ - WAZUH_MONITORING_FREQUENCY="" \ - WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" \ - API_SELECTOR="" - -ARG XPACK_CANVAS="false" -ARG XPACK_LOGS="false" -ARG XPACK_INFRA="false" -ARG XPACK_ML="false" -ARG XPACK_DEVTOOLS="false" -ARG XPACK_MONITORING="false" -ARG XPACK_APM="false" -ARG XPACK_MAPS="false" -ARG XPACK_UPTIME="false" -ARG XPACK_SIEM="false" - -ARG CHANGE_WELCOME="true" - -COPY --chown=kibana:kibana ./config/05-decrypt_credentials.sh /entrypoint-scripts/05-decrypt_credentials.sh -COPY --chown=kibana:kibana ./config/10-wazuh_app_config.sh /entrypoint-scripts/10-wazuh_app_config.sh -COPY --chown=kibana:kibana ./config/12-custom_logos.sh /entrypoint-scripts/12-custom_logos.sh -COPY --chown=kibana:kibana ./config/20-entrypoint.sh /entrypoint-scripts/20-entrypoint.sh -COPY --chown=kibana:kibana ./config/20-entrypoint_kibana_settings.sh ./ -COPY --chown=kibana:kibana ./config/20-entrypoint_certs_management.sh ./ -RUN chmod +x /entrypoint-scripts/05-decrypt_credentials.sh && \ - chmod +x /entrypoint-scripts/10-wazuh_app_config.sh && \ - chmod +x /entrypoint-scripts/12-custom_logos.sh && \ - chmod +x /entrypoint-scripts/20-entrypoint.sh && \ - chmod +x ./20-entrypoint_kibana_settings.sh && \ - chmod +x ./20-entrypoint_certs_management.sh - -COPY --chown=kibana:kibana ./config/xpack_config.sh ./ - -RUN chmod +x ./xpack_config.sh - -RUN ./xpack_config.sh - -COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ - -RUN chmod +x ./welcome_wazuh.sh - -RUN ./welcome_wazuh.sh - -RUN /usr/local/bin/kibana-docker --optimize - -USER root - -RUN chmod 660 /usr/share/kibana/plugins/wazuh/wazuh.yml && \ - chmod 775 /usr/share/kibana/plugins/wazuh && \ - chown root:kibana /usr/share/kibana/plugins/wazuh/wazuh.yml && \ - chown root:kibana /usr/share/kibana/plugins/wazuh - -USER kibana - -ENTRYPOINT ./entrypoint.sh diff --git a/kibana/config/05-decrypt_credentials.sh b/kibana/config/05-decrypt_credentials.sh deleted file mode 100644 index 1f348e5f..00000000 --- a/kibana/config/05-decrypt_credentials.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Decrypt credentials. -# If the credentials of the users to be created are encrypted, -# they must be decrypted for later use. -############################################################################## - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "Security credentials file not used. Nothing to do." -else - echo "TO DO" -fi -# TO DO \ No newline at end of file diff --git a/kibana/config/10-wazuh_app_config.sh b/kibana/config/10-wazuh_app_config.sh deleted file mode 100644 index eba39679..00000000 --- a/kibana/config/10-wazuh_app_config.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -############################################################################## -# If Elasticsearch security is enabled get the kibana user, the Kibana -# password and WAZUH API credentials. -############################################################################## - -KIBANA_USER="" -KIBANA_PASS="" -WAZH_API_USER="" -WAZH_API_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - KIBANA_USER=${SECURITY_KIBANA_USER} - KIBANA_PASS=${SECURITY_KIBANA_PASS} - WAZH_API_USER=${API_USER} - WAZH_API_PASS=${API_PASS} - echo "USERS - Credentials obtained from environment variables." -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"KIBANA_USER"* ]]; then - arrIN=(${line//:/ }) - KIBANA_USER=${arrIN[1]} - elif [[ $line == *"KIBANA_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - KIBANA_PASS=${arrIN[1]} - elif [[ $line == *"WAZUH_API_USER"* ]]; then - arrIN=(${line//:/ }) - WAZH_API_USER=${arrIN[1]} - elif [[ $line == *"WAZUH_API_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - WAZH_API_PASS=${arrIN[1]} - fi - done < "$input" - echo "USERS - Credentials obtained from file." -fi - -############################################################################## -# Establish the way to run the curl command, with or without authentication. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-u ${KIBANA_USER}:${KIBANA_PASS} -k" -elif [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then - auth="" -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" -fi - -############################################################################## -# Set custom wazuh.yml config -############################################################################## - -kibana_config_file="/usr/share/kibana/plugins/wazuh/wazuh.yml" - -declare -A CONFIG_MAP=( - [pattern]=$PATTERN - [checks.pattern]=$CHECKS_PATTERN - [checks.template]=$CHECKS_TEMPLATE - [checks.api]=$CHECKS_API - [checks.setup]=$CHECKS_SETUP - [extensions.pci]=$EXTENSIONS_PCI - [extensions.gdpr]=$EXTENSIONS_GDPR - [extensions.audit]=$EXTENSIONS_AUDIT - [extensions.oscap]=$EXTENSIONS_OSCAP - [extensions.ciscat]=$EXTENSIONS_CISCAT - [extensions.aws]=$EXTENSIONS_AWS - [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL - [extensions.osquery]=$EXTENSIONS_OSQUERY - [timeout]=$APP_TIMEOUT - [wazuh.shards]=$WAZUH_SHARDS - [wazuh.replicas]=$WAZUH_REPLICAS - [wazuh-version.shards]=$WAZUH_VERSION_SHARDS - [wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS - [ip.selector]=$IP_SELECTOR - [ip.ignore]=$IP_IGNORE - [xpack.rbac.enabled]=$XPACK_RBAC_ENABLED - [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED - [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY - [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS - [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS - [admin]=$ADMIN_PRIVILEGES - [api.selector]=$API_SELECTOR -) - -for i in "${!CONFIG_MAP[@]}" -do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file - fi -done - -# remove default API entry (new in 3.11.0_7.5.1) -sed -ie '/- default:/,+4d' $kibana_config_file - -# If this is an update to 3.11 -CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $ELASTICSEARCH_URL/.wazuh/_doc/1513629884013 ${auth}) - -grep -q 1513629884013 $kibana_config_file -_config_exists=$? - -if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then -cat << EOF >> $kibana_config_file - - 1: - url: https://wazuh - port: 55000 - user: $WAZH_API_USER - password: $WAZH_API_PASS -EOF -else - echo "Wazuh APP already configured" -fi diff --git a/kibana/config/12-custom_logos.sh b/kibana/config/12-custom_logos.sh deleted file mode 100644 index c799c999..00000000 --- a/kibana/config/12-custom_logos.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Kibana logos -############################################################################## - -if [[ $CUSTOM_LOGO == "true" ]]; then - - - echo "CUSTOM LOGO - Change Kibana logos." - # TO DO - -fi \ No newline at end of file diff --git a/kibana/config/20-entrypoint.sh b/kibana/config/20-entrypoint.sh deleted file mode 100644 index 4df616f5..00000000 --- a/kibana/config/20-entrypoint.sh +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -############################################################################## -# Set Elasticsearch API url. -############################################################################## - -if [ "x${ELASTICSEARCH_URL}" = "x" ]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_URL}" -fi - -echo "ENTRYPOINT - Set Elasticsearc url:${ELASTICSEARCH_URL}" - - -############################################################################## -# If there are credentials for Kibana they are obtained. -############################################################################## - -KIBANA_USER="" -KIBANA_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - KIBANA_USER=${SECURITY_KIBANA_USER} - KIBANA_PASS=${SECURITY_KIBANA_PASS} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"KIBANA_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - KIBANA_PASS=${arrIN[1]} - elif [[ $line == *"KIBANA_USER"* ]]; then - arrIN=(${line//:/ }) - KIBANA_USER=${arrIN[1]} - fi - done < "$input" - -fi - -echo "ENTRYPOINT - Kibana credentials obtained." - -############################################################################## -# Establish the way to run the curl command, with or without authentication. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-u ${KIBANA_USER}:${KIBANA_PASS} -k" -elif [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then - auth="" -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" -fi - -echo "ENTRYPOINT - Kibana authentication established." - -############################################################################## -# Waiting for elasticsearch. -############################################################################## - -until curl -XGET $el_url ${auth}; do - >&2 echo "ENTRYPOINT - Elastic is unavailable: sleeping" - sleep 5 -done - -sleep 2 - ->&2 echo "ENTRYPOINT - Elasticsearch is up." - - -############################################################################## -# Waiting for wazuh alerts template. -############################################################################## - -strlen=0 - -while [[ $strlen -eq 0 ]] -do - template=$(curl $auth $el_url/_cat/templates/wazuh -s) - strlen=${#template} - >&2 echo "ENTRYPOINT - Wazuh alerts template not loaded - sleeping." - sleep 2 -done - -sleep 2 - ->&2 echo "ENTRYPOINT - Wazuh alerts template is loaded." - - -############################################################################## -# Create keystore if security is enabled. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - - echo "ENTRYPOINT - Create Keystore." - /usr/share/kibana/bin/kibana-keystore create - # Add keys to keystore - echo -e "$KIBANA_PASS" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.password --stdin - echo -e "$KIBANA_USER" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.username --stdin - - echo "ENTRYPOINT - Keystore created." -fi - -############################################################################## -# If security is enabled set Kibana configuration. -# Create the ssl certificate. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - - bash /usr/share/kibana/20-entrypoint_certs_management.sh - -fi - - -############################################################################## -# Run kibana_settings.sh script. -############################################################################## - -bash /usr/share/kibana/20-entrypoint_kibana_settings.sh & - -/usr/local/bin/kibana-docker diff --git a/kibana/config/20-entrypoint_certs_management.sh b/kibana/config/20-entrypoint_certs_management.sh deleted file mode 100644 index 0be8ff40..00000000 --- a/kibana/config/20-entrypoint_certs_management.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Kibana certs and keystore management -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - - - echo "CERTS_MANAGEMENT - Create certificates. TO DO." - # TO DO - -fi \ No newline at end of file diff --git a/kibana/config/20-entrypoint_kibana_settings.sh b/kibana/config/20-entrypoint_kibana_settings.sh deleted file mode 100644 index 754813e7..00000000 --- a/kibana/config/20-entrypoint_kibana_settings.sh +++ /dev/null @@ -1,183 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -WAZUH_MAJOR=3 - -############################################################################## -# Wait for the Kibana API to start. It is necessary to do it in this container -# because the others are running Elastic Stack and we can not interrupt them. -# -# The following actions are performed: -# -# Add the wazuh alerts index as default. -# Set the Discover time interval to 24 hours instead of 15 minutes. -# Do not ask user to help providing usage statistics to Elastic. -############################################################################## - -############################################################################## -# Customize elasticsearch ip -############################################################################## -if [[ "$ELASTICSEARCH_KIBANA_IP" != "" && "$CONFIGURATION_FROM_FILE" == "false" ]]; then - sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml - sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml -fi - -echo "SETTINGS - Update Elasticsearch host." - -# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate. -if [[ "$KIBANA_INDEX" != "" && "$CONFIGURATION_FROM_FILE" == "false" ]]; then - if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then - sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml - fi - echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml -fi - -# If XPACK_SECURITY_ENABLED was set, then change the xpack.security.enabled option from true (default) to false. -if [[ "$XPACK_SECURITY_ENABLED" != "" && "$CONFIGURATION_FROM_FILE" == "false" ]]; then - if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then - sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml - fi - echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml -fi - -############################################################################## -# Get Kibana credentials -############################################################################## - -if [ "$KIBANA_IP" != "" ]; then - kibana_ip="$KIBANA_IP" -else - kibana_ip="kibana" -fi - -KIBANA_USER="" -KIBANA_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - KIBANA_USER=${SECURITY_KIBANA_USER} - KIBANA_PASS=${SECURITY_KIBANA_PASS} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"KIBANA_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - KIBANA_PASS=${arrIN[1]} - elif [[ $line == *"KIBANA_USER"* ]]; then - arrIN=(${line//:/ }) - KIBANA_USER=${arrIN[1]} - fi - done < "$input" - -fi - -echo "SETTINGS - Kibana credentials obtained." - - -############################################################################## -# Set url authentication. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-k -u $KIBANA_USER:${KIBANA_PASS}" - kibana_secure_ip="https://$kibana_ip" -else - auth="" - kibana_secure_ip="http://$kibana_ip" -fi - -echo "SETTINGS - Kibana authentication established." - - -############################################################################## -# Waiting for Kibana. -############################################################################## - -while [[ "$(curl $auth -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_secure_ip:5601/status)" != "200" ]]; do - echo "SETTINGS - Waiting for Kibana API. Sleeping 5 seconds" - sleep 5 -done - -echo "SETTINGS - Kibana API is running" - - -############################################################################## -# Prepare index selection. -############################################################################## - -echo "SETTINGS - Prepare index selection." - -default_index="/tmp/default_index.json" - -if [[ $PATTERN == "" ]]; then - - cat > ${default_index} << EOF -{ - "changes": { - "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*" - } -} -EOF - -else - - cat > ${default_index} << EOF -{ - "changes": { - "defaultIndex": "$PATTERN" - } -} -EOF - -fi - - -sleep 5 - - -############################################################################## -# Add the wazuh alerts index as default. -############################################################################## - -echo "SETTINGS - Add the wazuh alerts index as default." - -curl $auth -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index} -rm -f ${default_index} - -sleep 5 - - -############################################################################## -# Configuring Kibana TimePicker. -############################################################################## - -echo "SETTINGS - Configuring Kibana TimePicker." - -curl $auth -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' - -sleep 5 - - -############################################################################## -# Do not ask user to help providing usage statistics to Elastic. -############################################################################## - -echo "SETTINGS - Do not ask user to help providing usage statistics to Elastic." - -curl $auth -POST "$kibana_secure_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}' - - -############################################################################## -# Remove credentials file. -############################################################################## - -echo "SETTINGS - Remove credentials file." - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "Security credentials file not used. Nothing to do." -else - shred -zvu ${SECURITY_CREDENTIALS_FILE} -fi - -echo "End settings" diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh deleted file mode 100644 index ca575d93..00000000 --- a/kibana/config/entrypoint.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -# It will run every .sh script located in entrypoint-scripts folder in lexicographical order -for script in `ls /entrypoint-scripts/*.sh | sort -n`; do - bash "$script" - -done diff --git a/kibana/config/wazuhapp-3.11.5_7.4.2.zip b/kibana/config/wazuhapp-3.11.5_7.4.2.zip deleted file mode 100644 index d3370881..00000000 Binary files a/kibana/config/wazuhapp-3.11.5_7.4.2.zip and /dev/null differ diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh deleted file mode 100644 index 26d13516..00000000 --- a/kibana/config/welcome_wazuh.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -if [[ $CHANGE_WELCOME == "true" ]] -then - - rm -rf ./optimize/bundles - - kibana_path="/usr/share/kibana" - # Set Wazuh app as the default landing page - echo "Set Wazuh app as the default landing page" - echo "server.defaultRoute: /app/wazuh" >> $kibana_path/config/kibana.yml - - # Redirect Kibana welcome screen to Discover - echo "Redirect Kibana welcome screen to Discover" - sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/core/public/chrome/chrome_service.js - - # Hide management undesired links - echo "Hide management undesired links" - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/rollup/public/crud_app/index.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/license_management/public/management_section.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/index_lifecycle_management/public/register_management_section.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/cross_cluster_replication/public/register_routes.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/remote_clusters/public/index.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/upgrade_assistant/public/index.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/snapshot_restore/public/plugin.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/remote_clusters/public/plugin.js - sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/index_management/public/register_management_section.js -fi - diff --git a/kibana/config/xpack_config.sh b/kibana/config/xpack_config.sh deleted file mode 100644 index 8817480a..00000000 --- a/kibana/config/xpack_config.sh +++ /dev/null @@ -1,43 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -kibana_config_file="/usr/share/kibana/config/kibana.yml" -if grep -Fq "#xpack features" "$kibana_config_file"; -then - declare -A CONFIG_MAP=( - [xpack.apm.ui.enabled]=$XPACK_APM - [xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS - [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS - [xpack.ml.enabled]=$XPACK_ML - [xpack.canvas.enabled]=$XPACK_CANVAS - [xpack.logstash.enabled]=$XPACK_LOGS - [xpack.infra.enabled]=$XPACK_INFRA - [xpack.monitoring.enabled]=$XPACK_MONITORING - [xpack.maps.enabled]=$XPACK_MAPS - [xpack.uptime.enabled]=$XPACK_UPTIME - [xpack.siem.enabled]=$XPACK_SIEM - [console.enabled]=$XPACK_DEVTOOLS - ) - for i in "${!CONFIG_MAP[@]}" - do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file - fi - done -else - echo " -#xpack features -xpack.apm.ui.enabled: $XPACK_APM -xpack.grokdebugger.enabled: $XPACK_DEVTOOLS -xpack.searchprofiler.enabled: $XPACK_DEVTOOLS -xpack.ml.enabled: $XPACK_ML -xpack.canvas.enabled: $XPACK_CANVAS -xpack.logstash.enabled: $XPACK_LOGS -xpack.infra.enabled: $XPACK_INFRA -xpack.monitoring.enabled: $XPACK_MONITORING -xpack.maps.enabled: $XPACK_MAPS -xpack.uptime.enabled: $XPACK_UPTIME -xpack.siem.enabled: $XPACK_SIEM -console.enabled: $XPACK_DEVTOOLS -" >> $kibana_config_file -fi diff --git a/logstash/Dockerfile b/logstash/Dockerfile deleted file mode 100644 index 786a2238..00000000 --- a/logstash/Dockerfile +++ /dev/null @@ -1,46 +0,0 @@ -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -ARG LOGSTASH_VERSION=7.4.2 -FROM docker.elastic.co/logstash/logstash:${LOGSTASH_VERSION} - -COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -RUN rm -f /usr/share/logstash/pipeline/logstash.conf - -ENV PIPELINE_FROM_FILE="false" -COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf - -# This CA is created for testing. Please set your own CA pem signed certificate. -# command: $ docker build --build-arg SECURITY_CA_PEM_LOCATION= --build-arg SECURITY_CA_PEM_ARG= -# ENV variables are necessary: SECURITY_CA_PEM -# Sample: -# ARG SECURITY_CA_PEM_LOCATION="config/server.TEST-CA-signed.pem" -# ARG SECURITY_CA_PEM_ARG="server.TEST-CA-signed.pem" -ARG SECURITY_CA_PEM_LOCATION="" -ARG SECURITY_CA_PEM_ARG="" - -# CA for secure communication with Elastic -ADD $SECURITY_CA_PEM_LOCATION /usr/share/logstash/config - -# Set permissions for CA -USER root -RUN if [[ "x$SECURITY_CA_PEM_LOCATION" == x ]] ; then echo Nothing to do ; else chown logstash: /usr/share/logstash/config/$SECURITY_CA_PEM_ARG ; fi -RUN if [[ "x$SECURITY_CA_PEM_LOCATION" == x ]] ; then echo Nothing to do ; else chmod 400 /usr/share/logstash/config/$SECURITY_CA_PEM_ARG ; fi - -# Add entrypoint scripts -RUN mkdir /entrypoint-scripts -RUN chmod -R 774 /entrypoint-scripts -RUN chown -R logstash:logstash /entrypoint-scripts - -COPY --chown=logstash:logstash ./config/05-decrypt_credentials.sh /entrypoint-scripts/05-decrypt_credentials.sh -COPY --chown=logstash:logstash ./config/10-entrypoint.sh /entrypoint-scripts/10-entrypoint.sh -COPY --chown=logstash:logstash ./config/10-entrypoint_configuration.sh ./config/10-entrypoint_configuration.sh -RUN chmod +x /entrypoint-scripts/05-decrypt_credentials.sh && \ - chmod +x /entrypoint-scripts/10-entrypoint.sh && \ - chmod +x ./config/10-entrypoint_configuration.sh - -USER logstash - -ENTRYPOINT /entrypoint.sh diff --git a/logstash/config/01-wazuh.conf b/logstash/config/01-wazuh.conf deleted file mode 100644 index d70d45e0..00000000 --- a/logstash/config/01-wazuh.conf +++ /dev/null @@ -1,64 +0,0 @@ -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -# Wazuh - Logstash configuration file -## Remote Wazuh Manager - Filebeat input -input { - beats { - port => 5000 -# ssl => true -# ssl_certificate => "/etc/logstash/logstash.crt" -# ssl_key => "/etc/logstash/logstash.key" - } -} -filter { - json { - source => "message" - } -} -filter { - if [data][srcip] { - mutate { - add_field => [ "@src_ip", "%{[data][srcip]}" ] - } - } - if [data][aws][sourceIPAddress] { - mutate { - add_field => [ "@src_ip", "%{[data][aws][sourceIPAddress]}" ] - } - } -} -filter { - geoip { - source => "@src_ip" - target => "GeoLocation" - fields => ["city_name", "country_name", "region_name", "location"] - } - date { - match => ["timestamp", "ISO8601"] - target => "@timestamp" - } - mutate { - remove_field => [ "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"] - } -} -filter { - # Workarounds for vulnerability-detector - if "vulnerability-detector" in [rule][groups] { - # Drop vulnerability-detector events from Manager - if [agent][id] == "000"{ - drop { } - } - - # if exists, remove data.vulnerability.published field due to conflicts - if [data][vulnerability][published] { - mutate { - remove_field => [ "[data][vulnerability][published]" ] - } - } - } -} -output { - elasticsearch { - hosts => ["elasticsearch:9200"] - index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}" - } -} diff --git a/logstash/config/05-decrypt_credentials.sh b/logstash/config/05-decrypt_credentials.sh deleted file mode 100644 index 1f348e5f..00000000 --- a/logstash/config/05-decrypt_credentials.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -############################################################################## -# Decrypt credentials. -# If the credentials of the users to be created are encrypted, -# they must be decrypted for later use. -############################################################################## - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "Security credentials file not used. Nothing to do." -else - echo "TO DO" -fi -# TO DO \ No newline at end of file diff --git a/logstash/config/10-entrypoint.sh b/logstash/config/10-entrypoint.sh deleted file mode 100644 index a1b9de88..00000000 --- a/logstash/config/10-entrypoint.sh +++ /dev/null @@ -1,163 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -# -# OSSEC container bootstrap. See the README for information of the environment -# variables expected by this script. -# - -set -e - -############################################################################## -# Set elasticsearch url. -############################################################################## - -if [ "x${ELASTICSEARCH_URL}" = "x" ]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_URL}" -fi - -echo "ENTRYPOINT - Elasticsearch url: $el_url" - -############################################################################## -# Get Logstash credentials. -############################################################################## - -LOGSTASH_USER="" -LOGSTASH_PASS="" - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - LOGSTASH_USER=${SECURITY_LOGSTASH_USER} - LOGSTASH_PASS=${SECURITY_LOGSTASH_PASS} -else - input=${SECURITY_CREDENTIALS_FILE} - while IFS= read -r line - do - if [[ $line == *"LOGSTASH_PASSWORD"* ]]; then - arrIN=(${line//:/ }) - LOGSTASH_PASS=${arrIN[1]} - elif [[ $line == *"LOGSTASH_USER"* ]]; then - arrIN=(${line//:/ }) - LOGSTASH_USER=${arrIN[1]} - fi - done < "$input" - -fi - -echo "ENTRYPOINT - Logstash credentials obtained." - -############################################################################## -# Set authentication for curl command. -############################################################################## - -if [ ${SECURITY_ENABLED} != "no" ]; then - auth="-u ${LOGSTASH_USER}:${LOGSTASH_PASS} -k" -elif [ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]; then - auth="" -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" -fi - -echo "ENTRYPOINT - curl authentication established" - - -############################################################################## -# Customize logstash output ip. -############################################################################## - -if [ "$LOGSTASH_OUTPUT" != "" ]; then - >&2 echo "ENTRYPOINT - Customize Logstash ouput ip." - sed -i 's|http://elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/config/logstash.yml - - if [[ "$PIPELINE_FROM_FILE" == "false" ]]; then - sed -i 's|elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/pipeline/01-wazuh.conf - fi -fi - - -############################################################################## -# Waiting for elasticsearch. -############################################################################## - -until curl $auth -XGET $el_url; do - >&2 echo "ENTRYPOINT - Elastic is unavailable - sleeping." - sleep 5 -done - -sleep 2 - ->&2 echo "ENTRYPOINT - Elasticsearch is up." - - -############################################################################## -# Create keystore if security is enabled. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - - echo "ENTRYPOINT - Create Keystore." - - ## Create secure keystore - SECURITY_RANDOM_PASS=`date +%s | sha256sum | base64 | head -c 32 ; echo` - export LOGSTASH_KEYSTORE_PASS=$SECURITY_RANDOM_PASS - /usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config create - - ## Settings for logstash.yml - bash /usr/share/logstash/config/10-entrypoint_configuration.sh - - ## Add keys to the keystore - echo -e "$LOGSTASH_USER" | /usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config add LOGSTASH_KS_USER - echo -e "$LOGSTASH_PASS" | /usr/share/logstash/bin/logstash-keystore --path.settings /usr/share/logstash/config add LOGSTASH_KS_PASS - -fi - - -############################################################################## -# Waiting for wazuh alerts template -############################################################################## - -strlen=0 - -while [[ $strlen -eq 0 ]] -do - template=$(curl $auth $el_url/_cat/templates/wazuh -s) - strlen=${#template} - >&2 echo "ENTRYPOINT - Wazuh alerts template not loaded - sleeping." - sleep 2 -done - -sleep 2 - ->&2 echo "ENTRYPOINT - Wazuh alerts template is loaded." - - -############################################################################## -# Remove credentials file -############################################################################## - ->&2 echo "ENTRYPOINT - Removing unnecessary files." - -if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - echo "ENTRYPOINT - Security credentials file not used. Nothing to do." -else - shred -zvu ${SECURITY_CREDENTIALS_FILE} -fi - ->&2 echo "ENTRYPOINT - Unnecessary files removed." - -############################################################################## -# Map environment variables to entries in logstash.yml. -# Note that this will mutate logstash.yml in place if any such settings are found. -# This may be undesirable, especially if logstash.yml is bind-mounted from the -# host system. -############################################################################## - -env2yaml /usr/share/logstash/config/logstash.yml - -export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS" - -if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then - exec logstash "$@" -else - exec "$@" -fi diff --git a/logstash/config/10-entrypoint_configuration.sh b/logstash/config/10-entrypoint_configuration.sh deleted file mode 100644 index 44c016af..00000000 --- a/logstash/config/10-entrypoint_configuration.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) -# -# OSSEC container bootstrap. See the README for information of the environment -# variables expected by this script. -# - -set -e - -############################################################################## -# Adapt logstash.yml configuration. -############################################################################## - -if [[ $SECURITY_ENABLED == "yes" ]]; then - - echo "CONFIGURATION - TO DO" - - # Settings for logstash.yml - # Example: - # echo " - # xpack.monitoring.enabled: true - # xpack.monitoring.elasticsearch.username: LOGSTASH_USER - # xpack.monitoring.elasticsearch.password: LOGSTASH_PASS - # xpack.monitoring.elasticsearch.ssl.certificate_authority: /usr/share/logstash/config/CA.pem - # " >> /usr/share/logstash/config/logstash.yml - -fi \ No newline at end of file diff --git a/logstash/config/entrypoint.sh b/logstash/config/entrypoint.sh deleted file mode 100644 index 333cc951..00000000 --- a/logstash/config/entrypoint.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -# It will run every .sh script located in entrypoint-scripts folder in lexicographical order -for script in `ls /entrypoint-scripts/*.sh | sort -n`; do - bash "$script" - -done \ No newline at end of file diff --git a/nginx/Dockerfile b/nginx/Dockerfile deleted file mode 100644 index 2ca20d6f..00000000 --- a/nginx/Dockerfile +++ /dev/null @@ -1,19 +0,0 @@ -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -FROM nginx:latest - -ENV DEBIAN_FRONTEND noninteractive - -RUN apt-get update && apt-get install -y openssl apache2-utils - -COPY config/entrypoint.sh /entrypoint.sh - -RUN chmod 755 /entrypoint.sh - -RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* - -VOLUME ["/etc/nginx/conf.d"] - -ENV NGINX_NAME="foo" \ - NGINX_PWD="bar" - -ENTRYPOINT /entrypoint.sh diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh deleted file mode 100644 index 468c8a92..00000000 --- a/nginx/config/entrypoint.sh +++ /dev/null @@ -1,79 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) - -set -e - -# Generating certificates. -if [ ! -d /etc/nginx/conf.d/ssl ]; then - echo "Generating SSL certificates" - mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private - openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null -else - echo "SSL certificates already present" -fi - -# Setting users credentials. -# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b): -# -# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or -# export NGINX_CREDENTIALS="user1:pass1;user2:pass2" -# -# b) Set NGINX_CREDENTIALS in docker-compose.yml: -# NGINX_CREDENTIALS=user1:pass1;user2:pass2; or -# NGINX_CREDENTIALS=user1:pass1;user2:pass2 -# -if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then - echo "Setting users credentials" - if [ ! -z "$NGINX_CREDENTIALS" ]; then - IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS" - for index in "${!users[@]}" - do - IFS=':' read -r -a credentials <<< "${users[index]}" - if [ $index -eq 0 ]; then - echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null - else - echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null - fi - done - else - # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile - echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null - fi -else - echo "Kibana credentials already configured" -fi - -if [ "x${NGINX_PORT}" = "x" ]; then - NGINX_PORT=443 -fi - -if [ "x${KIBANA_HOST}" = "x" ]; then - KIBANA_HOST="kibana:5601" -fi - -echo "Configuring NGINX" -cat > /etc/nginx/conf.d/default.conf <> /etc/yum.repos.d/wazuh.repo @@ -34,7 +34,6 @@ RUN set -x && \ yum install -y openssl vim expect python-boto python-pip python-cryptography && \ yum install -y postfix bsd-mailx mailx ca-certificates && \ yum install -y wazuh-manager-${WAZUH_VERSION} && \ - yum install -y nodejs wazuh-api-${WAZUH_VERSION} && \ yum clean all && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \ rm -f /var/ossec/logs/alerts/*/*/* && \ @@ -43,24 +42,20 @@ RUN set -x && \ rm -f /var/ossec/logs/api/*/*/* && \ rm -f /var/ossec/logs/cluster/*/*/* && \ rm -f /var/ossec/logs/ossec/*/*/* && \ - rm /var/ossec/var/run/* && \ curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \ rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \ sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo # Services RUN mkdir /etc/service/wazuh && \ - mkdir /etc/service/wazuh-api && \ mkdir /etc/service/postfix && \ mkdir /etc/service/filebeat COPY config/wazuh.runit.service /etc/service/wazuh/run -COPY config/wazuh-api.runit.service /etc/service/wazuh-api/run COPY config/postfix.runit.service /etc/service/postfix/run COPY config/filebeat.runit.service /etc/service/filebeat/run -RUN chmod +x /etc/service/wazuh-api/run && \ - chmod +x /etc/service/wazuh/run && \ +RUN chmod +x /etc/service/wazuh/run && \ chmod +x /etc/service/postfix/run && \ chmod +x /etc/service/filebeat/run @@ -88,6 +83,7 @@ VOLUME ["/var/ossec/api/configuration"] VOLUME ["/var/ossec/etc"] VOLUME ["/var/ossec/logs"] VOLUME ["/var/ossec/queue"] +VOLUME ["/var/ossec/agentless"] VOLUME ["/var/ossec/var/multigroups"] VOLUME ["/var/ossec/integrations"] VOLUME ["/var/ossec/active-response/bin"] @@ -101,6 +97,7 @@ VOLUME ["/var/lib/filebeat"] RUN mkdir /entrypoint-scripts COPY config/entrypoint.sh /entrypoint.sh +COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py COPY config/00-decrypt_credentials.sh /entrypoint-scripts/00-decrypt_credentials.sh COPY config/01-wazuh.sh /entrypoint-scripts/01-wazuh.sh COPY config/02-set_filebeat_destination.sh /entrypoint-scripts/02-set_filebeat_destination.sh diff --git a/wazuh/config/01-wazuh.sh b/wazuh/config/01-wazuh.sh index 74edb42c..c4c6c615 100644 --- a/wazuh/config/01-wazuh.sh +++ b/wazuh/config/01-wazuh.sh @@ -56,6 +56,17 @@ check_update() { return 0 else echo "Different Wazuh version: Update" + mayor_previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2 | cut -d'.' -f1) + if [[ ${mayor_previous_version} == "v3" ]]; then + echo "Remove Wazuh API deprecated files" + rm -rf "${WAZUH_INSTALL_PATH}/api/configuration/auth" + rm "${WAZUH_INSTALL_PATH}/api/configuration/config.js" + rm "${WAZUH_INSTALL_PATH}/api/configuration/preloaded_vars.conf" + echo "Load new API configuration" + exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/api/configuration/. /var/ossec/api/configuration" + echo "Remove Wazuh agent-info queue" + rm -rf "${WAZUH_INSTALL_PATH}/queue/agent-info" + fi return 1 fi else @@ -144,21 +155,6 @@ create_ossec_key_cert() { exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/" } -############################################################################## -# Create certificates: API -############################################################################## - -create_api_key_cert() { - print "Enabling Wazuh API HTTPS" - edit_configuration "https" "yes" - print "Create Wazuh API key and cert" - exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key 4096" - exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/" - - # Granting proper permissions - chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key - chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -} ############################################################################## # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect @@ -207,18 +203,19 @@ docker_custom_args() { # Change Wazuh API user credentials. ############################################################################## -change_api_user_credentials() { - pushd /var/ossec/api/configuration/auth/ + +function_create_custom_user() { + + # get custom credentials if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then - WAZUH_API_USER=${API_USER} - WAZUH_API_PASS=${API_PASS} + echo "No security credentials file used" else input=${SECURITY_CREDENTIALS_FILE} while IFS= read -r line do - if [[ $line == *"WAZUH_API_USER"* ]]; then + if [[ $line == *"WUI_API_PASS"* ]]; then arrIN=(${line//:/ }) - WAZUH_API_USER=${arrIN[1]} + WUI_API_PASS=${arrIN[1]} elif [[ $line == *"WAZUH_API_PASS"* ]]; then arrIN=(${line//:/ }) WAZUH_API_PASS=${arrIN[1]} @@ -226,10 +223,35 @@ change_api_user_credentials() { done < "$input" fi - echo "Change Wazuh API user credentials" - change_user="node htpasswd -b -c user $WAZUH_API_USER $WAZUH_API_PASS" - eval $change_user - popd + + if [[ ! -z $WAZUH_API_PASS ]]; then + cat << EOF > "/var/ossec/api/configuration/wazuh-user.json" +{ + "password": "$WAZUH_API_PASS" +} +EOF + fi + + if [[ ! -z $WUI_API_PASS ]]; then + cat << EOF > "/var/ossec/api/configuration/wui-user.json" +{ + "password": "$WUI_API_PASS" +} +EOF + + # create or customize API user + if /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/create_user.py; then + # remove json if exit code is 0 + echo "Wazuh API credentials changed" + rm /var/ossec/api/configuration/wui-user.json + rm /var/ossec/api/configuration/wazuh-user.json + else + echo "There was an error configuring the API users" + sleep 10 + # terminate container to avoid unpredictable behavior + kill -s SIGINT 1 + fi + fi } @@ -267,15 +289,6 @@ main() { fi fi - # Generate API certs if API_GENERATE_CERTS is true and does not exist - if [ $API_GENERATE_CERTS == true ] - then - if [ ! -e ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt ] - then - create_api_key_cert - fi - fi - # Mount selected files (WAZUH_CONFIG_MOUNT) to container mount_files @@ -286,7 +299,9 @@ main() { docker_custom_args # Change API user credentials - change_api_user_credentials + if [[ ${CLUSTER_NODE_TYPE} == "master" ]]; then + function_create_custom_user + fi # Delete temporary data folder rm -rf ${WAZUH_INSTALL_PATH}/data_tmp diff --git a/wazuh/config/create_user.py b/wazuh/config/create_user.py new file mode 100644 index 00000000..0238d4b8 --- /dev/null +++ b/wazuh/config/create_user.py @@ -0,0 +1,60 @@ +import logging +import sys +import json +import random +import string +import os +import re +# Set framework path +sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") +WUI_USER_FILE_PATH = "/var/ossec/api/configuration/wui-user.json" +WAZUH_USER_FILE_PATH = "/var/ossec/api/configuration/wazuh-user.json" +try: + from wazuh.security import ( + create_user, + get_users, + get_roles, + set_user_role, + update_user, + ) +except Exception as e: + logging.error("No module 'wazuh' found.") + sys.exit(1) + +def read_wui_user_file(path=WUI_USER_FILE_PATH): + with open(path) as wui_user_file: + data = json.load(wui_user_file) + return data["password"] + +def read_wazuh_user_file(path=WAZUH_USER_FILE_PATH): + with open(path) as wazuh_user_file: + data = json.load(wazuh_user_file) + return data["password"] + +def db_users(): + users_result = get_users() + return {user["username"]: user["id"] for user in users_result.affected_items} + +if __name__ == "__main__": + if not os.path.exists(WUI_USER_FILE_PATH): + # abort if no user file detected + sys.exit(0) + + wui_password = read_wui_user_file() + wazuh_password = read_wazuh_user_file() + initial_users = db_users() + + # set a random password for all other users (not wazuh-wui) + for name, id in initial_users.items(): + custom_pass = None + if name == "wazuh-wui": + custom_pass = wui_password + elif name == "wazuh": + custom_pass = wazuh_password + if custom_pass: + update_user( + user_id=[ + str(id), + ], + password=custom_pass, + ) \ No newline at end of file diff --git a/wazuh/config/filebeat_to_elasticsearch.yml b/wazuh/config/filebeat_to_elasticsearch.yml index 3d1b145d..3b7819b7 100644 --- a/wazuh/config/filebeat_to_elasticsearch.yml +++ b/wazuh/config/filebeat_to_elasticsearch.yml @@ -52,4 +52,4 @@ output.elasticsearch: hosts: ['http://elasticsearch:9200'] #pipeline: geoip indices: - - index: 'wazuh-alerts-3.x-%{+yyyy.MM.dd}' \ No newline at end of file + - index: 'wazuh-alerts-4.x-%{+yyyy.MM.dd}' \ No newline at end of file diff --git a/wazuh/config/permanent_data.env b/wazuh/config/permanent_data.env index ab622ef4..0ef61cf1 100644 --- a/wazuh/config/permanent_data.env +++ b/wazuh/config/permanent_data.env @@ -4,6 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" +PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/ossec/integrations" PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" @@ -15,6 +16,8 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.crt" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.key" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" @@ -38,22 +41,28 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-8-oval.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-9-oval.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-ubuntu-xenial-oval.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-debian-8-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1404-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1604-ds.xml" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/msu.json.gz" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db" @@ -62,7 +71,6 @@ export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted when updating i=0 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" -PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/global.db*" PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/.profile.db*" PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/.template.db*" PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/agents/*" diff --git a/wazuh/config/wazuh-api.runit.service b/wazuh/config/wazuh-api.runit.service deleted file mode 100644 index 09ea1fb2..00000000 --- a/wazuh/config/wazuh-api.runit.service +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/sh -# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) -/etc/init.d/wazuh-api start -tail -f /var/ossec/logs/api.log - diff --git a/wazuh/config/wazuh-api_3.11.5-1_amd64.deb b/wazuh/config/wazuh-api_3.11.5-1_amd64.deb deleted file mode 100644 index 6d7027de..00000000 Binary files a/wazuh/config/wazuh-api_3.11.5-1_amd64.deb and /dev/null differ diff --git a/wazuh/config/wazuh-manager_3.11.5-1_amd64.deb b/wazuh/config/wazuh-manager_3.11.5-1_amd64.deb deleted file mode 100644 index b4bbb79a..00000000 Binary files a/wazuh/config/wazuh-manager_3.11.5-1_amd64.deb and /dev/null differ diff --git a/wazuh/config/wazuh.runit.service b/wazuh/config/wazuh.runit.service index 25534237..19771d34 100644 --- a/wazuh/config/wazuh.runit.service +++ b/wazuh/config/wazuh.runit.service @@ -1,5 +1,4 @@ #!/bin/sh # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2) /etc/init.d/wazuh-manager start -tail -f /var/ossec/logs/ossec.log - +tail -f /var/ossec/logs/ossec.log \ No newline at end of file