Adapt wazuh 4.0 (#408)

2020-11-23 14:17:35 +01:00
parent e2911e1f70
commit f4d2eb96c7
46 changed files with 157 additions and 2301 deletions
@@ -2,25 +2,25 @@
 FROM waystonesystems/baseimage-centos:0.2.0

 # Arguments
-ARG FILEBEAT_VERSION=7.7.0
-ARG WAZUH_VERSION=3.13.2-1
+ARG FILEBEAT_VERSION=7.9.1
+ARG WAZUH_VERSION=4.0.1-1

 # Environment variables
 ENV API_USER="foo" \
   API_PASS="bar"

-ARG TEMPLATE_VERSION="v3.13.2"
+ARG TEMPLATE_VERSION="4.0"
 ENV FILEBEAT_DESTINATION="elasticsearch"

 RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH

-RUN echo $'[wazuh_repo] \n\
+RUN echo $'[wazuh] \n\
 gpgcheck=1\n\
 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\n\
 gpgcheck=0\n\
 enabled=1\n\
 name=Wazuh repository\n\
-baseurl=https://packages.wazuh.com/3.x/yum/\n\
+baseurl=https://packages.wazuh.com/4.x/yum/\n\
 protect=1\n'\
 >> /etc/yum.repos.d/wazuh.repo

@@ -34,7 +34,6 @@ RUN set -x && \
    yum install -y openssl vim expect python-boto python-pip python-cryptography && \
    yum install -y postfix bsd-mailx mailx ca-certificates && \
    yum install -y wazuh-manager-${WAZUH_VERSION} && \
-    yum install -y nodejs wazuh-api-${WAZUH_VERSION} && \
    yum clean all && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
    rm -f /var/ossec/logs/alerts/*/*/* && \
@@ -43,24 +42,20 @@ RUN set -x && \
    rm -f /var/ossec/logs/api/*/*/* && \
    rm -f /var/ossec/logs/cluster/*/*/* && \
    rm -f /var/ossec/logs/ossec/*/*/* && \
-    rm /var/ossec/var/run/* && \
    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
    rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

 # Services
 RUN mkdir /etc/service/wazuh && \
-   mkdir /etc/service/wazuh-api && \
   mkdir /etc/service/postfix && \
   mkdir /etc/service/filebeat

 COPY config/wazuh.runit.service /etc/service/wazuh/run
-COPY config/wazuh-api.runit.service /etc/service/wazuh-api/run
 COPY config/postfix.runit.service /etc/service/postfix/run
 COPY config/filebeat.runit.service /etc/service/filebeat/run

-RUN chmod +x /etc/service/wazuh-api/run && \
-   chmod +x /etc/service/wazuh/run && \
+RUN chmod +x /etc/service/wazuh/run && \
   chmod +x /etc/service/postfix/run && \
   chmod +x /etc/service/filebeat/run 

@@ -88,6 +83,7 @@ VOLUME ["/var/ossec/api/configuration"]
 VOLUME ["/var/ossec/etc"]
 VOLUME ["/var/ossec/logs"]
 VOLUME ["/var/ossec/queue"]
+VOLUME ["/var/ossec/agentless"]
 VOLUME ["/var/ossec/var/multigroups"]
 VOLUME ["/var/ossec/integrations"]
 VOLUME ["/var/ossec/active-response/bin"]
@@ -101,6 +97,7 @@ VOLUME ["/var/lib/filebeat"]
 RUN mkdir /entrypoint-scripts

 COPY config/entrypoint.sh /entrypoint.sh
+COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py
 COPY config/00-decrypt_credentials.sh /entrypoint-scripts/00-decrypt_credentials.sh
 COPY config/01-wazuh.sh /entrypoint-scripts/01-wazuh.sh
 COPY config/02-set_filebeat_destination.sh /entrypoint-scripts/02-set_filebeat_destination.sh
@@ -56,6 +56,17 @@ check_update() {
        return 0
      else
        echo "Different Wazuh version: Update"
+        mayor_previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2 | cut -d'.' -f1)
+        if [[ ${mayor_previous_version} == "v3" ]]; then
+          echo "Remove Wazuh API deprecated files"
+          rm -rf "${WAZUH_INSTALL_PATH}/api/configuration/auth"
+          rm "${WAZUH_INSTALL_PATH}/api/configuration/config.js"
+          rm "${WAZUH_INSTALL_PATH}/api/configuration/preloaded_vars.conf"
+          echo "Load new API configuration"
+          exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/api/configuration/. /var/ossec/api/configuration"
+          echo "Remove Wazuh agent-info queue"
+          rm -rf "${WAZUH_INSTALL_PATH}/queue/agent-info"
+        fi
        return 1
      fi
    else
@@ -144,21 +155,6 @@ create_ossec_key_cert() {
  exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
 }

-##############################################################################
-# Create certificates: API
-##############################################################################
-
-create_api_key_cert() {
-  print "Enabling Wazuh API HTTPS"
-  edit_configuration "https" "yes"
-  print "Create Wazuh API key and cert"
-  exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key 4096"
-  exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
-
-  # Granting proper permissions 
-  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key
-  chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt
-}

 ##############################################################################
 # Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect
@@ -207,18 +203,19 @@ docker_custom_args() {
 # Change Wazuh API user credentials.
 ##############################################################################

-change_api_user_credentials() {
-  pushd /var/ossec/api/configuration/auth/
+
+function_create_custom_user() {
+
+  # get custom credentials
  if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
-    WAZUH_API_USER=${API_USER}
-    WAZUH_API_PASS=${API_PASS}
+    echo "No security credentials file used"
  else
    input=${SECURITY_CREDENTIALS_FILE}
    while IFS= read -r line
    do
-      if [[ $line == *"WAZUH_API_USER"* ]]; then
+      if [[ $line == *"WUI_API_PASS"* ]]; then
        arrIN=(${line//:/ })
-        WAZUH_API_USER=${arrIN[1]}
+        WUI_API_PASS=${arrIN[1]}
      elif [[ $line == *"WAZUH_API_PASS"* ]]; then
        arrIN=(${line//:/ })
        WAZUH_API_PASS=${arrIN[1]}
@@ -226,10 +223,35 @@ change_api_user_credentials() {
    done < "$input"
  fi

-  echo "Change Wazuh API user credentials"
-  change_user="node htpasswd -b -c user $WAZUH_API_USER $WAZUH_API_PASS"
-  eval $change_user
-  popd
+
+    if [[ ! -z $WAZUH_API_PASS ]]; then
+  cat << EOF > "/var/ossec/api/configuration/wazuh-user.json"
+{
+  "password": "$WAZUH_API_PASS"
+}
+EOF
+  fi
+
+  if [[ ! -z $WUI_API_PASS ]]; then
+  cat << EOF > "/var/ossec/api/configuration/wui-user.json"
+{
+  "password": "$WUI_API_PASS"
+}
+EOF
+
+    # create or customize API user
+    if /var/ossec/framework/python/bin/python3  /var/ossec/framework/scripts/create_user.py; then
+      # remove json if exit code is 0
+      echo "Wazuh API credentials changed"
+      rm /var/ossec/api/configuration/wui-user.json
+      rm /var/ossec/api/configuration/wazuh-user.json
+    else
+      echo "There was an error configuring the API users"
+      sleep 10
+      # terminate container to avoid unpredictable behavior
+      kill -s SIGINT 1
+    fi
+  fi
 }


@@ -267,15 +289,6 @@ main() {
    fi
  fi

-  # Generate API certs if API_GENERATE_CERTS is true and does not exist
-  if [ $API_GENERATE_CERTS == true ]
-  then
-    if [ ! -e ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt ]
-    then
-      create_api_key_cert
-    fi
-  fi
-
  # Mount selected files (WAZUH_CONFIG_MOUNT) to container
  mount_files

@@ -286,7 +299,9 @@ main() {
  docker_custom_args

  # Change API user credentials
-  change_api_user_credentials
+  if [[ ${CLUSTER_NODE_TYPE} == "master" ]]; then
+    function_create_custom_user
+  fi

  # Delete temporary data folder
  rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
@@ -0,0 +1,60 @@
+import logging
+import sys
+import json
+import random
+import string
+import os
+import re
+# Set framework path
+sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
+WUI_USER_FILE_PATH = "/var/ossec/api/configuration/wui-user.json"
+WAZUH_USER_FILE_PATH = "/var/ossec/api/configuration/wazuh-user.json"
+try:
+    from wazuh.security import (
+        create_user,
+        get_users,
+        get_roles,
+        set_user_role,
+        update_user,
+    )
+except Exception as e:
+    logging.error("No module 'wazuh' found.")
+    sys.exit(1)
+
+def read_wui_user_file(path=WUI_USER_FILE_PATH):
+    with open(path) as wui_user_file:
+        data = json.load(wui_user_file)
+        return data["password"]
+
+def read_wazuh_user_file(path=WAZUH_USER_FILE_PATH):
+    with open(path) as wazuh_user_file:
+        data = json.load(wazuh_user_file)
+        return data["password"]
+
+def db_users():
+    users_result = get_users()
+    return {user["username"]: user["id"] for user in users_result.affected_items}
+
+if __name__ == "__main__":
+    if not os.path.exists(WUI_USER_FILE_PATH):
+        # abort if no user file detected
+        sys.exit(0)
+
+    wui_password = read_wui_user_file()
+    wazuh_password = read_wazuh_user_file()
+    initial_users = db_users()
+
+    # set a random password for all other users (not wazuh-wui)
+    for name, id in initial_users.items():
+        custom_pass = None
+        if name == "wazuh-wui":
+            custom_pass = wui_password
+        elif name == "wazuh":
+            custom_pass = wazuh_password
+        if custom_pass:
+            update_user(
+                user_id=[
+                    str(id),
+                ],
+                password=custom_pass,
+            )
@@ -52,4 +52,4 @@ output.elasticsearch:
  hosts: ['http://elasticsearch:9200']
  #pipeline: geoip
  indices:
-    - index: 'wazuh-alerts-3.x-%{+yyyy.MM.dd}'
+    - index: 'wazuh-alerts-4.x-%{+yyyy.MM.dd}'
@@ -4,6 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
 PERMANENT_DATA[((i++))]="/var/ossec/etc"
 PERMANENT_DATA[((i++))]="/var/ossec/logs"
 PERMANENT_DATA[((i++))]="/var/ossec/queue"
+PERMANENT_DATA[((i++))]="/var/ossec/agentless"
 PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
 PERMANENT_DATA[((i++))]="/var/ossec/integrations"
 PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
@@ -15,6 +16,8 @@ export PERMANENT_DATA

 # Files mounted in a volume that should not be permanent
 i=0
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.crt"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.key"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
@@ -38,22 +41,28 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-8-oval.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-9-oval.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-ubuntu-xenial-oval.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-debian-8-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1404-ds.xml"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1604-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/msu.json.gz"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db"
@@ -62,7 +71,6 @@ export PERMANENT_DATA_EXCP
 # Files mounted in a volume that should be deleted when updating
 i=0
 PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db"
-PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/global.db*"
 PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/.profile.db*"
 PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/.template.db*"
 PERMANENT_DATA_DEL[((i++))]="/var/ossec/var/db/agents/*"
@@ -1,5 +0,0 @@
-#!/bin/sh
-# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-/etc/init.d/wazuh-api start
-tail -f /var/ossec/logs/api.log
-
@@ -1,5 +1,4 @@
 #!/bin/sh
 # Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 /etc/init.d/wazuh-manager start
-tail -f /var/ossec/logs/ossec.log
-
+tail -f /var/ossec/logs/ossec.log