Elastic 7-x Docker refactor (#257)

Former-commit-id: d3220826fc

kibana/Dockerfile

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana:7.2.1
-ARG ELASTIC_VERSION=7.2.1
-ARG WAZUH_VERSION=3.9.5
+FROM docker.elastic.co/kibana/kibana:7.3.2
+ARG ELASTIC_VERSION=7.3.2
+ARG WAZUH_VERSION=3.10.2
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 USER root
@@ -21,8 +21,6 @@ ADD $SECURITY_CA_PEM_LOCATION /usr/share/kibana/config
 RUN /usr/share/kibana/bin/kibana-plugin install --allow-root file:///tmp/wazuhapp-${WAZUH_APP_VERSION}.zip 
 RUN rm -rf /tmp/wazuhapp-${WAZUH_APP_VERSION}.zip
 
-RUN yum install openssl -y
-
 COPY config/entrypoint.sh ./entrypoint.sh
 RUN chmod 755 ./entrypoint.sh
 RUN mkdir /entrypoint-scripts
@@ -65,18 +63,22 @@ ARG XPACK_MONITORING="false"
 ARG XPACK_APM="false"
 ARG XPACK_MAPS="false"
 ARG XPACK_UPTIME="false"
+ARG XPACK_SIEM="false"
 
 ARG CHANGE_WELCOME="true"
 
 COPY --chown=kibana:kibana ./config/10-wazuh_app_config.sh /entrypoint-scripts/10-wazuh_app_config.sh
-RUN chmod +x /entrypoint-scripts/10-wazuh_app_config.sh
-
+COPY --chown=kibana:kibana ./config/15-decrypt_credentials.sh /entrypoint-scripts/15-decrypt_credentials.sh
 COPY --chown=kibana:kibana ./config/20-entrypoint.sh /entrypoint-scripts/20-entrypoint.sh
-RUN chmod +x /entrypoint-scripts/20-entrypoint.sh
-
-COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
-
-RUN chmod +x ./kibana_settings.sh
+COPY --chown=kibana:kibana ./config/20-entrypoint_kibana_settings.sh ./
+COPY --chown=kibana:kibana ./config/20-entrypoint_certs_management.sh ./
+COPY --chown=kibana:kibana ./config/20-entrypoint_security_configuration.sh ./
+RUN chmod +x /entrypoint-scripts/10-wazuh_app_config.sh && \
+    chmod +x /entrypoint-scripts/15-decrypt_credentials.sh && \
+    chmod +x /entrypoint-scripts/20-entrypoint.sh && \
+    chmod +x ./20-entrypoint_kibana_settings.sh && \
+    chmod +x ./20-entrypoint_certs_management.sh && \
+    chmod +x ./20-entrypoint_security_configuration.sh
 
 COPY --chown=kibana:kibana ./config/xpack_config.sh ./
 

kibana/config/15-decrypt_credentials.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+##############################################################################
+# Decrypt credentials.
+# If the credentials of the users to be created are encrypted,
+# they must be decrypted for later use. 
+##############################################################################
+
+if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
+    echo "Security credentials file not used. Nothing to do."
+else
+    echo "TO DO"
+fi
+# TO DO

kibana/config/20-entrypoint.sh

@@ -4,7 +4,7 @@
 set -e
 
 ##############################################################################
-# Waiting for elasticsearch
+# Set Elasticsearch API url.
 ##############################################################################
 
 if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
@@ -13,6 +13,13 @@ else
   el_url="${ELASTICSEARCH_URL}"
 fi
 
+echo "ENTRYPOINT - Set Elasticsearc url:${ELASTICSEARCH_URL}"
+
+
+##############################################################################
+# If there are credentials for Kibana they are obtained. 
+##############################################################################
+
 KIBANA_USER=""
 KIBANA_PASS=""
 
@@ -34,6 +41,11 @@ else
  
 fi
 
+echo "ENTRYPOINT - Kibana credentials obtained."
+
+##############################################################################
+# Establish the way to run the curl command, with or without authentication. 
+##############################################################################
 
 if [ ${SECURITY_ENABLED} != "no" ]; then
   auth="-u ${KIBANA_USER}:${KIBANA_PASS} -k"
@@ -43,18 +55,24 @@ else
   auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
 fi
 
+echo "ENTRYPOINT - Kibana authentication established."
+
+##############################################################################
+# Waiting for elasticsearch.
+##############################################################################
+
 until curl -XGET $el_url ${auth}; do
-  >&2 echo "Elastic is unavailable - sleeping"
+  >&2 echo "ENTRYPOINT - Elastic is unavailable: sleeping"
   sleep 5
 done
 
 sleep 2
 
->&2 echo "Elasticsearch is up."
+>&2 echo "ENTRYPOINT - Elasticsearch is up."
 
 
 ##############################################################################
-# Waiting for wazuh alerts template
+# Waiting for wazuh alerts template.
 ##############################################################################
 
 strlen=0
@@ -63,71 +81,47 @@ while [[ $strlen -eq 0 ]]
 do
   template=$(curl $auth $el_url/_cat/templates/wazuh -s)
   strlen=${#template}
-  >&2 echo "Wazuh alerts template not loaded - sleeping."
+  >&2 echo "ENTRYPOINT - Wazuh alerts template not loaded - sleeping."
   sleep 2
 done
 
 sleep 2
 
->&2 echo "Wazuh alerts template is loaded."
+>&2 echo "ENTRYPOINT - Wazuh alerts template is loaded."
 
 
 ##############################################################################
-# If Secure access to Kibana is enabled, we must set the credentials.
-# We must create the ssl certificate.
+# Create keystore if security is enabled.
 ##############################################################################
 
 if [[ $SECURITY_ENABLED == "yes" ]]; then
 
-
-  # Create keystore
+  echo "ENTRYPOINT - Create Keystore."
   /usr/share/kibana/bin/kibana-keystore create
-  
-  echo "Setting security Kibana configuiration options."
-
-  echo "
-# Elasticsearch from/to Kibana
-elasticsearch.ssl.certificateAuthorities: [\"/usr/share/kibana/config/$SECURITY_CA_PEM\"]
-
-server.ssl.enabled: true
-server.ssl.certificate: $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
-server.ssl.key: $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key
-server.ssl.supportedProtocols: 
-  - TLSv1.1
-  - TLSv1.2
-" >> /usr/share/kibana/config/kibana.yml
-
-  echo "Create SSL directories."
-
-  mkdir -p $SECURITY_KIBANA_SSL_KEY_PATH $SECURITY_KIBANA_SSL_CERT_PATH
-  CA_PATH="/usr/share/kibana/config"
-
-  echo "Creating SSL certificates."
-  
-  pushd $CA_PATH
-
-  # chown kibana: $CA_PATH/$SECURITY_CA_PEM
-  # chmod 400 $CA_PATH/$SECURITY_CA_PEM
-  SECURITY_KEY_PASS=`openssl rand -base64 32`
-  openssl req -batch -x509 -days 18250 -newkey rsa:2048 -keyout $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key -out $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem -passout pass:"$SECURITY_KEY_PASS" >/dev/null
-  # chown -R kibana: $CA_PATH/ssl
-  chmod -R 770 $CA_PATH/ssl
-  chmod 440 $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
-
-  popd
-  echo "SSL certificates created."
-
   # Add keys to keystore
   echo -e "$KIBANA_PASS" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.password --stdin
-  echo -e "$SECURITY_KEY_PASS" | /usr/share/kibana/bin/kibana-keystore add server.ssl.keyPassphrase --stdin
   echo -e "$KIBANA_USER" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.username --stdin
 
+  echo "ENTRYPOINT - Keystore created."
 fi
 
 ##############################################################################
-# Run more configuration scripts.
+# If security is enabled set Kibana configuration.
+# Create the ssl certificate.
 ##############################################################################
 
-bash /usr/share/kibana/kibana_settings.sh &
+if [[ $SECURITY_ENABLED == "yes" ]]; then
+
+  bash /usr/share/kibana/20-entrypoint_certs_management.sh
+  bash /usr/share/kibana/20-entrypoint_security_configuration.sh
+
+fi
+
+
+##############################################################################
+# Run kibana_settings.sh script.
+##############################################################################
+
+bash /usr/share/kibana/20-entrypoint_kibana_settings.sh &
 
 /usr/local/bin/kibana-docker

kibana/config/20-entrypoint_certs_management.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+##############################################################################
+# Kibana certs and keystore management 
+##############################################################################
+
+if [[ $SECURITY_ENABLED == "yes" ]]; then
+
+
+    echo "CERTS_MANAGEMENT - Create certificates. TO DO."
+    # TO DO
+
+fi

kibana/config/20-entrypoint_kibana_settings.sh

@@ -22,6 +22,8 @@ if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
   sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
 fi
 
+echo "SETTINGS - Update Elasticsearch host."
+
 # If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate.
 if [ "$KIBANA_INDEX" != "" ]; then
   if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then
@@ -39,7 +41,7 @@ if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
 fi
 
 ##############################################################################
-# Set url and credentials
+# Get Kibana credentials
 ##############################################################################
 
 if [ "$KIBANA_IP" != "" ]; then
@@ -69,6 +71,12 @@ else
  
 fi
 
+echo "SETTINGS - Kibana credentials obtained."
+
+
+##############################################################################
+# Set url authentication.
+##############################################################################
 
 if [ ${SECURITY_ENABLED} != "no" ]; then
   auth="-k -u $KIBANA_USER:${KIBANA_PASS}"
@@ -78,14 +86,26 @@ else
   kibana_secure_ip="http://$kibana_ip"
 fi
 
+echo "SETTINGS - Kibana authentication established."
+
+
+##############################################################################
+# Waiting for Kibana.
+##############################################################################
 
 while [[ "$(curl $auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_secure_ip:5601/status)" != "200" ]]; do
-  echo "Waiting for Kibana API. Sleeping 5 seconds"
+  echo "SETTINGS - Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
 
+echo "SETTINGS - Kibana API is running"
+
+
+##############################################################################
 # Prepare index selection.
-echo "Kibana API is running"
+##############################################################################
+
+echo "SETTINGS - Prepare index selection."
 
 default_index="/tmp/default_index.json"
 
@@ -98,20 +118,47 @@ cat > ${default_index} << EOF
 EOF
 
 sleep 5
+
+
+##############################################################################
 # Add the wazuh alerts index as default.
+##############################################################################
+
+echo "SETTINGS - Add the wazuh alerts index as default."
+
 curl $auth -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index}
 rm -f ${default_index}
 
 sleep 5
+
+
+##############################################################################
 # Configuring Kibana TimePicker.
+##############################################################################
+
+echo "SETTINGS - Configuring Kibana TimePicker."
+
 curl $auth -POST "$kibana_secure_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \
 '{"changes":{"timepicker:timeDefaults":"{\n  \"from\": \"now-24h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"}"}}'
 
 sleep 5
-# Do not ask user to help providing usage statistics to Elastic
+
+
+##############################################################################
+# Do not ask user to help providing usage statistics to Elastic.
+##############################################################################
+
+echo "SETTINGS - Do not ask user to help providing usage statistics to Elastic."
+
 curl $auth -POST "$kibana_secure_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
 
-# Remove credentials file
+
+##############################################################################
+# Remove credentials file.
+##############################################################################
+
+echo "SETTINGS - Remove credentials file."
+
 if [[ "x${SECURITY_CREDENTIALS_FILE}" == "x" ]]; then
   echo "Security credentials file not used. Nothing to do."
 else

kibana/config/20-entrypoint_security_configuration.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
+
+set -e
+
+##############################################################################
+# Adapt kibana.yml configuration file 
+##############################################################################
+
+if [[ $SECURITY_ENABLED == "yes" ]]; then
+
+    echo "CONFIGURATION - Setting security Kibana configuiration options."
+
+    # Example:
+
+    #     echo "
+    # # Elasticsearch from/to Kibana
+    # elasticsearch.ssl.certificateAuthorities: [\"/usr/share/kibana/config/CA.pem\"]
+
+    # server.ssl.enabled: true
+    # server.ssl.certificate: /usr/share/kibana/config/ssl/certs/cert.pem
+    # server.ssl.key: /usr/share/kibana/config/ssl/private/cert.key
+    # server.ssl.supportedProtocols: 
+    #     - TLSv1.1
+    #     - TLSv1.2
+    # " >> /usr/share/kibana/config/kibana.yml
+
+fi

kibana/config/welcome_wazuh.sh

@@ -13,15 +13,17 @@ then
 
     # Redirect Kibana welcome screen to Discover
     echo "Redirect Kibana welcome screen to Discover"
-    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/legacy/ui/public/chrome/directives/header_global_nav/header_global_nav.js
+    sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/core/public/chrome/chrome_service.js
 
     # Hide management undesired links
     echo "Hide management undesired links"
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/rollup/public/crud_app/index.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/license_management/public/management_section.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/index_lifecycle_management/public/register_management_section.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/cross_cluster_replication/public/register_routes.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/remote_clusters/public/index.js
-    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/plugins/upgrade_assistant/public/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/rollup/public/crud_app/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/license_management/public/management_section.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/index_lifecycle_management/public/register_management_section.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/cross_cluster_replication/public/register_routes.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/remote_clusters/public/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/upgrade_assistant/public/index.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/snapshot_restore/public/plugin.js
+    sed -i 's#visible: true#visible: false#g' $kibana_path/x-pack/legacy/plugins/remote_clusters/public/plugin.js
 fi
 

kibana/config/xpack_config.sh

@@ -14,6 +14,7 @@ then
     [xpack.monitoring.enabled]=$XPACK_MONITORING
     [xpack.maps.enabled]=$XPACK_MAPS
     [xpack.uptime.enabled]=$XPACK_UPTIME
+    [xpack.siem.enabled]=$XPACK_SIEM
     [console.enabled]=$XPACK_DEVTOOLS
   )
   for i in "${!CONFIG_MAP[@]}"
@@ -34,6 +35,7 @@ xpack.infra.enabled: $XPACK_INFRA
 xpack.monitoring.enabled: $XPACK_MONITORING
 xpack.maps.enabled: $XPACK_MAPS
 xpack.uptime.enabled: $XPACK_UPTIME
+xpack.siem.enabled: $XPACK_SIEM
 console.enabled: $XPACK_DEVTOOLS
 " >> $kibana_config_file
 fi