Elastic 7-x Docker refactor (#257)

Former-commit-id: d3220826fc

kibana/config/20-entrypoint.sh

@@ -4,7 +4,7 @@
 set -e
 
 ##############################################################################
-# Waiting for elasticsearch
+# Set Elasticsearch API url.
 ##############################################################################
 
 if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
@@ -13,6 +13,13 @@ else
   el_url="${ELASTICSEARCH_URL}"
 fi
 
+echo "ENTRYPOINT - Set Elasticsearc url:${ELASTICSEARCH_URL}"
+
+
+##############################################################################
+# If there are credentials for Kibana they are obtained. 
+##############################################################################
+
 KIBANA_USER=""
 KIBANA_PASS=""
 
@@ -34,6 +41,11 @@ else
  
 fi
 
+echo "ENTRYPOINT - Kibana credentials obtained."
+
+##############################################################################
+# Establish the way to run the curl command, with or without authentication. 
+##############################################################################
 
 if [ ${SECURITY_ENABLED} != "no" ]; then
   auth="-u ${KIBANA_USER}:${KIBANA_PASS} -k"
@@ -43,18 +55,24 @@ else
   auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
 fi
 
+echo "ENTRYPOINT - Kibana authentication established."
+
+##############################################################################
+# Waiting for elasticsearch.
+##############################################################################
+
 until curl -XGET $el_url ${auth}; do
-  >&2 echo "Elastic is unavailable - sleeping"
+  >&2 echo "ENTRYPOINT - Elastic is unavailable: sleeping"
   sleep 5
 done
 
 sleep 2
 
->&2 echo "Elasticsearch is up."
+>&2 echo "ENTRYPOINT - Elasticsearch is up."
 
 
 ##############################################################################
-# Waiting for wazuh alerts template
+# Waiting for wazuh alerts template.
 ##############################################################################
 
 strlen=0
@@ -63,71 +81,47 @@ while [[ $strlen -eq 0 ]]
 do
   template=$(curl $auth $el_url/_cat/templates/wazuh -s)
   strlen=${#template}
-  >&2 echo "Wazuh alerts template not loaded - sleeping."
+  >&2 echo "ENTRYPOINT - Wazuh alerts template not loaded - sleeping."
   sleep 2
 done
 
 sleep 2
 
->&2 echo "Wazuh alerts template is loaded."
+>&2 echo "ENTRYPOINT - Wazuh alerts template is loaded."
 
 
 ##############################################################################
-# If Secure access to Kibana is enabled, we must set the credentials.
-# We must create the ssl certificate.
+# Create keystore if security is enabled.
 ##############################################################################
 
 if [[ $SECURITY_ENABLED == "yes" ]]; then
 
-
-  # Create keystore
+  echo "ENTRYPOINT - Create Keystore."
   /usr/share/kibana/bin/kibana-keystore create
-  
-  echo "Setting security Kibana configuiration options."
-
-  echo "
-# Elasticsearch from/to Kibana
-elasticsearch.ssl.certificateAuthorities: [\"/usr/share/kibana/config/$SECURITY_CA_PEM\"]
-
-server.ssl.enabled: true
-server.ssl.certificate: $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
-server.ssl.key: $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key
-server.ssl.supportedProtocols: 
-  - TLSv1.1
-  - TLSv1.2
-" >> /usr/share/kibana/config/kibana.yml
-
-  echo "Create SSL directories."
-
-  mkdir -p $SECURITY_KIBANA_SSL_KEY_PATH $SECURITY_KIBANA_SSL_CERT_PATH
-  CA_PATH="/usr/share/kibana/config"
-
-  echo "Creating SSL certificates."
-  
-  pushd $CA_PATH
-
-  # chown kibana: $CA_PATH/$SECURITY_CA_PEM
-  # chmod 400 $CA_PATH/$SECURITY_CA_PEM
-  SECURITY_KEY_PASS=`openssl rand -base64 32`
-  openssl req -batch -x509 -days 18250 -newkey rsa:2048 -keyout $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key -out $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem -passout pass:"$SECURITY_KEY_PASS" >/dev/null
-  # chown -R kibana: $CA_PATH/ssl
-  chmod -R 770 $CA_PATH/ssl
-  chmod 440 $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
-
-  popd
-  echo "SSL certificates created."
-
   # Add keys to keystore
   echo -e "$KIBANA_PASS" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.password --stdin
-  echo -e "$SECURITY_KEY_PASS" | /usr/share/kibana/bin/kibana-keystore add server.ssl.keyPassphrase --stdin
   echo -e "$KIBANA_USER" | /usr/share/kibana/bin/kibana-keystore add elasticsearch.username --stdin
 
+  echo "ENTRYPOINT - Keystore created."
 fi
 
 ##############################################################################
-# Run more configuration scripts.
+# If security is enabled set Kibana configuration.
+# Create the ssl certificate.
 ##############################################################################
 
-bash /usr/share/kibana/kibana_settings.sh &
+if [[ $SECURITY_ENABLED == "yes" ]]; then
+
+  bash /usr/share/kibana/20-entrypoint_certs_management.sh
+  bash /usr/share/kibana/20-entrypoint_security_configuration.sh
+
+fi
+
+
+##############################################################################
+# Run kibana_settings.sh script.
+##############################################################################
+
+bash /usr/share/kibana/20-entrypoint_kibana_settings.sh &
 
 /usr/local/bin/kibana-docker