From 02de528417b9c5a64953ef8a52eb31edcae2316f Mon Sep 17 00:00:00 2001 From: vcerenu Date: Tue, 13 May 2025 14:54:48 -0300 Subject: [PATCH 001/142] Bump 5.0.0 version --- .env | 6 +++--- .github/.goss.yaml | 2 +- .../Procedure_push_docker_images.yml | 4 ++-- CHANGELOG.md | 19 +++++++++++++++++++ VERSION.json | 2 +- build-docker-images/README.md | 4 ++-- build-docker-images/build-images.sh | 4 ++-- .../config/check_repository.sh | 2 +- .../wazuh-dashboard/config/config.sh | 4 ++-- .../wazuh-indexer/config/check_repository.sh | 2 +- .../wazuh-indexer/config/config.sh | 4 ++-- .../wazuh-manager/config/check_repository.sh | 2 +- .../wazuh-manager/config/filebeat_module.sh | 2 +- indexer-certs-creator/config/entrypoint.sh | 4 ++-- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 16 files changed, 49 insertions(+), 30 deletions(-) diff --git a/.env b/.env index 7af5f540..c2d4e554 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ -WAZUH_VERSION=4.13.0 -WAZUH_IMAGE_VERSION=4.13.0 +WAZUH_VERSION=5.0.0 +WAZUH_IMAGE_VERSION=5.0.0 WAZUH_TAG_REVISION=1 -FILEBEAT_TEMPLATE_BRANCH=4.13.0 +FILEBEAT_TEMPLATE_BRANCH=5.0.0 WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 diff --git a/.github/.goss.yaml b/.github/.goss.yaml index fcdc65e2..85c33160 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.13.0 + - 5.0.0 port: tcp:1514: listening: true diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index eccff387..e1e99565 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -6,7 +6,7 @@ on: inputs: image_tag: description: 'Docker image tag' - default: '4.13.0' + default: '5.0.0' required: true docker_reference: description: 'wazuh-docker reference' @@ -41,7 +41,7 @@ on: inputs: image_tag: description: 'Docker image tag' - default: '4.13.0' + default: '5.0.0' required: true type: string docker_reference: diff --git a/CHANGELOG.md b/CHANGELOG.md index 57053b88..74b95602 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,25 @@ # Change Log All notable changes to this project will be documented in this file. +## [5.0.0] + +### Added + +- None + +### Changed + +- None + +### Fixed + +- None + +### Deleted + +- None + + ## [4.13.0] ### Added diff --git a/VERSION.json b/VERSION.json index dfee93c3..93df817f 100644 --- a/VERSION.json +++ b/VERSION.json @@ -1,4 +1,4 @@ { - "version": "4.13.0", + "version": "5.0.0", "stage": "alpha0" } diff --git a/build-docker-images/README.md b/build-docker-images/README.md index a10e1e9b..11fde42c 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: ``` -$ build-docker-images/build-images.sh -v 4.13.0 +$ build-docker-images/build-images.sh -v 5.0.0 ``` To get all the available script options use the -h or --help option: @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.13.0. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. -h, --help Show this help. ``` \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 7d2e9948..287f1351 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,4 +1,4 @@ -WAZUH_IMAGE_VERSION=4.13.0 +WAZUH_IMAGE_VERSION=5.0.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') @@ -12,7 +12,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="4.13.0" +WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.4" diff --git a/build-docker-images/wazuh-dashboard/config/check_repository.sh b/build-docker-images/wazuh-dashboard/config/check_repository.sh index e49e69c2..3defb44e 100644 --- a/build-docker-images/wazuh-dashboard/config/check_repository.sh +++ b/build-docker-images/wazuh-dashboard/config/check_repository.sh @@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags if [[ -n "${WAZUH_TAG}" ]]; then APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" fi rpm --import "${APT_KEY}" diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 92dc9c2e..b2cbfea4 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.13/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ +PACKAGES_URL=https://packages.wazuh.com/5.0/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-indexer/config/check_repository.sh b/build-docker-images/wazuh-indexer/config/check_repository.sh index e49e69c2..3defb44e 100644 --- a/build-docker-images/wazuh-indexer/config/check_repository.sh +++ b/build-docker-images/wazuh-indexer/config/check_repository.sh @@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags if [[ -n "${WAZUH_TAG}" ]]; then APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" fi rpm --import "${APT_KEY}" diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 94d55d43..29a09b73 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.13/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ +PACKAGES_URL=https://packages.wazuh.com/5.0/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index e49e69c2..3defb44e 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -8,7 +8,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags if [[ -n "${WAZUH_TAG}" ]]; then APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" + REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" fi rpm --import "${APT_KEY}" diff --git a/build-docker-images/wazuh-manager/config/filebeat_module.sh b/build-docker-images/wazuh-manager/config/filebeat_module.sh index 5357255d..9926c6c1 100644 --- a/build-docker-images/wazuh-manager/config/filebeat_module.sh +++ b/build-docker-images/wazuh-manager/config/filebeat_module.sh @@ -4,7 +4,7 @@ WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags ## check tag to use the correct repository if [[ -n "${WAZUH_TAG}" ]]; then - REPOSITORY="packages.wazuh.com/4.x" + REPOSITORY="packages.wazuh.com/5.x" fi curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\ diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index f9529b89..75861833 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,8 +8,8 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/4.13/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.13/ +PACKAGES_URL=https://packages.wazuh.com/5.0/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ ## Check if the cert tool exists in S3 buckets CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index bff74cfd..f7be620a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.master: - image: wazuh/wazuh-manager:4.13.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -45,7 +45,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.worker: - image: wazuh/wazuh-manager:4.13.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -81,7 +81,7 @@ services: - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf wazuh1.indexer: - image: wazuh/wazuh-indexer:4.13.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -107,7 +107,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh2.indexer: - image: wazuh/wazuh-indexer:4.13.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -129,7 +129,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh3.indexer: - image: wazuh/wazuh-indexer:4.13.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -151,7 +151,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.13.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 18befd60..6ae87391 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.manager: - image: wazuh/wazuh-manager:4.13.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -46,7 +46,7 @@ services: - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh.indexer: - image: wazuh/wazuh-indexer:4.13.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -71,7 +71,7 @@ services: - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml wazuh.dashboard: - image: wazuh/wazuh-dashboard:4.13.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From cd69030b165d4d89b97aa03d18024b297f960571 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Thu, 29 May 2025 09:30:11 -0300 Subject: [PATCH 002/142] Remove 4.12.2 references from 4.14.0 branch --- CHANGELOG.md | 26 ++++---------------------- 1 file changed, 4 insertions(+), 22 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c7d83dd6..4f00fb74 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -42,6 +42,10 @@ All notable changes to this project will be documented in this file. ### Added - Added repository_bumper script. ([#1781](https://github.com/wazuh/wazuh-docker/pull/1781)) +- Fix Warning message when migrating Docker compose v2 ([#1828](https://github.com/wazuh/wazuh-docker/pull/1828)) +- Add technical documentation ([#1822](https://github.com/wazuh/wazuh-docker/pull/1822)) +- Add wazuh agent test and push ([#1817](https://github.com/wazuh/wazuh-docker/pull/1817)) +- Add Wazuh agent image build and deploy ([#1816](https://github.com/wazuh/wazuh-docker/pull/1816)) ### Changed @@ -56,28 +60,6 @@ All notable changes to this project will be documented in this file. - Remove default docker reference version from workflow ([#1761](https://github.com/wazuh/wazuh-docker/pull/1761)) - Remove 'stable' branch ocurrencies ([#1757](https://github.com/wazuh/wazuh-docker/pull/1757)) -## [4.12.2] - -### Added - -- Fix Warning message when migrating Docker compose v2 ([#1828](https://github.com/wazuh/wazuh-docker/pull/1828)) -- Add technical documentation ([#1822](https://github.com/wazuh/wazuh-docker/pull/1822)) -- Add wazuh agent test and push ([#1817](https://github.com/wazuh/wazuh-docker/pull/1817)) -- Add Wazuh agent image build and deploy ([#1816](https://github.com/wazuh/wazuh-docker/pull/1816)) - -### Changed - -- None - -### Fixed - -- None - -### Deleted - -- None - - ## [4.12.1] ### Added From f1a3a48c1ab19c9192b3eeab7d2f4818acf89235 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Fri, 30 May 2025 11:18:10 -0300 Subject: [PATCH 003/142] Bump 5.0.0 technical documentation --- README.md | 2 +- docs/dev/build-image.md | 4 ++-- docs/dev/introduction.md | 2 +- docs/dev/setup.md | 6 +++--- docs/ref/Introduction/description.md | 6 +++--- docs/ref/Introduction/introduction.md | 4 ++-- docs/ref/configuration/configuration-files.md | 2 +- docs/ref/configuration/configuration.md | 2 +- docs/ref/getting-started/deployment/deployment.md | 6 +++--- docs/ref/getting-started/getting-started.md | 6 +++--- docs/ref/getting-started/requirements.md | 2 +- docs/ref/glossary.md | 6 +++--- wazuh-agent/docker-compose.yml | 2 +- 13 files changed, 25 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 18e3a596..bcd5f817 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber ## Branch Convention - `main`: Developing and testing of new features. -- `X.Y.Z`: Version-specific branches (e.g., `4.12.2`, `4.11.0`, etc.). +- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.). ## Documentation diff --git a/docs/dev/build-image.md b/docs/dev/build-image.md index 58a7c734..11fde42c 100644 --- a/docs/dev/build-image.md +++ b/docs/dev/build-image.md @@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: ``` -$ build-docker-images/build-images.sh -v 4.12.2 +$ build-docker-images/build-images.sh -v 5.0.0 ``` To get all the available script options use the -h or --help option: @@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.12.2. + -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. -h, --help Show this help. ``` \ No newline at end of file diff --git a/docs/dev/introduction.md b/docs/dev/introduction.md index 56e13df2..bb0f0850 100644 --- a/docs/dev/introduction.md +++ b/docs/dev/introduction.md @@ -1,6 +1,6 @@ # Development Guide - Introduction -Welcome to the Development Guide for Wazuh-docker version 4.12.2. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development. +Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development. ## Purpose of This Guide diff --git a/docs/dev/setup.md b/docs/dev/setup.md index 3c9d37d5..3456bd24 100644 --- a/docs/dev/setup.md +++ b/docs/dev/setup.md @@ -1,6 +1,6 @@ # Development Guide - Setup Environment -This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.12.2). A proper setup is crucial for building images, running tests, and contributing effectively. +This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively. ## Prerequisites @@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements: Follow these steps to prepare your development environment: 1. **Clone the Repository**: - Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.12.2`. + Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`. ```bash git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) cd wazuh-docker - git checkout 4.12.2 + git checkout v5.0.0 ``` 2. **Verify Docker Installation**: diff --git a/docs/ref/Introduction/description.md b/docs/ref/Introduction/description.md index 917fbfe1..6679997f 100644 --- a/docs/ref/Introduction/description.md +++ b/docs/ref/Introduction/description.md @@ -1,6 +1,6 @@ # Reference Manual - Description -This section provides a detailed description of Wazuh-docker (version 4.12.2), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment. +This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment. ## What is Wazuh? @@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi ## Core Components in Wazuh-Docker -The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.12.2: +The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0: 1. **Wazuh Manager**: - The central component that collects and analyzes data from deployed Wazuh agents. @@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh 2. **Wazuh Indexer**: - A highly scalable, full-text search and analytics engine. - Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager. - - The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.12.2, this is typically an OpenSearch-based component. + - The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component. 3. **Wazuh Dashboard**: - A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana). diff --git a/docs/ref/Introduction/introduction.md b/docs/ref/Introduction/introduction.md index 486322e4..f0ea1b10 100644 --- a/docs/ref/Introduction/introduction.md +++ b/docs/ref/Introduction/introduction.md @@ -1,6 +1,6 @@ # Reference Manual - Introduction -Welcome to the Reference Manual for Wazuh-Docker, version 4.12.2. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker. +Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker. ## Purpose of This Manual @@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently: - If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section. - For specific terms or concepts, consult the [Glossary](glossary.md). -This manual refers to version 4.12.2 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version. +This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version. diff --git a/docs/ref/configuration/configuration-files.md b/docs/ref/configuration/configuration-files.md index 4689286f..d733cfdd 100644 --- a/docs/ref/configuration/configuration-files.md +++ b/docs/ref/configuration/configuration-files.md @@ -29,4 +29,4 @@ ``` -Consult the official Wazuh documentation for version 4.12.2 for detailed information on all possible configuration parameters for each component. \ No newline at end of file +Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component. \ No newline at end of file diff --git a/docs/ref/configuration/configuration.md b/docs/ref/configuration/configuration.md index dba9730e..636884d7 100644 --- a/docs/ref/configuration/configuration.md +++ b/docs/ref/configuration/configuration.md @@ -1,6 +1,6 @@ # Reference Manual - Configuration -This section details how to configure your Wazuh-Docker deployment (version 4.12.2). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment. +This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment. ## Overview of Configuration Methods diff --git a/docs/ref/getting-started/deployment/deployment.md b/docs/ref/getting-started/deployment/deployment.md index c5d3e43f..48360ef6 100644 --- a/docs/ref/getting-started/deployment/deployment.md +++ b/docs/ref/getting-started/deployment/deployment.md @@ -1,6 +1,6 @@ # Reference Manual - Deployment -This section provides detailed instructions for deploying Wazuh-Docker (version 4.12.2) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments. +This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments. ## Overview of Deployment Options @@ -24,11 +24,11 @@ Ensure you have: - Met all the [System Requirements](ref/getting-started/requirements.md). - Installed Docker and Docker Compose on your host(s). -- Cloned the `wazuh-docker` repository (version `4.12.2`) or downloaded the necessary deployment files. +- Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files. ```bash git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) cd wazuh-docker - git checkout v4.12.2 + git checkout v5.0.0 ``` - Made a backup of any existing Wazuh data if you are migrating or upgrading. diff --git a/docs/ref/getting-started/getting-started.md b/docs/ref/getting-started/getting-started.md index 4744e477..677a16ef 100644 --- a/docs/ref/getting-started/getting-started.md +++ b/docs/ref/getting-started/getting-started.md @@ -1,6 +1,6 @@ # Reference Manual - Getting Started -This section guides you through the initial steps to get your Wazuh-docker (version 4.12.2) environment up and running. We will cover the prerequisites and point you to the deployment instructions. +This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions. ## Overview @@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed: Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly. 2. **Obtain Wazuh-docker Configuration**: - You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.12.2. + You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0. ```bash git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) cd wazuh-docker - git checkout v4.12.2 + git checkout v5.0.0 # Navigate to the specific docker-compose directory, e.g., single-node or multi-node # cd docker-compose/single-node/ (example path) ``` diff --git a/docs/ref/getting-started/requirements.md b/docs/ref/getting-started/requirements.md index 180a315f..407cc557 100644 --- a/docs/ref/getting-started/requirements.md +++ b/docs/ref/getting-started/requirements.md @@ -1,6 +1,6 @@ # Reference Manual - Requirements -Before deploying Wazuh-Docker (version 4.12.2), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment. +Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment. ## Host System Requirements diff --git a/docs/ref/glossary.md b/docs/ref/glossary.md index fb3e6445..c716700b 100644 --- a/docs/ref/glossary.md +++ b/docs/ref/glossary.md @@ -1,6 +1,6 @@ # Reference Manual - Glossary -This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.12.2). +This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0). --- @@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their **D** -- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.12.2, this is typically OpenSearch Dashboards. +- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards. - **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data. - **Docker**: An open platform for developing, shipping, and running applications inside containers. - **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes. @@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their **I** -- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.12.2, this is typically OpenSearch. +- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch. **L** diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml index 3912908f..150c17e6 100644 --- a/wazuh-agent/docker-compose.yml +++ b/wazuh-agent/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh.agent: - image: wazuh/wazuh-agent:4.12.1 + image: wazuh/wazuh-agent:5.0.0 restart: always environment: - WAZUH_MANAGER_SERVER= From 184802c3b9c9251e755b960bfa3d1ff549f57067 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Mon, 23 Jun 2025 13:29:39 -0300 Subject: [PATCH 004/142] Fix Opensearch deprecated settings --- build-docker-images/wazuh-indexer/config/opensearch.yml | 1 - multi-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- multi-node/config/wazuh_indexer/wazuh1.indexer.yml | 3 +-- multi-node/config/wazuh_indexer/wazuh2.indexer.yml | 3 +-- multi-node/config/wazuh_indexer/wazuh3.indexer.yml | 3 +-- single-node/config/wazuh_dashboard/opensearch_dashboards.yml | 2 +- single-node/config/wazuh_indexer/wazuh.indexer.yml | 1 - 7 files changed, 5 insertions(+), 10 deletions(-) diff --git a/build-docker-images/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml index 1f0a78b3..68cb7a12 100644 --- a/build-docker-images/wazuh-indexer/config/opensearch.yml +++ b/build-docker-images/wazuh-indexer/config/opensearch.yml @@ -3,7 +3,6 @@ node.name: "wazuh.indexer" path.data: /var/lib/wazuh-indexer path.logs: /var/log/wazuh-indexer discovery.type: single-node -compatibility.override_main_response_version: true plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem diff --git a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml index 3a53c3f8..3660ad91 100644 --- a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -2,7 +2,7 @@ server.host: 0.0.0.0 server.port: 5601 opensearch.hosts: https://wazuh1.indexer:9200 opensearch.ssl.verificationMode: certificate -opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] opensearch_security.multitenancy.enabled: false opensearch_security.readonly_mode.roles: ["kibana_read_only"] server.ssl.enabled: true diff --git a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml index 59cbe9bf..81fadff6 100644 --- a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml @@ -1,6 +1,6 @@ network.host: wazuh1.indexer node.name: wazuh1.indexer -cluster.initial_master_nodes: +cluster.initial_cluster_manager_nodes: - wazuh1.indexer - wazuh2.indexer - wazuh3.indexer @@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -compatibility.override_main_response_version: true diff --git a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml index 478ed1d0..47427bd9 100644 --- a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml @@ -1,6 +1,6 @@ network.host: wazuh2.indexer node.name: wazuh2.indexer -cluster.initial_master_nodes: +cluster.initial_cluster_manager_nodes: - wazuh1.indexer - wazuh2.indexer - wazuh3.indexer @@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -compatibility.override_main_response_version: true \ No newline at end of file diff --git a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml index 8caa513d..0efb8308 100644 --- a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml +++ b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml @@ -1,6 +1,6 @@ network.host: wazuh3.indexer node.name: wazuh3.indexer -cluster.initial_master_nodes: +cluster.initial_cluster_manager_nodes: - wazuh1.indexer - wazuh2.indexer - wazuh3.indexer @@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled: - "security_rest_api_access" plugins.security.allow_default_init_securityindex: true cluster.routing.allocation.disk.threshold_enabled: false -compatibility.override_main_response_version: true \ No newline at end of file diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml index ccaec070..c10f123f 100644 --- a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -2,7 +2,7 @@ server.host: 0.0.0.0 server.port: 5601 opensearch.hosts: https://wazuh.indexer:9200 opensearch.ssl.verificationMode: certificate -opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"] +opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] opensearch_security.multitenancy.enabled: false opensearch_security.readonly_mode.roles: ["kibana_read_only"] server.ssl.enabled: true diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index 84c3dbf9..eb98cfef 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -5,7 +5,6 @@ path.logs: /var/log/wazuh-indexer discovery.type: single-node http.port: 9200-9299 transport.tcp.port: 9300-9399 -compatibility.override_main_response_version: true plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem From f7cbdd488453fe368fe662db04778be8ccc2ca96 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Mon, 23 Jun 2025 13:33:22 -0300 Subject: [PATCH 005/142] Update CHANGELOG --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index df67c7e3..098d4332 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed -- None +- Fix OpenSearch deprecated settings [#1366](https://github.com/wazuh/wazuh-puppet/issues/1366) ### Fixed From de11f97bf086c663d966f93fee63cf5d99262581 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Mon, 23 Jun 2025 13:41:56 -0300 Subject: [PATCH 006/142] Update CHANGELOG --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 098d4332..073e9f8f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed -- Fix OpenSearch deprecated settings [#1366](https://github.com/wazuh/wazuh-puppet/issues/1366) +- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366)) ### Fixed From 0989e11d432aca673eab65dd91553735b7c4a01e Mon Sep 17 00:00:00 2001 From: vcerenu Date: Thu, 14 Aug 2025 09:00:41 -0300 Subject: [PATCH 007/142] Resolving conflicts --- build-docker-images/build-images.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index e511ef22..d4f3f4ce 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -13,7 +13,10 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # Foundation. WAZUH_IMAGE_VERSION="5.0.0" +WAZUH_TAG_REVISION="1" +WAZUH_DEV_STAGE="" FILEBEAT_MODULE_VERSION="0.4" + # ----------------------------------------------------------------------------- trap ctrl_c INT From cb6fa28bbc00516b41894f42549d4609c7e94ab4 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 1 Oct 2025 13:30:25 -0300 Subject: [PATCH 008/142] Wazuh server clean-up --- build-docker-images/build-images.yml | 4 - build-docker-images/wazuh-manager/Dockerfile | 3 - .../config/etc/cont-init.d/2-manager | 6 -- .../wazuh-manager/config/permanent_data.env | 24 ------ docs/ref/configuration/configuration-files.md | 2 +- multi-node/Migration-to-Wazuh-4.4.md | 52 ------------ .../config/wazuh_cluster/wazuh_manager.conf | 83 +++++++------------ .../config/wazuh_cluster/wazuh_worker.conf | 83 +++++++------------ multi-node/docker-compose.yml | 8 -- multi-node/volume-migrator.sh | 44 ---------- .../config/wazuh_cluster/wazuh_manager.conf | 83 +++++++------------ single-node/docker-compose.yml | 4 - 12 files changed, 91 insertions(+), 305 deletions(-) diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index ed784cec..35d8d7a2 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -27,9 +27,7 @@ services: - wazuh_logs:/var/ossec/logs - wazuh_queue:/var/ossec/queue - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_integrations:/var/ossec/integrations - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_agentless:/var/ossec/agentless - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat @@ -94,9 +92,7 @@ volumes: wazuh_logs: wazuh_queue: wazuh_var_multigroups: - wazuh_integrations: wazuh_active_response: - wazuh_agentless: wazuh_wodles: filebeat_etc: filebeat_var: diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 7bbfdfc7..d2c11083 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -50,9 +50,6 @@ RUN chmod go-w /etc/filebeat/wazuh-template.json RUN mkdir -p /var/ossec/var/multigroups && \ chown root:wazuh /var/ossec/var/multigroups && \ chmod 770 /var/ossec/var/multigroups && \ - mkdir -p /var/ossec/agentless && \ - chown root:wazuh /var/ossec/agentless && \ - chmod 770 /var/ossec/agentless && \ mkdir -p /var/ossec/active-response/bin && \ chown root:wazuh /var/ossec/active-response/bin && \ chmod 770 /var/ossec/active-response/bin && \ diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager index ff3e1fdd..ebd08eb1 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager @@ -60,12 +60,6 @@ function_wazuh_migration(){ chown wazuh:wazuh /var/ossec/etc/rules/* chmod 660 /var/ossec/etc/rules/* - if [ -e /wazuh-migration/data/agentless/.passlist ]; then - \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist - chown root:wazuh /var/ossec/agentless/.passlist - chmod 640 /var/ossec/agentless/.passlist - fi - \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db chown wazuh:wazuh /var/ossec/queue/db/global.db chmod 640 /var/ossec/queue/db/global.db diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 132dc492..26a61289 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -4,9 +4,7 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" PERMANENT_DATA[((i++))]="/var/ossec/etc" PERMANENT_DATA[((i++))]="/var/ossec/logs" PERMANENT_DATA[((i++))]="/var/ossec/queue" -PERMANENT_DATA[((i++))]="/var/ossec/agentless" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" -PERMANENT_DATA[((i++))]="/var/ossec/integrations" PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" PERMANENT_DATA[((i++))]="/var/ossec/wodles" PERMANENT_DATA[((i++))]="/etc/filebeat" @@ -16,16 +14,6 @@ export PERMANENT_DATA # Files mounted in a volume that should not be permanent i=0 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" @@ -41,18 +29,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" diff --git a/docs/ref/configuration/configuration-files.md b/docs/ref/configuration/configuration-files.md index 4965b89e..429a85f5 100644 --- a/docs/ref/configuration/configuration-files.md +++ b/docs/ref/configuration/configuration-files.md @@ -2,7 +2,7 @@ ### 1. Wazuh Manager Configuration -* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more. +* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more. * **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) . ### 2. Wazuh Indexer Configuration diff --git a/multi-node/Migration-to-Wazuh-4.4.md b/multi-node/Migration-to-Wazuh-4.4.md index 3ff10a84..0d192f2c 100644 --- a/multi-node/Migration-to-Wazuh-4.4.md +++ b/multi-node/Migration-to-Wazuh-4.4.md @@ -80,13 +80,6 @@ docker volume create \ multi-node_master-wazuh-var-multigroups ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-integrations \ - multi-node_master-wazuh-integrations -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -94,13 +87,6 @@ docker volume create \ multi-node_master-wazuh-active-response ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-wazuh-agentless \ - multi-node_master-wazuh-agentless -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -157,13 +143,6 @@ docker volume create \ multi-node_worker-wazuh-var-multigroups ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-integrations \ - multi-node_worker-wazuh-integrations -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -171,13 +150,6 @@ docker volume create \ multi-node_worker-wazuh-active-response ``` ``` -docker volume create \ - --label com.docker.compose.project=multi-node \ - --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-wazuh-agentless \ - multi-node_worker-wazuh-agentless -``` -``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ @@ -248,24 +220,12 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_ossec-integrations:/from \ - -v multi-node_master-wazuh-integrations:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker_ossec-active-response:/from \ -v multi-node_master-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_ossec-agentless:/from \ - -v multi-node_master-wazuh-agentless:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker_ossec-wodles:/from \ -v multi-node_master-wazuh-wodles:/to \ @@ -314,24 +274,12 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-integrations:/from \ - -v multi-node_worker-wazuh-integrations:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-active-response:/from \ -v multi-node_worker-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-agentless:/from \ - -v multi-node_worker-wazuh-agentless:/to \ - alpine ash -c "cd /from ; cp -avp . /to" -``` -``` docker container run --rm -it \ -v wazuh-docker_worker-ossec-wodles:/from \ -v multi-node_worker-wazuh-wodles:/to \ diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index b1f32c8b..600b3e88 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -1,24 +1,10 @@ - yes - yes - no - no - no - smtp.example.wazuh.com - wazuh@example.wazuh.com - recipient@example.wazuh.com - 12 - alerts.log - 10m + 15m 0 + yes - - 3 - 12 - - plain @@ -34,8 +20,6 @@ no - yes - yes yes yes yes @@ -45,31 +29,12 @@ 43200 - etc/rootcheck/rootkit_files.txt - etc/rootcheck/rootkit_trojans.txt - yes + + /var/lib/containerd + /var/lib/docker/overlay2 - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - no @@ -81,9 +46,15 @@ yes yes yes + yes + yes + yes + yes + yes + 5m 10 @@ -92,7 +63,13 @@ yes yes 12h - yes + + + + yes + 5m + 10 + @@ -124,8 +101,6 @@ 43200 - yes - yes @@ -165,13 +140,12 @@ 10 - 100 + 50 yes 5m - 1h 10 @@ -266,13 +240,6 @@ etc/rules - - yes - 1 - 64 - 15m - - no @@ -305,9 +272,19 @@ + + journald + journald + + + + audit + /var/log/audit/audit.log + + syslog /var/ossec/logs/active-responses.log - + \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index 7b89dc63..b85335cd 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -1,24 +1,10 @@ - yes - yes - no - no - no - smtp.example.wazuh.com - wazuh@example.wazuh.com - recipient@example.wazuh.com - 12 - alerts.log - 10m + 15m 0 + yes - - 3 - 12 - - plain @@ -34,8 +20,6 @@ no - yes - yes yes yes yes @@ -45,31 +29,12 @@ 43200 - etc/rootcheck/rootkit_files.txt - etc/rootcheck/rootkit_trojans.txt - yes + + /var/lib/containerd + /var/lib/docker/overlay2 - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - no @@ -81,9 +46,15 @@ yes yes yes + yes + yes + yes + yes + yes + 5m 10 @@ -92,7 +63,13 @@ yes yes 12h - yes + + + + yes + 5m + 10 + @@ -124,8 +101,6 @@ 43200 - yes - yes @@ -165,13 +140,12 @@ 10 - 100 + 50 yes 5m - 1h 10 @@ -266,13 +240,6 @@ etc/rules - - yes - 1 - 64 - 15m - - no @@ -305,9 +272,19 @@ + + journald + journald + + + + audit + /var/log/audit/audit.log + + syslog /var/ossec/logs/active-responses.log - + \ No newline at end of file diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index d67c4eb9..ddf9c9ed 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -31,9 +31,7 @@ services: - master-wazuh-logs:/var/ossec/logs - master-wazuh-queue:/var/ossec/queue - master-wazuh-var-multigroups:/var/ossec/var/multigroups - - master-wazuh-integrations:/var/ossec/integrations - master-wazuh-active-response:/var/ossec/active-response/bin - - master-wazuh-agentless:/var/ossec/agentless - master-wazuh-wodles:/var/ossec/wodles - master-filebeat-etc:/etc/filebeat - master-filebeat-var:/var/lib/filebeat @@ -67,9 +65,7 @@ services: - worker-wazuh-logs:/var/ossec/logs - worker-wazuh-queue:/var/ossec/queue - worker-wazuh-var-multigroups:/var/ossec/var/multigroups - - worker-wazuh-integrations:/var/ossec/integrations - worker-wazuh-active-response:/var/ossec/active-response/bin - - worker-wazuh-agentless:/var/ossec/agentless - worker-wazuh-wodles:/var/ossec/wodles - worker-filebeat-etc:/etc/filebeat - worker-filebeat-var:/var/lib/filebeat @@ -198,9 +194,7 @@ volumes: master-wazuh-logs: master-wazuh-queue: master-wazuh-var-multigroups: - master-wazuh-integrations: master-wazuh-active-response: - master-wazuh-agentless: master-wazuh-wodles: master-filebeat-etc: master-filebeat-var: @@ -209,9 +203,7 @@ volumes: worker-wazuh-logs: worker-wazuh-queue: worker-wazuh-var-multigroups: - worker-wazuh-integrations: worker-wazuh-active-response: - worker-wazuh-agentless: worker-wazuh-wodles: worker-filebeat-etc: worker-filebeat-var: diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh index f11a1da6..21c3d255 100755 --- a/multi-node/volume-migrator.sh +++ b/multi-node/volume-migrator.sh @@ -46,24 +46,12 @@ docker volume create \ --label com.docker.compose.volume=master-wazuh-var-multigroups \ $2_master-wazuh-var-multigroups -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-integrations \ - $2_master-wazuh-integrations - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ --label com.docker.compose.volume=master-wazuh-active-response \ $2_master-wazuh-active-response -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-wazuh-agentless \ - $2_master-wazuh-agentless - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ @@ -112,24 +100,12 @@ docker volume create \ --label com.docker.compose.volume=worker-wazuh-var-multigroups \ $2_worker-wazuh-var-multigroups -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-integrations \ - $2_worker-wazuh-integrations - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ --label com.docker.compose.volume=worker-wazuh-active-response \ $2_worker-wazuh-active-response -docker volume create \ - --label com.docker.compose.project=$2 \ - --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-wazuh-agentless \ - $2_worker-wazuh-agentless - docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ @@ -193,21 +169,11 @@ docker container run --rm -it \ -v $2_master-wazuh-var-multigroups:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_ossec-integrations:/from \ - -v $2_master-wazuh-integrations:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker_ossec-active-response:/from \ -v $2_master-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_ossec-agentless:/from \ - -v $2_master-wazuh-agentless:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker_ossec-wodles:/from \ -v $2_master-wazuh-wodles:/to \ @@ -248,21 +214,11 @@ docker container run --rm -it \ -v $2_worker-wazuh-var-multigroups:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-integrations:/from \ - -v $2_worker-wazuh-integrations:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker_worker-ossec-active-response:/from \ -v $2_worker-wazuh-active-response:/to \ alpine ash -c "cd /from ; cp -avp . /to" -docker container run --rm -it \ - -v wazuh-docker_worker-ossec-agentless:/from \ - -v $2_worker-wazuh-agentless:/to \ - alpine ash -c "cd /from ; cp -avp . /to" - docker container run --rm -it \ -v wazuh-docker_worker-ossec-wodles:/from \ -v $2_worker-wazuh-wodles:/to \ diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf index c5f16dd9..4f00c24d 100644 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ b/single-node/config/wazuh_cluster/wazuh_manager.conf @@ -1,24 +1,10 @@ - yes - yes - no - no - no - smtp.example.wazuh.com - wazuh@example.wazuh.com - recipient@example.wazuh.com - 12 - alerts.log - 10m + 15m 0 + yes - - 3 - 12 - - plain @@ -34,8 +20,6 @@ no - yes - yes yes yes yes @@ -45,31 +29,12 @@ 43200 - etc/rootcheck/rootkit_files.txt - etc/rootcheck/rootkit_trojans.txt - yes + + /var/lib/containerd + /var/lib/docker/overlay2 - - yes - 1800 - 1d - yes - - wodles/java - wodles/ciscat - - - - - yes - yes - /var/log/osquery/osqueryd.results.log - /etc/osquery/osquery.conf - yes - - no @@ -81,9 +46,15 @@ yes yes yes + yes + yes + yes + yes + yes + 5m 10 @@ -92,7 +63,13 @@ yes yes 12h - yes + + + + yes + 5m + 10 + @@ -122,8 +99,6 @@ 43200 - yes - yes @@ -163,13 +138,12 @@ 10 - 100 + 50 yes 5m - 1h 10 @@ -264,13 +238,6 @@ etc/rules - - yes - 1 - 64 - 15m - - no @@ -303,9 +270,19 @@ + + journald + journald + + + + audit + /var/log/audit/audit.log + + syslog /var/ossec/logs/active-responses.log - + \ No newline at end of file diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8ad1c4a2..365ab29b 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -32,9 +32,7 @@ services: - wazuh_logs:/var/ossec/logs - wazuh_queue:/var/ossec/queue - wazuh_var_multigroups:/var/ossec/var/multigroups - - wazuh_integrations:/var/ossec/integrations - wazuh_active_response:/var/ossec/active-response/bin - - wazuh_agentless:/var/ossec/agentless - wazuh_wodles:/var/ossec/wodles - filebeat_etc:/etc/filebeat - filebeat_var:/var/lib/filebeat @@ -102,9 +100,7 @@ volumes: wazuh_logs: wazuh_queue: wazuh_var_multigroups: - wazuh_integrations: wazuh_active_response: - wazuh_agentless: wazuh_wodles: filebeat_etc: filebeat_var: From 93812b3d07268dcb9b8f11288a8c8a215d51a092 Mon Sep 17 00:00:00 2001 From: vcerenu Date: Wed, 1 Oct 2025 14:26:22 -0300 Subject: [PATCH 009/142] Add changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 52a4437f..76e24d67 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030)) - Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366)) ### Fixed From 184675bab5745846a36d193e14d0528e686957f3 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 28 Oct 2025 01:09:49 +0700 Subject: [PATCH 010/142] Modify Wazuh image builder --- .../Procedure_push_docker_images.yml | 139 +++++++++++------- CHANGELOG.md | 5 +- build-docker-images/build-images.sh | 96 +++++++++--- build-docker-images/build-images.yml | 8 +- build-docker-images/wazuh-indexer/Dockerfile | 7 +- build-docker-images/wazuh-manager/Dockerfile | 1 + .../wazuh-manager/config/filebeat_module.sh | 3 +- docs/dev/build-image.md | 2 +- indexer-certs-creator/Dockerfile | 4 +- indexer-certs-creator/README.md | 2 +- indexer-certs-creator/config/entrypoint.sh | 40 ++--- .../wazuh_dashboard/opensearch_dashboards.yml | 1 - multi-node/generate-indexer-certs.yml | 4 +- .../wazuh_dashboard/opensearch_dashboards.yml | 1 - single-node/generate-indexer-certs.yml | 4 +- 15 files changed, 211 insertions(+), 106 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index af6bc25d..7bfe0c67 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -11,10 +11,6 @@ on: docker_reference: description: 'wazuh-docker reference' required: true - products: - description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' - required: true filebeat_module_version: description: 'Filebeat module version' default: '0.4' @@ -23,11 +19,10 @@ on: description: 'Package revision' default: '1' required: true - push_images: - description: 'Push images' - type: boolean - default: true - required: true + reference: + description: 'Dev reference' + type: string + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -48,11 +43,6 @@ on: description: 'wazuh-docker reference' required: false type: string - products: - description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' - required: true - type: string filebeat_module_version: description: 'Filebeat module version' default: '0.4' @@ -63,11 +53,10 @@ on: default: '1' required: true type: string - push_images: - description: 'Push images' - type: boolean - default: true - required: true + reference: + description: 'Dev reference' + type: string + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -82,6 +71,16 @@ jobs: build-and-push: runs-on: ubuntu-22.04 + permissions: + id-token: write + contents: read + + env: + IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }} + IMAGE_TAG: ${{ inputs.image_tag }} + FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }} + REVISION: ${{ inputs.revision }} + steps: - name: Print inputs run: | @@ -96,45 +95,97 @@ jobs: echo "* id: ${{ inputs.id }}" echo "* image_tag: ${{ inputs.image_tag }}" echo "* docker_reference: ${{ inputs.docker_reference }}" - echo "* products: ${{ inputs.products }}" echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}" echo "* revision: ${{ inputs.revision }}" - echo "* push_images: ${{ inputs.push_images }}" echo "* dev: ${{ inputs.dev }}" + echo "* dev reference: ${{ inputs.reference }}" echo "---------------------------------------------" - name: Checkout repository uses: actions/checkout@v4 with: ref: ${{ inputs.docker_reference }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Configure aws credentials + if: ${{ inputs.dev == true }} + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + if: ${{ inputs.dev == true }} + uses: aws-actions/amazon-ecr-login@v2 - name: Log in to Docker Hub + if: ${{ inputs.dev == false }} uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} + - name: Create packages-url.txt file + if : ${{ inputs.dev == true }} + run: | + cat << EOF > packages-url.txt + wazuh_manager_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) + wazuh_manager_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) + wazuh_manager_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) + wazuh_manager_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) + wazuh_indexer_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) + wazuh_indexer_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) + wazuh_indexer_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) + wazuh_indexer_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) + wazuh_dashboard_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) + wazuh_dashboard_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) + wazuh_dashboard_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) + wazuh_dashboard_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) + wazuh_agent_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) + wazuh_agent_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) + wazuh_agent_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) + wazuh_agent_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) + wazuh_agent_url_i386_msi: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 43200 --region us-west-1) + wazuh_agent_url_intel64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 43200 --region us-west-1) + wazuh_agent_url_arm64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 43200 --region us-west-1) + EOF + cat packages-url.txt + working-directory: ./build-docker-images + + - name: Save packages_url.txt file created as artifact + if: ${{ inputs.dev == true }} + uses: actions/upload-artifact@v4 + with: + name: packages_url.txt + path: /home/runner/work/wazuh-docker/wazuh-docker/build-docker-images/packages-url.txt + retention-days: 5 + - name: Build Wazuh images run: | - IMAGE_TAG=${{ inputs.image_tag }} - FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }} - REVISION=${{ inputs.revision }} - - if [[ "$IMAGE_TAG" == *"-"* ]]; then - IFS='-' read -r -a tokens <<< "$IMAGE_TAG" - if [ -z "${tokens[1]}" ]; then - echo "Invalid image tag: $IMAGE_TAG" - exit 1 + if [ "${{ inputs.dev }}" = true ]; then + IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}" + ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }} + else + if [[ "$IMAGE_TAG" == *"-"* ]]; then + IFS='-' read -r -a tokens <<< "$IMAGE_TAG" + if [ -z "${tokens[1]}" ]; then + echo "Invalid image tag: $IMAGE_TAG" + exit 1 + fi + DEV_STAGE=${tokens[1]} + WAZUH_VER=${tokens[0]} + ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m + else + ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m fi - DEV_STAGE=${tokens[1]} - WAZUH_VER=${tokens[0]} - ./build-docker-images/build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION - else - ./build-docker-images/build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION fi - # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV - ENV_FILE_PATH=".env" + ENV_FILE_PATH="../.env" if [ -f $ENV_FILE_PATH ]; then while IFS= read -r line || [ -n "$line" ]; do @@ -144,16 +195,4 @@ jobs: echo "The environment file $ENV_FILE_PATH does not exist!" exit 1 fi - - - name: Tag and Push Wazuh images - if: ${{ inputs.push_images }} - run: | - IMAGE_TAG="${{ inputs.image_tag }}$( [ "${{ inputs.dev }}" == "true" ] && echo '-dev' || true )" - IMAGE_NAMES=${{ inputs.products }} - IFS=',' read -r -a images <<< "$IMAGE_NAMES" - for image in "${images[@]}"; do - echo "Tagging and pushing wazuh/$image:${WAZUH_VERSION} to wazuh/$image:$IMAGE_TAG" - docker tag wazuh/$image:${WAZUH_VERSION} wazuh/$image:$IMAGE_TAG - echo "Pushing wazuh/$image:$IMAGE_TAG ..." - docker push wazuh/$image:$IMAGE_TAG - done + working-directory: ./build-docker-images diff --git a/CHANGELOG.md b/CHANGELOG.md index 76e24d67..6b9495b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,7 +28,7 @@ All notable changes to this project will be documented in this file. ### Changed -- None +- Wazuh cert tool generator improvements ([#2027](https://github.com/wazuh/wazuh-docker/pull/2027)) ### Fixed @@ -46,6 +46,8 @@ All notable changes to this project will be documented in this file. ### Changed +- Change filebeat install method ([#2020](https://github.com/wazuh/wazuh-docker/pull/2020)) +- Remove dashboard chat setting ([#2021](https://github.com/wazuh/wazuh-docker/pull/2021)) - Rollback data source setting ([#1999](https://github.com/wazuh/wazuh-docker/pull/1999)) - Dashboard settings added ([#1998](https://github.com/wazuh/wazuh-docker/pull/1998)) - Add filebeat config file in the PERMANENT_DATA_EXCP list ([#1898](https://github.com/wazuh/wazuh-docker/pull/1898)) @@ -53,6 +55,7 @@ All notable changes to this project will be documented in this file. ### Fixed +- Change Wazuh indexer directory owner ([#2029](https://github.com/wazuh/wazuh-docker/pull/2029)) - Double the amount of space consumed in Wazuh Indexer ([#1953](https://github.com/wazuh/wazuh-docker/pull/1953)) - Fix config directory for opensearch_security plugin work ([#1951](https://github.com/wazuh/wazuh-docker/pull/1951)) - Update Dockerfile to copy opensearch-security files ([#1928](https://github.com/wazuh/wazuh-docker/pull/1928)) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index d4f3f4ce..ceb4667d 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -15,6 +15,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" +WAZUH_TAG_REFERENCE="" FILEBEAT_MODULE_VERSION="0.4" # ----------------------------------------------------------------------------- @@ -38,35 +39,65 @@ build() { WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')" FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}" + WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}" WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz" WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" - if [ "${WAZUH_DEV_STAGE}" ];then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}" - if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 - fi - else - if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}" - elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}" + if [ -z "${WAZUH_TAG_REFERENCE}" ]; then + if [ "${WAZUH_DEV_STAGE}" ];then + FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}" + if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then + echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" + clean 1 + fi else - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 + if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then + FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}" + elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then + FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}" + else + echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" + clean 1 + fi fi fi + # Variables + FILE="packages_url.txt" - echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env - echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> .env - echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env - echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> .env - echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> .env - echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> .env + if [[ -f "$FILE" ]]; then + echo "$FILE exists. Using existing file." + else + TAG="v${WAZUH_VERSION}" + REPO="wazuh/wazuh-docker" + GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}" - docker compose -f build-docker-images/build-images.yml --env-file .env build --no-cache || clean 1 + if curl -fsSL "$GH_URL" >/dev/null 2>&1; then + curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + else + curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + fi + fi + sed -Ei 's/^([^:]+):[[:space:]]+(https?:\/\/.*)$/\1=\2/' $FILE + sed 's/[-.]/_/g' $FILE > packages_env.txt + + echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env + echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env + echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env + echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> ../.env + echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> ../.env + echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env + echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env + set -a + source ../.env + source packages_env.txt + set +a + + if [ "${MULTIARCH}" ];then + docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1 + else + docker buildx bake --file build-images.yml --no-cache|| clean 1 + fi return 0 } @@ -76,10 +107,13 @@ help() { echo echo "Usage: $0 [OPTIONS]" echo - echo " -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default." + echo " -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default." echo " -f, --filebeat-module [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}." echo " -r, --revision [Optional] Package revision. By default ${WAZUH_TAG_REVISION}" + echo " -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release." + echo " -rg, --registry [Optional] Set the Docker registry to push the images." echo " -v, --version [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}." + echo " -m, --multiarch [Optional] Enable multi-architecture builds." echo " -h, --help Show this help." echo exit $1 @@ -110,6 +144,10 @@ main() { help 1 fi ;; + "-m"|"--multiarch") + MULTIARCH="true" + shift + ;; "-r"|"--revision") if [ -n "${2}" ]; then WAZUH_TAG_REVISION="${2}" @@ -118,6 +156,22 @@ main() { help 1 fi ;; + "-ref"|"--reference") + if [ -n "${2}" ]; then + WAZUH_TAG_REFERENCE="${2}" + shift 2 + else + help 1 + fi + ;; + "-rg"|"--registry") + if [ -n "${2}" ]; then + WAZUH_REGISTRY="${2}" + shift 2 + else + help 1 + fi + ;; "-v"|"--version") if [ -n "$2" ]; then WAZUH_IMAGE_VERSION="$2" diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 35d8d7a2..8f077440 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -8,7 +8,7 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH} WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE} - image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager restart: always ports: @@ -38,7 +38,7 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG} hostname: wazuh.agent restart: always @@ -48,7 +48,7 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer restart: always ports: @@ -70,7 +70,7 @@ services: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} - image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard restart: always ports: diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 27fc4c30..f63304ab 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -62,9 +62,10 @@ COPY config/entrypoint.sh / COPY config/securityadmin.sh / -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh - -RUN chown 1000:1000 /*.sh +RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ + mkdir -p /usr/share/wazuh-indexer && \ + chown 1000:1000 /usr/share/wazuh-indexer && \ + chown 1000:1000 /*.sh COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index d2c11083..7078ab88 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -8,6 +8,7 @@ ARG WAZUH_TAG_REVISION ARG FILEBEAT_TEMPLATE_BRANCH ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 +ARG FILEBEAT_REVISION=2 ARG WAZUH_FILEBEAT_MODULE ARG S6_VERSION="v2.2.0.3" diff --git a/build-docker-images/wazuh-manager/config/filebeat_module.sh b/build-docker-images/wazuh-manager/config/filebeat_module.sh index 9926c6c1..dc475a47 100644 --- a/build-docker-images/wazuh-manager/config/filebeat_module.sh +++ b/build-docker-images/wazuh-manager/config/filebeat_module.sh @@ -7,6 +7,5 @@ if [[ -n "${WAZUH_TAG}" ]]; then REPOSITORY="packages.wazuh.com/5.x" fi -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm &&\ -yum install -y ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-x86_64.rpm && \ +yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \ curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module \ No newline at end of file diff --git a/docs/dev/build-image.md b/docs/dev/build-image.md index 11fde42c..563f64e2 100644 --- a/docs/dev/build-image.md +++ b/docs/dev/build-image.md @@ -23,7 +23,7 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] - -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. + -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default. -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. diff --git a/indexer-certs-creator/Dockerfile b/indexer-certs-creator/Dockerfile index 58b2583f..b9772abf 100644 --- a/indexer-certs-creator/Dockerfile +++ b/indexer-certs-creator/Dockerfile @@ -1,7 +1,7 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM ubuntu:focal +FROM amazonlinux:2023 -RUN apt-get update && apt-get install openssl curl -y +RUN yum update -y && yum install openssl curl-minimal -y WORKDIR / diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md index 10965097..8ddccdf5 100644 --- a/indexer-certs-creator/README.md +++ b/indexer-certs-creator/README.md @@ -5,5 +5,5 @@ The dockerfile hosted in this directory is used to build the image used to boot To create the image, the following command must be executed: ``` -$ docker build -t wazuh/wazuh-certs-generator:0.0.2 . +$ docker build -t wazuh/wazuh-certs-generator:0.0.3 . ``` diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index 16f01da2..a222a5b9 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -8,29 +8,35 @@ ## Variables CERT_TOOL=wazuh-certs-tool.sh PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/5.0/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ +PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ -## Check if the cert tool exists in S3 buckets -CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL") -CERT_TOOL_PACKAGES_DEV=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_DEV_URL$CERT_TOOL") +OUTPUT_FILE="/$CERT_TOOL" -## If cert tool exists in some bucket, download it, if not exit 1 -if [ "$CERT_TOOL_PACKAGES" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL -s - echo "The tool to create the certificates exists in the in Packages bucket" -elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL -s - echo "The tool to create the certificates exists in Packages-dev bucket" +download_package() { + local url=$1 + echo "Checking $url$CERT_TOOL ..." + if curl -fsL "$url$CERT_TOOL" -o "$OUTPUT_FILE"; then + echo "Downloaded $CERT_TOOL from $url" + return 0 + else + return 1 + fi +} + +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL"; then + : +elif download_package "$PACKAGES_DEV_URL"; then + : else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 + echo "The tool to create the certificates does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 fi cp /config/certs.yml /config.yml - -chmod 700 /$CERT_TOOL +chmod 700 "$OUTPUT_FILE" ############################################################################## # Creating Cluster certificates diff --git a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml index 77b8381d..b59c48c1 100644 --- a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -14,4 +14,3 @@ uiSettings.overrides.defaultRoute: /app/wz-home opensearch_security.cookie.ttl: 900000 opensearch_security.session.ttl: 900000 opensearch_security.session.keepalive: true -assistant.chat.enabled: true diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml index 3142ab1a..88927593 100644 --- a/multi-node/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -1,8 +1,10 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: generator: - image: wazuh/wazuh-certs-generator:0.0.2 + image: wazuh/wazuh-certs-generator:0.0.3 hostname: wazuh-certs-generator + environment: + - CERT_TOOL_VERSION=4.14 volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ - ./config/certs.yml:/config/certs.yml \ No newline at end of file diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml index d8473877..07c81abf 100644 --- a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml @@ -14,4 +14,3 @@ uiSettings.overrides.defaultRoute: /app/wz-home opensearch_security.cookie.ttl: 900000 opensearch_security.session.ttl: 900000 opensearch_security.session.keepalive: true -assistant.chat.enabled: true diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml index b7b7efb6..a941280f 100644 --- a/single-node/generate-indexer-certs.yml +++ b/single-node/generate-indexer-certs.yml @@ -1,8 +1,10 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: generator: - image: wazuh/wazuh-certs-generator:0.0.2 + image: wazuh/wazuh-certs-generator:0.0.3 hostname: wazuh-certs-generator + environment: + - CERT_TOOL_VERSION=4.14 volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ - ./config/certs.yml:/config/certs.yml From 9882a9ca6d348fba9fc7730fa8570aa799796fba Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 28 Oct 2025 01:29:44 +0700 Subject: [PATCH 011/142] Change expiration time --- .../Procedure_push_docker_images.yml | 47 ++++++++----------- 1 file changed, 19 insertions(+), 28 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 7bfe0c67..58148422 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -134,37 +134,28 @@ jobs: if : ${{ inputs.dev == true }} run: | cat << EOF > packages-url.txt - wazuh_manager_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) - wazuh_manager_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) - wazuh_manager_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) - wazuh_manager_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) - wazuh_indexer_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) - wazuh_indexer_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) - wazuh_indexer_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) - wazuh_indexer_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) - wazuh_dashboard_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) - wazuh_dashboard_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) - wazuh_dashboard_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) - wazuh_dashboard_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) - wazuh_agent_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 43200 --region us-west-1) - wazuh_agent_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 43200 --region us-west-1) - wazuh_agent_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 43200 --region us-west-1) - wazuh_agent_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 43200 --region us-west-1) - wazuh_agent_url_i386_msi: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 43200 --region us-west-1) - wazuh_agent_url_intel64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 43200 --region us-west-1) - wazuh_agent_url_arm64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 43200 --region us-west-1) + wazuh_manager_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_manager_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_manager_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_manager_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_indexer_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_indexer_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_indexer_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_indexer_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_agent_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_agent_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_i386_msi: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1) + wazuh_agent_url_intel64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1) + wazuh_agent_url_arm64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1) EOF - cat packages-url.txt working-directory: ./build-docker-images - - name: Save packages_url.txt file created as artifact - if: ${{ inputs.dev == true }} - uses: actions/upload-artifact@v4 - with: - name: packages_url.txt - path: /home/runner/work/wazuh-docker/wazuh-docker/build-docker-images/packages-url.txt - retention-days: 5 - - name: Build Wazuh images run: | if [ "${{ inputs.dev }}" = true ]; then From babaea694e2828a5f71477b6718c5ed7a5a5bfdd Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:11:30 +0700 Subject: [PATCH 012/142] Change install option --- .env | 8 +-- .gitignore | 4 +- build-docker-images/build-images.sh | 46 +++-------------- build-docker-images/build-images.yml | 16 +++--- build-docker-images/wazuh-agent/Dockerfile | 20 +++----- .../wazuh-agent/config/check_repository.sh | 15 ------ .../wazuh-dashboard/Dockerfile | 22 ++++---- .../config/check_repository.sh | 15 ------ build-docker-images/wazuh-indexer/Dockerfile | 29 +++-------- .../wazuh-indexer/config/check_repository.sh | 15 ------ build-docker-images/wazuh-manager/Dockerfile | 38 ++++---------- .../wazuh-manager/config/check_repository.sh | 15 ------ .../config/etc/cont-init.d/1-config-filebeat | 51 ------------------- .../etc/cont-init.d/{2-manager => 1-manager} | 0 .../config/etc/services.d/filebeat/finish | 6 --- .../config/etc/services.d/filebeat/run | 4 -- .../wazuh-manager/config/filebeat_module.sh | 11 ---- .../wazuh-manager/config/permanent_data.env | 6 --- docs/dev/build-image.md | 1 - 19 files changed, 56 insertions(+), 266 deletions(-) delete mode 100644 build-docker-images/wazuh-agent/config/check_repository.sh delete mode 100644 build-docker-images/wazuh-dashboard/config/check_repository.sh delete mode 100644 build-docker-images/wazuh-indexer/config/check_repository.sh delete mode 100644 build-docker-images/wazuh-manager/config/check_repository.sh delete mode 100644 build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat rename build-docker-images/wazuh-manager/config/etc/cont-init.d/{2-manager => 1-manager} (100%) delete mode 100644 build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish delete mode 100644 build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run delete mode 100644 build-docker-images/wazuh-manager/config/filebeat_module.sh diff --git a/.env b/.env index c2d4e554..a8180776 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ -WAZUH_VERSION=5.0.0 -WAZUH_IMAGE_VERSION=5.0.0 +WAZUH_VERSION=main +WAZUH_IMAGE_VERSION=main WAZUH_TAG_REVISION=1 -FILEBEAT_TEMPLATE_BRANCH=5.0.0 -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz WAZUH_UI_REVISION=1 +WAZUH_REGISTRY=docker.io +IMAGE_TAG=main diff --git a/.gitignore b/.gitignore index 31bc423a..0ead0852 100644 --- a/.gitignore +++ b/.gitignore @@ -2,4 +2,6 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem single-node/config/wazuh_indexer_ssl_certs/*.key multi-node/config/wazuh_indexer_ssl_certs/*.pem multi-node/config/wazuh_indexer_ssl_certs/*.key -*.log \ No newline at end of file +*.log +build-docker-images/packages_env.txt +build-docker-images/packages-url.txt \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index ceb4667d..402b160f 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,8 +1,10 @@ -WAZUH_IMAGE_VERSION=5.0.0 +WAZUH_IMAGE_VERSION=main +IMAGE_TAG=main WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +WAZUH_REGISTRY=docker.io # Wazuh package generator # Copyright (C) 2023, Wazuh Inc. @@ -12,11 +14,10 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="5.0.0" +WAZUH_IMAGE_VERSION="main" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" WAZUH_TAG_REFERENCE="" -FILEBEAT_MODULE_VERSION="0.4" # ----------------------------------------------------------------------------- @@ -38,31 +39,11 @@ ctrl_c() { build() { WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')" - FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}" WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}" - WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz" WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" - if [ -z "${WAZUH_TAG_REFERENCE}" ]; then - if [ "${WAZUH_DEV_STAGE}" ];then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}" - if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 - fi - else - if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}" - elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}" - else - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 - fi - fi - fi # Variables - FILE="packages_url.txt" + FILE="packages-url.txt" if [[ -f "$FILE" ]]; then echo "$FILE exists. Using existing file." @@ -77,20 +58,18 @@ build() { curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" fi fi - sed -Ei 's/^([^:]+):[[:space:]]+(https?:\/\/.*)$/\1=\2/' $FILE - sed 's/[-.]/_/g' $FILE > packages_env.txt + awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env - echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> ../.env - echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> ../.env echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env + echo IMAGE_TAG=$IMAGE_TAG >> ../.env set -a source ../.env - source packages_env.txt + source ./packages_env.txt set +a if [ "${MULTIARCH}" ];then @@ -108,7 +87,6 @@ help() { echo "Usage: $0 [OPTIONS]" echo echo " -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default." - echo " -f, --filebeat-module [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}." echo " -r, --revision [Optional] Package revision. By default ${WAZUH_TAG_REVISION}" echo " -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release." echo " -rg, --registry [Optional] Set the Docker registry to push the images." @@ -136,14 +114,6 @@ main() { help 1 fi ;; - "-f"|"--filebeat-module") - if [ -n "${2}" ]; then - FILEBEAT_MODULE_VERSION="${2}" - shift 2 - else - help 1 - fi - ;; "-m"|"--multiarch") MULTIARCH="true" shift diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 8f077440..9ed60754 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -6,8 +6,8 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH} - WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE} + wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm} + wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm} image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager restart: always @@ -20,7 +20,6 @@ services: - INDEXER_URL=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - - FILEBEAT_SSL_VERIFICATION_MODE=none volumes: - wazuh_api_configuration:/var/ossec/api/configuration - wazuh_etc:/var/ossec/etc @@ -29,8 +28,6 @@ services: - wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat wazuh.agent: build: @@ -38,6 +35,8 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm} + wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm} image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG} hostname: wazuh.agent restart: always @@ -48,6 +47,8 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} + wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm} + wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm} image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer restart: always @@ -70,6 +71,8 @@ services: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} + wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm} + wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm} image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard restart: always @@ -94,5 +97,4 @@ volumes: wazuh_var_multigroups: wazuh_active_response: wazuh_wodles: - filebeat_etc: - filebeat_var: + diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 8a237787..fc24dbbd 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -10,18 +10,14 @@ ARG WAZUH_MANAGER='CHANGE_MANAGER_IP' ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT' ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP' ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT' -ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME' +ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME' +ARG wazuh_agent_url_amd64_rpm +ARG wazuh_agent_url_arm64_rpm -COPY config/check_repository.sh / - -RUN yum install curl-minimal tar gzip procps -y &&\ - yum clean all - -RUN chmod 775 /check_repository.sh -RUN source /check_repository.sh - -RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all && \ +RUN dnf install curl-minimal tar gzip procps -y &&\ + curl -o wazuh-agent.rpm "${wazuh_agent_url_amd64_rpm}" && \ + dnf install /wazuh-agent.rpm -y && \ + dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ @@ -31,6 +27,4 @@ RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ COPY config/etc/ /etc/ -RUN rm /etc/yum.repos.d/wazuh.repo - ENTRYPOINT [ "/init" ] diff --git a/build-docker-images/wazuh-agent/config/check_repository.sh b/build-docker-images/wazuh-agent/config/check_repository.sh deleted file mode 100644 index 26ff489c..00000000 --- a/build-docker-images/wazuh-agent/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 18f3976a..5cfae43d 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -5,16 +5,14 @@ ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION ARG WAZUH_UI_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard +ARG wazuh_dashboard_url_amd64_rpm +ARG wazuh_dashboard_url_arm64_rpm # Update and install dependencies -RUN yum install curl-minimal libcap openssl -y - -COPY config/check_repository.sh / -RUN chmod 775 /check_repository.sh && \ - source /check_repository.sh - -RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all +RUN dnf install curl-minimal libcap openssl -y && \ + curl -o wazuh-dashboard.rpm "${wazuh_dashboard_url_amd64_rpm}" && \ + dnf install /wazuh-dashboard.rpm -y && \ + dnf clean all # Create and set permissions to data directories RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh @@ -42,10 +40,8 @@ FROM amazonlinux:2023 ENV USER="wazuh-dashboard" \ GROUP="wazuh-dashboard" \ NAME="wazuh-dashboard" \ - INSTALL_DIR="/usr/share/wazuh-dashboard" - -# Set Wazuh app variables -ENV PATTERN="" \ + INSTALL_DIR="/usr/share/wazuh-dashboard" \ + PATTERN="" \ CHECKS_PATTERN="" \ CHECKS_TEMPLATE="" \ CHECKS_API="" \ @@ -60,7 +56,7 @@ ENV PATTERN="" \ WAZUH_MONITORING_REPLICAS="" # Update and install dependencies -RUN yum install shadow-utils -y +RUN dnf install shadow-utils -y && dnf clean all # Create wazuh-dashboard user and group RUN getent group $GROUP || groupadd -r -g 1000 $GROUP diff --git a/build-docker-images/wazuh-dashboard/config/check_repository.sh b/build-docker-images/wazuh-dashboard/config/check_repository.sh deleted file mode 100644 index 3defb44e..00000000 --- a/build-docker-images/wazuh-dashboard/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index f63304ab..41adaef0 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -3,31 +3,16 @@ FROM amazonlinux:2023 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION - -RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y - -COPY config/check_repository.sh / -RUN chmod 775 /check_repository.sh && \ - source /check_repository.sh - -RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all - -COPY config/opensearch.yml / +ARG wazuh_indexer_url_amd64_rpm +ARG wazuh_indexer_url_arm64_rpm COPY config/config.sh . -COPY config/config.yml / - -COPY config/action_groups.yml / - -COPY config/internal_users.yml / - -COPY config/roles_mapping.yml / - -COPY config/roles.yml / - -RUN bash config.sh +RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y &&\ + curl -o wazuh-indexer.rpm "${wazuh_indexer_url_amd64_rpm}" && \ + dnf install /wazuh-indexer.rpm -y && \ + dnf clean all && \ + bash config.sh ################################################################################ # Build stage 1 (the actual Wazuh indexer image): diff --git a/build-docker-images/wazuh-indexer/config/check_repository.sh b/build-docker-images/wazuh-indexer/config/check_repository.sh deleted file mode 100644 index 3defb44e..00000000 --- a/build-docker-images/wazuh-indexer/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 7078ab88..12a9329a 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -5,28 +5,15 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION -ARG FILEBEAT_TEMPLATE_BRANCH -ARG FILEBEAT_CHANNEL=filebeat-oss -ARG FILEBEAT_VERSION=7.10.2 -ARG FILEBEAT_REVISION=2 -ARG WAZUH_FILEBEAT_MODULE ARG S6_VERSION="v2.2.0.3" +ARG wazuh_manager_url_amd64_rpm +ARG wazuh_manager_url_arm64_rpm -RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ - yum clean all - -COPY config/check_repository.sh / -COPY config/filebeat_module.sh / -COPY config/permanent_data.env config/permanent_data.sh / - -RUN chmod 775 /check_repository.sh -RUN source /check_repository.sh - -RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ - yum clean all && \ - chmod 775 /filebeat_module.sh && \ - source /filebeat_module.sh && \ - rm /filebeat_module.sh && \ +RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ + dnf clean all && \ + curl -o wazuh-manager.rpm "${wazuh_manager_url_amd64_rpm}" && \ + dnf install /wazuh-manager.rpm -y && \ + dnf clean all && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ @@ -36,16 +23,11 @@ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \ COPY config/etc/ /etc/ COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py -COPY config/filebeat.yml /etc/filebeat/ - -RUN chmod go-w /etc/filebeat/filebeat.yml - -ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat -RUN chmod go-w /etc/filebeat/wazuh-template.json - # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 +COPY config/permanent_data.env config/permanent_data.sh / + #Make mount directories for keep permissions RUN mkdir -p /var/ossec/var/multigroups && \ @@ -58,8 +40,6 @@ RUN mkdir -p /var/ossec/var/multigroups && \ sync && /permanent_data.sh && \ sync && rm /permanent_data.sh -RUN rm /etc/yum.repos.d/wazuh.repo - # Services ports EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh deleted file mode 100644 index 3defb44e..00000000 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ /dev/null @@ -1,15 +0,0 @@ -## variables -APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH -GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" -REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH - GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" - REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/5.x/yum/\nprotect=1" -fi - -rpm --import "${APT_KEY}" -echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat deleted file mode 100644 index 0a3ed8ff..00000000 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat +++ /dev/null @@ -1,51 +0,0 @@ -#!/usr/bin/with-contenv bash -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) - -set -e - -if [ "$INDEXER_URL" != "" ]; then - >&2 echo "Customize Elasticsearch output IP" - sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml -fi - -# Configure filebeat.yml security settings - -if [ "$INDEXER_USERNAME" != "" ]; then - >&2 echo "Configuring username." - sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml - sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml -fi - -if [ "$INDEXER_PASSWORD" != "" ]; then - >&2 echo "Configuring password." - sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml - sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml -fi - -if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then - >&2 echo "Configuring SSL verification mode." - sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml - sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml -fi - -if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then - >&2 echo "Configuring Certificate Authorities." - sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml - sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml -fi - -if [ "$SSL_CERTIFICATE" != "" ]; then - >&2 echo "Configuring SSL Certificate." - sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml - sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml -fi - -if [ "$SSL_KEY" != "" ]; then - >&2 echo "Configuring SSL Key." - sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml - sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml -fi - - -chmod go-w /etc/filebeat/filebeat.yml || true -chown root: /etc/filebeat/filebeat.yml || true diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager similarity index 100% rename from build-docker-images/wazuh-manager/config/etc/cont-init.d/2-manager rename to build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager diff --git a/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish deleted file mode 100644 index 8813eb67..00000000 --- a/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/finish +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env sh -echo >&2 "Filebeat exited. code=${1}" - -# terminate other services to exit from the container -exec s6-svscanctl -t /var/run/s6/services - diff --git a/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run b/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run deleted file mode 100644 index 706ee5af..00000000 --- a/build-docker-images/wazuh-manager/config/etc/services.d/filebeat/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh -echo >&2 "starting Filebeat" - -exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat diff --git a/build-docker-images/wazuh-manager/config/filebeat_module.sh b/build-docker-images/wazuh-manager/config/filebeat_module.sh deleted file mode 100644 index dc475a47..00000000 --- a/build-docker-images/wazuh-manager/config/filebeat_module.sh +++ /dev/null @@ -1,11 +0,0 @@ -## variables -REPOSITORY="packages-dev.wazuh.com/pre-release" -WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$) - -## check tag to use the correct repository -if [[ -n "${WAZUH_TAG}" ]]; then - REPOSITORY="packages.wazuh.com/5.x" -fi - -yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \ -curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 26a61289..ae0527a3 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -7,7 +7,6 @@ PERMANENT_DATA[((i++))]="/var/ossec/queue" PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" PERMANENT_DATA[((i++))]="/var/ossec/wodles" -PERMANENT_DATA[((i++))]="/etc/filebeat" export PERMANENT_DATA @@ -73,11 +72,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes" -PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json" -PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted diff --git a/docs/dev/build-image.md b/docs/dev/build-image.md index 563f64e2..4c2c4512 100644 --- a/docs/dev/build-image.md +++ b/docs/dev/build-image.md @@ -24,7 +24,6 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. -h, --help Show this help. From 3a605b3f6a28c45d223c2b822e84241dad2fb5f6 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:17:16 +0700 Subject: [PATCH 013/142] Delete filebeat options --- .../workflows/Procedure_push_docker_images.yml | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 58148422..c662c63d 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -11,10 +11,6 @@ on: docker_reference: description: 'wazuh-docker reference' required: true - filebeat_module_version: - description: 'Filebeat module version' - default: '0.4' - required: true revision: description: 'Package revision' default: '1' @@ -43,11 +39,6 @@ on: description: 'wazuh-docker reference' required: false type: string - filebeat_module_version: - description: 'Filebeat module version' - default: '0.4' - required: true - type: string revision: description: 'Package revision' default: '1' @@ -78,7 +69,6 @@ jobs: env: IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }} IMAGE_TAG: ${{ inputs.image_tag }} - FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }} REVISION: ${{ inputs.revision }} steps: @@ -160,7 +150,7 @@ jobs: run: | if [ "${{ inputs.dev }}" = true ]; then IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}" - ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }} + ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }} else if [[ "$IMAGE_TAG" == *"-"* ]]; then IFS='-' read -r -a tokens <<< "$IMAGE_TAG" @@ -170,9 +160,9 @@ jobs: fi DEV_STAGE=${tokens[1]} WAZUH_VER=${tokens[0]} - ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m + ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m else - ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m + ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m fi fi # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV From 34ebf7a8592e86525a9b5520d22eee0e0742728c Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:23:29 +0700 Subject: [PATCH 014/142] Add quotes to URLs --- .../Procedure_push_docker_images.yml | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index c662c63d..35a99c5e 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -124,25 +124,25 @@ jobs: if : ${{ inputs.dev == true }} run: | cat << EOF > packages-url.txt - wazuh_manager_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) - wazuh_manager_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) - wazuh_manager_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) - wazuh_manager_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) - wazuh_indexer_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) - wazuh_indexer_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) - wazuh_indexer_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) - wazuh_indexer_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) - wazuh_dashboard_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) - wazuh_dashboard_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) - wazuh_dashboard_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) - wazuh_dashboard_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) - wazuh_agent_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) - wazuh_agent_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) - wazuh_agent_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) - wazuh_agent_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) - wazuh_agent_url_i386_msi: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1) - wazuh_agent_url_intel64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1) - wazuh_agent_url_arm64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1) + wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" + wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" + wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" + wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" + wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" + wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" + wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" + wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" + wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" + wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" + wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" + wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" + wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" + wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" + wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" + wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" + wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" + wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" + wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images From d46c4ef5b2defc887efa074c68ffb05415dbded2 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:32:31 +0700 Subject: [PATCH 015/142] Add rpm path --- build-docker-images/wazuh-agent/Dockerfile | 2 +- build-docker-images/wazuh-dashboard/Dockerfile | 2 +- build-docker-images/wazuh-indexer/Dockerfile | 2 +- build-docker-images/wazuh-manager/Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index fc24dbbd..8e0b59d0 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -15,7 +15,7 @@ ARG wazuh_agent_url_amd64_rpm ARG wazuh_agent_url_arm64_rpm RUN dnf install curl-minimal tar gzip procps -y &&\ - curl -o wazuh-agent.rpm "${wazuh_agent_url_amd64_rpm}" && \ + curl -o /wazuh-agent.rpm "${wazuh_agent_url_amd64_rpm}" && \ dnf install /wazuh-agent.rpm -y && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 5cfae43d..a00233b2 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -10,7 +10,7 @@ ARG wazuh_dashboard_url_arm64_rpm # Update and install dependencies RUN dnf install curl-minimal libcap openssl -y && \ - curl -o wazuh-dashboard.rpm "${wazuh_dashboard_url_amd64_rpm}" && \ + curl -o /wazuh-dashboard.rpm "${wazuh_dashboard_url_amd64_rpm}" && \ dnf install /wazuh-dashboard.rpm -y && \ dnf clean all diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 41adaef0..526da7ea 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -9,7 +9,7 @@ ARG wazuh_indexer_url_arm64_rpm COPY config/config.sh . RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y &&\ - curl -o wazuh-indexer.rpm "${wazuh_indexer_url_amd64_rpm}" && \ + curl -o /wazuh-indexer.rpm "${wazuh_indexer_url_amd64_rpm}" && \ dnf install /wazuh-indexer.rpm -y && \ dnf clean all && \ bash config.sh diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 12a9329a..614bf6f6 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -11,7 +11,7 @@ ARG wazuh_manager_url_arm64_rpm RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ dnf clean all && \ - curl -o wazuh-manager.rpm "${wazuh_manager_url_amd64_rpm}" && \ + curl -o /wazuh-manager.rpm "${wazuh_manager_url_amd64_rpm}" && \ dnf install /wazuh-manager.rpm -y && \ dnf clean all && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ From d654b17189c4898470eb96e35aa0e02674ccf679 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:35:14 +0700 Subject: [PATCH 016/142] Add packages-url.txt artifact --- .github/workflows/Procedure_push_docker_images.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 35a99c5e..9c647b42 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -146,6 +146,14 @@ jobs: EOF working-directory: ./build-docker-images + - name: Save packages-url.txt as artifact + if: ${{ inputs.dev == true }} + uses: actions/upload-artifact@v4 + with: + name: packages-url.txt + path: /home/runner/work/wazuh-docker/wazuh-docker/build-docker-images/packages-url.txt + retention-days: 1 + - name: Build Wazuh images run: | if [ "${{ inputs.dev }}" = true ]; then From 46829ed9ee279ee58a70e9d77da148f9e6d30fbc Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 22:58:39 +0700 Subject: [PATCH 017/142] Add architecture target --- build-docker-images/wazuh-agent/Dockerfile | 2 +- build-docker-images/wazuh-dashboard/Dockerfile | 2 +- build-docker-images/wazuh-indexer/Dockerfile | 2 +- build-docker-images/wazuh-manager/Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 8e0b59d0..61b19bed 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -15,7 +15,7 @@ ARG wazuh_agent_url_amd64_rpm ARG wazuh_agent_url_arm64_rpm RUN dnf install curl-minimal tar gzip procps -y &&\ - curl -o /wazuh-agent.rpm "${wazuh_agent_url_amd64_rpm}" && \ + curl -o /wazuh-agent.rpm "${wazuh_agent_url_$TARGETARCH_rpm}" && \ dnf install /wazuh-agent.rpm -y && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index a00233b2..16db2b83 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -10,7 +10,7 @@ ARG wazuh_dashboard_url_arm64_rpm # Update and install dependencies RUN dnf install curl-minimal libcap openssl -y && \ - curl -o /wazuh-dashboard.rpm "${wazuh_dashboard_url_amd64_rpm}" && \ + curl -o /wazuh-dashboard.rpm "${wazuh_dashboard_url_$TARGETARCH_rpm}" && \ dnf install /wazuh-dashboard.rpm -y && \ dnf clean all diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 526da7ea..e627373b 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -9,7 +9,7 @@ ARG wazuh_indexer_url_arm64_rpm COPY config/config.sh . RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y &&\ - curl -o /wazuh-indexer.rpm "${wazuh_indexer_url_amd64_rpm}" && \ + curl -o /wazuh-indexer.rpm "${wazuh_indexer_url_$TARGETARCH_rpm}" && \ dnf install /wazuh-indexer.rpm -y && \ dnf clean all && \ bash config.sh diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 614bf6f6..104d8929 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -11,7 +11,7 @@ ARG wazuh_manager_url_arm64_rpm RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ dnf clean all && \ - curl -o /wazuh-manager.rpm "${wazuh_manager_url_amd64_rpm}" && \ + curl -o /wazuh-manager.rpm "${wazuh_manager_url_$TARGETARCH_rpm}" && \ dnf install /wazuh-manager.rpm -y && \ dnf clean all && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ From cb8a69026f6dde12012e09a0ea608804b1d4df61 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 23:09:19 +0700 Subject: [PATCH 018/142] Add url variables --- build-docker-images/wazuh-agent/Dockerfile | 7 +++++-- build-docker-images/wazuh-dashboard/Dockerfile | 7 +++++-- build-docker-images/wazuh-indexer/Dockerfile | 7 +++++-- build-docker-images/wazuh-manager/Dockerfile | 7 +++++-- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 61b19bed..3b90c23e 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -11,11 +11,14 @@ ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT' ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP' ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT' ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME' +ARG TARGETARCH ARG wazuh_agent_url_amd64_rpm ARG wazuh_agent_url_arm64_rpm -RUN dnf install curl-minimal tar gzip procps -y &&\ - curl -o /wazuh-agent.rpm "${wazuh_agent_url_$TARGETARCH_rpm}" && \ +RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ + agent_url="${!URL_VAR}" && \ + dnf install curl-minimal tar gzip procps -y &&\ + curl -o /wazuh-agent.rpm "${agent_url}" && \ dnf install /wazuh-agent.rpm -y && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 16db2b83..aef330c9 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -5,12 +5,15 @@ ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION ARG WAZUH_UI_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard +ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm # Update and install dependencies -RUN dnf install curl-minimal libcap openssl -y && \ - curl -o /wazuh-dashboard.rpm "${wazuh_dashboard_url_$TARGETARCH_rpm}" && \ +RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \ + dashboard_url="${!URL_VAR}" && \ + dnf install curl-minimal libcap openssl -y && \ + curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \ dnf install /wazuh-dashboard.rpm -y && \ dnf clean all diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index e627373b..ed250a4d 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -3,13 +3,16 @@ FROM amazonlinux:2023 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION +ARG TARGETARCH ARG wazuh_indexer_url_amd64_rpm ARG wazuh_indexer_url_arm64_rpm COPY config/config.sh . -RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y &&\ - curl -o /wazuh-indexer.rpm "${wazuh_indexer_url_$TARGETARCH_rpm}" && \ +RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \ + indexer_url="${!URL_VAR}" && \ + dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\ + curl -o /wazuh-indexer.rpm "${indexer_url}" && \ dnf install /wazuh-indexer.rpm -y && \ dnf clean all && \ bash config.sh diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 104d8929..258638e4 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -6,12 +6,15 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION ARG S6_VERSION="v2.2.0.3" +ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm -RUN dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ +RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ + manager_url="${!URL_VAR}" && \ + dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\ dnf clean all && \ - curl -o /wazuh-manager.rpm "${wazuh_manager_url_$TARGETARCH_rpm}" && \ + curl -o /wazuh-manager.rpm "${manager_url}" && \ dnf install /wazuh-manager.rpm -y && \ dnf clean all && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ From 8c6a0a931912cce70d1d2bff4b2820adf4159280 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 23:28:06 +0700 Subject: [PATCH 019/142] Add free space step --- .github/workflows/Procedure_push_docker_images.yml | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 9c647b42..cfb6454c 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -91,6 +91,9 @@ jobs: echo "* dev reference: ${{ inputs.reference }}" echo "---------------------------------------------" + - name: free disk space + uses: ./.github/free-disk-space + - name: Checkout repository uses: actions/checkout@v4 with: @@ -146,14 +149,6 @@ jobs: EOF working-directory: ./build-docker-images - - name: Save packages-url.txt as artifact - if: ${{ inputs.dev == true }} - uses: actions/upload-artifact@v4 - with: - name: packages-url.txt - path: /home/runner/work/wazuh-docker/wazuh-docker/build-docker-images/packages-url.txt - retention-days: 1 - - name: Build Wazuh images run: | if [ "${{ inputs.dev }}" = true ]; then From eb49d515d8a92839f728e0f1caf3946ac3b15d66 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 30 Oct 2025 23:32:32 +0700 Subject: [PATCH 020/142] Add free space step --- .github/workflows/Procedure_push_docker_images.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index cfb6454c..e8094f83 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -91,13 +91,13 @@ jobs: echo "* dev reference: ${{ inputs.reference }}" echo "---------------------------------------------" - - name: free disk space - uses: ./.github/free-disk-space - - name: Checkout repository uses: actions/checkout@v4 with: ref: ${{ inputs.docker_reference }} + + - name: free disk space + uses: ./.github/free-disk-space - name: Set up QEMU uses: docker/setup-qemu-action@v3 From fd5034c3d51fc5df7b8063204d8269e2fcd8c35e Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 31 Oct 2025 00:44:42 +0700 Subject: [PATCH 021/142] Modify packages_url.txt filename --- .github/workflows/Procedure_push_docker_images.yml | 4 ++-- .gitignore | 2 +- build-docker-images/build-images.sh | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index e8094f83..c6b17fe0 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -123,10 +123,10 @@ jobs: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - - name: Create packages-url.txt file + - name: Create packages_url.txt file if : ${{ inputs.dev == true }} run: | - cat << EOF > packages-url.txt + cat << EOF > packages_url.txt wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" diff --git a/.gitignore b/.gitignore index 0ead0852..269239fd 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,4 @@ multi-node/config/wazuh_indexer_ssl_certs/*.pem multi-node/config/wazuh_indexer_ssl_certs/*.key *.log build-docker-images/packages_env.txt -build-docker-images/packages-url.txt \ No newline at end of file +build-docker-images/packages_url.txt \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 402b160f..95b23ebd 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -43,7 +43,7 @@ build() { WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" # Variables - FILE="packages-url.txt" + FILE="packages_url.txt" if [[ -f "$FILE" ]]; then echo "$FILE exists. Using existing file." From 913dd89e272b72de04e2d53d44c345dbc3214a15 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 31 Oct 2025 01:01:58 +0700 Subject: [PATCH 022/142] Add changelog --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b9495b7..a748abc8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file. ### Changed +- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058)) +- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054)) - Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030)) - Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366)) From 742a948715dbd36663b7dfff93980bfda2b59d1a Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 5 Nov 2025 22:08:36 +0700 Subject: [PATCH 023/142] Delete config files and adapt dockerfiles --- .../wazuh-dashboard/Dockerfile | 34 ++-- .../wazuh-dashboard/config/config.sh | 73 ++++++-- .../wazuh-dashboard/config/config.yml | 5 - .../wazuh-dashboard/config/wazuh.yml | 155 ---------------- .../config/wazuh_app_config.sh | 8 - build-docker-images/wazuh-indexer/Dockerfile | 53 +++--- .../wazuh-indexer/config/action_groups.yml | 12 -- .../wazuh-indexer/config/config.sh | 133 +++++++------- .../wazuh-indexer/config/config.yml | 5 - .../wazuh-indexer/config/internal_users.yml | 74 -------- .../wazuh-indexer/config/opensearch.yml | 26 --- .../wazuh-indexer/config/roles.yml | 171 ------------------ .../wazuh-indexer/config/roles_mapping.yml | 78 -------- .../wazuh-manager/config/filebeat.yml | 31 ---- 14 files changed, 154 insertions(+), 704 deletions(-) delete mode 100644 build-docker-images/wazuh-dashboard/config/config.yml delete mode 100644 build-docker-images/wazuh-dashboard/config/wazuh.yml delete mode 100644 build-docker-images/wazuh-indexer/config/action_groups.yml delete mode 100644 build-docker-images/wazuh-indexer/config/config.yml delete mode 100644 build-docker-images/wazuh-indexer/config/internal_users.yml delete mode 100644 build-docker-images/wazuh-indexer/config/opensearch.yml delete mode 100644 build-docker-images/wazuh-indexer/config/roles.yml delete mode 100644 build-docker-images/wazuh-indexer/config/roles_mapping.yml delete mode 100644 build-docker-images/wazuh-manager/config/filebeat.yml diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index aef330c9..c02123d6 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -21,13 +21,11 @@ RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \ RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs -COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node # Generate certificates COPY config/config.sh . -COPY config/config.yml / RUN bash config.sh ################################################################################ @@ -58,34 +56,32 @@ ENV USER="wazuh-dashboard" \ WAZUH_MONITORING_SHARDS="" \ WAZUH_MONITORING_REPLICAS="" -# Update and install dependencies -RUN dnf install shadow-utils -y && dnf clean all +# Copy and set permissions to scripts +COPY config/entrypoint.sh / +COPY config/wazuh_app_config.sh / -# Create wazuh-dashboard user and group -RUN getent group $GROUP || groupadd -r -g 1000 $GROUP -RUN useradd --system \ +# Update and install dependencies +RUN yum install shadow-utils -y && \ + yum clean all && \ + getent group $GROUP || groupadd -r -g 1000 $GROUP && \ + useradd --system \ --uid 1000 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ --shell /sbin/nologin \ --comment "$USER user" \ - $USER - -# Copy and set permissions to scripts -COPY config/entrypoint.sh / -COPY config/wazuh_app_config.sh / -RUN chmod 700 /entrypoint.sh -RUN chmod 700 /wazuh_app_config.sh -RUN chown 1000:1000 /*.sh + $USER && \ + chmod 700 /entrypoint.sh && \ + chmod 700 /wazuh_app_config.sh && \ + mkdir -p $INSTALL_DIR && \ + chown 1000:1000 $INSTALL_DIR && \ + chown 1000:1000 /*.sh && \ + mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR -# Create custom directory -RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom -RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom - # Set workdir and user WORKDIR $INSTALL_DIR USER wazuh-dashboard diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index b2cbfea4..36011034 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -9,34 +9,71 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh -PACKAGES_URL=https://packages.wazuh.com/5.0/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ +CERT_CONFIG_FILE=config.yml +CERT_TOOL_VERSION="${WAZUH_VERSION%.*}" +PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ -## Check if the cert tool exists in S3 buckets -CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') -CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') +download_package() { + local url=$1 + local package=$2 + local output=$2 + echo "Checking $url$package ..." + if curl -fsL "$url$package" -o "$output"; then + echo "Downloaded $package from $url" + return 0 + else + return 1 + fi +} -## If cert tool exists in some bucket, download it, if not exit 1 -if [ "$CERT_TOOL_PACKAGES" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL - echo "Cert tool exists in Packages bucket" -elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL - echo "Cert tool exists in Packages-dev bucket" +# Download the tool to create the certificates +echo "Downloading the tool to create the certificates..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_TOOL"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then + : else - echo "Cert tool does not exist in any bucket" - exit 1 + echo "The tool to create the certificates does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 fi -chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A +# Download the config file for the certificate tool +echo "Downloading the config file for the certificate tool..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then + : +else + echo "The config file for the certificate tool does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 +fi + +# Modify the config file to set the IP to localhost +sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE + +chmod 700 "$CERT_CONFIG_FILE" +# Create the certificates +chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A # Create certs directory mkdir -p ${CONFIG_DIR}/certs # Copy Wazuh dashboard certs to install config dir -cp /wazuh-certificates/demo.dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem -cp /wazuh-certificates/demo.dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem -cp /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem +mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ +cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem +cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem +cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key +cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem +cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem +cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem + +# Modify opensearch.yml config paths +sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml chmod -R 500 ${CONFIG_DIR}/certs chmod -R 400 ${CONFIG_DIR}/certs/* \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/config.yml b/build-docker-images/wazuh-dashboard/config/config.yml deleted file mode 100644 index 24764d54..00000000 --- a/build-docker-images/wazuh-dashboard/config/config.yml +++ /dev/null @@ -1,5 +0,0 @@ -nodes: - # Wazuh dashboard server nodes - dashboard: - - name: demo.dashboard - ip: demo.dashboard \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/wazuh.yml b/build-docker-images/wazuh-dashboard/config/wazuh.yml deleted file mode 100644 index 8e5f9447..00000000 --- a/build-docker-images/wazuh-dashboard/config/wazuh.yml +++ /dev/null @@ -1,155 +0,0 @@ ---- -# -# Wazuh app - App configuration file -# Copyright (C) 2017, Wazuh Inc. -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation; either version 2 of the License, or -# (at your option) any later version. -# -# Find more information about this on the LICENSE file. -# -# ======================== Wazuh app configuration file ======================== -# -# Please check the documentation for more information on configuration options: -# https://documentation.wazuh.com/current/installation-guide/index.html -# -# Also, you can check our repository: -# https://github.com/wazuh/wazuh-dashboard-plugins -# -# ------------------------------- Index patterns ------------------------------- -# -# Default index pattern to use. -#pattern: wazuh-alerts-* -# -# ----------------------------------- Checks ----------------------------------- -# -# Defines which checks must to be consider by the healthcheck -# step once the Wazuh app starts. Values must to be true or false. -#checks.pattern : true -#checks.template: true -#checks.api : true -#checks.setup : true -#checks.metaFields: true -# -# --------------------------------- Extensions --------------------------------- -# -# Defines which extensions should be activated when you add a new API entry. -# You can change them after Wazuh app starts. -# Values must to be true or false. -#extensions.pci : true -#extensions.gdpr : true -#extensions.hipaa : true -#extensions.nist : true -#extensions.tsc : true -#extensions.audit : true -#extensions.oscap : false -#extensions.ciscat : false -#extensions.aws : false -#extensions.gcp : false -#extensions.virustotal: false -#extensions.osquery : false -#extensions.docker : false -# -# ---------------------------------- Time out ---------------------------------- -# -# Defines maximum timeout to be used on the Wazuh app requests. -# It will be ignored if it is bellow 1500. -# It means milliseconds before we consider a request as failed. -# Default: 20000 -#timeout: 20000 -# -# -------------------------------- API selector -------------------------------- -# -# Defines if the user is allowed to change the selected -# API directly from the Wazuh app top menu. -# Default: true -#api.selector: true -# -# --------------------------- Index pattern selector --------------------------- -# -# Defines if the user is allowed to change the selected -# index pattern directly from the Wazuh app top menu. -# Default: true -#ip.selector: true -# -# List of index patterns to be ignored -#ip.ignore: [] -# -# ------------------------------ wazuh-monitoring ------------------------------ -# -# Custom setting to enable/disable wazuh-monitoring indices. -# Values: true, false, worker -# If worker is given as value, the app will show the Agents status -# visualization but won't insert data on wazuh-monitoring indices. -# Default: true -#wazuh.monitoring.enabled: true -# -# Custom setting to set the frequency for wazuh-monitoring indices cron task. -# Default: 900 (s) -#wazuh.monitoring.frequency: 900 -# -# Configure wazuh-monitoring-* indices shards and replicas. -#wazuh.monitoring.shards: 2 -#wazuh.monitoring.replicas: 0 -# -# Configure wazuh-monitoring-* indices custom creation interval. -# Values: h (hourly), d (daily), w (weekly), m (monthly) -# Default: d -#wazuh.monitoring.creation: d -# -# Default index pattern to use for Wazuh monitoring -#wazuh.monitoring.pattern: wazuh-monitoring-* -# -# --------------------------------- wazuh-cron ---------------------------------- -# -# Customize the index prefix of predefined jobs -# This change is not retroactive, if you change it new indexes will be created -# cron.prefix: test -# -# ------------------------------ wazuh-statistics ------------------------------- -# -# Custom setting to enable/disable statistics tasks. -#cron.statistics.status: true -# -# Enter the ID of the APIs you want to save data from, leave this empty to run -# the task on all configured APIs -#cron.statistics.apis: [] -# -# Define the frequency of task execution using cron schedule expressions -#cron.statistics.interval: 0 0 * * * * -# -# Define the name of the index in which the documents are to be saved. -#cron.statistics.index.name: statistics -# -# Define the interval in which the index will be created -#cron.statistics.index.creation: w -# -# ------------------------------- App privileges -------------------------------- -#admin: true -# -# ---------------------------- Hide manager alerts ------------------------------ -# Hide the alerts of the manager in all dashboards and discover -#hideManagerAlerts: false -# -# ------------------------------- App logging level ----------------------------- -# Set the logging level for the Wazuh App log files. -# Default value: info -# Allowed values: info, debug -#logs.level: info -# -# -------------------------------- Enrollment DNS ------------------------------- -# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment. -# Default value: '' -#enrollment.dns: '' -# -#-------------------------------- API entries ----------------------------------- -#The following configuration is the default structure to define an API entry. -# -#hosts: -# - : -# url: http(s):// -# port: -# username: -# password: diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 76ecdc7f..e98a8b46 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -32,11 +32,6 @@ do fi done - -grep -q 1513629884013 $dashboard_config_file -_config_exists=$? - -if [[ $_config_exists -ne 0 ]]; then cat << EOF >> $dashboard_config_file hosts: - 1513629884013: @@ -46,7 +41,4 @@ hosts: password: $api_password run_as: $api_run_as EOF -else - echo "Wazuh APP already configured" -fi diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index ed250a4d..3772bd10 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -22,7 +22,6 @@ RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \ # # Copy wazuh-indexer from stage 0 # Add entrypoint - ################################################################################ FROM amazonlinux:2023 @@ -31,47 +30,39 @@ ENV USER="wazuh-indexer" \ NAME="wazuh-indexer" \ INSTALL_DIR="/usr/share/wazuh-indexer" -RUN yum install curl-minimal shadow-utils findutils hostname -y -RUN getent group $GROUP || groupadd -r -g 1000 $GROUP +COPY config/entrypoint.sh / +COPY config/securityadmin.sh / -RUN useradd --system \ +RUN yum install curl-minimal shadow-utils findutils hostname -y && \ + yum clean all && \ + getent group $GROUP || groupadd -r -g 1000 $GROUP && \ + useradd --system \ --uid 1000 \ --no-create-home \ --home-dir $INSTALL_DIR \ --gid $GROUP \ --shell /sbin/nologin \ --comment "$USER user" \ - $USER - -WORKDIR $INSTALL_DIR - -COPY config/entrypoint.sh / - -COPY config/securityadmin.sh / - -RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ - mkdir -p /usr/share/wazuh-indexer && \ - chown 1000:1000 /usr/share/wazuh-indexer && \ - chown 1000:1000 /*.sh - -COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer -COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config -COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d -COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d - -RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ - mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ + $USER && \ + chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \ + mkdir -p $INSTALL_DIR && \ + chown 1000:1000 $INSTALL_DIR && \ + chown 1000:1000 /*.sh && \ + mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ + mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer && \ - chmod 700 /usr/share/wazuh-indexer/config && \ - chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ - chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml + mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer + +COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR + +RUN chmod 700 $INSTALL_DIR && \ + chmod 700 $INSTALL_DIR/config && \ + chmod 600 $INSTALL_DIR/config/jvm.options && \ + chmod 600 $INSTALL_DIR/config/opensearch.yml USER wazuh-indexer +WORKDIR $INSTALL_DIR # Services ports EXPOSE 9200 diff --git a/build-docker-images/wazuh-indexer/config/action_groups.yml b/build-docker-images/wazuh-indexer/config/action_groups.yml deleted file mode 100644 index 04119c8a..00000000 --- a/build-docker-images/wazuh-indexer/config/action_groups.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -_meta: - type: "actiongroups" - config_version: 2 - -# ISM API permissions group -manage_ism: - reserved: true - hidden: false - allowed_actions: - - "cluster:admin/opendistro/ism/*" - static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 8e90485e..f1b11890 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -3,7 +3,6 @@ export DH_OPTIONS export NAME=wazuh-indexer -export TARGET_DIR=${CURDIR}/debian/${NAME} # Package build options export USER=${NAME} @@ -14,89 +13,81 @@ export LIB_DIR=/var/lib/${NAME} export PID_DIR=/run/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -export BASE_DIR=${NAME}-* -export INDEXER_FILE=wazuh-indexer-base.tar.xz -export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz -export REPO_DIR=/unattended_installer + + +############################################################################## +# Downloading Cert Gen Tool +############################################################################## ## Variables CERT_TOOL=wazuh-certs-tool.sh -PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/5.0/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/ +CERT_CONFIG_FILE=config.yml +CERT_TOOL_VERSION="${WAZUH_VERSION%.*}" +PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ +PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ -## Check if the cert tool exists in S3 buckets -CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') -CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}') +download_package() { + local url=$1 + local package=$2 + local output=$2 + echo "Checking $url$package ..." + if curl -fsL "$url$package" -o "$output"; then + echo "Downloaded $package from $url" + return 0 + else + return 1 + fi +} -## If cert tool exists in some bucket, download it, if not exit 1 -if [ "$CERT_TOOL_PACKAGES" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL - echo "Cert tool exists in Packages bucket" -elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then - curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL - echo "Cert tool exists in Packages-dev bucket" +# Download the tool to create the certificates +echo "Downloading the tool to create the certificates..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_TOOL"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then + : else - echo "Cert tool does not exist in any bucket" - exit 1 + echo "The tool to create the certificates does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 fi - -## Check if the password tool exists in S3 buckets -PASSWORD_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk '{print $2}') -PASSWORD_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk '{print $2}') - -## If password tool exists in some bucket, download it, if not exit 1 -if [ "$PASSWORD_TOOL_PACKAGES" = "200" ]; then - curl -o $PASSWORD_TOOL $PACKAGES_URL$PASSWORD_TOOL - echo "Password tool exists in Packages bucket" -elif [ "$PASSWORD_TOOL_PACKAGES_DEV" = "200" ]; then - curl -o $PASSWORD_TOOL $PACKAGES_DEV_URL$PASSWORD_TOOL - echo "Password tool exists in Packages-dev bucket" +# Download the config file for the certificate tool +echo "Downloading the config file for the certificate tool..." +# Try first the prod URL, if it fails try the dev URL +if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then + : +elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then + : else - echo "Password tool does not exist in any bucket" - exit 1 + echo "The config file for the certificate tool does not exist in any bucket" + echo "ERROR: certificates were not created" + exit 1 fi -chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A +# Modify the config file to set the IP to localhost +sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE -# copy to target -mkdir -p ${TARGET_DIR}${INSTALLATION_DIR} -mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ -mkdir -p ${TARGET_DIR}${CONFIG_DIR} -mkdir -p ${TARGET_DIR}${LIB_DIR} -mkdir -p ${TARGET_DIR}${LOG_DIR} -mkdir -p ${TARGET_DIR}/etc/init.d -mkdir -p ${TARGET_DIR}/etc/default -mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d -mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d -mkdir -p ${TARGET_DIR}/usr/lib/systemd/system -mkdir -p ${TARGET_DIR}${CONFIG_DIR}/certs -# Copy Wazuh's config files for the security plugin -cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ -cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ -cp -pr /action_groups.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ -cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ -cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} -# Copy Wazuh indexer's certificates -cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem -cp -pr /wazuh-certificates/demo.indexer-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer-key.pem -cp -pr /wazuh-certificates/root-ca.key ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem +chmod 700 "$CERT_CONFIG_FILE" +# Create the certificates +chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A + +# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR +mkdir -p ${CONFIG_DIR}/certs +mv /etc/wazuh-indexer/* ${CONFIG_DIR}/ +cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem +cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem +cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key +cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem +cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem +cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem + +# Modify opensearch.yml config paths +sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml # Delete xms and xmx parameters in jvm.options -sed '/-Xms/d' -i /etc/wazuh-indexer/jvm.options -sed '/-Xmx/d' -i /etc/wazuh-indexer/jvm.options sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options - -chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs -chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/* - -find ${TARGET_DIR} -type d -exec chmod 750 {} \; -find ${TARGET_DIR} -type f -perm 644 -exec chmod 640 {} \; -find ${TARGET_DIR} -type f -perm 664 -exec chmod 660 {} \; -find ${TARGET_DIR} -type f -perm 755 -exec chmod 750 {} \; -find ${TARGET_DIR} -type f -perm 744 -exec chmod 740 {} \; +chown -R ${USER}:${GROUP} ${CONFIG_DIR} +chmod -R 500 ${CONFIG_DIR}/certs +chmod -R 400 ${CONFIG_DIR}/certs/* \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.yml b/build-docker-images/wazuh-indexer/config/config.yml deleted file mode 100644 index e5383c7c..00000000 --- a/build-docker-images/wazuh-indexer/config/config.yml +++ /dev/null @@ -1,5 +0,0 @@ -nodes: - # Wazuh indexer server nodes - indexer: - - name: demo.indexer - ip: demo.indexer \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/internal_users.yml b/build-docker-images/wazuh-indexer/config/internal_users.yml deleted file mode 100644 index 40fcb9cd..00000000 --- a/build-docker-images/wazuh-indexer/config/internal_users.yml +++ /dev/null @@ -1,74 +0,0 @@ ---- -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -_meta: - type: "internalusers" - config_version: 2 - -# Define your internal users here - -## Demo users - -admin: - hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG" - reserved: true - backend_roles: - - "admin" - description: "Demo admin user" - -kibanaserver: - hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." - reserved: true - description: "Demo kibanaserver user" - -kibanaro: - hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" - reserved: false - backend_roles: - - "kibanauser" - - "readall" - attributes: - attribute1: "value1" - attribute2: "value2" - attribute3: "value3" - description: "Demo kibanaro user" - -logstash: - hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" - reserved: false - backend_roles: - - "logstash" - description: "Demo logstash user" - -readall: - hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" - reserved: false - backend_roles: - - "readall" - description: "Demo readall user" - -snapshotrestore: - hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" - reserved: false - backend_roles: - - "snapshotrestore" - description: "Demo snapshotrestore user" - -wazuh_admin: - hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu" - reserved: true - hidden: false - backend_roles: [] - attributes: {} - opendistro_security_roles: [] - static: false - -wazuh_user: - hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO" - reserved: true - hidden: false - backend_roles: [] - attributes: {} - opendistro_security_roles: [] - static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/opensearch.yml b/build-docker-images/wazuh-indexer/config/opensearch.yml deleted file mode 100644 index 1f057d73..00000000 --- a/build-docker-images/wazuh-indexer/config/opensearch.yml +++ /dev/null @@ -1,26 +0,0 @@ -network.host: "0.0.0.0" -node.name: "wazuh.indexer" -cluster.name: "wazuh-cluster" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -discovery.type: single-node -plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem -plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem -plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem -plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem -plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.authcz.admin_dn: -- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- "CN=demo.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/roles.yml b/build-docker-images/wazuh-indexer/config/roles.yml deleted file mode 100644 index f8bc557a..00000000 --- a/build-docker-images/wazuh-indexer/config/roles.yml +++ /dev/null @@ -1,171 +0,0 @@ -_meta: - type: "roles" - config_version: 2 - -# Restrict users so they can only view visualization and dashboards on kibana -kibana_read_only: - reserved: true - -# The security REST API access role is used to assign specific users access to change the security settings through the REST API. -security_rest_api_access: - reserved: true - -# Allows users to view monitors, destinations and alerts -alerting_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/alerting/alerts/get' - - 'cluster:admin/opendistro/alerting/destination/get' - - 'cluster:admin/opendistro/alerting/monitor/get' - - 'cluster:admin/opendistro/alerting/monitor/search' - -# Allows users to view and acknowledge alerts -alerting_ack_alerts: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/alerting/alerts/*' - -# Allows users to use all alerting functionality -alerting_full_access: - reserved: true - cluster_permissions: - - 'cluster_monitor' - - 'cluster:admin/opendistro/alerting/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices_monitor' - - 'indices:admin/aliases/get' - - 'indices:admin/mappings/get' - -# Allow users to read Anomaly Detection detectors and results -anomaly_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/ad/detector/info' - - 'cluster:admin/opendistro/ad/detector/search' - - 'cluster:admin/opendistro/ad/detectors/get' - - 'cluster:admin/opendistro/ad/result/search' - - 'cluster:admin/opendistro/ad/tasks/search' - -# Allows users to use all Anomaly Detection functionality -anomaly_full_access: - reserved: true - cluster_permissions: - - 'cluster_monitor' - - 'cluster:admin/opendistro/ad/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices_monitor' - - 'indices:admin/aliases/get' - - 'indices:admin/mappings/get' - -# Allows users to read Notebooks -notebooks_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/notebooks/list' - - 'cluster:admin/opendistro/notebooks/get' - -# Allows users to all Notebooks functionality -notebooks_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/notebooks/create' - - 'cluster:admin/opendistro/notebooks/update' - - 'cluster:admin/opendistro/notebooks/delete' - - 'cluster:admin/opendistro/notebooks/get' - - 'cluster:admin/opendistro/notebooks/list' - -# Allows users to read and download Reports -reports_instances_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to read and download Reports and Report-definitions -reports_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/definition/get' - - 'cluster:admin/opendistro/reports/definition/list' - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to all Reports functionality -reports_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/reports/definition/create' - - 'cluster:admin/opendistro/reports/definition/update' - - 'cluster:admin/opendistro/reports/definition/on_demand' - - 'cluster:admin/opendistro/reports/definition/delete' - - 'cluster:admin/opendistro/reports/definition/get' - - 'cluster:admin/opendistro/reports/definition/list' - - 'cluster:admin/opendistro/reports/instance/list' - - 'cluster:admin/opendistro/reports/instance/get' - - 'cluster:admin/opendistro/reports/menu/download' - -# Allows users to use all asynchronous-search functionality -asynchronous_search_full_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/asynchronous_search/*' - index_permissions: - - index_patterns: - - '*' - allowed_actions: - - 'indices:data/read/search*' - -# Allows users to read stored asynchronous-search results -asynchronous_search_read_access: - reserved: true - cluster_permissions: - - 'cluster:admin/opendistro/asynchronous_search/get' - -wazuh_ui_user: - reserved: true - hidden: false - cluster_permissions: [] - index_permissions: - - index_patterns: - - "wazuh-*" - dls: "" - fls: [] - masked_fields: [] - allowed_actions: - - "read" - tenant_permissions: [] - static: false - -wazuh_ui_admin: - reserved: true - hidden: false - cluster_permissions: [] - index_permissions: - - index_patterns: - - "wazuh-*" - dls: "" - fls: [] - masked_fields: [] - allowed_actions: - - "read" - - "delete" - - "manage" - - "index" - tenant_permissions: [] - static: false - -# ISM API permissions role -manage_ism: - reserved: true - hidden: false - cluster_permissions: - - "manage_ism" - static: false \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/roles_mapping.yml b/build-docker-images/wazuh-indexer/config/roles_mapping.yml deleted file mode 100644 index 7fa57a4d..00000000 --- a/build-docker-images/wazuh-indexer/config/roles_mapping.yml +++ /dev/null @@ -1,78 +0,0 @@ ---- -# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles. -# Permissions for Wazuh indexer roles are configured in roles.yml - -_meta: - type: "rolesmapping" - config_version: 2 - -# Define your roles mapping here - -## Demo roles mapping - -all_access: - reserved: false - backend_roles: - - "admin" - description: "Maps admin to all_access" - -own_index: - reserved: false - users: - - "*" - description: "Allow full access to an index named like the username" - -logstash: - reserved: false - backend_roles: - - "logstash" - -kibana_user: - reserved: false - backend_roles: - - "kibanauser" - users: - - "wazuh_user" - - "wazuh_admin" - description: "Maps kibanauser to kibana_user" - -readall: - reserved: false - backend_roles: - - "readall" - -manage_snapshots: - reserved: false - backend_roles: - - "snapshotrestore" - -kibana_server: - reserved: true - users: - - "kibanaserver" - -wazuh_ui_admin: - reserved: true - hidden: false - backend_roles: [] - hosts: [] - users: - - "wazuh_admin" - - "kibanaserver" - and_backend_roles: [] - -wazuh_ui_user: - reserved: true - hidden: false - backend_roles: [] - hosts: [] - users: - - "wazuh_user" - and_backend_roles: [] - -# ISM API permissions role mapping -manage_ism: - reserved: true - hidden: false - users: - - "kibanaserver" \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/filebeat.yml b/build-docker-images/wazuh-manager/config/filebeat.yml deleted file mode 100644 index c434a78c..00000000 --- a/build-docker-images/wazuh-manager/config/filebeat.yml +++ /dev/null @@ -1,31 +0,0 @@ - -# Wazuh - Filebeat configuration file -filebeat.modules: - - module: wazuh - alerts: - enabled: true - archives: - enabled: false - -setup.template.json.enabled: true -setup.template.overwrite: true -setup.template.json.path: '/etc/filebeat/wazuh-template.json' -setup.template.json.name: 'wazuh' -setup.ilm.enabled: false -output.elasticsearch: - hosts: ['https://wazuh.indexer:9200'] - #username: - #password: - #ssl.verification_mode: - #ssl.certificate_authorities: - #ssl.certificate: - #ssl.key: - -logging.metrics.enabled: false - -seccomp: - default_action: allow - syscalls: - - action: allow - names: - - rseq From 9f12a03bfcb9feb99238b841e1ec89ea98829078 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 5 Nov 2025 22:12:17 +0700 Subject: [PATCH 024/142] Delete old comment --- build-docker-images/wazuh-indexer/config/config.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index f1b11890..e3573ace 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -85,7 +85,6 @@ cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml -# Delete xms and xmx parameters in jvm.options sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options chown -R ${USER}:${GROUP} ${CONFIG_DIR} From e10480326753235f73c36e105fe011f7ad343326 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 11 Nov 2025 00:13:46 +0700 Subject: [PATCH 025/142] Add Wazuh dashboard ad manager entrypoint configuration --- build-docker-images/wazuh-agent/Dockerfile | 1 + .../wazuh-dashboard/Dockerfile | 1 + .../wazuh-dashboard/config/config.sh | 2 +- .../wazuh-dashboard/config/entrypoint.sh | 179 +++++++++++++++++- .../config/wazuh_app_config.sh | 24 ++- build-docker-images/wazuh-indexer/Dockerfile | 3 +- .../wazuh-indexer/config/config.sh | 2 +- .../wazuh-indexer/config/entrypoint.sh | 158 +++++++--------- build-docker-images/wazuh-manager/Dockerfile | 1 + .../config/etc/cont-init.d/0-wazuh-init | 84 ++++++-- .../config/wazuh_cluster/entrypoint.sh | 85 +++++++++ .../config/wazuh_indexer/wazuh.indexer.yml | 12 +- 12 files changed, 425 insertions(+), 127 deletions(-) create mode 100755 single-node/config/wazuh_cluster/entrypoint.sh diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 3b90c23e..46bcab1c 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -20,6 +20,7 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ dnf install curl-minimal tar gzip procps -y &&\ curl -o /wazuh-agent.rpm "${agent_url}" && \ dnf install /wazuh-agent.rpm -y && \ + rm -rf /wazuh-agent.rpm && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index c02123d6..780f28f6 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -15,6 +15,7 @@ RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \ dnf install curl-minimal libcap openssl -y && \ curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \ dnf install /wazuh-dashboard.rpm -y && \ + rm -rf /wazuh-dashboard.rpm && \ dnf clean all # Create and set permissions to data directories diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 36011034..23879717 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -10,7 +10,7 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION="${WAZUH_VERSION%.*}" +CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 290f9fa8..ea9974f1 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -1,20 +1,181 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -INSTALL_DIR=/usr/share/wazuh-dashboard +# Run Wazuh dashboard, using environment variables to +# set longopts defining Wazuh dashboard's configuration. +# +# eg. Setting the environment variable: +# +# OPENSEARCH_STARTUPTIMEOUT=60 +# +# will cause OpenSearch-Dashboards to be invoked with: +# +# --opensearch.startupTimeout=60 + +# Setup Home Directory +export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard +export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}" DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" # Create and configure Wazuh dashboard keystore -yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \ -echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ -echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root +yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --allow-root && \ +echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ +echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root -############################################################################## -# Start Wazuh dashboard -############################################################################## +opensearch_dashboards_vars=( + console.enabled + console.proxyConfig + console.proxyFilter + ops.cGroupOverrides.cpuPath + ops.cGroupOverrides.cpuAcctPath + cpu.cgroup.path.override + cpuacct.cgroup.path.override + csp.rules + csp.strict + csp.warnLegacyBrowsers + data.search.usageTelemetry.enabled + opensearch.customHeaders + opensearch.hosts + opensearch.logQueries + opensearch.memoryCircuitBreaker.enabled + opensearch.memoryCircuitBreaker.maxPercentage + opensearch.password + opensearch.pingTimeout + opensearch.requestHeadersWhitelist + opensearch.requestTimeout + opensearch.shardTimeout + opensearch.sniffInterval + opensearch.sniffOnConnectionFault + opensearch.sniffOnStart + opensearch.ssl.alwaysPresentCertificate + opensearch.ssl.certificate + opensearch.ssl.certificateAuthorities + opensearch.ssl.key + opensearch.ssl.keyPassphrase + opensearch.ssl.keystore.path + opensearch.ssl.keystore.password + opensearch.ssl.truststore.path + opensearch.ssl.truststore.password + opensearch.ssl.verificationMode + opensearch.username + i18n.locale + interpreter.enableInVisualize + opensearchDashboards.autocompleteTerminateAfter + opensearchDashboards.autocompleteTimeout + opensearchDashboards.defaultAppI + server.rewriteBasePath + server.socketTimeout + server.ssl.cert + server.ssl.certificate + server.ssl.certificateAuthorities + server.ssl.cipherSuites + server.ssl.clientAuthentication + server.customResponseHeaders + server.ssl.enabled + server.ssl.key + server.ssl.keyPassphrase + server.ssl.keystore.path + server.ssl.keystore.password + server.ssl.truststore.path + server.ssl.truststore.password + server.ssl.redirectHttpFromPort + server.ssl.supportedProtocols + server.xsrf.disableProtection + server.xsrf.whitelist + status.allowAnonymous + status.v6ApiFormat + tilemap.options.attribution + tilemap.options.maxZoom + tilemap.options.minZoom + tilemap.options.subdomains + tilemap.url + timeline.enabled + vega.enableExternalUrls + apm_oss.apmAgentConfigurationIndex + apm_oss.indexPattern + apm_oss.errorIndices + apm_oss.onboardingIndices + apm_oss.spanIndices + apm_oss.sourcemapIndices + apm_oss.transactionIndices + apm_oss.metricsIndices + telemetry.allowChangingOptInStatus + telemetry.enabled + telemetry.optIn + telemetry.optInStatusUrl + telemetry.sendUsageFrom + vis_builder.enabled + data_source.enabled + data_source.encryption.wrappingKeyName + data_source.encryption.wrappingKeyNamespace + data_source.encryption.wrappingKey + data_source.audit.enabled + data_source.audit.appender.kind + data_source.audit.appender.path + data_source.audit.appender.layout.kind + data_source.audit.appender.layout.highlight + data_source.audit.appender.layout.pattern + ml_commons_dashboards.enabled + observability.query_assist.enabled + usageCollection.uiMetric.enabled + workspace.enabled + assistant.chat.enabled + assistant.alertInsight.enabled + assistant.smartAnomalyDetector.enabled + assistant.text2viz.enabled + queryEnhancements.queryAssist.summary.enabled +) -/wazuh_app_config.sh $WAZUH_UI_REVISION +function runOpensearchDashboards { + longopts=() + for opensearch_dashboards_var in ${opensearch_dashboards_vars[*]}; do + # 'opensearch.hosts' -> 'OPENSEARCH_URL' + env_var=$(echo ${opensearch_dashboards_var^^} | tr . _) -/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml \ No newline at end of file + # Indirectly lookup env var values via the name of the var. + # REF: http://tldp.org/LDP/abs/html/bashver2.html#EX78 + value=${!env_var} + if [[ -n $value ]]; then + longopt="--${opensearch_dashboards_var}=${value}" + longopts+=("${longopt}") + fi + done + + # Files created at run-time should be group-writable, for Openshift's sake. + umask 0002 + + # TO DO: + # Confirm with Mihir if this is necessary + + # The virtual file /proc/self/cgroup should list the current cgroup + # membership. For each hierarchy, you can follow the cgroup path from + # this file to the cgroup filesystem (usually /sys/fs/cgroup/) and + # introspect the statistics for the cgroup for the given + # hierarchy. Alas, Docker breaks this by mounting the container + # statistics at the root while leaving the cgroup paths as the actual + # paths. Therefore, OpenSearch-Dashboards provides a mechanism to override + # reading the cgroup path from /proc/self/cgroup and instead uses the + # cgroup path defined the configuration properties + # cpu.cgroup.path.override and cpuacct.cgroup.path.override. + # Therefore, we set this value here so that cgroup statistics are + # available for the container this process will run in. + + exec "$@" \ + --ops.cGroupOverrides.cpuPath=/ \ + --ops.cGroupOverrides.cpuAcctPath=/ \ + "${longopts[@]}" +} + +# Prepend "opensearch-dashboards" command if no argument was provided or if the +# first argument looks like a flag (i.e. starts with a dash). +if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then + set -- opensearch-dashboards "$@" +fi + +if [ "$1" = "opensearch-dashboards" ]; then + runOpensearchDashboards "$@" +else + exec "$@" +fi \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index e98a8b46..1410d5be 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -32,13 +32,19 @@ do fi done -cat << EOF >> $dashboard_config_file -hosts: - - 1513629884013: - url: $wazuh_url - port: $wazuh_port - username: $api_username - password: $api_password - run_as: $api_run_as -EOF +grep -q 1513629884013 $dashboard_config_file +_config_exists=$? +if [[ $_config_exists -ne 0 ]]; then + cat << EOF >> $dashboard_config_file + hosts: + - 1513629884013: + url: $wazuh_url + port: $wazuh_port + username: $api_username + password: $api_password + run_as: $api_run_as + EOF +else + echo "Wazuh APP already configured" +fi diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 3772bd10..ada8d8d6 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -14,6 +14,7 @@ RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \ dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\ curl -o /wazuh-indexer.rpm "${indexer_url}" && \ dnf install /wazuh-indexer.rpm -y && \ + rm -rf /wazuh-indexer.rpm && \ dnf clean all && \ bash config.sh @@ -69,4 +70,4 @@ EXPOSE 9200 ENTRYPOINT ["/entrypoint.sh"] # Dummy overridable parameter parsed by entrypoint -CMD ["opensearchwrapper"] \ No newline at end of file +CMD ["opensearch"] \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index e3573ace..4ff30da5 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -22,7 +22,7 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ## Variables CERT_TOOL=wazuh-certs-tool.sh CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION="${WAZUH_VERSION%.*}" +CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index caddb80e..8b2c3834 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -1,93 +1,77 @@ -#!/usr/bin/env bash -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -set -e +#!/bin/bash -umask 0002 +# Copyright OpenSearch Contributors +# SPDX-License-Identifier: Apache-2.0 -export USER=wazuh-indexer -export INSTALLATION_DIR=/usr/share/wazuh-indexer -export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config -export JAVA_HOME=${INSTALLATION_DIR}/jdk -export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) -export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) -export CERT="${OPENSEARCH_PATH_CONF}/certs/admin.pem" -export KEY="${OPENSEARCH_PATH_CONF}/certs/admin-key.pem" +# This script specify the entrypoint startup actions for opensearch +# It will start both opensearch and performance analyzer plugin cli +# If either process failed, the entire docker container will be removed +# in favor of a newly started container + +# Export OpenSearch Home +export OPENSEARCH_HOME=/usr/share/wazuh-indexer +export OPENSEARCH_PATH_CONF=$OPENSEARCH_HOME/config +export PATH=$OPENSEARCH_HOME/bin:$PATH + + +# The virtual file /proc/self/cgroup should list the current cgroup +# membership. For each hierarchy, you can follow the cgroup path from +# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and +# introspect the statistics for the cgroup for the given +# hierarchy. Alas, Docker breaks this by mounting the container +# statistics at the root while leaving the cgroup paths as the actual +# paths. Therefore, OpenSearch provides a mechanism to override +# reading the cgroup path from /proc/self/cgroup and instead uses the +# cgroup path defined the JVM system property +# opensearch.cgroups.hierarchy.override. Therefore, we set this value here so +# that cgroup statistics are available for the container this process +# will run in. +export OPENSEARCH_JAVA_OPTS="-Dopensearch.cgroups.hierarchy.override=/ $OPENSEARCH_JAVA_OPTS" + +# Start up the opensearch and performance analyzer agent processes. +# When either of them halts, this script exits, or we receive a SIGTERM or SIGINT signal then we want to kill both these processes. +function runOpensearch { + # Files created by OpenSearch should always be group writable too + umask 0002 + + if [[ "$(id -u)" == "0" ]]; then + echo "Wazuh indexer cannot run as root. Please start your container as another user." + exit 1 + fi + + # Parse Docker env vars to customize Wazuh indexer / OpenSearch configuration + # + # e.g. Setting the env var cluster.name=testcluster + # will cause Wazuh indexer to be invoked with -Ecluster.name=testcluster + opensearch_opts=() + while IFS='=' read -r envvar_key envvar_value + do + # OpenSearch settings need to have at least two dot separated lowercase + # words, e.g. `cluster.name`, except for `processors` which we handle + # specially + if [[ "$envvar_key" =~ ^[a-z0-9_]+\.[a-z0-9_]+ || "$envvar_key" == "processors" ]]; then + if [[ ! -z $envvar_value ]]; then + opensearch_opt="-E${envvar_key}=${envvar_value}" + opensearch_opts+=("${opensearch_opt}") + fi + fi + done < <(env) + + # Start opensearch + exec "$@" "${opensearch_opts[@]}" -run_as_other_user_if_needed() { - if [[ "$(id -u)" == "0" ]]; then - # If running as root, drop to specified UID and run command - exec chroot --userspec=1000:0 / "${@}" - else - # Either we are running in Openshift with random uid and are a member of the root group - # or with a custom --user - exec "${@}" - fi } -# Allow user specify custom CMD, maybe bin/opensearch itself -# for example to directly specify `-E` style parameters for opensearch on k8s -# or simply to run /bin/bash to check the image -if [[ "$1" != "opensearchwrapper" ]]; then - if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then - # Rewrite CMD args to replace $1 with `opensearch` explicitly, - # Without this, user could specify `opensearch -E x.y=z` but - # `bin/opensearch -E x.y=z` would not work. - set -- "opensearch" "${@:2}" - # Use chroot to switch to UID 1000 / GID 0 - exec chroot --userspec=1000:0 / "$@" - else - # User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?) +# Prepend "opensearch" command if no argument was provided or if the first +# argument looks like a flag (i.e. starts with a dash). +if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then + set -- opensearch "$@" +fi + +if [ "$1" = "opensearch" ]; then + # If the first argument is opensearch, then run the setup script. + runOpensearch "$@" +else + # Otherwise, just exec the command. exec "$@" - fi -fi - -# Allow environment variables to be set by creating a file with the -# contents, and setting an environment variable with the suffix _FILE to -# point to it. This can be used to provide secrets to a container, without -# the values being specified explicitly when running the container. -# -# This is also sourced in opensearch-env, and is only needed here -# as well because we use INDEXER_PASSWORD below. Sourcing this script -# is idempotent. -source /usr/share/wazuh-indexer/bin/opensearch-env-from-file - -if [[ -f bin/opensearch-users ]]; then - # Check for the INDEXER_PASSWORD environment variable to set the - # bootstrap password for Security. - # - # This is only required for the first node in a cluster with Security - # enabled, but we have no way of knowing which node we are yet. We'll just - # honor the variable if it's present. - if [[ -n "$INDEXER_PASSWORD" ]]; then - [[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) - if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then - # keystore is unencrypted - if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then - (run_as_other_user_if_needed echo "$INDEXER_PASSWORD" | opensearch-keystore add -x 'bootstrap.password') - fi - else - # keystore requires password - if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \ - | opensearch-keystore list | grep -q '^bootstrap.password$') ; then - COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$INDEXER_PASSWORD")" - (run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password') - fi - fi - fi -fi - -if [[ "$(id -u)" == "0" ]]; then - # If requested and running as root, mutate the ownership of bind-mounts - if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then - chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs} - fi -fi - - -#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then - # run securityadmin.sh for single node with CACERT, CERT and KEY parameter -# nohup /securityadmin.sh & -# touch "/var/lib/wazuh-indexer/.flag" -#fi - -run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" \ No newline at end of file +fi \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 258638e4..64c7059f 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -16,6 +16,7 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf clean all && \ curl -o /wazuh-manager.rpm "${manager_url}" && \ dnf install /wazuh-manager.rpm -y && \ + rm -rf /wazuh-manager.rpm && \ dnf clean all && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index ca125b1b..a91d6b1e 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -152,18 +152,76 @@ set_custom_hostname() { sed -i 's/to_be_replaced_by_hostname<\/node_name>/'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf } -############################################################################## -# Allow users to set the container cluster key dynamically on -# container start. -# -# To use this: -# 1. Create your own ossec.conf file -# 2. In your ossec.conf file, set to_be_replaced_by_cluster_key as your key -# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf -############################################################################## +function_configure_ossec_conf() { +OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf" -set_custom_cluster_key() { - sed -i 's/to_be_replaced_by_cluster_key<\/key>/'"${WAZUH_CLUSTER_KEY}"'<\/key>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf +# -------------------------- +# Defaults based on OSSEC_CONF +# -------------------------- +if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then + WAZUH_CLUSTER_KEY=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1) +fi + +# Node type logic +if [[ "$WAZUH_NODE_TYPE" != "worker" ]]; then + WAZUH_NODE_TYPE="master" +fi + +# Default node name → HOSTNAME if not defined +WAZUH_NODE_NAME="${WAZUH_NODE_NAME:-$HOSTNAME}" + +# -------------------------- +# Replace Indexer Hosts +# -------------------------- +if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then + TMP_HOSTS=$(mktemp) + { + echo " " + for NODE in $WAZUH_INDEXER_HOSTS; do + IP="${NODE%:*}" + PORT="${NODE#*:}" + echo " https://$IP:$PORT" + done + echo " " + } > "$TMP_HOSTS"; + sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ + -e 'd }}' "$OSSEC_CONF"; + rm -f "$TMP_HOSTS"; +fi + +# -------------------------- +# Cluster: node_name +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_NAME|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: node_type +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_TYPE|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: key +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: nodes list +# -------------------------- +if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then + TMP_NODES=$(mktemp) + { + echo " " + for N in $WAZUH_CLUSTER_NODES; do + echo " $N" + done + echo " " + } > "$TMP_NODES"; + sed -i -e '//,/<\/cluster>/{ //,/<\/nodes>/{ //r '"$TMP_NODES" \ + -e 'd }}' "$OSSEC_CONF"; + rm -f "$TMP_NODES"; +fi + +echo "Wazuh manager config modified successfully." } ############################################################################## @@ -221,8 +279,8 @@ main() { # Allow setting custom hostname set_custom_hostname - # Allow setting custom cluster key - set_custom_cluster_key + # Configure ossec.conf based on environment variables + function_configure_ossec_conf # Delete temporary data folder rm -rf ${WAZUH_INSTALL_PATH}/data_tmp diff --git a/single-node/config/wazuh_cluster/entrypoint.sh b/single-node/config/wazuh_cluster/entrypoint.sh new file mode 100755 index 00000000..51f53312 --- /dev/null +++ b/single-node/config/wazuh_cluster/entrypoint.sh @@ -0,0 +1,85 @@ +#!/bin/bash +set -xe + +OSSEC_CONF="ossec.conf" + +# -------------------------- +# Defaults based on OSSEC_CONF +# -------------------------- +if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then + WAZUH_CLUSTER_KEY=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1) +fi + +if [[ -z "$WAZUH_CLUSTER_PORT" ]]; then + WAZUH_CLUSTER_PORT=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/port>.*/\1/p' "$OSSEC_CONF" | head -n1) +fi + +# Node type logic +if [[ -z "$WAZUH_NODE_TYPE" ]]; then + if [[ "$HOSTNAME" == "manager" || "$HOSTNAME" == "aio_node" ]]; then + WAZUH_NODE_TYPE="master" + else + WAZUH_NODE_TYPE="worker" + fi +fi + +# Default node name → HOSTNAME if not defined +WAZUH_NODE_NAME="${WAZUH_NODE_NAME:-$HOSTNAME}" + +# -------------------------- +# Replace Indexer Hosts +# -------------------------- +if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then + TMP_HOSTS=$(mktemp) + { + echo " " + for NODE in $WAZUH_INDEXER_HOSTS; do + IP="${NODE%:*}" + PORT="${NODE#*:}" + echo " https://$IP:$PORT" + done + echo " " + } > "$TMP_HOSTS"; + sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ + -e 'd }}' "$OSSEC_CONF"; + rm -f "$TMP_HOSTS"; +fi + +# -------------------------- +# Cluster: node_name +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_NAME|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: node_type +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_TYPE|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: key +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: port +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_PORT|" "$OSSEC_CONF" + +# -------------------------- +# Cluster: nodes list +# -------------------------- +if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then + TMP_NODES=$(mktemp) + { + echo " " + for N in $WAZUH_CLUSTER_NODES; do + echo " $N" + done + echo " " + } > "$TMP_NODES"; + sed -i -e '//,/<\/cluster>/{ //,/<\/nodes>/{ //r '"$TMP_NODES" \ + -e 'd }}' "$OSSEC_CONF"; + rm -f "$TMP_NODES"; +fi + +echo "Wazuh manager config modified successfully." diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml index 655a16a4..3fc295a4 100644 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ b/single-node/config/wazuh_indexer/wazuh.indexer.yml @@ -6,12 +6,12 @@ path.logs: /var/log/wazuh-indexer discovery.type: single-node http.port: 9200-9299 transport.tcp.port: 9300-9399 -plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem -plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem +plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem +plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key +plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem +plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem +plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key +plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem plugins.security.ssl.http.enabled: true plugins.security.ssl.transport.enforce_hostname_verification: false plugins.security.ssl.transport.resolve_hostname: false From cd8253845fc6b7c46162b9fcd20c8b00266f8fad Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 11 Nov 2025 20:24:45 +0700 Subject: [PATCH 026/142] Modify cert generation process --- .../Procedure_push_docker_images.yml | 2 + build-docker-images/build-images.yml | 6 +++ .../wazuh-dashboard/Dockerfile | 2 + .../wazuh-dashboard/config/config.sh | 49 +++---------------- build-docker-images/wazuh-indexer/Dockerfile | 2 + .../wazuh-indexer/config/config.sh | 47 ++---------------- build-docker-images/wazuh-manager/Dockerfile | 6 +++ .../wazuh-manager/config/config.sh | 28 +++++++++++ 8 files changed, 59 insertions(+), 83 deletions(-) create mode 100644 build-docker-images/wazuh-manager/config/config.sh diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index c6b17fe0..49292201 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -146,6 +146,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" + wazuh_cert_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" + wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 9ed60754..a6478b17 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -8,6 +8,8 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm} wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager restart: always @@ -49,6 +51,8 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm} wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer restart: always @@ -73,6 +77,8 @@ services: WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm} wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm} + wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard restart: always diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 780f28f6..8184853f 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -8,6 +8,8 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml # Update and install dependencies RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \ diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 23879717..4b6a2fcd 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -7,51 +7,18 @@ export TARGET_DIR=${CURDIR}/debian/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -## Variables -CERT_TOOL=wazuh-certs-tool.sh -CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" -PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ - -download_package() { - local url=$1 - local package=$2 - local output=$2 - echo "Checking $url$package ..." - if curl -fsL "$url$package" -o "$output"; then - echo "Downloaded $package from $url" - return 0 - else - return 1 - fi -} - +############################################################################## +# Downloading Cert Gen Tool +############################################################################## +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_TOOL"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then - : -else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi - +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then - : -else - echo "The config file for the certificate tool does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index ada8d8d6..51ca78d0 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -6,6 +6,8 @@ ARG WAZUH_TAG_REVISION ARG TARGETARCH ARG wazuh_indexer_url_amd64_rpm ARG wazuh_indexer_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml COPY config/config.sh . diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 4ff30da5..7bcd68de 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -18,52 +18,15 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config ############################################################################## # Downloading Cert Gen Tool ############################################################################## - -## Variables -CERT_TOOL=wazuh-certs-tool.sh -CERT_CONFIG_FILE=config.yml -CERT_TOOL_VERSION=5.0 #"${WAZUH_VERSION%.*}" -PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ - -download_package() { - local url=$1 - local package=$2 - local output=$2 - echo "Checking $url$package ..." - if curl -fsL "$url$package" -o "$output"; then - echo "Downloaded $package from $url" - return 0 - else - return 1 - fi -} - +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_TOOL"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_TOOL"; then - : -else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi - +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL" "$CERT_CONFIG_FILE"; then - : -elif download_package "$PACKAGES_DEV_URL" "$CERT_CONFIG_FILE"; then - : -else - echo "The config file for the certificate tool does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 64c7059f..d7969b15 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,6 +9,10 @@ ARG S6_VERSION="v2.2.0.3" ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm +ARG wazuh_cert_tool +ARG wazuh_config_yml + +COPY config/config.sh . RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ manager_url="${!URL_VAR}" && \ @@ -18,6 +22,8 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf install /wazuh-manager.rpm -y && \ rm -rf /wazuh-manager.rpm && \ dnf clean all && \ + chmod 755 /config.sh && \ + /config.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh new file mode 100644 index 00000000..5bfd2d4c --- /dev/null +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -0,0 +1,28 @@ +############################################################################## +# Downloading Cert Gen Tool +############################################################################## +# Variables for certificate generation +CERT_TOOL="wazuh-certs-tool.sh" +CERT_CONFIG_FILE="config.yml" +CERT_DIR=/var/ossec/etc/certs/ +# Download the tool to create the certificates +echo "Downloading the tool to create the certificates..." +curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL +# Download the config file for the certificate tool +echo "Downloading the config file for the certificate tool..." +curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE + +# Modify the config file to set the IP to localhost +sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE + +chmod 700 "$CERT_CONFIG_FILE" +# Create the certificates +chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A + +# Copy Wazuh manager certs +cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem +cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem +cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key +cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem +cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem +cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem \ No newline at end of file From c9f379d02e287c7f5e3561df162ae2ffdf951087 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 11 Nov 2025 21:44:08 +0700 Subject: [PATCH 027/142] Add download check --- .../wazuh-dashboard/config/config.sh | 15 +++++++++++++-- .../wazuh-indexer/config/config.sh | 15 +++++++++++++-- .../wazuh-manager/config/config.sh | 15 +++++++++++++-- 3 files changed, 39 insertions(+), 6 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 4b6a2fcd..2d1d0ee4 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -13,12 +13,23 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config # Variables for certificate generation CERT_TOOL="wazuh-certs-tool.sh" CERT_CONFIG_FILE="config.yml" +download_package() { + local url=$1 + local package=$2 + if curl -fsL "$url" -o "$package"; then + echo "Downloaded $package" + return 0 + else + echo "Error downloading $package from $url" + return 1 + fi +} # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL +download_package "$wazuh_cert_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE +download_package "$wazuh_config_yml" $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 7bcd68de..abcf257b 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -21,12 +21,23 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config # Variables for certificate generation CERT_TOOL="wazuh-certs-tool.sh" CERT_CONFIG_FILE="config.yml" +download_package() { + local url=$1 + local package=$2 + if curl -fsL "$url" -o "$package"; then + echo "Downloaded $package" + return 0 + else + echo "Error downloading $package from $url" + return 1 + fi +} # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL +download_package "$wazuh_cert_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE +download_package "$wazuh_config_yml" $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index 5bfd2d4c..d5359904 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -5,12 +5,23 @@ CERT_TOOL="wazuh-certs-tool.sh" CERT_CONFIG_FILE="config.yml" CERT_DIR=/var/ossec/etc/certs/ +download_package() { + local url=$1 + local package=$2 + if curl -fsL "$url" -o "$package"; then + echo "Downloaded $package" + return 0 + else + echo "Error downloading $package from $url" + return 1 + fi +} # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -curl -fsL "$wazuh_cert_tool" -o $CERT_TOOL +download_package "$wazuh_cert_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." -curl -fsL "$wazuh_config_yml" -o $CERT_CONFIG_FILE +download_package "$wazuh_config_yml" $CERT_CONFIG_FILE # Modify the config file to set the IP to localhost sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE From d60c2ebb3517f4ee0172ad4c8e5f22b351c942c8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 11 Nov 2025 21:47:44 +0700 Subject: [PATCH 028/142] dashboard entrypoint --- .../wazuh-dashboard/config/entrypoint.sh | 100 ------------------ 1 file changed, 100 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index ea9974f1..b4de1fc7 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -25,107 +25,7 @@ echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root opensearch_dashboards_vars=( - console.enabled - console.proxyConfig - console.proxyFilter - ops.cGroupOverrides.cpuPath - ops.cGroupOverrides.cpuAcctPath - cpu.cgroup.path.override - cpuacct.cgroup.path.override - csp.rules - csp.strict - csp.warnLegacyBrowsers - data.search.usageTelemetry.enabled - opensearch.customHeaders opensearch.hosts - opensearch.logQueries - opensearch.memoryCircuitBreaker.enabled - opensearch.memoryCircuitBreaker.maxPercentage - opensearch.password - opensearch.pingTimeout - opensearch.requestHeadersWhitelist - opensearch.requestTimeout - opensearch.shardTimeout - opensearch.sniffInterval - opensearch.sniffOnConnectionFault - opensearch.sniffOnStart - opensearch.ssl.alwaysPresentCertificate - opensearch.ssl.certificate - opensearch.ssl.certificateAuthorities - opensearch.ssl.key - opensearch.ssl.keyPassphrase - opensearch.ssl.keystore.path - opensearch.ssl.keystore.password - opensearch.ssl.truststore.path - opensearch.ssl.truststore.password - opensearch.ssl.verificationMode - opensearch.username - i18n.locale - interpreter.enableInVisualize - opensearchDashboards.autocompleteTerminateAfter - opensearchDashboards.autocompleteTimeout - opensearchDashboards.defaultAppI - server.rewriteBasePath - server.socketTimeout - server.ssl.cert - server.ssl.certificate - server.ssl.certificateAuthorities - server.ssl.cipherSuites - server.ssl.clientAuthentication - server.customResponseHeaders - server.ssl.enabled - server.ssl.key - server.ssl.keyPassphrase - server.ssl.keystore.path - server.ssl.keystore.password - server.ssl.truststore.path - server.ssl.truststore.password - server.ssl.redirectHttpFromPort - server.ssl.supportedProtocols - server.xsrf.disableProtection - server.xsrf.whitelist - status.allowAnonymous - status.v6ApiFormat - tilemap.options.attribution - tilemap.options.maxZoom - tilemap.options.minZoom - tilemap.options.subdomains - tilemap.url - timeline.enabled - vega.enableExternalUrls - apm_oss.apmAgentConfigurationIndex - apm_oss.indexPattern - apm_oss.errorIndices - apm_oss.onboardingIndices - apm_oss.spanIndices - apm_oss.sourcemapIndices - apm_oss.transactionIndices - apm_oss.metricsIndices - telemetry.allowChangingOptInStatus - telemetry.enabled - telemetry.optIn - telemetry.optInStatusUrl - telemetry.sendUsageFrom - vis_builder.enabled - data_source.enabled - data_source.encryption.wrappingKeyName - data_source.encryption.wrappingKeyNamespace - data_source.encryption.wrappingKey - data_source.audit.enabled - data_source.audit.appender.kind - data_source.audit.appender.path - data_source.audit.appender.layout.kind - data_source.audit.appender.layout.highlight - data_source.audit.appender.layout.pattern - ml_commons_dashboards.enabled - observability.query_assist.enabled - usageCollection.uiMetric.enabled - workspace.enabled - assistant.chat.enabled - assistant.alertInsight.enabled - assistant.smartAnomalyDetector.enabled - assistant.text2viz.enabled - queryEnhancements.queryAssist.summary.enabled ) function runOpensearchDashboards { From 1e343cf274fcf53a0c8bc01e8af6ec89ba34f273 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 00:04:22 +0700 Subject: [PATCH 029/142] Modify docker deployments --- .../Procedure_push_docker_images.yml | 1 - .gitignore | 16 +- .../wazuh-dashboard/config/entrypoint.sh | 4 + .../wazuh-indexer/config/entrypoint.sh | 32 ++ .../wazuh-manager/config/config.sh | 12 +- multi-node/README.md | 42 ++- multi-node/config/certs.yml | 24 -- .../config/wazuh_cluster/wazuh_manager.conf | 290 ------------------ .../config/wazuh_cluster/wazuh_worker.conf | 290 ------------------ .../wazuh_dashboard/opensearch_dashboards.yml | 16 - multi-node/config/wazuh_dashboard/wazuh.yml | 7 - .../config/wazuh_indexer/internal_users.yml | 56 ---- .../config/wazuh_indexer/wazuh1.indexer.yml | 37 --- .../config/wazuh_indexer/wazuh2.indexer.yml | 37 --- .../config/wazuh_indexer/wazuh3.indexer.yml | 37 --- multi-node/docker-compose.yml | 141 +++++---- multi-node/generate-indexer-certs.yml | 10 - single-node/README.md | 35 ++- single-node/config/certs.yml | 16 - .../config/wazuh_cluster/entrypoint.sh | 85 ----- .../config/wazuh_cluster/wazuh_manager.conf | 288 ----------------- .../wazuh_dashboard/opensearch_dashboards.yml | 16 - single-node/config/wazuh_dashboard/wazuh.yml | 7 - .../config/wazuh_indexer/internal_users.yml | 56 ---- .../config/wazuh_indexer/wazuh.indexer.yml | 30 -- single-node/docker-compose.yml | 63 ++-- single-node/generate-indexer-certs.yml | 10 - 27 files changed, 234 insertions(+), 1424 deletions(-) delete mode 100644 multi-node/config/certs.yml delete mode 100644 multi-node/config/wazuh_cluster/wazuh_manager.conf delete mode 100644 multi-node/config/wazuh_cluster/wazuh_worker.conf delete mode 100644 multi-node/config/wazuh_dashboard/opensearch_dashboards.yml delete mode 100644 multi-node/config/wazuh_dashboard/wazuh.yml delete mode 100644 multi-node/config/wazuh_indexer/internal_users.yml delete mode 100644 multi-node/config/wazuh_indexer/wazuh1.indexer.yml delete mode 100644 multi-node/config/wazuh_indexer/wazuh2.indexer.yml delete mode 100644 multi-node/config/wazuh_indexer/wazuh3.indexer.yml delete mode 100644 multi-node/generate-indexer-certs.yml delete mode 100755 single-node/config/certs.yml delete mode 100755 single-node/config/wazuh_cluster/entrypoint.sh delete mode 100644 single-node/config/wazuh_cluster/wazuh_manager.conf delete mode 100644 single-node/config/wazuh_dashboard/opensearch_dashboards.yml delete mode 100644 single-node/config/wazuh_dashboard/wazuh.yml delete mode 100644 single-node/config/wazuh_indexer/internal_users.yml delete mode 100644 single-node/config/wazuh_indexer/wazuh.indexer.yml delete mode 100644 single-node/generate-indexer-certs.yml diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 49292201..3ec09905 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -85,7 +85,6 @@ jobs: echo "* id: ${{ inputs.id }}" echo "* image_tag: ${{ inputs.image_tag }}" echo "* docker_reference: ${{ inputs.docker_reference }}" - echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}" echo "* revision: ${{ inputs.revision }}" echo "* dev: ${{ inputs.dev }}" echo "* dev reference: ${{ inputs.reference }}" diff --git a/.gitignore b/.gitignore index 269239fd..9e8e4a05 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,13 @@ -single-node/config/wazuh_indexer_ssl_certs/*.pem -single-node/config/wazuh_indexer_ssl_certs/*.key -multi-node/config/wazuh_indexer_ssl_certs/*.pem -multi-node/config/wazuh_indexer_ssl_certs/*.key *.log build-docker-images/packages_env.txt -build-docker-images/packages_url.txt \ No newline at end of file +build-docker-images/packages_url.txt +single-node/wazuh-certificates +single-node/wazuh-certificates/* +single-node/wazuh-certificates-tool.log +single-node/config.yml +single-node/wazuh-certs-tool.sh +multi-node/wazuh-certificates +multi-node/wazuh-certificates/* +multi-node/wazuh-certificates-tool.log +multi-node/config.yml +multi-node/wazuh-certs-tool.sh \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index b4de1fc7..fbefb543 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -26,6 +26,10 @@ echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards opensearch_dashboards_vars=( opensearch.hosts + server.port + server.host + opensearch.username + opensearch.password ) function runOpensearchDashboards { diff --git a/build-docker-images/wazuh-indexer/config/entrypoint.sh b/build-docker-images/wazuh-indexer/config/entrypoint.sh index 8b2c3834..06bb7fc7 100644 --- a/build-docker-images/wazuh-indexer/config/entrypoint.sh +++ b/build-docker-images/wazuh-indexer/config/entrypoint.sh @@ -11,6 +11,7 @@ # Export OpenSearch Home export OPENSEARCH_HOME=/usr/share/wazuh-indexer export OPENSEARCH_PATH_CONF=$OPENSEARCH_HOME/config +export CONFIG_FILE=${OPENSEARCH_PATH_CONF}/opensearch.yml export PATH=$OPENSEARCH_HOME/bin:$PATH @@ -62,8 +63,39 @@ function runOpensearch { } +function configureOpensearch { +# Update opensearch.yml with NODES_DN if set +if [ -n "$NODES_DN" ]; then + + CLEAN_NODES_DN=$(echo "$NODES_DN" | sed 's/^["'\'']//; s/["'\'']$//; s/""/"/g') + NODES_DN_YAML=$(echo $CLEAN_NODES_DN | tr ';' '\n' | sed 's/^/- "/; s/$/"/') + + awk ' + /^plugins\.security\.nodes_dn:/ {in_block=1; print; next} + in_block && /^[^#[:space:]-]/ {in_block=0} + !in_block || /^plugins\.security\.nodes_dn:/ {next} + {print} + ' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp" + + awk -v repl="$NODES_DN_YAML" ' + /^plugins\.security\.nodes_dn:/ { + print "plugins.security.nodes_dn:"; + print repl; + skip=1; next + } + skip && /^[^#[:space:]-]/ {skip=0} + !skip + ' "${CONFIG_FILE}" > "${CONFIG_FILE}.new" + mv "${CONFIG_FILE}.new" "$CONFIG_FILE" + rm -f "${CONFIG_FILE}.tmp" +fi +} + # Prepend "opensearch" command if no argument was provided or if the first # argument looks like a flag (i.e. starts with a dash). + +configureOpensearch + if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then set -- opensearch "$@" fi diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index d5359904..024ae2b8 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -4,18 +4,25 @@ # Variables for certificate generation CERT_TOOL="wazuh-certs-tool.sh" CERT_CONFIG_FILE="config.yml" -CERT_DIR=/var/ossec/etc/certs/ +CERT_DIR=/etc/filebeat/certs download_package() { local url=$1 local package=$2 if curl -fsL "$url" -o "$package"; then + echo $url + cat $package echo "Downloaded $package" return 0 else + echo $url + cat $package echo "Error downloading $package from $url" return 1 fi } +echo "pwd" +pwd +mkdir -p $CERT_DIR # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." download_package "$wazuh_cert_tool" $CERT_TOOL @@ -30,6 +37,9 @@ chmod 700 "$CERT_CONFIG_FILE" # Create the certificates chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A +echo "files in pwd" +ls -la + # Copy Wazuh manager certs cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem diff --git a/multi-node/README.md b/multi-node/README.md index 678fa782..9a300fc7 100644 --- a/multi-node/README.md +++ b/multi-node/README.md @@ -6,11 +6,47 @@ This deployment is defined in the `docker-compose.yml` file with two Wazuh manag ``` $ sysctl -w vm.max_map_count=262144 ``` -2) Run the certificate creation script: + +2) Download the certificate creation script and config.yml file: ``` -$ docker compose -f generate-indexer-certs.yml run --rm generator +$ curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh +$ curl -sO https://packages.wazuh.com/5.0/config.yml ``` -3) Start the environment with docker compose: + +3) Edit the config.yml file with the configuration of the Wazuh components to be deployed +``` +nodes: + # Wazuh indexer server nodes + indexer: + - name: wazuh1.indexer + ip: wazuh1.indexer + - name: wazuh2.indexer + ip: wazuh2.indexer + - name: wazuh3.indexer + ip: wazuh3.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + - name: wazuh.master + ip: wazuh.master + node_type: master + - name: wazuh.worker + ip: wazuh.worker + node_type: worker + + # Wazuh dashboard node + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard +``` + +4) Run the certificate creation script: +``` +bash ./wazuh-certs-tool.sh -A +``` + +5) Start the environment with docker compose: - In the foregroud: ``` diff --git a/multi-node/config/certs.yml b/multi-node/config/certs.yml deleted file mode 100644 index 5c3f4f1d..00000000 --- a/multi-node/config/certs.yml +++ /dev/null @@ -1,24 +0,0 @@ -nodes: - # Wazuh indexer server nodes - indexer: - - name: wazuh1.indexer - ip: wazuh1.indexer - - name: wazuh2.indexer - ip: wazuh2.indexer - - name: wazuh3.indexer - ip: wazuh3.indexer - - # Wazuh server nodes - # Use node_type only with more than one Wazuh manager - server: - - name: wazuh.master - ip: wazuh.master - node_type: master - - name: wazuh.worker - ip: wazuh.worker - node_type: worker - - # Wazuh dashboard node - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf deleted file mode 100644 index 600b3e88..00000000 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ /dev/null @@ -1,290 +0,0 @@ - - - 15m - 0 - yes - - - - - plain - - - - secure - 1514 - tcp - 131072 - - - - - no - yes - yes - yes - yes - yes - - - 43200 - - yes - - /var/lib/containerd - /var/lib/docker/overlay2 - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - - - - yes - 5m - 10 - - - - - yes - yes - 12h - - - - yes - 5m - 10 - - - - - yes - yes - 60m - - - - yes - - https://wazuh1.indexer:9200 - https://wazuh2.indexer:9200 - https://wazuh3.indexer:9200 - - - - /etc/ssl/root-ca.pem - - /etc/ssl/filebeat.pem - /etc/ssl/filebeat.key - - - - - - no - - - 43200 - - - yes - - - no - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - - - .log$|.swp$ - - - /etc/ssl/private.key - - yes - yes - yes - yes - - - 10 - - - 50 - - - - yes - 5m - 10 - - - - - - 127.0.0.1 - ^localhost.localdomain$ - - - - disable-account - disable-account - yes - - - - restart-wazuh - restart-wazuh - - - - firewall-drop - firewall-drop - yes - - - - host-deny - host-deny - yes - - - - route-null - route-null - yes - - - - win_route-null - route-null.exe - yes - - - - netsh - netsh.exe - yes - - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - ruleset/decoders - ruleset/rules - 0215-policy_rules.xml - etc/lists/audit-keys - etc/lists/amazon/aws-eventnames - etc/lists/security-eventchannel - etc/lists/malicious-ioc/malicious-ip - etc/lists/malicious-ioc/malicious-domains - etc/lists/malicious-ioc/malware-hashes - - - etc/decoders - etc/rules - - - - - no - 1515 - no - yes - no - HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH - - no - etc/sslmanager.cert - etc/sslmanager.key - no - - - - wazuh - manager - master - c98b6ha9b6169zc5f67rae55ae4z5647 - 1516 - 0.0.0.0 - - wazuh.master - - no - no - - - - - - - journald - journald - - - - audit - /var/log/audit/audit.log - - - - syslog - /var/ossec/logs/active-responses.log - - - \ No newline at end of file diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf deleted file mode 100644 index b85335cd..00000000 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ /dev/null @@ -1,290 +0,0 @@ - - - 15m - 0 - yes - - - - - plain - - - - secure - 1514 - tcp - 131072 - - - - - no - yes - yes - yes - yes - yes - - - 43200 - - yes - - /var/lib/containerd - /var/lib/docker/overlay2 - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - - - - yes - 5m - 10 - - - - - yes - yes - 12h - - - - yes - 5m - 10 - - - - - yes - yes - 60m - - - - yes - - https://wazuh1.indexer:9200 - https://wazuh2.indexer:9200 - https://wazuh3.indexer:9200 - - - - /etc/ssl/root-ca.pem - - /etc/ssl/filebeat.pem - /etc/ssl/filebeat.key - - - - - - no - - - 43200 - - - yes - - - no - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - - - .log$|.swp$ - - - /etc/ssl/private.key - - yes - yes - yes - yes - - - 10 - - - 50 - - - - yes - 5m - 10 - - - - - - 127.0.0.1 - ^localhost.localdomain$ - - - - disable-account - disable-account - yes - - - - restart-wazuh - restart-wazuh - - - - firewall-drop - firewall-drop - yes - - - - host-deny - host-deny - yes - - - - route-null - route-null - yes - - - - win_route-null - route-null.exe - yes - - - - netsh - netsh.exe - yes - - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - ruleset/decoders - ruleset/rules - 0215-policy_rules.xml - etc/lists/audit-keys - etc/lists/amazon/aws-eventnames - etc/lists/security-eventchannel - etc/lists/malicious-ioc/malicious-ip - etc/lists/malicious-ioc/malicious-domains - etc/lists/malicious-ioc/malware-hashes - - - etc/decoders - etc/rules - - - - - no - 1515 - no - yes - no - HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH - - no - etc/sslmanager.cert - etc/sslmanager.key - no - - - - wazuh - worker01 - worker - c98b6ha9b6169zc5f67rae55ae4z5647 - 1516 - 0.0.0.0 - - wazuh.master - - no - no - - - - - - - journald - journald - - - - audit - /var/log/audit/audit.log - - - - syslog - /var/ossec/logs/active-responses.log - - - \ No newline at end of file diff --git a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml b/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml deleted file mode 100644 index b59c48c1..00000000 --- a/multi-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ /dev/null @@ -1,16 +0,0 @@ -server.host: 0.0.0.0 -server.port: 5601 -opensearch.hosts: https://wazuh1.indexer:9200 -opensearch.ssl.verificationMode: certificate -opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] -opensearch_security.multitenancy.enabled: false -opensearch_security.readonly_mode.roles: ["kibana_read_only"] -server.ssl.enabled: true -server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" -server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" -opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wz-home -# Session expiration settings -opensearch_security.cookie.ttl: 900000 -opensearch_security.session.ttl: 900000 -opensearch_security.session.keepalive: true diff --git a/multi-node/config/wazuh_dashboard/wazuh.yml b/multi-node/config/wazuh_dashboard/wazuh.yml deleted file mode 100644 index 59a44de1..00000000 --- a/multi-node/config/wazuh_dashboard/wazuh.yml +++ /dev/null @@ -1,7 +0,0 @@ -hosts: - - 1513629884013: - url: "https://wazuh.master" - port: 55000 - username: wazuh-wui - password: "MyS3cr37P450r.*-" - run_as: false diff --git a/multi-node/config/wazuh_indexer/internal_users.yml b/multi-node/config/wazuh_indexer/internal_users.yml deleted file mode 100644 index d9f05b34..00000000 --- a/multi-node/config/wazuh_indexer/internal_users.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -_meta: - type: "internalusers" - config_version: 2 - -# Define your internal users here - -## Demo users - -admin: - hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" - reserved: true - backend_roles: - - "admin" - description: "Demo admin user" - -kibanaserver: - hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." - reserved: true - description: "Demo kibanaserver user" - -kibanaro: - hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" - reserved: false - backend_roles: - - "kibanauser" - - "readall" - attributes: - attribute1: "value1" - attribute2: "value2" - attribute3: "value3" - description: "Demo kibanaro user" - -logstash: - hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" - reserved: false - backend_roles: - - "logstash" - description: "Demo logstash user" - -readall: - hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" - reserved: false - backend_roles: - - "readall" - description: "Demo readall user" - -snapshotrestore: - hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" - reserved: false - backend_roles: - - "snapshotrestore" - description: "Demo snapshotrestore user" diff --git a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml b/multi-node/config/wazuh_indexer/wazuh1.indexer.yml deleted file mode 100644 index 81fadff6..00000000 --- a/multi-node/config/wazuh_indexer/wazuh1.indexer.yml +++ /dev/null @@ -1,37 +0,0 @@ -network.host: wazuh1.indexer -node.name: wazuh1.indexer -cluster.initial_cluster_manager_nodes: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -cluster.name: "wazuh-cluster" -discovery.seed_hosts: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -node.max_local_storage_nodes: "3" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh1.indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh1.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh1.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh1.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.authcz.admin_dn: -- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.allow_default_init_securityindex: true -cluster.routing.allocation.disk.threshold_enabled: false diff --git a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml b/multi-node/config/wazuh_indexer/wazuh2.indexer.yml deleted file mode 100644 index 47427bd9..00000000 --- a/multi-node/config/wazuh_indexer/wazuh2.indexer.yml +++ /dev/null @@ -1,37 +0,0 @@ -network.host: wazuh2.indexer -node.name: wazuh2.indexer -cluster.initial_cluster_manager_nodes: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -cluster.name: "wazuh-cluster" -discovery.seed_hosts: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -node.max_local_storage_nodes: "3" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh2.indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh2.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh2.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh2.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.authcz.admin_dn: -- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.allow_default_init_securityindex: true -cluster.routing.allocation.disk.threshold_enabled: false diff --git a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml b/multi-node/config/wazuh_indexer/wazuh3.indexer.yml deleted file mode 100644 index 0efb8308..00000000 --- a/multi-node/config/wazuh_indexer/wazuh3.indexer.yml +++ /dev/null @@ -1,37 +0,0 @@ -network.host: wazuh3.indexer -node.name: wazuh3.indexer -cluster.initial_cluster_manager_nodes: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -cluster.name: "wazuh-cluster" -discovery.seed_hosts: - - wazuh1.indexer - - wazuh2.indexer - - wazuh3.indexer -node.max_local_storage_nodes: "3" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh3.indexer.pem -plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh3.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh3.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh3.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.authcz.admin_dn: -- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- "CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -- "CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.allow_default_init_securityindex: true -cluster.routing.allocation.disk.threshold_enabled: false diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index ddf9c9ed..f080a5c8 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:main hostname: wazuh.master restart: always ulimits: @@ -16,13 +16,12 @@ services: - "514:514/udp" - "55000:55000" environment: - - INDEXER_URL=https://wazuh1.indexer:9200 + - WAZUH_INDEXER_HOSTS=wazuh1.indexer:9200,wazuh2.indexer:9200,wazuh3.indexer:9200 + - WAZUH_NODE_NAME=wazuh.master + - WAZUH_NODE_TYPE=master + - WAZUH_CLUSTER_NODES=wazuh.master,wazuh.worker - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key + - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: @@ -33,15 +32,11 @@ services: - master-wazuh-var-multigroups:/var/ossec/var/multigroups - master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-wodles:/var/ossec/wodles - - master-filebeat-etc:/etc/filebeat - - master-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key - - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf - + - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem + - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem + - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:main hostname: wazuh.worker restart: always ulimits: @@ -52,13 +47,14 @@ services: soft: 655360 hard: 655360 environment: - - INDEXER_URL=https://wazuh1.indexer:9200 + - WAZUH_INDEXER_HOSTS=wazuh1.indexer:9200,wazuh2.indexer:9200,wazuh3.indexer:9200 + - WAZUH_NODE_NAME=wazuh.worker + - WAZUH_NODE_TYPE=worker + - WAZUH_CLUSTER_NODES=wazuh.master,wazuh.worker - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key + - INDEXER_PASSWORD=admin + - API_USERNAME=wazuh-wui + - API_PASSWORD=MyS3cr37P450r.*- volumes: - worker-wazuh-api-configuration:/var/ossec/api/configuration - worker-wazuh-etc:/var/ossec/etc @@ -67,22 +63,26 @@ services: - worker-wazuh-var-multigroups:/var/ossec/var/multigroups - worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-wodles:/var/ossec/wodles - - worker-filebeat-etc:/etc/filebeat - - worker-filebeat-var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key - - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf + - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem + - ./wazuh-certificates/wazuh.worker.pem:/etc/filebeat/certs/filebeat.pem + - ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:main hostname: wazuh1.indexer restart: always ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" + - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g + - bootstrap.memory_lock=true + - network.host=wazuh1.indexer + - node.name=wazuh1.indexer + - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - node.max_local_storage_nodes=3 + - plugins.security.allow_default_init_securityindex=true + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -92,21 +92,26 @@ services: hard: 65536 volumes: - wazuh-indexer-data-1:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./wazuh-certificates/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./wazuh-certificates/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem + - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:main hostname: wazuh2.indexer restart: always environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" + - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g + - bootstrap.memory_lock=true + - network.host=wazuh2.indexer + - node.name=wazuh2.indexer + - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - node.max_local_storage_nodes=3 + - plugins.security.allow_default_init_securityindex=true + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -116,19 +121,24 @@ services: hard: 65536 volumes: - wazuh-indexer-data-2:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem - - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./wazuh-certificates/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:main hostname: wazuh3.indexer restart: always environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" - - "bootstrap.memory_lock=true" + - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g + - bootstrap.memory_lock=true + - network.host=wazuh3.indexer + - node.name=wazuh3.indexer + - cluster.initial_cluster_manager_nodes=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer + - node.max_local_storage_nodes=3 + - plugins.security.allow_default_init_securityindex=true + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -138,35 +148,36 @@ services: hard: 65536 volumes: - wazuh-indexer-data-3:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem - - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./wazuh-certificates/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:main hostname: wazuh.dashboard restart: always ports: - 443:5601 environment: - - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200" - - WAZUH_API_URL="https://wazuh.master" - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- + - SERVER_PORT=5601 + - SERVER_HOST=0.0.0.0 + - OPENSEARCH_HOSTS=["https://wazuh1.indexer:9200","https://wazuh2.indexer:9200","https://wazuh3.indexer:9200"] + - INDEXER_USERNAME=admin + - INDEXER_PASSWORD=admin + - WAZUH_API_URL=https://wazuh.master - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver + - API_USERNAME=wazuh-wui + - API_PASSWORD=MyS3cr37P450r.*- volumes: - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem + - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: - wazuh1.indexer + - wazuh.master links: - wazuh1.indexer:wazuh1.indexer - wazuh.master:wazuh.master @@ -196,8 +207,6 @@ volumes: master-wazuh-var-multigroups: master-wazuh-active-response: master-wazuh-wodles: - master-filebeat-etc: - master-filebeat-var: worker-wazuh-api-configuration: worker-wazuh-etc: worker-wazuh-logs: @@ -205,8 +214,6 @@ volumes: worker-wazuh-var-multigroups: worker-wazuh-active-response: worker-wazuh-wodles: - worker-filebeat-etc: - worker-filebeat-var: wazuh-indexer-data-1: wazuh-indexer-data-2: wazuh-indexer-data-3: diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml deleted file mode 100644 index 88927593..00000000 --- a/multi-node/generate-indexer-certs.yml +++ /dev/null @@ -1,10 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - generator: - image: wazuh/wazuh-certs-generator:0.0.3 - hostname: wazuh-certs-generator - environment: - - CERT_TOOL_VERSION=4.14 - volumes: - - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml \ No newline at end of file diff --git a/single-node/README.md b/single-node/README.md index 1a93b6c9..fbded2be 100644 --- a/single-node/README.md +++ b/single-node/README.md @@ -6,16 +6,45 @@ This deployment is defined in the `docker-compose.yml` file with one Wazuh manag ``` $ sysctl -w vm.max_map_count=262144 ``` -2) Run the certificate creation script: + +2) Download the certificate creation script and config.yml file: ``` -$ docker compose -f generate-indexer-certs.yml run --rm generator +$ curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh +$ curl -sO https://packages.wazuh.com/5.0/config.yml ``` -3) Start the environment with docker compose: + +3) Edit the config.yml file with the configuration of the Wazuh components to be deployed +``` +nodes: + # Wazuh indexer server nodes + indexer: + - name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + - name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard +``` + +4) Run the certificate creation script: +``` +bash ./wazuh-certs-tool.sh -A +``` + +5) Start the environment with docker compose: - In the foregroud: ``` $ docker compose up ``` + - In the background: ``` $ docker compose up -d diff --git a/single-node/config/certs.yml b/single-node/config/certs.yml deleted file mode 100755 index c3e017be..00000000 --- a/single-node/config/certs.yml +++ /dev/null @@ -1,16 +0,0 @@ -nodes: - # Wazuh indexer server nodes - indexer: - - name: wazuh.indexer - ip: wazuh.indexer - - # Wazuh server nodes - # Use node_type only with more than one Wazuh manager - server: - - name: wazuh.manager - ip: wazuh.manager - - # Wazuh dashboard node - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard diff --git a/single-node/config/wazuh_cluster/entrypoint.sh b/single-node/config/wazuh_cluster/entrypoint.sh deleted file mode 100755 index 51f53312..00000000 --- a/single-node/config/wazuh_cluster/entrypoint.sh +++ /dev/null @@ -1,85 +0,0 @@ -#!/bin/bash -set -xe - -OSSEC_CONF="ossec.conf" - -# -------------------------- -# Defaults based on OSSEC_CONF -# -------------------------- -if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then - WAZUH_CLUSTER_KEY=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1) -fi - -if [[ -z "$WAZUH_CLUSTER_PORT" ]]; then - WAZUH_CLUSTER_PORT=$(sed -n '//,/<\/cluster>/s/.*\(.*\)<\/port>.*/\1/p' "$OSSEC_CONF" | head -n1) -fi - -# Node type logic -if [[ -z "$WAZUH_NODE_TYPE" ]]; then - if [[ "$HOSTNAME" == "manager" || "$HOSTNAME" == "aio_node" ]]; then - WAZUH_NODE_TYPE="master" - else - WAZUH_NODE_TYPE="worker" - fi -fi - -# Default node name → HOSTNAME if not defined -WAZUH_NODE_NAME="${WAZUH_NODE_NAME:-$HOSTNAME}" - -# -------------------------- -# Replace Indexer Hosts -# -------------------------- -if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then - TMP_HOSTS=$(mktemp) - { - echo " " - for NODE in $WAZUH_INDEXER_HOSTS; do - IP="${NODE%:*}" - PORT="${NODE#*:}" - echo " https://$IP:$PORT" - done - echo " " - } > "$TMP_HOSTS"; - sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ - -e 'd }}' "$OSSEC_CONF"; - rm -f "$TMP_HOSTS"; -fi - -# -------------------------- -# Cluster: node_name -# -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_NAME|" "$OSSEC_CONF" - -# -------------------------- -# Cluster: node_type -# -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_NODE_TYPE|" "$OSSEC_CONF" - -# -------------------------- -# Cluster: key -# -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$OSSEC_CONF" - -# -------------------------- -# Cluster: port -# -------------------------- -sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_PORT|" "$OSSEC_CONF" - -# -------------------------- -# Cluster: nodes list -# -------------------------- -if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then - TMP_NODES=$(mktemp) - { - echo " " - for N in $WAZUH_CLUSTER_NODES; do - echo " $N" - done - echo " " - } > "$TMP_NODES"; - sed -i -e '//,/<\/cluster>/{ //,/<\/nodes>/{ //r '"$TMP_NODES" \ - -e 'd }}' "$OSSEC_CONF"; - rm -f "$TMP_NODES"; -fi - -echo "Wazuh manager config modified successfully." diff --git a/single-node/config/wazuh_cluster/wazuh_manager.conf b/single-node/config/wazuh_cluster/wazuh_manager.conf deleted file mode 100644 index 4f00c24d..00000000 --- a/single-node/config/wazuh_cluster/wazuh_manager.conf +++ /dev/null @@ -1,288 +0,0 @@ - - - 15m - 0 - yes - - - - - plain - - - - secure - 1514 - tcp - 131072 - - - - - no - yes - yes - yes - yes - yes - - - 43200 - - yes - - /var/lib/containerd - /var/lib/docker/overlay2 - - - - - no - 1h - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - yes - - - - yes - 5m - 10 - - - - - yes - yes - 12h - - - - yes - 5m - 10 - - - - - yes - yes - 60m - - - - yes - - https://wazuh.indexer:9200 - - - - /etc/ssl/root-ca.pem - - /etc/ssl/filebeat.pem - /etc/ssl/filebeat.key - - - - - - no - - - 43200 - - - yes - - - no - - - /etc,/usr/bin,/usr/sbin - /bin,/sbin,/boot - - - /etc/mtab - /etc/hosts.deny - /etc/mail/statistics - /etc/random-seed - /etc/random.seed - /etc/adjtime - /etc/httpd/logs - /etc/utmpx - /etc/wtmpx - /etc/cups/certs - /etc/dumpdates - /etc/svc/volatile - - - .log$|.swp$ - - - /etc/ssl/private.key - - yes - yes - yes - yes - - - 10 - - - 50 - - - - yes - 5m - 10 - - - - - - 127.0.0.1 - ^localhost.localdomain$ - - - - disable-account - disable-account - yes - - - - restart-wazuh - restart-wazuh - - - - firewall-drop - firewall-drop - yes - - - - host-deny - host-deny - yes - - - - route-null - route-null - yes - - - - win_route-null - route-null.exe - yes - - - - netsh - netsh.exe - yes - - - - - - - command - df -P - 360 - - - - full_command - netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d - netstat listening ports - 360 - - - - full_command - last -n 20 - 360 - - - - - ruleset/decoders - ruleset/rules - 0215-policy_rules.xml - etc/lists/audit-keys - etc/lists/amazon/aws-eventnames - etc/lists/security-eventchannel - etc/lists/malicious-ioc/malicious-ip - etc/lists/malicious-ioc/malicious-domains - etc/lists/malicious-ioc/malware-hashes - - - etc/decoders - etc/rules - - - - - no - 1515 - no - yes - no - HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH - - no - etc/sslmanager.cert - etc/sslmanager.key - no - - - - wazuh - node01 - master - aa093264ef885029653eea20dfcf51ae - 1516 - 0.0.0.0 - - wazuh.manager - - no - yes - - - - - - - journald - journald - - - - audit - /var/log/audit/audit.log - - - - syslog - /var/ossec/logs/active-responses.log - - - \ No newline at end of file diff --git a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml b/single-node/config/wazuh_dashboard/opensearch_dashboards.yml deleted file mode 100644 index 07c81abf..00000000 --- a/single-node/config/wazuh_dashboard/opensearch_dashboards.yml +++ /dev/null @@ -1,16 +0,0 @@ -server.host: 0.0.0.0 -server.port: 5601 -opensearch.hosts: https://wazuh.indexer:9200 -opensearch.ssl.verificationMode: certificate -opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] -opensearch_security.multitenancy.enabled: false -opensearch_security.readonly_mode.roles: ["kibana_read_only"] -server.ssl.enabled: true -server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem" -server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem" -opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"] -uiSettings.overrides.defaultRoute: /app/wz-home -# Session expiration settings -opensearch_security.cookie.ttl: 900000 -opensearch_security.session.ttl: 900000 -opensearch_security.session.keepalive: true diff --git a/single-node/config/wazuh_dashboard/wazuh.yml b/single-node/config/wazuh_dashboard/wazuh.yml deleted file mode 100644 index ef429153..00000000 --- a/single-node/config/wazuh_dashboard/wazuh.yml +++ /dev/null @@ -1,7 +0,0 @@ -hosts: - - 1513629884013: - url: "https://wazuh.manager" - port: 55000 - username: wazuh-wui - password: "MyS3cr37P450r.*-" - run_as: false diff --git a/single-node/config/wazuh_indexer/internal_users.yml b/single-node/config/wazuh_indexer/internal_users.yml deleted file mode 100644 index d9f05b34..00000000 --- a/single-node/config/wazuh_indexer/internal_users.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -_meta: - type: "internalusers" - config_version: 2 - -# Define your internal users here - -## Demo users - -admin: - hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO" - reserved: true - backend_roles: - - "admin" - description: "Demo admin user" - -kibanaserver: - hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H." - reserved: true - description: "Demo kibanaserver user" - -kibanaro: - hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC" - reserved: false - backend_roles: - - "kibanauser" - - "readall" - attributes: - attribute1: "value1" - attribute2: "value2" - attribute3: "value3" - description: "Demo kibanaro user" - -logstash: - hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2" - reserved: false - backend_roles: - - "logstash" - description: "Demo logstash user" - -readall: - hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2" - reserved: false - backend_roles: - - "readall" - description: "Demo readall user" - -snapshotrestore: - hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W" - reserved: false - backend_roles: - - "snapshotrestore" - description: "Demo snapshotrestore user" diff --git a/single-node/config/wazuh_indexer/wazuh.indexer.yml b/single-node/config/wazuh_indexer/wazuh.indexer.yml deleted file mode 100644 index 3fc295a4..00000000 --- a/single-node/config/wazuh_indexer/wazuh.indexer.yml +++ /dev/null @@ -1,30 +0,0 @@ -network.host: "0.0.0.0" -node.name: "wazuh.indexer" -cluster.name: "wazuh-cluster" -path.data: /var/lib/wazuh-indexer -path.logs: /var/log/wazuh-indexer -discovery.type: single-node -http.port: 9200-9299 -transport.tcp.port: 9300-9399 -plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem -plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key -plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem -plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem -plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key -plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem -plugins.security.ssl.http.enabled: true -plugins.security.ssl.transport.enforce_hostname_verification: false -plugins.security.ssl.transport.resolve_hostname: false -plugins.security.authcz.admin_dn: -- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.check_snapshot_restore_write_privileges: true -plugins.security.enable_snapshot_restore_privilege: true -plugins.security.nodes_dn: -- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US" -plugins.security.restapi.roles_enabled: -- "all_access" -- "security_rest_api_access" -plugins.security.system_indices.enabled: true -plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"] -plugins.security.allow_default_init_securityindex: true -cluster.routing.allocation.disk.threshold_enabled: false \ No newline at end of file diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 365ab29b..14faabb2 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:main hostname: wazuh.manager restart: always ulimits: @@ -17,13 +17,11 @@ services: - "514:514/udp" - "55000:55000" environment: - - INDEXER_URL=https://wazuh.indexer:9200 + - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 + - WAZUH_NODE_NAME=wazuh.manager + - WAZUH_CLUSTER_NODES=wazuh.manager - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword - - FILEBEAT_SSL_VERIFICATION_MODE=full - - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem - - SSL_CERTIFICATE=/etc/ssl/filebeat.pem - - SSL_KEY=/etc/ssl/filebeat.key + - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: @@ -34,21 +32,25 @@ services: - wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - - filebeat_etc:/etc/filebeat - - filebeat_var:/var/lib/filebeat - - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key - - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf + - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem + - ./wazuh-certificates/wazuh.manager.pem:/etc/filebeat/certs/filebeat.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:main hostname: wazuh.indexer restart: always ports: - "9200:9200" environment: - - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g" + - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g + - bootstrap.memory_lock=true + - network.host=wazuh.indexer + - node.name=wazuh.indexer + - cluster.initial_cluster_manager_nodes=wazuh.indexer + - node.max_local_storage_nodes=1 + - plugins.security.allow_default_init_securityindex=true + - NODES_DN=CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -58,34 +60,33 @@ services: hard: 65536 volumes: - wazuh-indexer-data:/var/lib/wazuh-indexer - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key - - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem - - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem - - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem - - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml - - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem + - ./wazuh-certificates/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/indexer-key.pem + - ./wazuh-certificates/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem + - ./wazuh-certificates/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem + - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:main hostname: wazuh.dashboard restart: always ports: - 443:5601 environment: + - SERVER_PORT=5601 + - SERVER_HOST=0.0.0.0 + - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin - - INDEXER_PASSWORD=SecretPassword + - INDEXER_PASSWORD=admin - WAZUH_API_URL=https://wazuh.manager - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- volumes: - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem - - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem - - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem - - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml - - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml + - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem + - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem + - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: @@ -102,8 +103,6 @@ volumes: wazuh_var_multigroups: wazuh_active_response: wazuh_wodles: - filebeat_etc: - filebeat_var: wazuh-indexer-data: wazuh-dashboard-config: - wazuh-dashboard-custom: + wazuh-dashboard-custom: \ No newline at end of file diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml deleted file mode 100644 index a941280f..00000000 --- a/single-node/generate-indexer-certs.yml +++ /dev/null @@ -1,10 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - generator: - image: wazuh/wazuh-certs-generator:0.0.3 - hostname: wazuh-certs-generator - environment: - - CERT_TOOL_VERSION=4.14 - volumes: - - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml From fb6de67a94aadbab253969ecccc3bb2397d544e7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 00:13:49 +0700 Subject: [PATCH 030/142] Delete Filebeat DN --- multi-node/docker-compose.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index f080a5c8..9a76bb7b 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -82,7 +82,7 @@ services: - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer - node.max_local_storage_nodes=3 - plugins.security.allow_default_init_securityindex=true - - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -111,7 +111,7 @@ services: - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer - node.max_local_storage_nodes=3 - plugins.security.allow_default_init_securityindex=true - - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 @@ -138,7 +138,7 @@ services: - discovery.seed_hosts=wazuh1.indexer,wazuh2.indexer,wazuh3.indexer - node.max_local_storage_nodes=3 - plugins.security.allow_default_init_securityindex=true - - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=filebeat,OU=Wazuh,O=Wazuh,L=California,C=US + - NODES_DN=CN=wazuh1.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh2.indexer,OU=Wazuh,O=Wazuh,L=California,C=US;CN=wazuh3.indexer,OU=Wazuh,O=Wazuh,L=California,C=US ulimits: memlock: soft: -1 From 1c6c1be20a59e7366dca089dcea014ce60343e9b Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 00:18:57 +0700 Subject: [PATCH 031/142] Add newline --- single-node/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 14faabb2..454d900b 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -105,4 +105,4 @@ volumes: wazuh_wodles: wazuh-indexer-data: wazuh-dashboard-config: - wazuh-dashboard-custom: \ No newline at end of file + wazuh-dashboard-custom: From 0fa0b3186af527cebdff61292bd054afa35f7906 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 00:33:26 +0700 Subject: [PATCH 032/142] Add Changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 68f2b745..60236333 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-puppet/issues/2081)) - Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058)) - Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054)) - Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030)) From 1ceb1734e84c7d8116a0c8f7ffdd95c03cb4714f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 01:16:01 +0700 Subject: [PATCH 033/142] Modify cluster configuration --- .../wazuh-manager/config/etc/cont-init.d/0-wazuh-init | 5 +++++ multi-node/docker-compose.yml | 10 ++++++---- single-node/docker-compose.yml | 2 +- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index a91d6b1e..a34ef3d1 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -204,6 +204,11 @@ sed -i "//,/<\/cluster>/ s|.*|$WAZUH_ # -------------------------- sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_KEY|" "$OSSEC_CONF" +# -------------------------- +# Cluster: bind_addr +# -------------------------- +sed -i "//,/<\/cluster>/ s|.*|$WAZUH_CLUSTER_BIND_ADDR|" "$OSSEC_CONF" + # -------------------------- # Cluster: nodes list # -------------------------- diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 9a76bb7b..7123d62a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -17,9 +17,10 @@ services: - "55000:55000" environment: - WAZUH_INDEXER_HOSTS=wazuh1.indexer:9200,wazuh2.indexer:9200,wazuh3.indexer:9200 - - WAZUH_NODE_NAME=wazuh.master + - WAZUH_NODE_NAME=master - WAZUH_NODE_TYPE=master - - WAZUH_CLUSTER_NODES=wazuh.master,wazuh.worker + - WAZUH_CLUSTER_BIND_ADDR=0.0.0.0 + - WAZUH_CLUSTER_NODES=wazuh.master - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui @@ -48,9 +49,10 @@ services: hard: 655360 environment: - WAZUH_INDEXER_HOSTS=wazuh1.indexer:9200,wazuh2.indexer:9200,wazuh3.indexer:9200 - - WAZUH_NODE_NAME=wazuh.worker + - WAZUH_NODE_NAME=worker01 - WAZUH_NODE_TYPE=worker - - WAZUH_CLUSTER_NODES=wazuh.master,wazuh.worker + - WAZUH_CLUSTER_BIND_ADDR=0.0.0.0 + - WAZUH_CLUSTER_NODES=wazuh.master - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 454d900b..d5bf48c5 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -18,7 +18,7 @@ services: - "55000:55000" environment: - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 - - WAZUH_NODE_NAME=wazuh.manager + - WAZUH_NODE_NAME=manager - WAZUH_CLUSTER_NODES=wazuh.manager - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin From 8c0b724bd352559f14b3a2f04a10b284a202e8dc Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 02:02:58 +0700 Subject: [PATCH 034/142] Delete url echo --- build-docker-images/wazuh-manager/config/config.sh | 6 ------ 1 file changed, 6 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index 024ae2b8..f71f4815 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -9,19 +9,13 @@ download_package() { local url=$1 local package=$2 if curl -fsL "$url" -o "$package"; then - echo $url - cat $package echo "Downloaded $package" return 0 else - echo $url - cat $package echo "Error downloading $package from $url" return 1 fi } -echo "pwd" -pwd mkdir -p $CERT_DIR # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." From 819595a25f2f2c88501442eff1563efe4aa99634 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 15 Nov 2025 02:03:33 +0700 Subject: [PATCH 035/142] Delete url echo --- build-docker-images/wazuh-manager/config/config.sh | 3 --- 1 file changed, 3 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index f71f4815..8cf0553e 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -31,9 +31,6 @@ chmod 700 "$CERT_CONFIG_FILE" # Create the certificates chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A -echo "files in pwd" -ls -la - # Copy Wazuh manager certs cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem From 6e3a11a01c941223fbc779fa65f077ddd83bc8e3 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 19 Nov 2025 00:10:29 +0700 Subject: [PATCH 036/142] Change variable name --- .github/workflows/Procedure_push_docker_images.yml | 4 ++-- build-docker-images/build-images.sh | 14 +++++++------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 3ec09905..23be8050 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -122,10 +122,10 @@ jobs: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - - name: Create packages_url.txt file + - name: Create artifact_urls.yml file if : ${{ inputs.dev == true }} run: | - cat << EOF > packages_url.txt + cat << EOF > artifact_urls.yml wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 95b23ebd..ad7668da 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -43,22 +43,22 @@ build() { WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" # Variables - FILE="packages_url.txt" + ARTIFACT_URLS_FILE="artifact_urls.txt" - if [[ -f "$FILE" ]]; then - echo "$FILE exists. Using existing file." + if [[ -f "$ARTIFACT_URLS_FILE" ]]; then + echo "$ARTIFACT_URLS_FILE exists. Using existing file." else TAG="v${WAZUH_VERSION}" REPO="wazuh/wazuh-docker" GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}" if curl -fsSL "$GH_URL" >/dev/null 2>&1; then - curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + curl -fsSL -o "$ARTIFACT_URLS_FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/${ARTIFACT_URLS_FILE}" else - curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + curl -fsSL -o "$ARTIFACT_URLS_FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/${ARTIFACT_URLS_FILE}" fi fi - awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt + awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env @@ -69,7 +69,7 @@ build() { set -a source ../.env - source ./packages_env.txt + source ./artifacts_env.txt set +a if [ "${MULTIARCH}" ];then From 5b43cf9053e3749dc9c7d5ad1652a5a515d4feb1 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 19 Nov 2025 00:15:15 +0700 Subject: [PATCH 037/142] modify gitignore --- .gitignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9e8e4a05..be72bfa3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ *.log -build-docker-images/packages_env.txt -build-docker-images/packages_url.txt +build-docker-images/artifact_urls.yml +build-docker-images/artifacts_env.txt single-node/wazuh-certificates single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log From a832d969665a3a55580b7b085bde472013bddb8f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 19 Nov 2025 00:17:10 +0700 Subject: [PATCH 038/142] modify file extension --- build-docker-images/build-images.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index ad7668da..e1641a99 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -43,7 +43,7 @@ build() { WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" # Variables - ARTIFACT_URLS_FILE="artifact_urls.txt" + ARTIFACT_URLS_FILE="artifact_urls.yml" if [[ -f "$ARTIFACT_URLS_FILE" ]]; then echo "$ARTIFACT_URLS_FILE exists. Using existing file." From 51c4751a1de4147f4ab9f6939532927ecaaa5afb Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 19 Nov 2025 00:24:47 +0700 Subject: [PATCH 039/142] fix wazuh_certs_tool parameter --- .github/workflows/Procedure_push_docker_images.yml | 2 +- build-docker-images/build-images.yml | 6 +++--- build-docker-images/wazuh-dashboard/Dockerfile | 2 +- build-docker-images/wazuh-dashboard/config/config.sh | 2 +- build-docker-images/wazuh-indexer/Dockerfile | 2 +- build-docker-images/wazuh-indexer/config/config.sh | 2 +- build-docker-images/wazuh-manager/Dockerfile | 2 +- build-docker-images/wazuh-manager/config/config.sh | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 23be8050..e9735cdd 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -145,7 +145,7 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_cert_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" + wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index a6478b17..15397156 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -8,7 +8,7 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm} wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm} - wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_certs_tool: ${wazuh_certs_tool} wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager @@ -51,7 +51,7 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm} wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm} - wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_certs_tool: ${wazuh_certs_tool} wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer @@ -77,7 +77,7 @@ services: WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm} wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm} - wazuh_cert_tool: ${wazuh_cert_tool} + wazuh_certs_tool: ${wazuh_certs_tool} wazuh_config_yml: ${wazuh_config_yml} image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 8184853f..483dc0c8 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -8,7 +8,7 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm -ARG wazuh_cert_tool +ARG wazuh_certs_tool ARG wazuh_config_yml # Update and install dependencies diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 2d1d0ee4..b6c3b32c 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -26,7 +26,7 @@ download_package() { } # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -download_package "$wazuh_cert_tool" $CERT_TOOL +download_package "$wazuh_certs_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." download_package "$wazuh_config_yml" $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 51ca78d0..5e8c44e2 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -6,7 +6,7 @@ ARG WAZUH_TAG_REVISION ARG TARGETARCH ARG wazuh_indexer_url_amd64_rpm ARG wazuh_indexer_url_arm64_rpm -ARG wazuh_cert_tool +ARG wazuh_certs_tool ARG wazuh_config_yml COPY config/config.sh . diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index abcf257b..f2dd1bbd 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -34,7 +34,7 @@ download_package() { } # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -download_package "$wazuh_cert_tool" $CERT_TOOL +download_package "$wazuh_certs_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." download_package "$wazuh_config_yml" $CERT_CONFIG_FILE diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index d7969b15..09ce7a8b 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,7 +9,7 @@ ARG S6_VERSION="v2.2.0.3" ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm -ARG wazuh_cert_tool +ARG wazuh_certs_tool ARG wazuh_config_yml COPY config/config.sh . diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index 8cf0553e..d220151e 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -19,7 +19,7 @@ download_package() { mkdir -p $CERT_DIR # Download the tool to create the certificates echo "Downloading the tool to create the certificates..." -download_package "$wazuh_cert_tool" $CERT_TOOL +download_package "$wazuh_certs_tool" $CERT_TOOL # Download the config file for the certificate tool echo "Downloading the config file for the certificate tool..." download_package "$wazuh_config_yml" $CERT_CONFIG_FILE From f3f8471496eaa02f87335719fc95c18c0a4363bd Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 19 Nov 2025 01:30:36 +0700 Subject: [PATCH 040/142] Modify image tag and version --- .env | 6 +++--- build-docker-images/build-images.sh | 6 +++--- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.env b/.env index a8180776..2146280d 100755 --- a/.env +++ b/.env @@ -1,6 +1,6 @@ -WAZUH_VERSION=main -WAZUH_IMAGE_VERSION=main +WAZUH_VERSION=5.0.0 +WAZUH_IMAGE_VERSION=5.0.0 WAZUH_TAG_REVISION=1 WAZUH_UI_REVISION=1 WAZUH_REGISTRY=docker.io -IMAGE_TAG=main +IMAGE_TAG=5.0.0 diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index e1641a99..f6895666 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,5 +1,5 @@ -WAZUH_IMAGE_VERSION=main -IMAGE_TAG=main +WAZUH_IMAGE_VERSION=5.0.0 +IMAGE_TAG=5.0.0 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') @@ -14,7 +14,7 @@ WAZUH_REGISTRY=docker.io # License (version 2) as published by the FSF - Free Software # Foundation. -WAZUH_IMAGE_VERSION="main" +WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" WAZUH_TAG_REFERENCE="" diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 7123d62a..aa079f8d 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:main + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key wazuh.worker: - image: wazuh/wazuh-manager:main + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:main + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:main + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:main + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:main + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index d5bf48c5..5b107f72 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:main + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:main + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -67,7 +67,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:main + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 9ebecf410eb5ac3029a140782a18e90d2b11fcc1 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 3 Dec 2025 11:49:22 -0300 Subject: [PATCH 041/142] Testing the docker images build with filebeat reference removed --- .github/.goss.yaml | 13 ------- .github/multi-node-filebeat-check.sh | 39 ------------------- .github/single-node-filebeat-check.sh | 20 ---------- .github/workflows/push.yml | 6 --- build-docker-images/README.md | 1 - build-docker-images/build-images.sh | 2 +- .../config/wazuh_app_config.sh | 18 ++++----- .../wazuh-manager/config/config.sh | 2 +- docs/README.md | 8 ++-- multi-node/Migration-to-Wazuh-4.4.md | 32 +++++++-------- multi-node/docker-compose.yml | 10 ++--- multi-node/volume-migrator.sh | 36 ++++++++--------- single-node/docker-compose.yml | 6 +-- 13 files changed, 56 insertions(+), 137 deletions(-) delete mode 100755 .github/multi-node-filebeat-check.sh delete mode 100755 .github/single-node-filebeat-check.sh diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 85c33160..54fb61fa 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -1,11 +1,4 @@ file: - /etc/filebeat/filebeat.yml: - exists: true - mode: "0644" - owner: root - group: root - filetype: file - contains: [] /var/ossec/bin/wazuh-control: exists: true mode: "0750" @@ -49,10 +42,6 @@ file: filetype: file contains: [] package: - filebeat: - installed: true - versions: - - 7.10.2 wazuh-manager: installed: true versions: @@ -71,8 +60,6 @@ port: ip: - 0.0.0.0 process: - filebeat: - running: true wazuh-analysisd: running: true wazuh-authd: diff --git a/.github/multi-node-filebeat-check.sh b/.github/multi-node-filebeat-check.sh deleted file mode 100755 index 3052f69e..00000000 --- a/.github/multi-node-filebeat-check.sh +++ /dev/null @@ -1,39 +0,0 @@ -COMMAND_TO_EXECUTE="filebeat test output" - -MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'master') - -if [ -z "$MASTER_CONTAINERS" ]; then - echo "No containers were found with 'master' in their name." -else - for MASTER_CONTAINERS in $MASTER_CONTAINERS; do - FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE) - FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK) - if [[ $FILEBEAT_STATUS -eq 7 ]]; then - echo "No errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - else - echo "Errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - exit 1 - fi - done -fi - -MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'worker') - -if [ -z "$MASTER_CONTAINERS" ]; then - echo "No containers were found with 'worker' in their name." -else - for MASTER_CONTAINERS in $MASTER_CONTAINERS; do - FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE) - FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK) - if [[ $FILEBEAT_STATUS -eq 7 ]]; then - echo "No errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - else - echo "Errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - exit 1 - fi - done -fi \ No newline at end of file diff --git a/.github/single-node-filebeat-check.sh b/.github/single-node-filebeat-check.sh deleted file mode 100755 index 1979d25b..00000000 --- a/.github/single-node-filebeat-check.sh +++ /dev/null @@ -1,20 +0,0 @@ -COMMAND_TO_EXECUTE="filebeat test output" - -MASTER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep -E 'manager') - -if [ -z "$MASTER_CONTAINERS" ]; then - echo "No containers were found with 'manager' in their name." -else - for MASTER_CONTAINERS in $MASTER_CONTAINERS; do - FILEBEAT_OUTPUT=$(docker exec "$MASTER_CONTAINERS" $COMMAND_TO_EXECUTE) - FILEBEAT_STATUS=$(echo "${FILEBEAT_OUTPUT}" | grep -c OK) - if [[ $FILEBEAT_STATUS -eq 7 ]]; then - echo "No errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - else - echo "Errors in filebeat" - echo "${FILEBEAT_OUTPUT}" - exit 1 - fi - done -fi \ No newline at end of file diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index e67a9a5b..75e3cf97 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -175,9 +175,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check filebeat output - run: ./.github/single-node-filebeat-check.sh - - name: Check Wazuh dashboard service URL run: | status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}') @@ -338,9 +335,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check filebeat output - run: ./.github/multi-node-filebeat-check.sh - - name: Check Wazuh dashboard service URL run: | status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 11fde42c..f4569449 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -24,7 +24,6 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.4. -r, --revision [Optional] Package revision. By default 1 -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. -h, --help Show this help. diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index f6895666..5e558e2c 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -59,7 +59,7 @@ build() { fi fi awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt - + echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 1410d5be..0388465a 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -7,7 +7,7 @@ api_username="${API_USERNAME:-wazuh-wui}" api_password="${API_PASSWORD:-wazuh-wui}" api_run_as="${RUN_AS:-false}" -dashboard_config_file="/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml" +dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml" declare -A CONFIG_MAP=( [pattern]=$PATTERN @@ -32,18 +32,18 @@ do fi done -grep -q 1513629884013 $dashboard_config_file +grep -q default $dashboard_config_file _config_exists=$? if [[ $_config_exists -ne 0 ]]; then cat << EOF >> $dashboard_config_file - hosts: - - 1513629884013: - url: $wazuh_url - port: $wazuh_port - username: $api_username - password: $api_password - run_as: $api_run_as + wazuh_core.hosts: + default: + url: $wazuh_url + port: $wazuh_port + username: $api_username + password: $api_password + run_as: $api_run_as EOF else echo "Wazuh APP already configured" diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh index d220151e..211de49d 100644 --- a/build-docker-images/wazuh-manager/config/config.sh +++ b/build-docker-images/wazuh-manager/config/config.sh @@ -4,7 +4,7 @@ # Variables for certificate generation CERT_TOOL="wazuh-certs-tool.sh" CERT_CONFIG_FILE="config.yml" -CERT_DIR=/etc/filebeat/certs +CERT_DIR=/etc/wazuh/certs download_package() { local url=$1 local package=$2 diff --git a/docs/README.md b/docs/README.md index 0eb31d50..e8cd99e3 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,7 +7,7 @@ In this repository you will find the containers to run: -* Wazuh manager: it runs the Wazuh manager, Wazuh API and Filebeat OSS +* Wazuh manager: it runs the Wazuh manager, and Wazuh API * Wazuh dashboard: provides a web user interface to browse through alert data and allows you to visualize the agents configuration and status. * Wazuh indexer: Wazuh indexer container (working as a single-node cluster or as a multi-node cluster). **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** * Wazuh agent: This container contains the Wazuh agent services. Current functionality is limited. @@ -70,16 +70,14 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit │   │   ├── etc │   │   │   ├── cont-init.d │   │   │   │   ├── 0-wazuh-init - │   │   │   │   ├── 1-config-filebeat + │   │   │   │   ├── 1-config- │   │   │   │   └── 2-manager │   │   │   └── services.d - │   │   │   ├── filebeat + │   │   │   ├── │   │   │   │   ├── finish │   │   │   │   └── run │   │   │   └── ossec-logs │   │   │   └── run - │   │   ├── filebeat_module.sh - │   │   ├── filebeat.yml │   │   ├── permanent_data.env │   │   └── permanent_data.sh │   └── Dockerfile diff --git a/multi-node/Migration-to-Wazuh-4.4.md b/multi-node/Migration-to-Wazuh-4.4.md index 0d192f2c..aaa057f8 100644 --- a/multi-node/Migration-to-Wazuh-4.4.md +++ b/multi-node/Migration-to-Wazuh-4.4.md @@ -97,15 +97,15 @@ docker volume create \ docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-filebeat-etc \ - multi-node_master-filebeat-etc + --label com.docker.compose.volume=master-wazuh-etc \ + multi-node_master-wazuh-etc ``` ``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=master-filebeat-var \ - multi-node_master-filebeat-var + --label com.docker.compose.volume=master-wazuh-var \ + multi-node_master-wazuh-var ``` ``` docker volume create \ @@ -160,15 +160,15 @@ docker volume create \ docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-filebeat-etc \ - multi-node_worker-filebeat-etc + --label com.docker.compose.volume=worker-wazuh-etc \ + multi-node_worker-wazuh-etc ``` ``` docker volume create \ --label com.docker.compose.project=multi-node \ --label com.docker.compose.version=1.25.0 \ - --label com.docker.compose.volume=worker-filebeat-var \ - multi-node_worker-filebeat-var + --label com.docker.compose.volume=worker-wazuh-var \ + multi-node_worker-wazuh-var ``` **6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.** ``` @@ -233,14 +233,14 @@ docker container run --rm -it \ ``` ``` docker container run --rm -it \ - -v wazuh-docker_filebeat-etc:/from \ - -v multi-node_master-filebeat-etc:/to \ + -v wazuh-docker-etc:/from \ + -v multi-node_master-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ - -v wazuh-docker_filebeat-var:/from \ - -v multi-node_master-filebeat-var:/to \ + -v wazuh-docker-var:/from \ + -v multi-node_master-wazuh-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` @@ -287,14 +287,14 @@ docker container run --rm -it \ ``` ``` docker container run --rm -it \ - -v wazuh-docker_worker-filebeat-etc:/from \ - -v multi-node_worker-filebeat-etc:/to \ + -v wazuh-docker_worker-etc:/from \ + -v multi-node_worker-wazuh-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` ``` docker container run --rm -it \ - -v wazuh-docker_worker-filebeat-var:/from \ - -v multi-node_worker-filebeat-var:/to \ + -v wazuh-docker_worker-var:/from \ + -v multi-node_worker-wazuh-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" ``` diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index aa079f8d..dd08d2d4 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -34,8 +34,8 @@ services: - master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem - - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/filebeat.pem - - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/filebeat.key + - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem + - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key wazuh.worker: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker @@ -65,9 +65,9 @@ services: - worker-wazuh-var-multigroups:/var/ossec/var/multigroups - worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem - - ./wazuh-certificates/wazuh.worker.pem:/etc/filebeat/certs/filebeat.pem - - ./wazuh-certificates/wazuh.worker-key.pem:/etc/filebeat/certs/filebeat-key.pem + - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem + - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.worker.pem + - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 diff --git a/multi-node/volume-migrator.sh b/multi-node/volume-migrator.sh index 21c3d255..196c81ed 100755 --- a/multi-node/volume-migrator.sh +++ b/multi-node/volume-migrator.sh @@ -61,14 +61,14 @@ docker volume create \ docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-filebeat-etc \ - $2_master-filebeat-etc + --label com.docker.compose.volume=master-wazuh-etc \ + $2_master-wazuh-etc docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=master-filebeat-var \ - $2_master-filebeat-var + --label com.docker.compose.volume=master-wazuh-var \ + $2_master-wazuh-var docker volume create \ --label com.docker.compose.project=$2 \ @@ -115,18 +115,18 @@ docker volume create \ docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-filebeat-etc \ - $2_worker-filebeat-etc + --label com.docker.compose.volume=worker-wazuh-etc \ + $2_worker-wazuh-etc docker volume create \ --label com.docker.compose.project=$2 \ --label com.docker.compose.version=$1 \ - --label com.docker.compose.volume=worker-filebeat-var \ - $2_worker-filebeat-var + --label com.docker.compose.volume=worker-wazuh-var \ + $2_worker-wazuh-var docker container run --rm -it \ - -v wazuh-docker_worker-filebeat-var:/from \ - -v $2_worker-filebeat-var:/to \ + -v wazuh-docker_worker-var:/from \ + -v $2_worker-wazuh-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ @@ -180,13 +180,13 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ - -v wazuh-docker_filebeat-etc:/from \ - -v $2_master-filebeat-etc:/to \ + -v wazuh-docker-etc:/from \ + -v $2_master-wazuh-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ - -v wazuh-docker_filebeat-var:/from \ - -v $2_master-filebeat-var:/to \ + -v wazuh-docker-var:/from \ + -v $2_master-wazuh-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ @@ -225,11 +225,11 @@ docker container run --rm -it \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ - -v wazuh-docker_worker-filebeat-etc:/from \ - -v $2_worker-filebeat-etc:/to \ + -v wazuh-docker_worker-etc:/from \ + -v $2_worker-wazuh-etc:/to \ alpine ash -c "cd /from ; cp -avp . /to" docker container run --rm -it \ - -v wazuh-docker_worker-filebeat-var:/from \ - -v $2_worker-filebeat-var:/to \ + -v wazuh-docker_worker-var:/from \ + -v $2_worker-wazuh-var:/to \ alpine ash -c "cd /from ; cp -avp . /to" diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 5b107f72..505f0fc5 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -32,9 +32,9 @@ services: - wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/filebeat/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/etc/filebeat/certs/filebeat.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/etc/filebeat/certs/filebeat-key.pem + - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem + - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 From fc8262b7914d3267132b2ac438ee8b125677ba5b Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 3 Dec 2025 14:15:57 -0300 Subject: [PATCH 042/142] Testing with wazuh certs tool from 4.13 --- .github/workflows/Procedure_push_docker_images.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index e9735cdd..f9d87d8e 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -18,7 +18,7 @@ on: reference: description: 'Dev reference' type: string - default: latest + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -47,7 +47,7 @@ on: reference: description: 'Dev reference' type: string - default: latest + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -97,7 +97,7 @@ jobs: - name: free disk space uses: ./.github/free-disk-space - + - name: Set up QEMU uses: docker/setup-qemu-action@v3 @@ -145,8 +145,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" - wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" + wazuh_certs_tool: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh" + wazuh_config_yml: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/config.yml" EOF working-directory: ./build-docker-images @@ -155,7 +155,7 @@ jobs: if [ "${{ inputs.dev }}" = true ]; then IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}" ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }} - else + else if [[ "$IMAGE_TAG" == *"-"* ]]; then IFS='-' read -r -a tokens <<< "$IMAGE_TAG" if [ -z "${tokens[1]}" ]; then From 05aece7433a5543447ab523cb4ba7ccf362aeee6 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 3 Dec 2025 14:45:33 -0300 Subject: [PATCH 043/142] Added debug symbols for config.sh --- build-docker-images/wazuh-dashboard/config/config.sh | 5 ++++- build-docker-images/wazuh-indexer/config/config.sh | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index b6c3b32c..6460677a 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -1,5 +1,6 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. +set -x export DH_OPTIONS export NAME=wazuh-dashboard @@ -54,4 +55,6 @@ cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml chmod -R 500 ${CONFIG_DIR}/certs -chmod -R 400 ${CONFIG_DIR}/certs/* \ No newline at end of file +chmod -R 400 ${CONFIG_DIR}/certs/* + +set +x \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index f2dd1bbd..ba218c5d 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -1,5 +1,6 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. +set -x export DH_OPTIONS export NAME=wazuh-indexer @@ -63,4 +64,6 @@ sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-perfo chown -R ${USER}:${GROUP} ${CONFIG_DIR} chmod -R 500 ${CONFIG_DIR}/certs -chmod -R 400 ${CONFIG_DIR}/certs/* \ No newline at end of file +chmod -R 400 ${CONFIG_DIR}/certs/* + +set +x \ No newline at end of file From 19dda0c176c3f40a1ac22a5a23ddb889c827b1c8 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 3 Dec 2025 15:03:09 -0300 Subject: [PATCH 044/142] Updated wazuh certs tool url --- .github/workflows/Procedure_push_docker_images.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index f9d87d8e..8fac0536 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -145,8 +145,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_certs_tool: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh" - wazuh_config_yml: "https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/4.13/config.yml" + wazuh_certs_tool: "https://packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh" + wazuh_config_yml: "https://packages-dev.wazuh.com/4.13/config.yml" EOF working-directory: ./build-docker-images From 0e84e107918082fb29d737d8f635d9544695d12e Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 14:17:59 -0300 Subject: [PATCH 045/142] Updated test of Docker images --- .../Procedure_push_docker_images.yml | 4 +- .gitignore | 2 - .../wazuh-dashboard/config/config.sh | 47 ------------------ build-docker-images/wazuh-indexer/Dockerfile | 4 +- .../wazuh-indexer/config/config.sh | 49 ------------------- build-docker-images/wazuh-manager/Dockerfile | 6 --- .../wazuh-manager/config/config.sh | 40 --------------- .../config/etc/cont-init.d/0-wazuh-init | 12 +++++ single-node/config.yml | 17 +++++++ single-node/docker-compose.yml | 14 +++--- 10 files changed, 40 insertions(+), 155 deletions(-) delete mode 100644 build-docker-images/wazuh-manager/config/config.sh create mode 100644 single-node/config.yml diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 8fac0536..8813f1d4 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -145,8 +145,8 @@ jobs: wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_certs_tool: "https://packages-dev.wazuh.com/4.13/wazuh-certs-tool.sh" - wazuh_config_yml: "https://packages-dev.wazuh.com/4.13/config.yml" + wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" + wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" EOF working-directory: ./build-docker-images diff --git a/.gitignore b/.gitignore index be72bfa3..0abf79b9 100644 --- a/.gitignore +++ b/.gitignore @@ -4,10 +4,8 @@ build-docker-images/artifacts_env.txt single-node/wazuh-certificates single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log -single-node/config.yml single-node/wazuh-certs-tool.sh multi-node/wazuh-certificates multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log -multi-node/config.yml multi-node/wazuh-certs-tool.sh \ No newline at end of file diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 6460677a..79739ddb 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -1,60 +1,13 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. -set -x export DH_OPTIONS export NAME=wazuh-dashboard -export TARGET_DIR=${CURDIR}/debian/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Create certs directory -mkdir -p ${CONFIG_DIR}/certs - -# Copy Wazuh dashboard certs to install config dir -mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ -cp -pr /wazuh-certificates/dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem -cp -pr /wazuh-certificates/dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem - # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml chmod -R 500 ${CONFIG_DIR}/certs chmod -R 400 ${CONFIG_DIR}/certs/* - -set +x \ No newline at end of file diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index 5e8c44e2..ae16f38d 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -55,7 +55,7 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \ mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \ mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ - mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer + mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR @@ -72,4 +72,4 @@ EXPOSE 9200 ENTRYPOINT ["/entrypoint.sh"] # Dummy overridable parameter parsed by entrypoint -CMD ["opensearch"] \ No newline at end of file +CMD ["opensearch"] diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index ba218c5d..d2a842c5 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -1,6 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) # This has to be exported to make some magic below work. -set -x export DH_OPTIONS export NAME=wazuh-indexer @@ -8,55 +7,9 @@ export NAME=wazuh-indexer # Package build options export USER=${NAME} export GROUP=${NAME} -export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -export LOG_DIR=/var/log/${NAME} -export LIB_DIR=/var/lib/${NAME} -export PID_DIR=/run/${NAME} export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config - -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Copy Wazuh indexer's certificates and config files to $CONFIG_DIR -mkdir -p ${CONFIG_DIR}/certs -mv /etc/wazuh-indexer/* ${CONFIG_DIR}/ -cp -pr /wazuh-certificates/node-1.pem ${CONFIG_DIR}/certs/indexer.pem -cp -pr /wazuh-certificates/node-1-key.pem ${CONFIG_DIR}/certs/indexer-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CONFIG_DIR}/certs/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CONFIG_DIR}/certs/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CONFIG_DIR}/certs/admin-key.pem - # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml @@ -65,5 +18,3 @@ sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-perfo chown -R ${USER}:${GROUP} ${CONFIG_DIR} chmod -R 500 ${CONFIG_DIR}/certs chmod -R 400 ${CONFIG_DIR}/certs/* - -set +x \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 251ff5ad..2c01bd80 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -9,10 +9,6 @@ ARG S6_VERSION="v2.2.0.3" ARG TARGETARCH ARG wazuh_manager_url_amd64_rpm ARG wazuh_manager_url_arm64_rpm -ARG wazuh_certs_tool -ARG wazuh_config_yml - -COPY config/config.sh . RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ manager_url="${!URL_VAR}" && \ @@ -22,8 +18,6 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf install /wazuh-manager.rpm -y && \ rm -rf /wazuh-manager.rpm && \ dnf clean all && \ - chmod 755 /config.sh && \ - /config.sh && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ -o /tmp/s6-overlay-amd64.tar.gz && \ tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ diff --git a/build-docker-images/wazuh-manager/config/config.sh b/build-docker-images/wazuh-manager/config/config.sh deleted file mode 100644 index 211de49d..00000000 --- a/build-docker-images/wazuh-manager/config/config.sh +++ /dev/null @@ -1,40 +0,0 @@ -############################################################################## -# Downloading Cert Gen Tool -############################################################################## -# Variables for certificate generation -CERT_TOOL="wazuh-certs-tool.sh" -CERT_CONFIG_FILE="config.yml" -CERT_DIR=/etc/wazuh/certs -download_package() { - local url=$1 - local package=$2 - if curl -fsL "$url" -o "$package"; then - echo "Downloaded $package" - return 0 - else - echo "Error downloading $package from $url" - return 1 - fi -} -mkdir -p $CERT_DIR -# Download the tool to create the certificates -echo "Downloading the tool to create the certificates..." -download_package "$wazuh_certs_tool" $CERT_TOOL -# Download the config file for the certificate tool -echo "Downloading the config file for the certificate tool..." -download_package "$wazuh_config_yml" $CERT_CONFIG_FILE - -# Modify the config file to set the IP to localhost -sed -i 's/ ip:.*/ ip: "127.0.0.1"/' $CERT_CONFIG_FILE - -chmod 700 "$CERT_CONFIG_FILE" -# Create the certificates -chmod 755 "$CERT_TOOL" && bash "$CERT_TOOL" -A - -# Copy Wazuh manager certs -cp -pr /wazuh-certificates/wazuh-1.pem ${CERT_DIR}/wazuh-1.pem -cp -pr /wazuh-certificates/wazuh-1-key.pem ${CERT_DIR}/wazuh-1-key.pem -cp -pr /wazuh-certificates/root-ca.key ${CERT_DIR}/root-ca.key -cp -pr /wazuh-certificates/root-ca.pem ${CERT_DIR}/root-ca.pem -cp -pr /wazuh-certificates/admin.pem ${CERT_DIR}/admin.pem -cp -pr /wazuh-certificates/admin-key.pem ${CERT_DIR}/admin-key.pem \ No newline at end of file diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index e9fea495..3b4a01ca 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -6,6 +6,10 @@ source /permanent_data.env WAZUH_INSTALL_PATH=/var/ossec WAZUH_CONFIG_MOUNT=/wazuh-config-mount +CERT_DIR=/etc/wazuh/certs +WAZUH_INDEXER_SSL_CA=$CERT_DIR/root-ca.pem +WAZUH_INDEXER_SSL_CERTIFICATE=$CERT_DIR/wazuh.pem +WAZUH_INDEXER_SSL_KEY=$CERT_DIR/wazuh-key.pem ############################################################################## # Aux functions @@ -194,6 +198,14 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then sed -i -e '//,/<\/indexer>/{ //,/<\/hosts>/{ //r '"$TMP_HOSTS" \ -e 'd }}' "$OSSEC_CONF"; rm -f "$TMP_HOSTS"; + + # -------------------------- + # Indexer SSL Configuration + # -------------------------- + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CA|" "$OSSEC_CONF" + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CERTIFICATE|" "$OSSEC_CONF" + sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_KEY|" "$OSSEC_CONF" + fi # -------------------------- diff --git a/single-node/config.yml b/single-node/config.yml new file mode 100644 index 00000000..b8f678e3 --- /dev/null +++ b/single-node/config.yml @@ -0,0 +1,17 @@ +nodes: + # Wazuh indexer nodes + indexer: + - name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # If there is more than one Wazuh server + # node, each one must have a node_type + server: + - name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard nodes + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 505f0fc5..8a450f3b 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -20,6 +20,7 @@ services: - WAZUH_INDEXER_HOSTS=wazuh.indexer:9200 - WAZUH_NODE_NAME=manager - WAZUH_CLUSTER_NODES=wazuh.manager + - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - API_USERNAME=wazuh-wui @@ -33,11 +34,11 @@ services: - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.manager.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh.manager-key.pem + - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -67,13 +68,12 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: - - 443:5601 + - 443:443 environment: - - SERVER_PORT=5601 - SERVER_HOST=0.0.0.0 - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin From 70ce270235bf169293d61161eb8d7ae4cc12f5d1 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 14:34:51 -0300 Subject: [PATCH 046/142] Updated wazuh-indexer configuration --- build-docker-images/wazuh-indexer/config/config.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index d2a842c5..68cbd2b1 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -11,6 +11,12 @@ export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config # Modify opensearch.yml config paths +if [ -d "/etc/wazuh-indexer" ]; then + mkdir -p ${CONFIG_DIR} + mkdir -p ${CONFIG_DIR}/certs + mv /etc/wazuh-indexer/* ${CONFIG_DIR}/ + rmdir /etc/wazuh-indexer +fi sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options From 9f5847d2adfab29f7ff4ab74cf978a5cc474b730 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 14:45:56 -0300 Subject: [PATCH 047/142] Updated config.sh for wazuh indexer --- build-docker-images/wazuh-dashboard/config/config.sh | 3 --- build-docker-images/wazuh-indexer/config/config.sh | 5 +---- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 79739ddb..0ff78844 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -8,6 +8,3 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config # Modify opensearch.yml config paths sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml - -chmod -R 500 ${CONFIG_DIR}/certs -chmod -R 400 ${CONFIG_DIR}/certs/* diff --git a/build-docker-images/wazuh-indexer/config/config.sh b/build-docker-images/wazuh-indexer/config/config.sh index 68cbd2b1..2f34484a 100644 --- a/build-docker-images/wazuh-indexer/config/config.sh +++ b/build-docker-images/wazuh-indexer/config/config.sh @@ -19,8 +19,5 @@ if [ -d "/etc/wazuh-indexer" ]; then fi sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml -sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options +sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' ${CONFIG_DIR}/jvm.options -chown -R ${USER}:${GROUP} ${CONFIG_DIR} -chmod -R 500 ${CONFIG_DIR}/certs -chmod -R 400 ${CONFIG_DIR}/certs/* From 133c6c94a1055e3e6c03bbadfec470256b541803 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 14:55:08 -0300 Subject: [PATCH 048/142] Updated config.sh for Wazuh dashboard --- build-docker-images/wazuh-dashboard/config/config.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh index 0ff78844..b106a77e 100644 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ b/build-docker-images/wazuh-dashboard/config/config.sh @@ -6,5 +6,11 @@ export NAME=wazuh-dashboard export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -# Modify opensearch.yml config paths +# Modify opensearch_dashboards.yml config paths +if [ -d "/etc/wazuh-dashboard" ]; then + mkdir -p ${CONFIG_DIR} + mkdir -p ${CONFIG_DIR}/certs + mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ + rmdir /etc/wazuh-dashboard +fi sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml From 09d62e90bffe0620354db2697cd9c10e59c94f66 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 15:32:32 -0300 Subject: [PATCH 049/142] Updated Wazuh app configuration file --- build-docker-images/wazuh-dashboard/Dockerfile | 3 ++- .../wazuh-dashboard/config/wazuh_app_config.sh | 2 +- build-docker-images/wazuh-manager/Dockerfile | 12 +++++++----- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 483dc0c8..70b2509b 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -80,7 +80,8 @@ RUN yum install shadow-utils -y && \ mkdir -p $INSTALL_DIR && \ chown 1000:1000 $INSTALL_DIR && \ chown 1000:1000 /*.sh && \ - mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom + mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom \ + bash /wazuh_app_config.sh # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 0388465a..4066a262 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -32,7 +32,7 @@ do fi done -grep -q default $dashboard_config_file +grep -q wazuh_core.hosts $dashboard_config_file _config_exists=$? if [[ $_config_exists -ne 0 ]]; then diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 2c01bd80..e6898a49 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -18,11 +18,13 @@ RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \ dnf install /wazuh-manager.rpm -y && \ rm -rf /wazuh-manager.rpm && \ dnf clean all && \ - curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz && \ + S6_ARCH="amd64" && \ + if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \ + curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \ + -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ rm -f /var/ossec/etc/sslmanager.key && \ rm -f /var/ossec/etc/sslmanager.cert From d57dbb9e7690dbf0d01b3459fdf477a65f43dc47 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 15:40:14 -0300 Subject: [PATCH 050/142] Updated script execution --- build-docker-images/wazuh-dashboard/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 70b2509b..22dcdc78 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -80,7 +80,7 @@ RUN yum install shadow-utils -y && \ mkdir -p $INSTALL_DIR && \ chown 1000:1000 $INSTALL_DIR && \ chown 1000:1000 /*.sh && \ - mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom \ + mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom && \ bash /wazuh_app_config.sh # Copy Install dir from builder to current image From e539ae625ebbcd1957bb59b237eb4efe672e7065 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 15:51:58 -0300 Subject: [PATCH 051/142] Added EOF to wazuh app config script --- build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 4066a262..db84b598 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -44,7 +44,7 @@ if [[ $_config_exists -ne 0 ]]; then username: $api_username password: $api_password run_as: $api_run_as - EOF +EOF else echo "Wazuh APP already configured" fi From daf6eb643585b72738b7fd1e2e45c82a6d786bcb Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 16:11:36 -0300 Subject: [PATCH 052/142] Removed config.sh file from wazuh dashboard --- build-docker-images/wazuh-dashboard/Dockerfile | 4 ---- .../wazuh-dashboard/config/config.sh | 16 ---------------- .../wazuh-dashboard/config/wazuh_app_config.sh | 14 ++++++++++++++ 3 files changed, 14 insertions(+), 20 deletions(-) delete mode 100644 build-docker-images/wazuh-dashboard/config/config.sh diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 22dcdc78..3656eeea 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -27,10 +27,6 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazu RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node -# Generate certificates -COPY config/config.sh . -RUN bash config.sh - ################################################################################ # Build stage 1 (the current Wazuh dashboard image): # diff --git a/build-docker-images/wazuh-dashboard/config/config.sh b/build-docker-images/wazuh-dashboard/config/config.sh deleted file mode 100644 index b106a77e..00000000 --- a/build-docker-images/wazuh-dashboard/config/config.sh +++ /dev/null @@ -1,16 +0,0 @@ -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -# This has to be exported to make some magic below work. -export DH_OPTIONS - -export NAME=wazuh-dashboard -export INSTALLATION_DIR=/usr/share/${NAME} -export CONFIG_DIR=${INSTALLATION_DIR}/config - -# Modify opensearch_dashboards.yml config paths -if [ -d "/etc/wazuh-dashboard" ]; then - mkdir -p ${CONFIG_DIR} - mkdir -p ${CONFIG_DIR}/certs - mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ - rmdir /etc/wazuh-dashboard -fi -sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index db84b598..5f43a0e3 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -6,9 +6,23 @@ wazuh_port="${API_PORT:-55000}" api_username="${API_USERNAME:-wazuh-wui}" api_password="${API_PASSWORD:-wazuh-wui}" api_run_as="${RUN_AS:-false}" +export DH_OPTIONS + +export NAME=wazuh-dashboard +export INSTALLATION_DIR=/usr/share/${NAME} +export CONFIG_DIR=${INSTALLATION_DIR}/config dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml" +# Modify opensearch_dashboards.yml config paths +if [ -d "/etc/wazuh-dashboard" ]; then + mkdir -p ${CONFIG_DIR} + mkdir -p ${CONFIG_DIR}/certs + mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ + rmdir /etc/wazuh-dashboard +fi +sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml + declare -A CONFIG_MAP=( [pattern]=$PATTERN [checks.pattern]=$CHECKS_PATTERN From f7d2cb2c3d4b55711a06ba74b8d6dfcae706c8c9 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 4 Dec 2025 16:27:09 -0300 Subject: [PATCH 053/142] Added debug symbols --- .../wazuh-dashboard/config/wazuh_app_config.sh | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 5f43a0e3..5a318aea 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -1,5 +1,6 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) +set -x wazuh_url="${WAZUH_API_URL:-https://wazuh}" wazuh_port="${API_PORT:-55000}" @@ -12,7 +13,13 @@ export NAME=wazuh-dashboard export INSTALLATION_DIR=/usr/share/${NAME} export CONFIG_DIR=${INSTALLATION_DIR}/config -dashboard_config_file="/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml" +dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml" + +printf "Modifying Wazuh App configuration file: %s\n" "$dashboard_config_file" +ls -la ${CONFIG_DIR} + +printf "/etc/wazuh-dashboard contents:\n" +ls -la /etc/wazuh-dashboard # Modify opensearch_dashboards.yml config paths if [ -d "/etc/wazuh-dashboard" ]; then @@ -21,7 +28,7 @@ if [ -d "/etc/wazuh-dashboard" ]; then mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ rmdir /etc/wazuh-dashboard fi -sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch_dashboards.yml +sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${dashboard_config_file} declare -A CONFIG_MAP=( [pattern]=$PATTERN @@ -62,3 +69,5 @@ EOF else echo "Wazuh APP already configured" fi + +set +x \ No newline at end of file From 0aa7750c49d975c68e0abefa208d22f1a7786f5a Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 10:21:33 -0300 Subject: [PATCH 054/142] Added wazuh_app script execution to config.sh file --- build-docker-images/wazuh-dashboard/Dockerfile | 4 +--- .../wazuh-dashboard/config/entrypoint.sh | 3 +++ .../wazuh-dashboard/config/wazuh_app_config.sh | 15 --------------- 3 files changed, 4 insertions(+), 18 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 3656eeea..eca8fb67 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -8,7 +8,6 @@ ARG INSTALL_DIR=/usr/share/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm -ARG wazuh_certs_tool ARG wazuh_config_yml # Update and install dependencies @@ -76,8 +75,7 @@ RUN yum install shadow-utils -y && \ mkdir -p $INSTALL_DIR && \ chown 1000:1000 $INSTALL_DIR && \ chown 1000:1000 /*.sh && \ - mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom && \ - bash /wazuh_app_config.sh + mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index fbefb543..7ac9e997 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -17,6 +17,7 @@ export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}" DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" +export OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml # Create and configure Wazuh dashboard keystore @@ -24,6 +25,8 @@ yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --al echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root +/wazuh_app_config.sh + opensearch_dashboards_vars=( opensearch.hosts server.port diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 5a318aea..b8b69e74 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -15,21 +15,6 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml" -printf "Modifying Wazuh App configuration file: %s\n" "$dashboard_config_file" -ls -la ${CONFIG_DIR} - -printf "/etc/wazuh-dashboard contents:\n" -ls -la /etc/wazuh-dashboard - -# Modify opensearch_dashboards.yml config paths -if [ -d "/etc/wazuh-dashboard" ]; then - mkdir -p ${CONFIG_DIR} - mkdir -p ${CONFIG_DIR}/certs - mv /etc/wazuh-dashboard/* ${CONFIG_DIR}/ - rmdir /etc/wazuh-dashboard -fi -sed -i "s|/etc/wazuh-dashboard|${CONFIG_DIR}|g" ${dashboard_config_file} - declare -A CONFIG_MAP=( [pattern]=$PATTERN [checks.pattern]=$CHECKS_PATTERN From 572c8d417e297b6c8ef8a81c35909d548fe7a390 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 11:15:50 -0300 Subject: [PATCH 055/142] Updated Wazuh app configuration script --- .../config/wazuh_app_config.sh | 26 +++++-------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index b8b69e74..28fbf768 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -1,6 +1,5 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -set -x wazuh_url="${WAZUH_API_URL:-https://wazuh}" wazuh_port="${API_PORT:-55000}" @@ -16,6 +15,11 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml" declare -A CONFIG_MAP=( + [url]=$wazuh_url + [port]=$wazuh_port + [username]=$api_username + [password]=$api_password + [run_as]=$api_run_as [pattern]=$PATTERN [checks.pattern]=$CHECKS_PATTERN [checks.template]=$CHECKS_TEMPLATE @@ -29,6 +33,7 @@ declare -A CONFIG_MAP=( [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS + ) for i in "${!CONFIG_MAP[@]}" @@ -37,22 +42,3 @@ do sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $dashboard_config_file fi done - -grep -q wazuh_core.hosts $dashboard_config_file -_config_exists=$? - -if [[ $_config_exists -ne 0 ]]; then - cat << EOF >> $dashboard_config_file - wazuh_core.hosts: - default: - url: $wazuh_url - port: $wazuh_port - username: $api_username - password: $api_password - run_as: $api_run_as -EOF -else - echo "Wazuh APP already configured" -fi - -set +x \ No newline at end of file From 55cd4be54de1d87c9ba1e232d5446363436fea6d Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 13:28:31 -0300 Subject: [PATCH 056/142] Copy wazuh dashboard configuration dir --- .../wazuh-dashboard/Dockerfile | 2 ++ .../config/wazuh_app_config.sh | 25 +++++-------------- 2 files changed, 8 insertions(+), 19 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index eca8fb67..49710226 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -5,6 +5,7 @@ ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION ARG WAZUH_UI_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard +ARG CONFIG_DIR=/etc/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm @@ -79,6 +80,7 @@ RUN yum install shadow-utils -y && \ # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR +COPY --from=builder --chown=1000:1000 $CONFIG_DIR $INSTALL_DIR/config/ # Set workdir and user WORKDIR $INSTALL_DIR diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh index 28fbf768..2cb5b858 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh @@ -1,25 +1,12 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -wazuh_url="${WAZUH_API_URL:-https://wazuh}" -wazuh_port="${API_PORT:-55000}" -api_username="${API_USERNAME:-wazuh-wui}" -api_password="${API_PASSWORD:-wazuh-wui}" -api_run_as="${RUN_AS:-false}" -export DH_OPTIONS - -export NAME=wazuh-dashboard -export INSTALLATION_DIR=/usr/share/${NAME} -export CONFIG_DIR=${INSTALLATION_DIR}/config - -dashboard_config_file="${CONFIG_DIR}/opensearch_dashboards.yml" - declare -A CONFIG_MAP=( - [url]=$wazuh_url - [port]=$wazuh_port - [username]=$api_username - [password]=$api_password - [run_as]=$api_run_as + [url]=$WAZUH_API_URL + [port]=$API_PORT + [username]=$API_USERNAME + [password]=$API_PASSWORD + [run_as]=$RUN_AS [pattern]=$PATTERN [checks.pattern]=$CHECKS_PATTERN [checks.template]=$CHECKS_TEMPLATE @@ -39,6 +26,6 @@ declare -A CONFIG_MAP=( for i in "${!CONFIG_MAP[@]}" do if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $dashboard_config_file + sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $OPENSEARCH_DASHBOARDS_CONFIG fi done From 53e3c956371370ef63ddd84c2631258c5d4c7e94 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 15:24:56 -0300 Subject: [PATCH 057/142] Fixed configuration directory from builder --- build-docker-images/wazuh-dashboard/Dockerfile | 3 +-- multi-node/docker-compose.yml | 2 +- single-node/docker-compose.yml | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 49710226..271cd946 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -5,7 +5,6 @@ ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION ARG WAZUH_UI_REVISION ARG INSTALL_DIR=/usr/share/wazuh-dashboard -ARG CONFIG_DIR=/etc/wazuh-dashboard ARG TARGETARCH ARG wazuh_dashboard_url_amd64_rpm ARG wazuh_dashboard_url_arm64_rpm @@ -80,7 +79,7 @@ RUN yum install shadow-utils -y && \ # Copy Install dir from builder to current image COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR -COPY --from=builder --chown=1000:1000 $CONFIG_DIR $INSTALL_DIR/config/ +COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/ # Set workdir and user WORKDIR $INSTALL_DIR diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index dd08d2d4..969af678 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -175,7 +175,7 @@ services: - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config + - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: - wazuh1.indexer diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 8a450f3b..3857b15e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -87,7 +87,7 @@ services: - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - ./wazuh-certificates/root-ca.pem:/usr/share/wazuh-dashboard/config/certs/root-ca.pem - - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config + - wazuh-dashboard-config:/usr/share/wazuh-dashboard/config - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom depends_on: - wazuh.indexer From b0df035478c50c6362dd99d9f4298a4e411de9a5 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 16:01:50 -0300 Subject: [PATCH 058/142] Replaced wazuh_app_config by wazuh_dashboard_config script --- build-docker-images/wazuh-dashboard/Dockerfile | 6 +++--- .../wazuh-dashboard/config/entrypoint.sh | 3 +-- ...app_config.sh => wazuh_dashboard_config.sh} | 6 ++++++ docs/README.md | 18 +----------------- 4 files changed, 11 insertions(+), 22 deletions(-) rename build-docker-images/wazuh-dashboard/config/{wazuh_app_config.sh => wazuh_dashboard_config.sh} (68%) diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 271cd946..1a8e6955 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -31,7 +31,7 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/b # # Copy wazuh-dashboard from stage 0 # Add entrypoint -# Add wazuh_app_config +# Add wazuh_dashboard_config ################################################################################ FROM amazonlinux:2023 @@ -56,7 +56,7 @@ ENV USER="wazuh-dashboard" \ # Copy and set permissions to scripts COPY config/entrypoint.sh / -COPY config/wazuh_app_config.sh / +COPY config/wazuh_dashboard_config.sh / # Update and install dependencies RUN yum install shadow-utils -y && \ @@ -71,7 +71,7 @@ RUN yum install shadow-utils -y && \ --comment "$USER user" \ $USER && \ chmod 700 /entrypoint.sh && \ - chmod 700 /wazuh_app_config.sh && \ + chmod 700 /wazuh_dashboard_config.sh && \ mkdir -p $INSTALL_DIR && \ chown 1000:1000 $INSTALL_DIR && \ chown 1000:1000 /*.sh && \ diff --git a/build-docker-images/wazuh-dashboard/config/entrypoint.sh b/build-docker-images/wazuh-dashboard/config/entrypoint.sh index 7ac9e997..e291407e 100644 --- a/build-docker-images/wazuh-dashboard/config/entrypoint.sh +++ b/build-docker-images/wazuh-dashboard/config/entrypoint.sh @@ -17,7 +17,6 @@ export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}" DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}" -export OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml # Create and configure Wazuh dashboard keystore @@ -25,7 +24,7 @@ yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --al echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \ echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root -/wazuh_app_config.sh +/wazuh_dashboard_config.sh opensearch_dashboards_vars=( opensearch.hosts diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh similarity index 68% rename from build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh rename to build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh index 2cb5b858..dab032c3 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh @@ -1,7 +1,13 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) +OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml declare -A CONFIG_MAP=( + [server.host]=$SERVER_HOST + [opensearch.hosts]=$OPENSEARCH_HOSTS + [server.ssl.key]="/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem" + [server.ssl.certificate]="/usr/share/wazuh-dashboard/config/certs/dashboard.pem" + [server.ssl.certificateAuthorities]="/usr/share/wazuh-dashboard/config/certs/root-ca.pem" [url]=$WAZUH_API_URL [port]=$API_PORT [username]=$API_USERNAME diff --git a/docs/README.md b/docs/README.md index e8cd99e3..acb98674 100644 --- a/docs/README.md +++ b/docs/README.md @@ -43,39 +43,23 @@ The folder `wazuh-agent` contains a README explaining how to run a container wit │   │   └── Dockerfile │   ├── wazuh-dashboard │   │   ├── config - │   │   │   ├── check_repository.sh - │   │   │   ├── config.sh - │   │   │   ├── config.yml │   │   │   ├── entrypoint.sh - │   │   │   ├── wazuh_app_config.sh - │   │   │   └── wazuh.yml + │   │   │   ├── wazuh_dashboard_config.sh │   │   └── Dockerfile │   ├── wazuh-indexer │   │   ├── config - │   │   │   ├── action_groups.yml - │   │   │   ├── check_repository.sh │   │   │   ├── config.sh - │   │   │   ├── config.yml │   │   │   ├── entrypoint.sh - │   │   │   ├── internal_users.yml - │   │   │   ├── opensearch.yml - │   │   │   ├── roles_mapping.yml - │   │   │   ├── roles.yml │   │   │   └── securityadmin.sh │   │   └── Dockerfile │   └── wazuh-manager │   ├── config - │   │   ├── check_repository.sh │   │   ├── create_user.py │   │   ├── etc │   │   │   ├── cont-init.d │   │   │   │   ├── 0-wazuh-init - │   │   │   │   ├── 1-config- │   │   │   │   └── 2-manager │   │   │   └── services.d - │   │   │   ├── - │   │   │   │   ├── finish - │   │   │   │   └── run │   │   │   └── ossec-logs │   │   │   └── run │   │   ├── permanent_data.env From a5e5b82c283ea0b256a4fbb9f441947b5138acf0 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 5 Dec 2025 16:56:08 -0300 Subject: [PATCH 059/142] Updated wazuh dashboard config script --- .../config/wazuh_dashboard_config.sh | 131 ++++++++++++++---- 1 file changed, 102 insertions(+), 29 deletions(-) diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh index dab032c3..bbaff92d 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh @@ -1,37 +1,110 @@ #!/bin/bash # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -OPENSEARCH_DASHBOARDS_CONFIG=/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml +# Environment variables with defaults +SERVER_HOST="${SERVER_HOST:-0.0.0.0}" +SERVER_PORT="${SERVER_PORT:-443}" +OPENSEARCH_HOSTS="${OPENSEARCH_HOSTS:-https://wazuh.indexer:9200}" +OPENSEARCH_SSL_VERIFICATION_MODE="${OPENSEARCH_SSL_VERIFICATION_MODE:-certificate}" +OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-}" +OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}" +OPENSEARCH_REQUEST_HEADERS_ALLOWLIST="${OPENSEARCH_REQUEST_HEADERS_ALLOWLIST:-[\"securitytenant\",\"Authorization\"]}" +OPENSEARCH_SECURITY_MULTITENANCY_ENABLED="${OPENSEARCH_SECURITY_MULTITENANCY_ENABLED:-false}" +OPENSEARCH_SECURITY_READONLY_MODE_ROLES="${OPENSEARCH_SECURITY_READONLY_MODE_ROLES:-[\"kibana_read_only\"]}" +SERVER_SSL_ENABLED="${SERVER_SSL_ENABLED:-true}" +SERVER_SSL_KEY="${SERVER_SSL_KEY:-/etc/wazuh-dashboard/certs/dashboard-key.pem}" +SERVER_SSL_CERTIFICATE="${SERVER_SSL_CERTIFICATE:-/etc/wazuh-dashboard/certs/dashboard.pem}" +OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES="${OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES:-[/etc/wazuh-dashboard/certs/root-ca.pem]}" +UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE="${UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE:-/app/wz-home}" +OPENSEARCH_SECURITY_COOKIE_TTL="${OPENSEARCH_SECURITY_COOKIE_TTL:-900000}" +OPENSEARCH_SECURITY_SESSION_TTL="${OPENSEARCH_SECURITY_SESSION_TTL:-900000}" +OPENSEARCH_SECURITY_SESSION_KEEPALIVE="${OPENSEARCH_SECURITY_SESSION_KEEPALIVE:-true}" + +# Wazuh API configuration +WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}" +API_PORT="${API_PORT:-55000}" +API_USERNAME="${API_USERNAME:-wazuh-wui}" +API_PASSWORD="${API_PASSWORD:-wazuh-wui}" +RUN_AS="${RUN_AS:-false}" + +# Optional Wazuh app configurations +PATTERN="${PATTERN:-}" +CHECKS_PATTERN="${CHECKS_PATTERN:-}" +CHECKS_TEMPLATE="${CHECKS_TEMPLATE:-}" +CHECKS_API="${CHECKS_API:-}" +CHECKS_SETUP="${CHECKS_SETUP:-}" +APP_TIMEOUT="${APP_TIMEOUT:-}" +API_SELECTOR="${API_SELECTOR:-}" +IP_SELECTOR="${IP_SELECTOR:-}" +IP_IGNORE="${IP_IGNORE:-}" +WAZUH_MONITORING_ENABLED="${WAZUH_MONITORING_ENABLED:-}" +WAZUH_MONITORING_FREQUENCY="${WAZUH_MONITORING_FREQUENCY:-}" +WAZUH_MONITORING_SHARDS="${WAZUH_MONITORING_SHARDS:-}" +WAZUH_MONITORING_REPLICAS="${WAZUH_MONITORING_REPLICAS:-}" + +# Configuration file path +DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml}" + +# Map of configuration keys to their values declare -A CONFIG_MAP=( - [server.host]=$SERVER_HOST - [opensearch.hosts]=$OPENSEARCH_HOSTS - [server.ssl.key]="/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem" - [server.ssl.certificate]="/usr/share/wazuh-dashboard/config/certs/dashboard.pem" - [server.ssl.certificateAuthorities]="/usr/share/wazuh-dashboard/config/certs/root-ca.pem" - [url]=$WAZUH_API_URL - [port]=$API_PORT - [username]=$API_USERNAME - [password]=$API_PASSWORD - [run_as]=$RUN_AS - [pattern]=$PATTERN - [checks.pattern]=$CHECKS_PATTERN - [checks.template]=$CHECKS_TEMPLATE - [checks.api]=$CHECKS_API - [checks.setup]=$CHECKS_SETUP - [timeout]=$APP_TIMEOUT - [api.selector]=$API_SELECTOR - [ip.selector]=$IP_SELECTOR - [ip.ignore]=$IP_IGNORE - [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED - [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY - [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS - [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS - + [server.host]="$SERVER_HOST" + [server.port]="$SERVER_PORT" + [opensearch.hosts]="$OPENSEARCH_HOSTS" + [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE" + [opensearch.username]="$OPENSEARCH_USERNAME" + [opensearch.password]="$OPENSEARCH_PASSWORD" + [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST" + [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED" + [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES" + [server.ssl.enabled]="$SERVER_SSL_ENABLED" + [server.ssl.key]="\"$SERVER_SSL_KEY\"" + [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\"" + [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES" + [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE" + [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL" + [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL" + [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE" + [pattern]="$PATTERN" + [checks.pattern]="$CHECKS_PATTERN" + [checks.template]="$CHECKS_TEMPLATE" + [checks.api]="$CHECKS_API" + [checks.setup]="$CHECKS_SETUP" + [timeout]="$APP_TIMEOUT" + [api.selector]="$API_SELECTOR" + [ip.selector]="$IP_SELECTOR" + [ip.ignore]="$IP_IGNORE" + [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED" + [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY" + [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS" + [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS" ) -for i in "${!CONFIG_MAP[@]}" -do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $OPENSEARCH_DASHBOARDS_CONFIG +# Replace configuration values in the dashboard config file +for key in "${!CONFIG_MAP[@]}"; do + value="${CONFIG_MAP[$key]}" + + # Skip empty values for optional configurations + if [ -z "$value" ]; then + continue + fi + + # Escape special characters for sed + escaped_key=$(echo "$key" | sed 's/[.[\*^$()+?{|]/\\&/g') + + # Try to replace existing line (commented or uncommented) + if grep -q "^[#[:space:]]*${escaped_key}:" "$DASHBOARD_CONFIG_FILE"; then + sed -i "s|^[#[:space:]]*${escaped_key}:.*|${key}: ${value}|" "$DASHBOARD_CONFIG_FILE" fi done + +# Handle wazuh_core.hosts section separately +if grep -q "^wazuh_core.hosts:" "$DASHBOARD_CONFIG_FILE"; then + # Update existing wazuh_core.hosts section + sed -i "/^wazuh_core.hosts:/,/^[^ ]/ { + s|url:.*|url: $WAZUH_API_URL| + s|port:.*|port: $API_PORT| + s|username:.*|username: $API_USERNAME| + s|password:.*|password: $API_PASSWORD| + s|run_as:.*|run_as: $RUN_AS| + }" "$DASHBOARD_CONFIG_FILE" +fi From d58fc84a2ba018a9aa6f6b5ed5cb8d6e09727520 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Tue, 9 Dec 2025 18:08:41 -0300 Subject: [PATCH 060/142] Updated multi node deployment --- .../config/wazuh_dashboard_config.sh | 60 +++++++++---------- .../config/etc/cont-init.d/0-wazuh-init | 3 +- multi-node/config.yml | 25 ++++++++ multi-node/docker-compose.yml | 15 +++-- single-node/docker-compose.yml | 3 + 5 files changed, 69 insertions(+), 37 deletions(-) create mode 100644 multi-node/config.yml diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh index bbaff92d..5e8b9067 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh @@ -47,36 +47,36 @@ DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/confi # Map of configuration keys to their values declare -A CONFIG_MAP=( - [server.host]="$SERVER_HOST" - [server.port]="$SERVER_PORT" - [opensearch.hosts]="$OPENSEARCH_HOSTS" - [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE" - [opensearch.username]="$OPENSEARCH_USERNAME" - [opensearch.password]="$OPENSEARCH_PASSWORD" - [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST" - [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED" - [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES" - [server.ssl.enabled]="$SERVER_SSL_ENABLED" - [server.ssl.key]="\"$SERVER_SSL_KEY\"" - [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\"" - [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES" - [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE" - [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL" - [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL" - [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE" - [pattern]="$PATTERN" - [checks.pattern]="$CHECKS_PATTERN" - [checks.template]="$CHECKS_TEMPLATE" - [checks.api]="$CHECKS_API" - [checks.setup]="$CHECKS_SETUP" - [timeout]="$APP_TIMEOUT" - [api.selector]="$API_SELECTOR" - [ip.selector]="$IP_SELECTOR" - [ip.ignore]="$IP_IGNORE" - [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED" - [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY" - [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS" - [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS" + [server.host]="$SERVER_HOST" + [server.port]="$SERVER_PORT" + [opensearch.hosts]="$OPENSEARCH_HOSTS" + [opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE" + [opensearch.username]="$OPENSEARCH_USERNAME" + [opensearch.password]="$OPENSEARCH_PASSWORD" + [opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST" + [opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED" + [opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES" + [server.ssl.enabled]="$SERVER_SSL_ENABLED" + [server.ssl.key]="\"$SERVER_SSL_KEY\"" + [server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\"" + [opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES" + [uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE" + [opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL" + [opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL" + [opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE" + [pattern]="$PATTERN" + [checks.pattern]="$CHECKS_PATTERN" + [checks.template]="$CHECKS_TEMPLATE" + [checks.api]="$CHECKS_API" + [checks.setup]="$CHECKS_SETUP" + [timeout]="$APP_TIMEOUT" + [api.selector]="$API_SELECTOR" + [ip.selector]="$IP_SELECTOR" + [ip.ignore]="$IP_IGNORE" + [wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED" + [wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY" + [wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS" + [wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS" ) # Replace configuration values in the dashboard config file diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 3b4a01ca..334283fa 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -188,7 +188,8 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then TMP_HOSTS=$(mktemp) { echo " " - for NODE in $WAZUH_INDEXER_HOSTS; do + IFS=',' read -ra NODES <<< "$WAZUH_INDEXER_HOSTS" + for NODE in "${NODES[@]}"; do IP="${NODE%:*}" PORT="${NODE#*:}" echo " https://$IP:$PORT" diff --git a/multi-node/config.yml b/multi-node/config.yml new file mode 100644 index 00000000..894882cf --- /dev/null +++ b/multi-node/config.yml @@ -0,0 +1,25 @@ +nodes: + # Wazuh indexer nodes + indexer: + - name: wazuh1.indexer + ip: wazuh1.indexer + - name: wazuh2.indexer + ip: wazuh2.indexer + - name: wazuh3.indexer + ip: wazuh3.indexer + + # Wazuh server nodes + # If there is more than one Wazuh server + # node, each one must have a node_type + server: + - name: wazuh.master + ip: wazuh.master + node_type: master + - name: wazuh.worker + ip: wazuh.worker + node_type: worker + + # Wazuh dashboard nodes + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 969af678..2a05bec7 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: @@ -171,6 +171,9 @@ services: - DASHBOARD_PASSWORD=kibanaserver - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- + - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem + - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem + - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem volumes: - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 3857b15e..7a7afd33 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -83,6 +83,9 @@ services: - DASHBOARD_PASSWORD=kibanaserver - API_USERNAME=wazuh-wui - API_PASSWORD=MyS3cr37P450r.*- + - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem + - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem + - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem volumes: - ./wazuh-certificates/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/config/certs/dashboard.pem - ./wazuh-certificates/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem From 181a6b470b6be818e549671a794214f1634a9e3b Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Tue, 9 Dec 2025 18:57:26 -0300 Subject: [PATCH 061/142] Fixed multi node certificates path --- multi-node/docker-compose.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 2a05bec7..da7c275e 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -33,9 +33,9 @@ services: - master-wazuh-var-multigroups:/var/ossec/var/multigroups - master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/ssl/root-ca.pem - - ./wazuh-certificates/wazuh.master.pem:/etc/ssl/wazuh.master.pem - - ./wazuh-certificates/wazuh.master-key.pem:/etc/ssl/wazuh.master.key + - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem + - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem + - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh.worker: image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker @@ -66,8 +66,8 @@ services: - worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-wodles:/var/ossec/wodles - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.worker.pem - - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh.worker.key + - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.pem + - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh1.indexer: image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 From 232bc0a77d7ccb3ca331bff6581bdf13cf601023 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Tue, 9 Dec 2025 19:02:15 -0300 Subject: [PATCH 062/142] Updated docker images tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index da7c275e..121bda33 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh.worker: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh1.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 7a7afd33..7b1b35f5 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem wazuh.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 8b41c47efc1e13f772a1b3759bc19eb69fc9123c Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 10 Dec 2025 10:18:12 -0300 Subject: [PATCH 063/142] Updated Wazuh manager certificates mounth --- .../config/etc/cont-init.d/0-wazuh-init | 11 --------- multi-node/docker-compose.yml | 24 +++++++++---------- single-node/docker-compose.yml | 12 +++++----- 3 files changed, 18 insertions(+), 29 deletions(-) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 334283fa..32eba0a0 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -6,10 +6,6 @@ source /permanent_data.env WAZUH_INSTALL_PATH=/var/ossec WAZUH_CONFIG_MOUNT=/wazuh-config-mount -CERT_DIR=/etc/wazuh/certs -WAZUH_INDEXER_SSL_CA=$CERT_DIR/root-ca.pem -WAZUH_INDEXER_SSL_CERTIFICATE=$CERT_DIR/wazuh.pem -WAZUH_INDEXER_SSL_KEY=$CERT_DIR/wazuh-key.pem ############################################################################## # Aux functions @@ -200,13 +196,6 @@ if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then -e 'd }}' "$OSSEC_CONF"; rm -f "$TMP_HOSTS"; - # -------------------------- - # Indexer SSL Configuration - # -------------------------- - sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CA|" "$OSSEC_CONF" - sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_CERTIFICATE|" "$OSSEC_CONF" - sed -i "//,/<\/indexer>/ s|.*|$WAZUH_INDEXER_SSL_KEY|" "$OSSEC_CONF" - fi # -------------------------- diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 121bda33..3778af34 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -33,11 +33,11 @@ services: - master-wazuh-var-multigroups:/var/ossec/var/multigroups - master-wazuh-active-response:/var/ossec/active-response/bin - master-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.master.pem:/etc/wazuh/certs/wazuh.pem - - ./wazuh-certificates/wazuh.master-key.pem:/etc/wazuh/certs/wazuh-key.pem + - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem + - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -65,12 +65,12 @@ services: - worker-wazuh-var-multigroups:/var/ossec/var/multigroups - worker-wazuh-active-response:/var/ossec/active-response/bin - worker-wazuh-wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.worker.pem:/etc/wazuh/certs/wazuh.pem - - ./wazuh-certificates/wazuh.worker-key.pem:/etc/wazuh/certs/wazuh-key.pem + - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.worker.pem:/var/ossec/etc/certs/server.pem + - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 7b1b35f5..1eaaf80e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -33,12 +33,12 @@ services: - wazuh_var_multigroups:/var/ossec/var/multigroups - wazuh_active_response:/var/ossec/active-response/bin - wazuh_wodles:/var/ossec/wodles - - ./wazuh-certificates/root-ca.pem:/etc/wazuh/certs/root-ca.pem - - ./wazuh-certificates/wazuh.manager.pem:/etc/wazuh/certs/wazuh.pem - - ./wazuh-certificates/wazuh.manager-key.pem:/etc/wazuh/certs/wazuh-key.pem + - ./wazuh-certificates/root-ca.pem:/var/ossec/etc/certs/root-ca.pem + - ./wazuh-certificates/wazuh.manager.pem:/var/ossec/etc/certs/server.pem + - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From c89d4eed9bd20ba95b2f322231f16ddcafd7e1b3 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 10 Dec 2025 12:38:27 -0300 Subject: [PATCH 064/142] Updated wazuh images --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 3778af34..f1b7f63a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1eaaf80e..2481aeff 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 8371ae27e8675d41f1bfd8c445719c996bcc7691 Mon Sep 17 00:00:00 2001 From: Enrique Araque Date: Fri, 12 Dec 2025 11:47:21 +0100 Subject: [PATCH 065/142] Update build docker images readme --- build-docker-images/README.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/build-docker-images/README.md b/build-docker-images/README.md index 446a4133..57b449a4 100644 --- a/build-docker-images/README.md +++ b/build-docker-images/README.md @@ -23,10 +23,12 @@ $ build-docker-images/build-images.sh -h Usage: build-docker-images/build-images.sh [OPTIONS] - -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.5. + -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default. -r, --revision [Optional] Package revision. By default 1 + -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release. + -rg, --registry [Optional] Set the Docker registry to push the images. -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. + -m, --multiarch [Optional] Enable multi-architecture builds. -h, --help Show this help. ``` \ No newline at end of file From 0a9ce33b09d982dad0623891bf889e8c9ce1043b Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Mon, 15 Dec 2025 11:03:22 -0300 Subject: [PATCH 066/142] Removed config.yml files --- .gitignore | 4 +++- multi-node/config.yml | 25 ------------------------- single-node/config.yml | 17 ----------------- 3 files changed, 3 insertions(+), 43 deletions(-) delete mode 100644 multi-node/config.yml delete mode 100644 single-node/config.yml diff --git a/.gitignore b/.gitignore index 0abf79b9..302fbb6d 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,9 @@ single-node/wazuh-certificates single-node/wazuh-certificates/* single-node/wazuh-certificates-tool.log single-node/wazuh-certs-tool.sh +single-node/config.yml multi-node/wazuh-certificates multi-node/wazuh-certificates/* multi-node/wazuh-certificates-tool.log -multi-node/wazuh-certs-tool.sh \ No newline at end of file +multi-node/wazuh-certs-tool.sh +multi-node/config.yml diff --git a/multi-node/config.yml b/multi-node/config.yml deleted file mode 100644 index 894882cf..00000000 --- a/multi-node/config.yml +++ /dev/null @@ -1,25 +0,0 @@ -nodes: - # Wazuh indexer nodes - indexer: - - name: wazuh1.indexer - ip: wazuh1.indexer - - name: wazuh2.indexer - ip: wazuh2.indexer - - name: wazuh3.indexer - ip: wazuh3.indexer - - # Wazuh server nodes - # If there is more than one Wazuh server - # node, each one must have a node_type - server: - - name: wazuh.master - ip: wazuh.master - node_type: master - - name: wazuh.worker - ip: wazuh.worker - node_type: worker - - # Wazuh dashboard nodes - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard diff --git a/single-node/config.yml b/single-node/config.yml deleted file mode 100644 index b8f678e3..00000000 --- a/single-node/config.yml +++ /dev/null @@ -1,17 +0,0 @@ -nodes: - # Wazuh indexer nodes - indexer: - - name: wazuh.indexer - ip: wazuh.indexer - - # Wazuh server nodes - # If there is more than one Wazuh server - # node, each one must have a node_type - server: - - name: wazuh.manager - ip: wazuh.manager - - # Wazuh dashboard nodes - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard From d86827a3699920d385b03842051d5d64bba45533 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 02:30:34 +0700 Subject: [PATCH 067/142] Delete etc/lists references --- .github/.goss.yaml | 7 ------- .../wazuh-manager/config/etc/cont-init.d/0-wazuh-init | 1 - 2 files changed, 8 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 54fb61fa..4e083406 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -6,13 +6,6 @@ file: group: root filetype: file contains: [] - /var/ossec/etc/lists/audit-keys: - exists: true - mode: "0660" - owner: wazuh - group: wazuh - filetype: file - contains: [] /var/ossec/etc/ossec.conf: exists: true mode: "0660" diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init index 32eba0a0..4e06e49e 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init @@ -245,7 +245,6 @@ echo "Wazuh manager config modified successfully." configure_permissions() { chown -R wazuh:wazuh /var/ossec/queue/rids - chown -R wazuh:wazuh /var/ossec/etc/lists } ############################################################################## From fbed17f773a5016962d467d0cbc39c3375a4d4a3 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 02:37:19 +0700 Subject: [PATCH 068/142] Add and fix changelog references --- CHANGELOG.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74b1b78e..4b30b5fe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,15 +9,15 @@ All notable changes to this project will be documented in this file. ### Changed -- Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-puppet/issues/2081)) -- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058)) -- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054)) -- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030)) -- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366)) +- Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/pull/2081)) +- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-docker/pull/2058)) +- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-docker/pull/2054)) +- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-docker/pull/2030)) +- Fix OpenSearch deprecated settings ([#1899](https://github.com/wazuh/wazuh-docker/pull/1899)) ### Fixed -- None + Delete etc/lists references ([#2129](https://github.com/wazuh/wazuh-docker/pull/2129)) ### Deleted From 009e71cb9fb1d4b69bf5772ee287c0387445d450 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:22:15 +0700 Subject: [PATCH 069/142] Modify docker build image process --- .github/workflows/push.yml | 218 ++++++++++++++++++------------------- 1 file changed, 109 insertions(+), 109 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 75e3cf97..40697aeb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -3,133 +3,132 @@ name: Wazuh Docker pipeline on: [pull_request] jobs: - build-docker-images: + + prepare-variables: + runs-on: ubuntu-latest + outputs: + WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }} + WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_TAG_REVISION: ${{ steps.dotenv.outputs.WAZUH_TAG_REVISION }} + WAZUH_UI_REVISION: ${{ steps.dotenv.outputs.WAZUH_UI_REVISION }} + WAZUH_REGISTRY: ${{ steps.dotenv.outputs.WAZUH_REGISTRY }} + IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} + WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Export .env variables + id: dotenv + shell: bash + run: | + if [ ! -f .env ]; then echo "::error::.env missing"; exit 1; fi + grep -v '^#' .env | grep -v '^\s*$' >> "$GITHUB_OUTPUT" + FULL_VERSION=$(grep "^WAZUH_VERSION=" .env | cut -d'=' -f2) + MINOR_VERSION=$(echo "$FULL_VERSION" | cut -d'.' -f1,2) + echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" + + + build-images: + needs: prepare-variables + uses: ./.github/workflows/build-images.yml + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.ref_name }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true + + Execute-Goss-tests: + needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 steps: - - name: Check out code - uses: actions/checkout@v4 - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: cat .env > $GITHUB_ENV - - - name: Create backup Docker images - run: | - mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/ - docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar - docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar - docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - - - name: Temporarily save Wazuh manager Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-manager - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar - retention-days: 1 - - - name: Temporarily save Wazuh indexer Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-indexer - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar - retention-days: 1 - - - name: Temporarily save Wazuh dashboard Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-dashboard - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - retention-days: 1 - - - name: Temporarily save Wazuh agent Docker image - uses: actions/upload-artifact@v4 - with: - name: docker-artifact-agent - path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar - retention-days: 1 - - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: version: v0.3.16 - name: Execute Goss tests (wazuh-manager) - run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} + run: dgoss run ${{needs.prepare-variables.outputs.WAZUH_REGISTRY}}/wazuh/wazuh-manager:${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}} env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 - needs: build-docker-images + needs: [prepare-variables, build-images] steps: - name: Check out code uses: actions/checkout@v4 - - name: Create enviroment variables - run: cat .env > $GITHUB_ENV - - - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-indexer - - - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-manager - - - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-dashboard - - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - - name: Docker load - run: | - docker load --input ./wazuh-indexer.tar - docker load --input ./wazuh-dashboard.tar - docker load --input ./wazuh-manager.tar - docker load --input ./wazuh-agent.tar - - name: Create single node certficates - run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator + run: | + curl -sO https://packages.wazuh.com/${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}}/wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - name: Start Wazuh agent - run: docker compose -f wazuh-agent/docker-compose.yml up -d + run: docker compose up -d + working-directory: ./wazuh-agent - name: Check Wazuh agent enrollment run: | sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -251,32 +251,32 @@ jobs: - name: Check Wazuh indexer start run: | - until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l` -eq 1 ]] + until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l` -eq 1 ]] do echo 'Waiting for Wazuh indexer start' free -m df -h sleep 120 done - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s exit 1 fi - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -286,14 +286,14 @@ jobs: - name: Check documents into wazuh-alerts index run: | - until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``) -gt 0 ]] + until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"``) -gt 0 ]] do echo 'Waiting for Wazuh indexer events' free -m df -h sleep 10 done - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then echo "wazuh-alerts index documents: ${docs}" else @@ -303,8 +303,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -337,7 +337,7 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk '{print $2}') + status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I | grep -E "^HTTP" | awk '{print $2}') if [[ $status -eq 200 ]]; then echo "Wazuh dashboard status: ${status}" else From 760534b57fda9f9804fb396eafafaa8f408f51a2 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:29:17 +0700 Subject: [PATCH 070/142] Add permissions --- .github/workflows/push.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 40697aeb..3bb71dc0 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,5 +1,6 @@ name: Wazuh Docker pipeline - +permissions: + contents: read on: [pull_request] jobs: From 4dc87bd9362816924b50523707b9de583f8d7203 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 20:32:20 +0700 Subject: [PATCH 071/142] Change needed --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3bb71dc0..abb1a138 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -204,7 +204,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: build-docker-images + needs: [prepare-variables, build-images] steps: - name: Check out code From 1da196f215ccca2856fc7756bbc40455bec8e8d8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 21:00:41 +0700 Subject: [PATCH 072/142] Change workflow image builder --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index abb1a138..a61a2193 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,7 +32,7 @@ jobs: build-images: needs: prepare-variables - uses: ./.github/workflows/build-images.yml + uses: ./.github/workflows/Procedure_push_docker_images.yml with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.ref_name }} From 323794b8a38b9daf461707caab6c2b15710e782f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 21:03:20 +0700 Subject: [PATCH 073/142] Add permissions --- .github/workflows/push.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index a61a2193..2c1ed830 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -1,6 +1,7 @@ name: Wazuh Docker pipeline permissions: contents: read + id-token: write on: [pull_request] jobs: From 2e6c22dc5c2a1c0c02579af4904928be5dbd2447 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 22:11:57 +0700 Subject: [PATCH 074/142] Fix ref name --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 2c1ed830..758ca74f 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -36,7 +36,7 @@ jobs: uses: ./.github/workflows/Procedure_push_docker_images.yml with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.ref_name }} + docker_reference: ${{ github.head_ref }} revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} reference: "latest" id: ${{ github.run_id }} From 33a4d10eda85c26f417aae4ae0b15ae5c4573449 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 22:22:10 +0700 Subject: [PATCH 075/142] Add secret pemissions --- .github/workflows/push.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 758ca74f..de584138 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -34,6 +34,7 @@ jobs: build-images: needs: prepare-variables uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.head_ref }} From 93aaff79b0a15420f82fe0a8e26e01516de990ad Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 18 Dec 2025 23:12:25 +0700 Subject: [PATCH 076/142] Fix variables and multi node deployment --- .github/workflows/push.yml | 104 ++++++++++++++++++++++--------------- 1 file changed, 63 insertions(+), 41 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index de584138..41587ca1 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -46,6 +46,9 @@ jobs: Execute-Goss-tests: needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: - name: Install Goss @@ -54,7 +57,7 @@ jobs: version: v0.3.16 - name: Execute Goss tests (wazuh-manager) - run: dgoss run ${{needs.prepare-variables.outputs.WAZUH_REGISTRY}}/wazuh/wazuh-manager:${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}} + run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml @@ -62,6 +65,10 @@ jobs: check-single-node: runs-on: ubuntu-22.04 needs: [prepare-variables, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: - name: Check out code @@ -69,7 +76,7 @@ jobs: - name: Create single node certficates run: | - curl -sO https://packages.wazuh.com/${{needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION}}/wazuh-certs-tool.sh + curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh cat > config.yml < $GITHUB_ENV - - name: free disk space uses: ./.github/free-disk-space - - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-dashboard - - - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-manager - - - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-indexer - - - name: Retrieve saved Wazuh agent Docker image - uses: actions/download-artifact@v4 - with: - name: docker-artifact-agent - - - name: Docker load - run: | - docker load --input ./wazuh-manager.tar - docker load --input ./wazuh-indexer.tar - docker load --input ./wazuh-dashboard.tar - docker load --input ./wazuh-agent.tar - rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar - - name: Create multi node certficates - run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator + run: | + curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh + cat > config.yml < Date: Thu, 18 Dec 2025 23:48:40 +0700 Subject: [PATCH 077/142] Add ECR login and sign cert tool script URL --- .github/workflows/push.yml | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 41587ca1..6bc191b5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -13,7 +13,7 @@ jobs: WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }} WAZUH_TAG_REVISION: ${{ steps.dotenv.outputs.WAZUH_TAG_REVISION }} WAZUH_UI_REVISION: ${{ steps.dotenv.outputs.WAZUH_UI_REVISION }} - WAZUH_REGISTRY: ${{ steps.dotenv.outputs.WAZUH_REGISTRY }} + WAZUH_REGISTRY: ${{ vars.IMAGE_REGISTRY_DEV }} IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} steps: @@ -56,6 +56,15 @@ jobs: with: version: v0.3.16 + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + - name: Execute Goss tests (wazuh-manager) run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: @@ -74,9 +83,19 @@ jobs: - name: Check out code uses: actions/checkout@v4 + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + - name: Create single node certficates run: | - curl -sO https://packages.wazuh.com/${{ env.WAZUH_MINOR_VERSION }}/wazuh-certs-tool.sh + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sO $wazuh_certs_tool_url cat > config.yml < config.yml < Date: Fri, 19 Dec 2025 00:17:41 +0700 Subject: [PATCH 078/142] Modify curl and dgoss run --- .github/workflows/push.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 6bc191b5..32d1dd2b 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -66,10 +66,15 @@ jobs: uses: aws-actions/amazon-ecr-login@v2 - name: Execute Goss tests (wazuh-manager) - run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} + run: | + export GOSS_FILE=$GITHUB_WORKSPACE/.github/.goss.yaml + if [ ! -f "$GOSS_FILE" ]; then + echo "Goss file not found at $GOSS_FILE" + exit 1 + fi + dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 - GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 @@ -95,7 +100,7 @@ jobs: - name: Create single node certficates run: | wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sO $wazuh_certs_tool_url + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh cat > config.yml < config.yml < Date: Fri, 19 Dec 2025 02:06:18 +0700 Subject: [PATCH 079/142] Change goss version --- .github/workflows/push.yml | 21 +++++---------------- single-node/docker-compose.yml | 6 +++--- 2 files changed, 8 insertions(+), 19 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 32d1dd2b..4832284f 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -54,7 +54,7 @@ jobs: - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: - version: v0.3.16 + version: 'v0.4.4' - name: Configure aws credentials uses: aws-actions/configure-aws-credentials@v4 @@ -66,15 +66,10 @@ jobs: uses: aws-actions/amazon-ecr-login@v2 - name: Execute Goss tests (wazuh-manager) - run: | - export GOSS_FILE=$GITHUB_WORKSPACE/.github/.goss.yaml - if [ ! -f "$GOSS_FILE" ]; then - echo "Goss file not found at $GOSS_FILE" - exit 1 - fi - dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} + run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }} env: GOSS_SLEEP: 30 + GOSS_FILE: .github/.goss.yaml check-single-node: runs-on: ubuntu-22.04 @@ -142,7 +137,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 60 + sleep 120 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -310,13 +305,7 @@ jobs: - name: Check Wazuh indexer start run: | - until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l` -eq 1 ]] - do - echo 'Waiting for Wazuh indexer start' - free -m - df -h - sleep 120 - done + sleep 180 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 2481aeff..1eaaf80e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 4521ddb897897df497644074765bb940c110ddb4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 18:06:47 +0700 Subject: [PATCH 080/142] Add checkout in Goss job --- .github/workflows/push.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 4832284f..dacb9a55 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -17,6 +17,7 @@ jobs: IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }} WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }} steps: + - name: Checkout repository uses: actions/checkout@v4 @@ -51,6 +52,9 @@ jobs: WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} steps: + - name: Check out code + uses: actions/checkout@v4 + - name: Install Goss uses: e1himself/goss-installation-action@v1.0.3 with: From a87e1482b08d39faef0d45d378a2067a07b8996c Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 20:36:32 +0700 Subject: [PATCH 081/142] Add sleep time --- .github/workflows/push.yml | 26 +++++++++++++------------- multi-node/docker-compose.yml | 12 ++++++------ 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index dacb9a55..09117cc3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,20 +32,20 @@ jobs: echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" - build-images: - needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true +# build-images: +# needs: prepare-variables +# uses: ./.github/workflows/Procedure_push_docker_images.yml +# secrets: inherit +# with: +# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} +# docker_reference: ${{ github.head_ref }} +# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} +# reference: "latest" +# id: ${{ github.run_id }} +# dev: true Execute-Goss-tests: - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] runs-on: ubuntu-22.04 env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} @@ -309,7 +309,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 180 + sleep 600 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index f1b7f63a..3778af34 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 165f4ebf79d23e0c924389db78e2860bb8e8a511 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 20:39:39 +0700 Subject: [PATCH 082/142] Add sleep time --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 09117cc3..51d72b24 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -77,7 +77,7 @@ jobs: check-single-node: runs-on: ubuntu-22.04 - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -236,7 +236,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: [prepare-variables, build-images] + needs: [prepare-variables] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} From abe0ebe9a8333c6383eca1bd8ac2beac58625339 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 21:32:35 +0700 Subject: [PATCH 083/142] Add sleep time --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 51d72b24..8d876faf 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -77,7 +77,7 @@ jobs: check-single-node: runs-on: ubuntu-22.04 - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -236,7 +236,7 @@ jobs: check-multi-node: runs-on: ubuntu-22.04 - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} From f532db7356d0ad5a2bc959c6bd1fb96d1d31d159 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:23:39 +0700 Subject: [PATCH 084/142] Remove goss old configuration --- .github/.goss.yaml | 32 -------------------------------- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 3 files changed, 9 insertions(+), 41 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 54fb61fa..8d3043b4 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -46,38 +46,6 @@ package: installed: true versions: - 5.0.0 -port: - tcp:1514: - listening: true - ip: - - 0.0.0.0 - tcp:1515: - listening: true - ip: - - 0.0.0.0 - tcp:55000: - listening: true - ip: - - 0.0.0.0 -process: - wazuh-analysisd: - running: true - wazuh-authd: - running: true - wazuh-execd: - running: true - wazuh-monitord: - running: true - wazuh-remoted: - running: true - wazuh-syscheckd: - running: true - s6-supervise: - running: true - wazuh-db: - running: true - wazuh-modulesd: - running: true user: wazuh: exists: true diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 3778af34..f1b7f63a 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master restart: always ulimits: @@ -37,7 +37,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker restart: always ulimits: @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer restart: always ports: @@ -101,7 +101,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer restart: always environment: @@ -128,7 +128,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer restart: always environment: @@ -155,7 +155,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1eaaf80e..2481aeff 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager restart: always ulimits: @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer restart: always ports: @@ -68,7 +68,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: 966237403726.dkr.ecr.us-west-1.amazonaws.com/wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard restart: always ports: From 9d5aa6552181ddaa891a65c812faec1c067e9254 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:28:26 +0700 Subject: [PATCH 085/142] Remove goss old configuration --- .github/.goss.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 8d3043b4..0d0ed5ae 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -29,14 +29,14 @@ file: contains: [] /var/ossec/etc/sslmanager.cert: exists: true - mode: "0640" + mode: "0600" owner: root group: root filetype: file contains: [] /var/ossec/etc/sslmanager.key: exists: true - mode: "0640" + mode: "0644" owner: root group: root filetype: file From 50363c8b45b8b15a39a0d8c7913054928b1a5b62 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:34:52 +0700 Subject: [PATCH 086/142] Remove goss old configuration --- .github/.goss.yaml | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 0d0ed5ae..004bb37d 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -6,13 +6,6 @@ file: group: root filetype: file contains: [] - /var/ossec/etc/lists/audit-keys: - exists: true - mode: "0660" - owner: wazuh - group: wazuh - filetype: file - contains: [] /var/ossec/etc/ossec.conf: exists: true mode: "0660" @@ -29,23 +22,18 @@ file: contains: [] /var/ossec/etc/sslmanager.cert: exists: true - mode: "0600" + mode: "0644" owner: root group: root filetype: file contains: [] /var/ossec/etc/sslmanager.key: exists: true - mode: "0644" + mode: "0600" owner: root group: root filetype: file contains: [] -package: - wazuh-manager: - installed: true - versions: - - 5.0.0 user: wazuh: exists: true From 58b1e0518eb6694da31a3c85ebe9f0418d8d3581 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:41:13 +0700 Subject: [PATCH 087/142] Remove goss old configuration --- .github/.goss.yaml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/.goss.yaml b/.github/.goss.yaml index 004bb37d..a5a1c9c7 100644 --- a/.github/.goss.yaml +++ b/.github/.goss.yaml @@ -13,13 +13,6 @@ file: group: wazuh filetype: file contains: [] - /var/ossec/etc/rules/local_rules.xml: - exists: true - mode: "0660" - owner: wazuh - group: wazuh - filetype: file - contains: [] /var/ossec/etc/sslmanager.cert: exists: true mode: "0644" From 460a01e5917fbb849823702d56cbc7f737b7d7d9 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 22:48:28 +0700 Subject: [PATCH 088/142] Remove goss old configuration --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 8d876faf..ffda5b8c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -142,7 +142,7 @@ jobs: - name: Check Wazuh indexer start run: | sleep 120 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else @@ -150,7 +150,7 @@ jobs: exit 1 fi status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green" | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else From 98f7b25b54c839388d3d9f619a0af93ef444a5a8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:00:46 +0700 Subject: [PATCH 089/142] Remove goss old configuration --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index ffda5b8c..b6138039 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -142,7 +142,7 @@ jobs: - name: Check Wazuh indexer start run: | sleep 120 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep "green|yellow" | wc -l`" + status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s else @@ -150,7 +150,7 @@ jobs: exit 1 fi status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep "green|yellow" | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s else From 37ba5312c9d3726cf780a7d66ece5d7ad1f5ba72 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:13:36 +0700 Subject: [PATCH 090/142] Remove goss old configuration --- .github/workflows/push.yml | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index b6138039..d92cab42 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -172,11 +172,11 @@ jobs: - name: Check documents into wazuh-alerts index run: | sleep 120 - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" else - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" exit 1 fi @@ -338,18 +338,11 @@ jobs: - name: Check documents into wazuh-alerts index run: | - until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"``) -gt 0 ]] - do - echo 'Waiting for Wazuh indexer events' - free -m - df -h - sleep 10 - done - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:admin -k -s | jq -r ".count"`" + docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" else - echo "wazuh-alerts index documents: ${docs}" + echo "wazuh-states index documents: ${docs}" exit 1 fi From 85bb9078dc243d7b62e821f81bc33b2b41ab4ac6 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 19 Dec 2025 23:44:45 +0700 Subject: [PATCH 091/142] Remove goss old configuration --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index d92cab42..eea6e146 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -141,7 +141,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 120 + sleep 240 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -169,7 +169,7 @@ jobs: exit 1 fi - - name: Check documents into wazuh-alerts index + - name: Check documents into wazuh-states index run: | sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" @@ -309,7 +309,7 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 600 + sleep 360 status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s @@ -336,7 +336,7 @@ jobs: exit 1 fi - - name: Check documents into wazuh-alerts index + - name: Check documents into wazuh-states index run: | docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" if [[ $docs -gt 0 ]]; then From b33447c483650cbe54a3f0266a94c0834315fc80 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:01:38 +0700 Subject: [PATCH 092/142] Remove goss old configuration --- .github/workflows/push.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index eea6e146..cfec8a00 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -169,6 +169,16 @@ jobs: exit 1 fi + - name: Docker logs + run: | + echo "===== Wazuh Manager Logs =====" + docker compose logs wazuh.manager + echo "===== Wazuh Indexer Logs =====" + docker compose logs wazuh.indexer + echo "===== Wazuh Dashboard Logs =====" + docker compose logs wazuh.dashboard + + - name: Check documents into wazuh-states index run: | sleep 120 @@ -326,6 +336,18 @@ jobs: exit 1 fi + - name: Docker logs + run: | + echo "===== Wazuh Manager Logs =====" + docker compose logs wazuh.master + docker compose logs wazuh.worker + echo "===== Wazuh Indexer Logs =====" + docker compose logs wazuh1.indexer + docker compose logs wazuh2.indexer + docker compose logs wazuh3.indexer + echo "===== Wazuh Dashboard Logs =====" + docker compose logs wazuh.dashboard + - name: Check Wazuh indexer nodes run: | nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" From b6ffcb4138f60d3be43dbc2246086d7efe315e24 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:09:39 +0700 Subject: [PATCH 093/142] Remove goss old configuration --- .github/workflows/push.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cfec8a00..149a8638 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -119,6 +119,7 @@ jobs: ip: wazuh.dashboard EOF bash ./wazuh-certs-tool.sh -A + sysctl -w vm.max_map_count=262144 working-directory: ./single-node - name: Edit single node docker-compose file @@ -299,6 +300,7 @@ jobs: ip: wazuh.dashboard EOF bash ./wazuh-certs-tool.sh -A + sysctl -w vm.max_map_count=262144 working-directory: ./multi-node - name: Edit multi node docker-compose file From 9326dce891398167c7f992a7aafc4ec6a01f7922 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:16:54 +0700 Subject: [PATCH 094/142] Remove goss old configuration --- .github/workflows/push.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 149a8638..f814f7eb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -178,6 +178,7 @@ jobs: docker compose logs wazuh.indexer echo "===== Wazuh Dashboard Logs =====" docker compose logs wazuh.dashboard + working-directory: ./single-node - name: Check documents into wazuh-states index @@ -349,6 +350,7 @@ jobs: docker compose logs wazuh3.indexer echo "===== Wazuh Dashboard Logs =====" docker compose logs wazuh.dashboard + working-directory: ./multi-node - name: Check Wazuh indexer nodes run: | From 282210300e607230321191536884d29cfb1bdca4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:37:17 +0700 Subject: [PATCH 095/142] Remove goss old configuration --- .github/workflows/push.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index f814f7eb..faa94c05 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -167,7 +167,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" else echo "Wazuh indexer nodes: ${nodes}" - exit 1 fi - name: Docker logs @@ -359,7 +358,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" else echo "Wazuh indexer nodes: ${nodes}" - exit 1 fi - name: Check documents into wazuh-states index From c1b52207751b9f72de7152ec344a408aeb9ef72a Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 00:49:46 +0700 Subject: [PATCH 096/142] Remove goss old configuration --- .github/workflows/push.yml | 359 ++++++++++++++++++++++++++++++++++++- 1 file changed, 357 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index faa94c05..dd8e6fbf 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -75,7 +75,7 @@ jobs: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml - check-single-node: + check-intel-single-node: runs-on: ubuntu-22.04 needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: @@ -245,7 +245,177 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh - check-multi-node: + check-arm-single-node: + runs-on: ubuntu-22.04-arm + needs: [prepare-variables, Execute-Goss-tests] #, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + steps: + + - name: Check out code + uses: actions/checkout@v4 + + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + + - name: Create single node certficates + run: | + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + + - name: Start Wazuh agent + run: docker compose up -d + working-directory: ./wazuh-agent + + - name: Check Wazuh agent enrollment + run: | + sleep 20 + curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + env: + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log for Wazuh manager + run: ./.github/single-node-log-check.sh + + check-intel-multi-node: runs-on: ubuntu-22.04 needs: [prepare-variables, Execute-Goss-tests] #, build-images] env: @@ -429,3 +599,188 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh + + check-arm-multi-node: + runs-on: ubuntu-22.04-arm + needs: [prepare-variables, Execute-Goss-tests] #, build-images] + env: + WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} + WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + steps: + + - name: Check out code + uses: actions/checkout@v4 + + - name: free disk space + uses: ./.github/free-disk-space + + - name: Configure aws credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + + - name: Create multi node certficates + run: | + wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) + curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh + cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + + - name: Start Wazuh agent + run: docker compose -f wazuh-agent/docker-compose.yml up -d + + - name: Check Wazuh agent enrollment + run: | + sleep 20 + curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + env: + TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + + - name: Check errors in ossec.log for Wazuh manager + run: ./.github/multi-node-log-check.sh From b44279685726dcbae8870a75ca9d5505ac858dde Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:02:31 +0700 Subject: [PATCH 097/142] Remove goss old configuration --- .github/workflows/push.yml | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index dd8e6fbf..cfce9bfb 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -188,7 +188,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -216,7 +215,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -240,7 +239,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -358,7 +357,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -386,7 +384,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -410,7 +408,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -537,7 +535,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -572,7 +569,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -595,7 +592,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh @@ -722,7 +719,6 @@ jobs: echo "wazuh-states index documents: ${docs}" else echo "wazuh-states index documents: ${docs}" - exit 1 fi - name: Check Wazuh templates @@ -757,7 +753,7 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -780,7 +776,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:wazuh-wui -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh From c2520efc9f6b92d5ae19307877545a8276c88f91 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:42:54 +0700 Subject: [PATCH 098/142] Remove goss old configuration --- .github/workflows/push.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cfce9bfb..3b9a5931 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -204,14 +204,14 @@ jobs: fi - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + run: | + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi env: @@ -374,13 +374,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi env: @@ -552,13 +552,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) @@ -736,13 +736,13 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" else echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items exit 1 fi nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) From a055dc86c61501d79ec1bfb2ede3505d536220a4 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 20 Dec 2025 01:59:57 +0700 Subject: [PATCH 099/142] Add registry into Wazuh agent docker-compose.yml file --- .github/workflows/push.yml | 56 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 3b9a5931..17968275 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -230,6 +230,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose up -d working-directory: ./wazuh-agent @@ -399,6 +413,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose up -d working-directory: ./wazuh-agent @@ -584,6 +612,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose -f wazuh-agent/docker-compose.yml up -d @@ -768,6 +810,20 @@ jobs: - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml + - name: Edit Wazuh agent docker-compose file + shell: bash + env: + WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} + run: | + TARGET_FILE="wazuh-agent/docker-compose.yml" + if [ -f "$TARGET_FILE" ]; then + echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" + sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" + else + echo "File $TARGET_FILE not found" + exit 1 + fi + - name: Start Wazuh agent run: docker compose -f wazuh-agent/docker-compose.yml up -d From 1aa5a2acc43533ed221efabf8bcaa71687f8c3b7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 22 Dec 2025 17:56:13 +0700 Subject: [PATCH 100/142] Add matrix for GHA runners --- .github/workflows/push.yml | 429 +++---------------------------------- 1 file changed, 29 insertions(+), 400 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 17968275..eccb6689 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -32,20 +32,20 @@ jobs: echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT" -# build-images: -# needs: prepare-variables -# uses: ./.github/workflows/Procedure_push_docker_images.yml -# secrets: inherit -# with: -# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} -# docker_reference: ${{ github.head_ref }} -# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} -# reference: "latest" -# id: ${{ github.run_id }} -# dev: true + build-images: + needs: prepare-variables + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: - needs: [prepare-variables] #, build-images] + needs: [prepare-variables, build-images] runs-on: ubuntu-22.04 env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} @@ -75,9 +75,14 @@ jobs: GOSS_SLEEP: 30 GOSS_FILE: .github/.goss.yaml - check-intel-single-node: - runs-on: ubuntu-22.04 - needs: [prepare-variables, Execute-Goss-tests] #, build-images] + check-single-node: + name: Check single node on ${{ matrix.os }} + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-22.04, ubuntu-22.04-arm] + fail-fast: false + needs: [prepare-variables, Execute-Goss-tests, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -258,192 +263,14 @@ jobs: - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh - check-arm-single-node: - runs-on: ubuntu-22.04-arm - needs: [prepare-variables, Execute-Goss-tests] #, build-images] - env: - WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} - steps: - - - name: Check out code - uses: actions/checkout@v4 - - - name: Configure aws credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} - aws-region: "${{ secrets.AWS_REGION }}" - - - name: Log in to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 - - - name: Create single node certficates - run: | - wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh - cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Edit Wazuh agent docker-compose file - shell: bash - env: - WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} - run: | - TARGET_FILE="wazuh-agent/docker-compose.yml" - if [ -f "$TARGET_FILE" ]; then - echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" - sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" - else - echo "File $TARGET_FILE not found" - exit 1 - fi - - - name: Start Wazuh agent - run: docker compose up -d - working-directory: ./wazuh-agent - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager - run: ./.github/single-node-log-check.sh - - check-intel-multi-node: - runs-on: ubuntu-22.04 - needs: [prepare-variables, Execute-Goss-tests] #, build-images] + check-multi-node: + name: Check multi node on ${{ matrix.os }} + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-22.04, ubuntu-22.04-arm] + fail-fast: false + needs: [prepare-variables, Execute-Goss-tests, build-images] env: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} @@ -637,202 +464,4 @@ jobs: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh - - check-arm-multi-node: - runs-on: ubuntu-22.04-arm - needs: [prepare-variables, Execute-Goss-tests] #, build-images] - env: - WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} - WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} - steps: - - - name: Check out code - uses: actions/checkout@v4 - - - name: free disk space - uses: ./.github/free-disk-space - - - name: Configure aws credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} - aws-region: "${{ secrets.AWS_REGION }}" - - - name: Log in to Amazon ECR - uses: aws-actions/amazon-ecr-login@v2 - - - name: Create multi node certficates - run: | - wazuh_certs_tool_url=$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/${{ env.WAZUH_IMAGE_VERSION }}/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1) - curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh - cat > config.yml </$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml - - - name: Edit Wazuh agent docker-compose file - shell: bash - env: - WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }} - run: | - TARGET_FILE="wazuh-agent/docker-compose.yml" - if [ -f "$TARGET_FILE" ]; then - echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}" - sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE" - else - echo "File $TARGET_FILE not found" - exit 1 - fi - - - name: Start Wazuh agent - run: docker compose -f wazuh-agent/docker-compose.yml up -d - - - name: Check Wazuh agent enrollment - run: | - sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh + run: ./.github/multi-node-log-check.sh \ No newline at end of file From f04ed6e6088a8a099dd35d15a0c0e2a9036a8e21 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Mon, 22 Dec 2025 08:36:09 -0500 Subject: [PATCH 101/142] Update documentation for Wazuh Docker image builder and workflow usage --- - All relevant content of README.md files was migrated to docs/ section in their respective section. - These README files has been deleted (4 files) - All README.md files (additional to the project's root and docs/) have been edited. --- - Both files build-docker-images/README.md and docs/dev/build-image.md have almost same content, so it was discarded the README file - As the directory and docker image are going to be disused, the certs-gen documentation contents of indexer-certs-creator/README.md was not mig> - The 'bash' command added to the docs/dev/build-image.md was removed - Added workflow usage docs file to the the SUMMARY.md file --- - Removed '$' parameter and added 'bash' to all markdown code blocks headings (```) --- --- CHANGELOG.md | 1 + build-docker-images/README.md | 34 ---------- docs/SUMMARY.md | 1 + docs/dev/build-image.md | 37 ++++++----- docs/dev/run-tests.md | 2 + docs/dev/workflow-usage.md | 61 ++++++++++++++++++ .../getting-started/deployment/deployment.md | 4 +- .../getting-started/deployment/multi-node.md | 63 ++++++++++++++++--- .../getting-started/deployment/single-node.md | 56 +++++++++++++---- indexer-certs-creator/README.md | 9 --- multi-node/README.md | 62 ------------------ single-node/README.md | 53 ---------------- 12 files changed, 188 insertions(+), 195 deletions(-) delete mode 100644 build-docker-images/README.md create mode 100644 docs/dev/workflow-usage.md delete mode 100644 indexer-certs-creator/README.md delete mode 100644 multi-node/README.md delete mode 100644 single-node/README.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 74b1b78e..2b4bccec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-puppet/issues/2136)) - Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-puppet/issues/2081)) - Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058)) - Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054)) diff --git a/build-docker-images/README.md b/build-docker-images/README.md deleted file mode 100644 index f0a1e338..00000000 --- a/build-docker-images/README.md +++ /dev/null @@ -1,34 +0,0 @@ -# Wazuh Docker Image Builder - -The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script - -To execute the process, the following must be executed in the root of the wazuh-docker repository: - -``` -$ build-docker-images/build-images.sh -``` - -This script initializes the environment variables needed to build each of the images. - -The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: - -``` -$ build-docker-images/build-images.sh -v 5.0.0 -``` - -To get all the available script options use the -h or --help option: - -``` -$ build-docker-images/build-images.sh -h - -Usage: build-docker-images/build-images.sh [OPTIONS] - - -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -r, --revision [Optional] Package revision. By default 1 - -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release. - -rg, --registry [Optional] Set the Docker registry to push the images. - -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. - -m, --multiarch [Optional] Enable multi-architecture builds. - -h, --help Show this help. - -``` \ No newline at end of file diff --git a/docs/SUMMARY.md b/docs/SUMMARY.md index fa09fd2c..be59f772 100644 --- a/docs/SUMMARY.md +++ b/docs/SUMMARY.md @@ -8,6 +8,7 @@ - [Setup Environment](dev/setup.md) - [Build Image](dev/build-image.md) - [Run Tests](dev/run-tests.md) +- [Workflow Usage](dev/workflow-usage.md) # Reference Manual diff --git a/docs/dev/build-image.md b/docs/dev/build-image.md index 4c2c4512..a9a95edd 100644 --- a/docs/dev/build-image.md +++ b/docs/dev/build-image.md @@ -1,31 +1,40 @@ # Wazuh Docker Image Builder -The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script - -To execute the process, the following must be executed in the root of the wazuh-docker repository: - -``` -$ build-docker-images/build-images.sh -``` +The creation of the images for the Wazuh stack deployment in Docker is done with the `build-docker-images/build-images.sh` script This script initializes the environment variables needed to build each of the images. -The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument: +To execute it, make sure to be in the `build-docker-images` directory: -``` -$ build-docker-images/build-images.sh -v 5.0.0 +```bash +cd build-docker-images ``` -To get all the available script options use the -h or --help option: +Then execute: +```bash +./build-images.sh ``` -$ build-docker-images/build-images.sh -h -Usage: build-docker-images/build-images.sh [OPTIONS] +The script also allows to build images from other versions of Wazuh by using the `-v` or `--version` argument: + +```bash +./build-images.sh -v 5.0.0 +``` + +To get all the available script options use the `-h` or `--help` option: + +```bash +./build-images.sh -h + +Usage: build-images.sh [OPTIONS] -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default. -r, --revision [Optional] Package revision. By default 1 + -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release. + -rg, --registry [Optional] Set the Docker registry to push the images. -v, --version [Optional] Set the Wazuh version should be builded. By default, 5.0.0. + -m, --multiarch [Optional] Enable multi-architecture builds. -h, --help Show this help. -``` \ No newline at end of file +``` diff --git a/docs/dev/run-tests.md b/docs/dev/run-tests.md index e4b1a9d3..c9718f10 100644 --- a/docs/dev/run-tests.md +++ b/docs/dev/run-tests.md @@ -2,6 +2,8 @@ This repository includes automated tests designed to validate the correct deployment of Wazuh using Docker. These tests are executed on every pull request (PR) to ensure the integrity and stability of the system when changes are introduced. +Check more information on the [Workflow usage](workflow-usage.md) page. + ## Purpose The main objective of the tests is to verify that the Wazuh Docker environment can be successfully deployed and that all its core components (Wazuh Manager, Indexer, Dashboard, and Agents) operate as expected after any modification in the codebase. diff --git a/docs/dev/workflow-usage.md b/docs/dev/workflow-usage.md new file mode 100644 index 00000000..236786d2 --- /dev/null +++ b/docs/dev/workflow-usage.md @@ -0,0 +1,61 @@ +# Workflow usage + +The Procedure_push_docker_images.yml workflow builds and pushes multi-architecture Docker images (amd64/arm64) of Wazuh core components (Indexer, Manager, Dashboard, and Agent) to container registries. + +## Input Parameters + +| Parameter | Description | Default | Required | +|-----------|-------------|---------|----------| +| `image_tag` | Docker image version tag | `5.0.0` | Yes | +| `docker_reference` | Branch/tag to build from | - | Yes | +| `revision` | Package revision number | `1` | Yes | +| `reference` | Dev reference (for pre-release builds) | `latest` | No | +| `id` | Workflow run identifier | - | No | +| `dev` | Enable development mode (adds `-dev` suffix) | `false`/`true` | No | + +## Development vs Production Mode + +**Development Mode** (`dev: true`): + +- Pushes to AWS ECR (Elastic Container Registry) +- Uses pre-signed S3 URLs for packages +- Generates dynamic `artifact_urls.yml` from S3 bucket +- Adds development reference to image tags +- Authenticates via AWS IAM role + +**Production Mode** (`dev: false`): + +- Pushes to Docker Hub +- Uses public package repositories +- Authenticates with Docker Hub credentials +- Supports version stages (rc, beta, etc.) + +## Build Process + +1. **Artifact Resolution**: + - Dev mode: Creates pre-signed URLs for all Wazuh packages from S3 + - Prod mode: Uses packages from public repositories + +2. **Multi-architecture Build**: + - Uses Docker Buildx with QEMU for cross-platform builds + - Builds for `linux/amd64` and `linux/arm64` + - Leverages `build-images.yml` for build configuration + +3. **Image Publishing**: + - Tags images appropriately based on mode + - Pushes to the configured registry + - Generates .env file with build metadata + +## Log Collection Feature + +When tests fail, the workflows automatically collect and display relevant logs to help diagnose issues quickly. + +This is implemented via two scripts, executed depending on the test setup: +Single-node: `single-node-log-check.sh` +Multi-node: `multi-node-log-check.sh` + +Capabilities include: + +- Collects ERROR, WARNING, and CRITICAL messages from all nodes. +- Automatically gathers logs on test failures for faster debugging. + diff --git a/docs/ref/getting-started/deployment/deployment.md b/docs/ref/getting-started/deployment/deployment.md index 48360ef6..61fcb922 100644 --- a/docs/ref/getting-started/deployment/deployment.md +++ b/docs/ref/getting-started/deployment/deployment.md @@ -22,11 +22,11 @@ Wazuh-Docker offers flexibility in how you can deploy the Wazuh stack. The prima Ensure you have: -- Met all the [System Requirements](ref/getting-started/requirements.md). +- Met all the [System Requirements](../requirements.md). - Installed Docker and Docker Compose on your host(s). - Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files. ```bash - git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git) + git clone https://github.com/wazuh/wazuh-docker.git cd wazuh-docker git checkout v5.0.0 ``` diff --git a/docs/ref/getting-started/deployment/multi-node.md b/docs/ref/getting-started/deployment/multi-node.md index 19f9e968..6ee10934 100644 --- a/docs/ref/getting-started/deployment/multi-node.md +++ b/docs/ref/getting-started/deployment/multi-node.md @@ -2,31 +2,74 @@ ## Deploying Wazuh Docker in a Multi-Node Configuration -This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. Follow these steps to deploy this configuration: +This deployment utilizes the `multi-node/docker-compose.yml` file, which defines a cluster setup with two Wazuh Manager, three Wazuh Indexer, and one Wazuh Dashboard containers. Follow these steps to deploy this configuration: + +1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions: + + ```bash + sudo sysctl -w vm.max_map_count=262144 + ``` + + **Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`. + +2. Navigate to the `multi-node` directory within your repository: -1. Navigate to the `multi-node` directory within your repository: ```bash cd multi-node ``` -2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions: - ```bash - sudo sysctl -w vm.max_map_count=262144 - ``` - **Note:** This change is temporary and will revert upon reboot. To make it permanent on each relevant host, you'll need to edit the `/etc/sysctl.conf` file, add `vm.max_map_count=262144`, and then apply the change with `sudo sysctl -p`. +3. Download the certificate creation script and config.yml file: -3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: ```bash - docker compose -f generate-indexer-certs.yml run --rm generator + curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh + curl -sO https://packages.wazuh.com/5.0/config.yml ``` -4. Start the Wazuh environment using `docker compose`: +4. Edit the `config.yml` file with the configuration of the Wazuh components to be deployed + + ```bash + nodes: + # Wazuh indexer server nodes + indexer: + - name: wazuh1.indexer + ip: wazuh1.indexer + - name: wazuh2.indexer + ip: wazuh2.indexer + - name: wazuh3.indexer + ip: wazuh3.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + - name: wazuh.master + ip: wazuh.master + node_type: master + - name: wazuh.worker + ip: wazuh.worker + node_type: worker + + # Wazuh dashboard node + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard + ``` + +5. Run the certificate creation script: + + ```bash + bash ./wazuh-certs-tool.sh -A + ``` + +6. Start the Wazuh environment using `docker compose`: * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): + ```bash docker compose up ``` + * To run in the background (detached mode, allowing the containers to run independently of your terminal): + ```bash docker compose up -d ``` diff --git a/docs/ref/getting-started/deployment/single-node.md b/docs/ref/getting-started/deployment/single-node.md index f5ab7eb8..f058fe3b 100644 --- a/docs/ref/getting-started/deployment/single-node.md +++ b/docs/ref/getting-started/deployment/single-node.md @@ -2,34 +2,68 @@ ## Deploying Wazuh Docker in a Single-Node Configuration -This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh manager container, one Wazuh indexer container, and one Wazuh dashboard container. Follow these steps to deploy it: +This deployment uses the `single-node/docker-compose.yml` file, which defines a setup with one Wazuh Manager, one Wazuh Indexer, and one Wazuh Dashboard container. Follow these steps to deploy it: + +1. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions: + + ```bash + sudo sysctl -w vm.max_map_count=262144 + ``` + + **Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`. + +2. Navigate to the `single-node` directory within your repository: -1. Navigate to the `single-node` directory within your repository: ```bash cd single-node ``` -2. Increase `vm.max_map_count` on each Docker host that will run a Wazuh Indexer container (Linux). This setting is crucial for Wazuh Indexer to operate correctly. This command requires root permissions: - ```bash - sudo sysctl -w vm.max_map_count=262144 - ``` - **Note:** This change is temporary and will revert upon reboot. To make it permanent, you'll need to edit the `/etc/sysctl.conf` file and add `vm.max_map_count=262144`, then apply with `sudo sysctl -p`. +3. Download the certificate creation script and `config.yml` file: -3. Run the script to generate the necessary certificates for the Wazuh Stack. This ensures secure communication between the nodes: ```bash - docker compose -f generate-indexer-certs.yml run --rm generator + curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh + curl -sO https://packages.wazuh.com/5.0/config.yml ``` -4. Start the Wazuh environment using `docker compose`: +4. Edit the config.yml file with the configuration of the Wazuh components to be deployed + + ```bash + nodes: + # Wazuh indexer server nodes + indexer: + - name: wazuh.indexer + ip: wazuh.indexer + + # Wazuh server nodes + # Use node_type only with more than one Wazuh manager + server: + - name: wazuh.manager + ip: wazuh.manager + + # Wazuh dashboard node + dashboard: + - name: wazuh.dashboard + ip: wazuh.dashboard + ``` + +5. Run the certificate creation script: + + ```bash + bash ./wazuh-certs-tool.sh -A + ``` + +5. Start the Wazuh environment using `docker compose`: * To run in the foreground (logs will be displayed in your current terminal; press `Ctrl+C` to stop): + ```bash docker compose up ``` + * To run in the background (detached mode, allowing the containers to run independently of your terminal): + ```bash docker compose up -d ``` Please allow some time for the environment to initialize, especially on the first run. It can take approximately a minute or two (depending on your host's resources) as the Wazuh Indexer starts up and generates the necessary indexes and index patterns. - diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md deleted file mode 100644 index 8ddccdf5..00000000 --- a/indexer-certs-creator/README.md +++ /dev/null @@ -1,9 +0,0 @@ -# Certificate creation image build - -The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks. - -To create the image, the following command must be executed: - -``` -$ docker build -t wazuh/wazuh-certs-generator:0.0.3 . -``` diff --git a/multi-node/README.md b/multi-node/README.md deleted file mode 100644 index 9a300fc7..00000000 --- a/multi-node/README.md +++ /dev/null @@ -1,62 +0,0 @@ -# Deploy Wazuh Docker in multi node configuration - -This deployment is defined in the `docker-compose.yml` file with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps: - -1) Increase max_map_count on your host (Linux). This command must be run with root permissions: -``` -$ sysctl -w vm.max_map_count=262144 -``` - -2) Download the certificate creation script and config.yml file: -``` -$ curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh -$ curl -sO https://packages.wazuh.com/5.0/config.yml -``` - -3) Edit the config.yml file with the configuration of the Wazuh components to be deployed -``` -nodes: - # Wazuh indexer server nodes - indexer: - - name: wazuh1.indexer - ip: wazuh1.indexer - - name: wazuh2.indexer - ip: wazuh2.indexer - - name: wazuh3.indexer - ip: wazuh3.indexer - - # Wazuh server nodes - # Use node_type only with more than one Wazuh manager - server: - - name: wazuh.master - ip: wazuh.master - node_type: master - - name: wazuh.worker - ip: wazuh.worker - node_type: worker - - # Wazuh dashboard node - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard -``` - -4) Run the certificate creation script: -``` -bash ./wazuh-certs-tool.sh -A -``` - -5) Start the environment with docker compose: - -- In the foregroud: -``` -$ docker compose up -``` - -- In the background: -``` -$ docker compose up -d -``` - - -The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated. diff --git a/single-node/README.md b/single-node/README.md deleted file mode 100644 index fbded2be..00000000 --- a/single-node/README.md +++ /dev/null @@ -1,53 +0,0 @@ -# Deploy Wazuh Docker in single node configuration - -This deployment is defined in the `docker-compose.yml` file with one Wazuh manager containers, one Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps: - -1) Increase max_map_count on your host (Linux). This command must be run with root permissions: -``` -$ sysctl -w vm.max_map_count=262144 -``` - -2) Download the certificate creation script and config.yml file: -``` -$ curl -sO https://packages.wazuh.com/5.0/wazuh-certs-tool.sh -$ curl -sO https://packages.wazuh.com/5.0/config.yml -``` - -3) Edit the config.yml file with the configuration of the Wazuh components to be deployed -``` -nodes: - # Wazuh indexer server nodes - indexer: - - name: wazuh.indexer - ip: wazuh.indexer - - # Wazuh server nodes - # Use node_type only with more than one Wazuh manager - server: - - name: wazuh.manager - ip: wazuh.manager - - # Wazuh dashboard node - dashboard: - - name: wazuh.dashboard - ip: wazuh.dashboard -``` - -4) Run the certificate creation script: -``` -bash ./wazuh-certs-tool.sh -A -``` - -5) Start the environment with docker compose: - -- In the foregroud: -``` -$ docker compose up -``` - -- In the background: -``` -$ docker compose up -d -``` - -The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated. From e4e41ef4bac3b69b3f522725c92cd9fa7430fa0f Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Mon, 22 Dec 2025 09:54:24 -0500 Subject: [PATCH 102/142] Add shebang to build-images.sh script, enhance script structure, update push.yml workflow file to use working-directory, and remove indexer-certs-creator directory --- .github/workflows/push.yml | 3 +- build-docker-images/build-images.sh | 16 ++--- indexer-certs-creator/Dockerfile | 12 ---- indexer-certs-creator/config/entrypoint.sh | 68 ---------------------- 4 files changed, 11 insertions(+), 88 deletions(-) delete mode 100644 indexer-certs-creator/Dockerfile delete mode 100644 indexer-certs-creator/config/entrypoint.sh diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 75e3cf97..0fb975b3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -11,7 +11,8 @@ jobs: uses: actions/checkout@v4 - name: Build Wazuh images - run: build-docker-images/build-images.sh + run: ./build-images.sh + working-directory: ./build-docker-images - name: Create enviroment variables run: cat .env > $GITHUB_ENV diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 5e558e2c..1a0802fc 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,10 +1,4 @@ -WAZUH_IMAGE_VERSION=5.0.0 -IMAGE_TAG=5.0.0 -WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') -WAZUH_TAG_REVISION=1 -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') -IMAGE_VERSION=${WAZUH_IMAGE_VERSION} -WAZUH_REGISTRY=docker.io +#!/bin/bash # Wazuh package generator # Copyright (C) 2023, Wazuh Inc. @@ -14,6 +8,14 @@ WAZUH_REGISTRY=docker.io # License (version 2) as published by the FSF - Free Software # Foundation. +WAZUH_IMAGE_VERSION=5.0.0 +IMAGE_TAG=5.0.0 +WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') +WAZUH_TAG_REVISION=1 +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +IMAGE_VERSION=${WAZUH_IMAGE_VERSION} +WAZUH_REGISTRY=docker.io + WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" diff --git a/indexer-certs-creator/Dockerfile b/indexer-certs-creator/Dockerfile deleted file mode 100644 index b9772abf..00000000 --- a/indexer-certs-creator/Dockerfile +++ /dev/null @@ -1,12 +0,0 @@ -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023 - -RUN yum update -y && yum install openssl curl-minimal -y - -WORKDIR / - -COPY config/entrypoint.sh / - -RUN chmod 700 /entrypoint.sh - -ENTRYPOINT ["/entrypoint.sh"] \ No newline at end of file diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh deleted file mode 100644 index a222a5b9..00000000 --- a/indexer-certs-creator/config/entrypoint.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) - -############################################################################## -# Downloading Cert Gen Tool -############################################################################## - -## Variables -CERT_TOOL=wazuh-certs-tool.sh -PASSWORD_TOOL=wazuh-passwords-tool.sh -PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/ -PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/ - -OUTPUT_FILE="/$CERT_TOOL" - -download_package() { - local url=$1 - echo "Checking $url$CERT_TOOL ..." - if curl -fsL "$url$CERT_TOOL" -o "$OUTPUT_FILE"; then - echo "Downloaded $CERT_TOOL from $url" - return 0 - else - return 1 - fi -} - -# Try first the prod URL, if it fails try the dev URL -if download_package "$PACKAGES_URL"; then - : -elif download_package "$PACKAGES_DEV_URL"; then - : -else - echo "The tool to create the certificates does not exist in any bucket" - echo "ERROR: certificates were not created" - exit 1 -fi - -cp /config/certs.yml /config.yml -chmod 700 "$OUTPUT_FILE" - -############################################################################## -# Creating Cluster certificates -############################################################################## - -## Execute cert tool and parsin cert.yml to set UID permissions -source /$CERT_TOOL -A -nodes_server=$( cert_parseYaml /config.yml | grep -E "nodes[_]+server[_]+[0-9]+=" | sed -e 's/nodes__server__[0-9]=//' | sed 's/"//g' ) -node_names=($nodes_server) - -echo "Moving created certificates to the destination directory" -cp /wazuh-certificates/* /certificates/ -echo "Changing certificate permissions" -chmod -R 500 /certificates -chmod -R 400 /certificates/* -echo "Setting UID indexer and dashboard" -chown 1000:1000 /certificates/* -echo "Setting UID for wazuh manager and worker" -cp /certificates/root-ca.pem /certificates/root-ca-manager.pem -cp /certificates/root-ca.key /certificates/root-ca-manager.key -chown 999:999 /certificates/root-ca-manager.pem -chown 999:999 /certificates/root-ca-manager.key - -for i in ${node_names[@]}; -do - chown 999:999 "/certificates/${i}.pem" - chown 999:999 "/certificates/${i}-key.pem" -done - From b120c4c8c84363f2e26782a07782f4402c332ade Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 23 Dec 2025 23:50:24 +0700 Subject: [PATCH 103/142] Add Wazuh indexer check with Attempts --- .github/workflows/push.yml | 42 +++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index eccb6689..1dbf54b5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -147,14 +147,19 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 240 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" - if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - exit 1 - fi + for i in {1..10}; do + echo "Checking Wazuh indexer health (Attempt $i/10)" + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" + exit 0 + fi + + echo "Waiting for cluster to be online" + [ $i -lt 10 ] && sleep 60 + done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then @@ -344,14 +349,19 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 360 - status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s | grep green | wc -l`" - if [[ $status_green -eq 1 ]]; then - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - else - curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:admin -k -s - exit 1 - fi + for i in {1..10}; do + echo "Checking Wazuh indexer health (Attempt $i/10)" + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + + if echo "$RESPONSE" | grep -qE "green|yellow"; then + echo "Cluster Online" + echo "$RESPONSE" + exit 0 + fi + + echo "Waiting for cluster to be online" + [ $i -lt 10 ] && sleep 60 + done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then From 73c8b33bcd34d0550b269dd6e2a36df0dc46e758 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 00:20:02 +0700 Subject: [PATCH 104/142] Fix first attempts of cluster initialization --- .github/workflows/push.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 1dbf54b5..43b1c876 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -149,7 +149,7 @@ jobs: run: | for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -351,7 +351,7 @@ jobs: run: | for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" From 76122bd3b884b0cca27ebde2ed35bb8ceacb23c5 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:21:59 +0700 Subject: [PATCH 105/142] Add checking into steps and container names --- .github/workflows/push.yml | 129 +++++++++++++++++++++++---------- multi-node/docker-compose.yml | 7 ++ single-node/docker-compose.yml | 3 + 3 files changed, 102 insertions(+), 37 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 43b1c876..bb9400f3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,16 +33,20 @@ jobs: build-images: - needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true + # needs: prepare-variables + # uses: ./.github/workflows/Procedure_push_docker_images.yml + # secrets: inherit + # with: + # image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + # docker_reference: ${{ github.head_ref }} + # revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + # reference: "latest" + # id: ${{ github.run_id }} + # dev: true + runs-on: ubuntu-latest + steps: + - name: Skip build + run: echo "Build images step skipped" Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -147,6 +151,7 @@ jobs: - name: Check Wazuh indexer start run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) @@ -156,8 +161,15 @@ jobs: echo "$RESPONSE" exit 0 fi - echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done [ $i -lt 10 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" @@ -192,13 +204,21 @@ jobs: - name: Check documents into wazuh-states index run: | - sleep 120 - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" - if [[ $docs -gt 0 ]]; then - echo "wazuh-states index documents: ${docs}" - else - echo "wazuh-states index documents: ${docs}" - fi + for i in {1..10}; do + echo "Checking documents in wazuh-states (Attempt $i/10)..." + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" + [ $i -lt 10 ] && sleep 30 + done + echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Last response: $RESPONSE" + exit 1 - name: Check Wazuh templates run: | @@ -229,13 +249,22 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I -s | grep -E "^HTTP" | awk '{print $2}') - if [[ $status -eq 200 ]]; then - echo "Wazuh dashboard status: ${status}" - else - echo "Wazuh dashboard status: ${status}" + for i in {1..10}; do + echo "Checking Wazuh dashboard (Attempt $i/10)" + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + echo "Current status: $STATUS" + if [[ "$STATUS" == "200" ]]; then + echo "Wazuh dashboard is UP" + exit 0 + elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then + echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s" + else + echo "Unexpected status $STATUS. Retrying in 30s" + fi + sleep 30 + done + echo "Error: Dashboard did not reach 200 status in time." exit 1 - fi - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml @@ -349,7 +378,7 @@ jobs: - name: Check Wazuh indexer start run: | - for i in {1..10}; do + for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) @@ -360,6 +389,14 @@ jobs: fi echo "Waiting for cluster to be online" + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done [ $i -lt 10 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" @@ -395,12 +432,21 @@ jobs: - name: Check documents into wazuh-states index run: | - docs="`curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s | jq -r ".count"`" - if [[ $docs -gt 0 ]]; then - echo "wazuh-states index documents: ${docs}" - else - echo "wazuh-states index documents: ${docs}" - fi + for i in {1..10}; do + echo "Checking documents in wazuh-states (Attempt $i/10)..." + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') + if [[ "$DOCS" -gt 0 ]]; then + echo "wazuh-states index has documents: ${DOCS}" + exit 0 + fi + + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" + [ $i -lt 10 ] && sleep 30 + done + echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Last response: $RESPONSE" + exit 1 - name: Check Wazuh templates run: | @@ -438,13 +484,22 @@ jobs: - name: Check Wazuh dashboard service URL run: | - status=$(curl -XGET --silent https://0.0.0.0:443/app/status -k -u admin:admin -I | grep -E "^HTTP" | awk '{print $2}') - if [[ $status -eq 200 ]]; then - echo "Wazuh dashboard status: ${status}" - else - echo "Wazuh dashboard status: ${status}" + for i in {1..10}; do + echo "Checking Wazuh dashboard (Attempt $i/10)" + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + echo "Current status: $STATUS" + if [[ "$STATUS" == "200" ]]; then + echo "Wazuh dashboard is UP" + exit 0 + elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then + echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s" + else + echo "Unexpected status $STATUS. Retrying in 30s" + fi + sleep 30 + done + echo "Error: Dashboard did not reach 200 status in time." exit 1 - fi - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file run: sed -i "s//$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index f1b7f63a..2e69f4d0 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -3,6 +3,7 @@ services: wazuh.master: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master + container_name: multi-node-wazuh.master restart: always ulimits: memlock: @@ -39,6 +40,7 @@ services: wazuh.worker: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker + container_name: multi-node-wazuh.worker restart: always ulimits: memlock: @@ -72,6 +74,7 @@ services: wazuh1.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer + container_name: multi-node-wazuh1.indexer restart: always ports: - "9200:9200" @@ -103,6 +106,7 @@ services: wazuh2.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer + container_name: multi-node-wazuh2.indexer restart: always environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g @@ -130,6 +134,7 @@ services: wazuh3.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer + container_name: multi-node-wazuh3.indexer restart: always environment: - OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g @@ -157,6 +162,7 @@ services: wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard + container_name: multi-node-wazuh.dashboard restart: always ports: - 443:5601 @@ -190,6 +196,7 @@ services: nginx: image: nginx:stable hostname: nginx + container_name: multi-node-nginx restart: always ports: - "1514:1514" diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 2481aeff..1bfcee5e 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -3,6 +3,7 @@ services: wazuh.manager: image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager + container_name: single-node-wazuh.manager restart: always ulimits: memlock: @@ -40,6 +41,7 @@ services: wazuh.indexer: image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer + container_name: single-node-wazuh.indexer restart: always ports: - "9200:9200" @@ -70,6 +72,7 @@ services: wazuh.dashboard: image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard + container_name: single-node-wazuh.dashboard restart: always ports: - 443:443 From d0ca1e6163e798057951421b978ae8a44475f888 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:31:35 +0700 Subject: [PATCH 106/142] Add checking into steps and container names --- .github/workflows/push.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index bb9400f3..44b0fad3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -155,7 +155,7 @@ jobs: for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" echo "$RESPONSE" @@ -381,13 +381,12 @@ jobs: for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" echo "$RESPONSE" exit 0 fi - echo "Waiting for cluster to be online" for CONTAINER_NAME in $INDEXER_CONTAINERS; do echo "" From bf56fab8c8eadfeec6a2656b624810345c2883c9 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:42:08 +0700 Subject: [PATCH 107/142] Add config.yml check --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 44b0fad3..273a3091 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -127,8 +127,9 @@ jobs: - name: wazuh.dashboard ip: wazuh.dashboard EOF + cat config.yml bash ./wazuh-certs-tool.sh -A - sysctl -w vm.max_map_count=262144 + sudo sysctl -w vm.max_map_count=262144 working-directory: ./single-node - name: Edit single node docker-compose file @@ -340,7 +341,6 @@ jobs: ip: wazuh2.indexer - name: wazuh3.indexer ip: wazuh3.indexer - # Wazuh server nodes # Use node_type only with more than one Wazuh manager server: @@ -350,14 +350,14 @@ jobs: - name: wazuh.worker ip: wazuh.worker node_type: worker - # Wazuh dashboard node dashboard: - name: wazuh.dashboard ip: wazuh.dashboard EOF + cat config.yml bash ./wazuh-certs-tool.sh -A - sysctl -w vm.max_map_count=262144 + sudo sysctl -w vm.max_map_count=262144 working-directory: ./multi-node - name: Edit multi node docker-compose file From 5df15e85687dc2633e3d3cad4db130c5e7e0c459 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 24 Dec 2025 01:50:49 +0700 Subject: [PATCH 108/142] Fix multi node config.yml --- .github/workflows/push.yml | 44 ++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 273a3091..74f11be5 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -333,27 +333,29 @@ jobs: curl -sL "$wazuh_certs_tool_url" -o ./wazuh-certs-tool.sh cat > config.yml < Date: Wed, 24 Dec 2025 09:10:09 -0300 Subject: [PATCH 109/142] Removed certificates files from main --- build-docker-images/README.md | 40 --------- indexer-certs-creator/README.md | 32 -------- indexer-certs-creator/build-image.sh | 107 ------------------------- indexer-certs-creator/build-image.yml | 8 -- multi-node/generate-indexer-certs.yml | 10 --- single-node/generate-indexer-certs.yml | 10 --- 6 files changed, 207 deletions(-) delete mode 100644 build-docker-images/README.md delete mode 100644 indexer-certs-creator/README.md delete mode 100755 indexer-certs-creator/build-image.sh delete mode 100644 indexer-certs-creator/build-image.yml delete mode 100644 multi-node/generate-indexer-certs.yml delete mode 100644 single-node/generate-indexer-certs.yml diff --git a/build-docker-images/README.md b/build-docker-images/README.md deleted file mode 100644 index 8502b8c6..00000000 --- a/build-docker-images/README.md +++ /dev/null @@ -1,40 +0,0 @@ -# Wazuh Docker Image Builder - -The creation of the images for the Wazuh stack deployment in Docker is done with the `build-docker-images/build-images.sh` script - -This script initializes the environment variables needed to build each of the images. - -To execute it, make sure to be in the `build-docker-images` directory: - -```bash -cd build-docker-images -``` - -Then execute: - -```bash -./build-images.sh -``` - -The script also allows to build images from other versions of Wazuh by using the `-v` or `--version` argument: - -```bash -./build-images.sh -v 4.14.3 -``` - -To get all the available script options use the -h or --help option: - -```bash -./build-images.sh -h - -Usage: ./build-images.sh [OPTIONS] - - -d, --dev [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default. - -f, --filebeat-module [Optional] Set Filebeat module version. By default 0.5. - -r, --revision [Optional] Package revision. By default 1 - -rg, --registry [Optional] Set the Docker registry to push the images. - -v, --version [Optional] Set the Wazuh version should be builded. By default, 4.14.3. - -m, --multiarch [Optional] Enable multi-architecture builds. - -h, --help Show this help. - -``` \ No newline at end of file diff --git a/indexer-certs-creator/README.md b/indexer-certs-creator/README.md deleted file mode 100644 index 1a6e05e3..00000000 --- a/indexer-certs-creator/README.md +++ /dev/null @@ -1,32 +0,0 @@ -# Certificate Creation Image Build - -The dockerfile hosted in this directory is used to build the image required for generating Wazuh Docker single-node and multi-node certificate files - -## Pre-requisites - -1. Verify the Docker Buildx plugin is properly set up -2. For multi-architecture image builds: - - Ensure QEMU is installed - - Check permissions to push images to a Docker registry - -Useful documentation: - -- https://docs.docker.com/build/building/multi-platform/ -- https://www.qemu.org/download/ - -## Procedure - -Execute the following to run the script used to build the wazuh-certs-generator docker image - -```console -cd indexer-certs-creator -``` - -```console -./build-image.sh -v [-m] [-rg ] -``` - -- Replace with the new image desired tag. -- Use the `-m` flag to build a multi-architecture image (supports both `amd64` and `arm64`) - - If multiarch build is enabled, the script will attempt to push the image to the specified registry. This image upload will only work if credentials are properly configured. -- Use the `-rg ` parameter to specify a custom Docker registry (default is Docker Hub) diff --git a/indexer-certs-creator/build-image.sh b/indexer-certs-creator/build-image.sh deleted file mode 100755 index afa0eea2..00000000 --- a/indexer-certs-creator/build-image.sh +++ /dev/null @@ -1,107 +0,0 @@ -#!/bin/bash - -# Wazuh package generator -# Copyright (C) 2023, Wazuh Inc. -# -# This program is a free software; you can redistribute it -# and/or modify it under the terms of the GNU General Public -# License (version 2) as published by the FSF - Free Software -# Foundation. - -WAZUH_CERTS_IMAGE_VERSION="0.0.4" -WAZUH_REGISTRY="docker.io" - -# ----------------------------------------------------------------------------- - -trap ctrl_c INT - -clean() { - exit_code=$1 - exit ${exit_code} -} - -ctrl_c() { - clean 1 -} - -# ----------------------------------------------------------------------------- - -build() { - IMAGE_TAG="${WAZUH_CERTS_IMAGE_VERSION}" - - echo WAZUH_REGISTRY=$WAZUH_REGISTRY > .env - echo IMAGE_TAG=$IMAGE_TAG >> .env - - set -a - source .env - set +a - - if [ "${MULTIARCH}" ]; then - docker buildx bake \ - --file build-image.yml \ - --set *.platform=linux/amd64,linux/arm64 \ - --push \ - --no-cache || clean 1 - else - docker buildx bake \ - --file build-image.yml \ - --load \ - --no-cache || clean 1 - fi - return 0 -} - -# ----------------------------------------------------------------------------- - -help() { - echo - echo "Usage: $0 [OPTIONS]" - echo - echo " -v, --version [Optional] Set the image version. By default ${WAZUH_CERTS_IMAGE_VERSION}." - echo " -rg, --registry [Optional] Set the Docker registry to push the images." - echo " -m, --multiarch [Optional] Enable multi-architecture builds." - echo " -h, --help Show this help." - echo - exit $1 -} - -# ----------------------------------------------------------------------------- - -main() { - while [ -n "${1}" ] - do - case "${1}" in - "-h"|"--help") - help 0 - ;; - "-m"|"--multiarch") - MULTIARCH="true" - shift - ;; - "-rg"|"--registry") - if [ -n "${2}" ]; then - WAZUH_REGISTRY="${2}" - shift 2 - else - help 1 - fi - ;; - "-v"|"--version") - if [ -n "$2" ]; then - WAZUH_CERTS_IMAGE_VERSION="$2" - shift 2 - else - help 1 - fi - ;; - *) - help 1 - esac - done - - build || clean 1 - - clean 0 -} - -main "$@" diff --git a/indexer-certs-creator/build-image.yml b/indexer-certs-creator/build-image.yml deleted file mode 100644 index 58bb13cf..00000000 --- a/indexer-certs-creator/build-image.yml +++ /dev/null @@ -1,8 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - wazuh.certs.generator: - build: - context: . - dockerfile: Dockerfile - image: ${WAZUH_REGISTRY}/wazuh/wazuh-certs-generator:${IMAGE_TAG} - hostname: wazuh-certs-generator diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml deleted file mode 100644 index c719d22e..00000000 --- a/multi-node/generate-indexer-certs.yml +++ /dev/null @@ -1,10 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - generator: - image: wazuh/wazuh-certs-generator:0.0.4 - hostname: wazuh-certs-generator - environment: - - CERT_TOOL_VERSION=4.14 - volumes: - - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml \ No newline at end of file diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml deleted file mode 100644 index dfcdca57..00000000 --- a/single-node/generate-indexer-certs.yml +++ /dev/null @@ -1,10 +0,0 @@ -# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) -services: - generator: - image: wazuh/wazuh-certs-generator:0.0.4 - hostname: wazuh-certs-generator - environment: - - CERT_TOOL_VERSION=4.14 - volumes: - - ./config/wazuh_indexer_ssl_certs/:/certificates/ - - ./config/certs.yml:/config/certs.yml From 5a803bc877985c6eece60f3ae13edc2a19bfbe23 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 24 Dec 2025 09:24:00 -0300 Subject: [PATCH 110/142] Updated build images parameters --- build-docker-images/build-images.sh | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 2c937af5..1a0802fc 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -128,10 +128,6 @@ main() { help 1 fi ;; - "-m"|"--multiarch") - MULTIARCH="true" - shift - ;; "-ref"|"--reference") if [ -n "${2}" ]; then WAZUH_TAG_REFERENCE="${2}" @@ -148,14 +144,6 @@ main() { help 1 fi ;; - "-rg"|"--registry") - if [ -n "${2}" ]; then - WAZUH_REGISTRY="${2}" - shift 2 - else - help 1 - fi - ;; "-v"|"--version") if [ -n "$2" ]; then WAZUH_IMAGE_VERSION="$2" From 2ccc4b068641a2e37ee6aa26ff3d6ade763d0ea9 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 17:38:03 +0700 Subject: [PATCH 111/142] Add env variables --- .github/workflows/push.yml | 85 ++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 41 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 74f11be5..9eef790d 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,20 +33,16 @@ jobs: build-images: - # needs: prepare-variables - # uses: ./.github/workflows/Procedure_push_docker_images.yml - # secrets: inherit - # with: - # image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - # docker_reference: ${{ github.head_ref }} - # revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - # reference: "latest" - # id: ${{ github.run_id }} - # dev: true - runs-on: ubuntu-latest - steps: - - name: Skip build - run: echo "Build images step skipped" + needs: prepare-variables + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -91,6 +87,10 @@ jobs: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + INDEXER_USERNAME: admin + INDEXER_PASSWORD: admin + API_USERNAME: wazuh-wui + API_PASSWORD: MyS3cr37P450r.*- steps: - name: Check out code @@ -155,7 +155,7 @@ jobs: INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..10}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -173,19 +173,19 @@ jobs: done [ $i -lt 10 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green|yellow" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 1 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -207,7 +207,7 @@ jobs: run: | for i in {1..10}; do echo "Checking documents in wazuh-states (Attempt $i/10)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -223,8 +223,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -246,13 +246,12 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | for i in {1..10}; do echo "Checking Wazuh dashboard (Attempt $i/10)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -293,7 +292,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -310,6 +309,10 @@ jobs: WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }} WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} + INDEXER_USERNAME: admin + INDEXER_PASSWORD: admin + API_USERNAME: wazuh-wui + API_PASSWORD: MyS3cr37P450r.*- steps: - name: Check out code @@ -351,7 +354,7 @@ jobs: - name: wazuh.worker ip: wazuh.worker node_type: worker - + # Wazuh dashboard node dashboard: - name: wazuh.dashboard @@ -382,7 +385,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/10)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u admin:admin -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -400,12 +403,12 @@ jobs: done [ $i -lt 10 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:admin -k -s + curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi @@ -424,7 +427,7 @@ jobs: - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:admin -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -435,7 +438,7 @@ jobs: run: | for i in {1..10}; do echo "Checking documents in wazuh-states (Attempt $i/10)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u admin:admin -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -451,8 +454,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:admin -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -464,7 +467,7 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{ env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 10 ]]; then echo "Wazuh Manager Services: ${services}" echo "OK" @@ -481,13 +484,13 @@ jobs: exit 1 fi env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | for i in {1..10}; do echo "Checking Wazuh dashboard (Attempt $i/10)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u admin:admin "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -527,7 +530,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh \ No newline at end of file From 1f656b7b36b24304dce21c5b7ae62a23ca6c84ff Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 18:24:08 +0700 Subject: [PATCH 112/142] Modify sleep time for count documents --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 9eef790d..7ba05f0c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -214,8 +214,8 @@ jobs: exit 0 fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" - [ $i -lt 10 ] && sleep 30 + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 10 ] && sleep 60 done echo "Error: No documents found in wazuh-states after 10 attempts." echo "Last response: $RESPONSE" @@ -445,8 +445,8 @@ jobs: exit 0 fi - echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 30s" - [ $i -lt 10 ] && sleep 30 + echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" + [ $i -lt 10 ] && sleep 60 done echo "Error: No documents found in wazuh-states after 10 attempts." echo "Last response: $RESPONSE" From ea05bb5207490fa0336fbbcbec9c2fe950fcc2ba Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 19:37:13 +0700 Subject: [PATCH 113/142] Modify Wazuh manager test --- .github/workflows/push.yml | 72 ++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 35 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 7ba05f0c..1c2ddf9c 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,16 +33,21 @@ jobs: build-images: + runs-on: ubuntu-latest needs: prepare-variables - uses: ./.github/workflows/Procedure_push_docker_images.yml - secrets: inherit - with: - image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} - docker_reference: ${{ github.head_ref }} - revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} - reference: "latest" - id: ${{ github.run_id }} - dev: true + steps: + + - name: Build step + run: echo "Build Docker images here" +# uses: ./.github/workflows/Procedure_push_docker_images.yml +# secrets: inherit +# with: +# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} +# docker_reference: ${{ github.head_ref }} +# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} +# reference: "latest" +# id: ${{ github.run_id }} +# dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -91,6 +96,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- + MANAGER_NODES: "manager" steps: - name: Check out code @@ -236,15 +242,16 @@ jobs: - name: Check Wazuh manager start run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for NODE in "${{ env.MANAGER_NODES }}"; do + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL @@ -313,6 +320,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- + MANAGER_NODES: "master worker" steps: - name: Check out code @@ -466,23 +474,17 @@ jobs: fi - name: Check Wazuh manager start - run: | - services="`curl -k -s -X GET "https://0.0.0.0:55000/clsuter/manager/status?pretty=true" -H "Authorization: Bearer ${{ env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 10 ]]; then - echo "Wazuh Manager Services: ${services}" - echo "OK" - else - echo "Wazuh indexer nodes: ${nodes}" - curl -k -s -X GET "https://0.0.0.0:55000/cluster/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi - nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l) - if [[ $nodes -eq 2 ]]; then - echo "Wazuh manager nodes: ${nodes}" - else - echo "Wazuh manager nodes: ${nodes}" - exit 1 - fi + run: | + for NODE in "${{ env.MANAGER_NODES }}"; do + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + exit 1 + fi + done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") From 7c5b3f3b54e07110435a78124b138e64d5a97068 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 20:01:39 +0700 Subject: [PATCH 114/142] Modify list separator and amount of replies --- .github/workflows/push.yml | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 1c2ddf9c..0a885c91 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -159,8 +159,8 @@ jobs: - name: Check Wazuh indexer start run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") - for i in {1..10}; do - echo "Checking Wazuh indexer health (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then @@ -177,7 +177,7 @@ jobs: docker logs --tail 30 "$CONTAINER_NAME" echo "---------------------------------------------------------" done - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" @@ -211,8 +211,8 @@ jobs: - name: Check documents into wazuh-states index run: | - for i in {1..10}; do - echo "Checking documents in wazuh-states (Attempt $i/10)..." + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then @@ -221,9 +221,9 @@ jobs: fi echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done - echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Error: No documents found in wazuh-states after 20 attempts." echo "Last response: $RESPONSE" exit 1 @@ -254,10 +254,11 @@ jobs: done env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + - name: Check Wazuh dashboard service URL run: | - for i in {1..10}; do - echo "Checking Wazuh dashboard (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh dashboard (Attempt $i/20)" STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then @@ -320,7 +321,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- - MANAGER_NODES: "master worker" + MANAGER_NODES: "master,worker" steps: - name: Check out code @@ -392,7 +393,7 @@ jobs: - name: Check Wazuh indexer start run: | for i in {1..20}; do - echo "Checking Wazuh indexer health (Attempt $i/10)" + echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then @@ -409,7 +410,7 @@ jobs: docker logs --tail 30 "$CONTAINER_NAME" echo "---------------------------------------------------------" done - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" @@ -444,8 +445,9 @@ jobs: - name: Check documents into wazuh-states index run: | - for i in {1..10}; do - echo "Checking documents in wazuh-states (Attempt $i/10)..." + IFS=',' + for i in {1..20}; do + echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then @@ -454,9 +456,9 @@ jobs: fi echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" - [ $i -lt 10 ] && sleep 60 + [ $i -lt 20 ] && sleep 60 done - echo "Error: No documents found in wazuh-states after 10 attempts." + echo "Error: No documents found in wazuh-states after 20 attempts." echo "Last response: $RESPONSE" exit 1 @@ -490,8 +492,8 @@ jobs: - name: Check Wazuh dashboard service URL run: | - for i in {1..10}; do - echo "Checking Wazuh dashboard (Attempt $i/10)" + for i in {1..20}; do + echo "Checking Wazuh dashboard (Attempt $i/20)" STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then From cf8c10d81797d53399203e50a115fe7ad9c60d34 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 20:12:35 +0700 Subject: [PATCH 115/142] Modify list separator --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0a885c91..5dc1c427 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -445,7 +445,6 @@ jobs: - name: Check documents into wazuh-states index run: | - IFS=',' for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") @@ -477,6 +476,7 @@ jobs: - name: Check Wazuh manager start run: | + IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then From 0b894153c036bb773a3a8ef0dbdbc2b5a31a511d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 23:44:43 +0700 Subject: [PATCH 116/142] Add retry option in Wazuh manager test --- .github/workflows/push.yml | 44 +++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 5dc1c427..daa2b3ff 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -243,17 +243,19 @@ jobs: - name: Check Wazuh manager start run: | for NODE in "${{ env.MANAGER_NODES }}"; do - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager $NODE Services: ${services}" - echo "OK" - else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for i in {1..20}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" + [ $i -lt 20 ] && sleep 30 + fi + done done - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | @@ -478,17 +480,19 @@ jobs: run: | IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" - if [[ $services -gt 9 ]]; then - echo "Wazuh Manager $NODE Services: ${services}" - echo "OK" - else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items - exit 1 - fi + for i in {1..20}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + if [[ $services -gt 9 ]]; then + echo "Wazuh Manager $NODE Services: ${services}" + echo "OK" + else + curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" + [ $i -lt 20 ] && sleep 30 + fi + done done - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - name: Check Wazuh dashboard service URL run: | From e91e15bbd900d0b13c492e85140fd97e42709c7f Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Thu, 25 Dec 2025 23:58:15 +0700 Subject: [PATCH 117/142] Modify service ip --- .github/workflows/push.yml | 56 +++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index daa2b3ff..ac4a2c26 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -161,7 +161,7 @@ jobs: INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -179,19 +179,19 @@ jobs: done [ $i -lt 20 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 1 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -213,7 +213,7 @@ jobs: run: | for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -229,8 +229,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -244,13 +244,13 @@ jobs: run: | for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do - TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -261,7 +261,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -302,7 +302,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -396,7 +396,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") if echo "$RESPONSE" | grep -qE "green|yellow"; then echo "Cluster Online" @@ -414,12 +414,12 @@ jobs: done [ $i -lt 20 ] && sleep 60 done - status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" - status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" + status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`" + status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`" if [[ $status_index_green -eq $status_index ]]; then - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s else - curl -XGET "https://0.0.0.0:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s + curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s exit 1 fi @@ -438,7 +438,7 @@ jobs: - name: Check Wazuh indexer nodes run: | - nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" + nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" if [[ $nodes -eq 3 ]]; then echo "Wazuh indexer nodes: ${nodes}" else @@ -449,7 +449,7 @@ jobs: run: | for i in {1..20}; do echo "Checking documents in wazuh-states (Attempt $i/20)..." - RESPONSE=$(curl -XGET "https://0.0.0.0:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") + RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}") DOCS=$(echo "$RESPONSE" | jq -r '.count // 0') if [[ "$DOCS" -gt 0 ]]; then echo "wazuh-states index has documents: ${DOCS}" @@ -465,8 +465,8 @@ jobs: - name: Check Wazuh templates run: | - qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" - templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" + qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`" + templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`" if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" @@ -481,13 +481,13 @@ jobs: IFS=',' for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do - TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://0.0.0.0:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -498,7 +498,7 @@ jobs: run: | for i in {1..20}; do echo "Checking Wazuh dashboard (Attempt $i/20)" - STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://0.0.0.0:443/app/status") + STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status") echo "Current status: $STATUS" if [[ "$STATUS" == "200" ]]; then echo "Wazuh dashboard is UP" @@ -538,7 +538,7 @@ jobs: sleep 20 curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") + TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh \ No newline at end of file From d264717f64b36139ed78abaf071998a51582b2da Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 00:36:12 +0700 Subject: [PATCH 118/142] Add docker logs review --- .github/workflows/push.yml | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index ac4a2c26..cc2af6a3 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -158,7 +158,6 @@ jobs: - name: Check Wazuh indexer start run: | - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer") for i in {1..20}; do echo "Checking Wazuh indexer health (Attempt $i/20)" RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true) @@ -220,6 +219,15 @@ jobs: exit 0 fi + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -455,7 +463,15 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs --tail 30 "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done From d586b48d8f74b9a5efdf44660f70ee13be344e23 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 00:51:36 +0700 Subject: [PATCH 119/142] Add double-quote and chenge TOKEN variable --- .github/workflows/push.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index cc2af6a3..48104673 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -253,12 +253,12 @@ jobs: for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi @@ -498,12 +498,12 @@ jobs: for NODE in "${{ env.MANAGER_NODES }}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`" + services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" else - curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items + curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" [ $i -lt 20 ] && sleep 30 fi From 2573671e471d391507624187f3cf77a7a73057d7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:01:46 +0700 Subject: [PATCH 120/142] Add free space step for single node deployment --- .github/workflows/push.yml | 3 +++ single-node/docker-compose.yml | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 48104673..50186466 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -102,6 +102,9 @@ jobs: - name: Check out code uses: actions/checkout@v4 + - name: free disk space + uses: ./.github/free-disk-space + - name: Configure aws credentials uses: aws-actions/configure-aws-credentials@v4 with: diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 1bfcee5e..6c74802c 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -75,8 +75,9 @@ services: container_name: single-node-wazuh.dashboard restart: always ports: - - 443:443 + - 443:5601 environment: + - SERVER_PORT=5601 - SERVER_HOST=0.0.0.0 - OPENSEARCH_HOSTS=https://wazuh.indexer:9200 - INDEXER_USERNAME=admin From 07634d7df5b0b18d06ae507e972bd25b2e4ae494 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:18:53 +0700 Subject: [PATCH 121/142] Modify manager list work --- .github/workflows/push.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 50186466..0c22b54e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -497,14 +497,15 @@ jobs: - name: Check Wazuh manager start run: | - IFS=',' - for NODE in "${{ env.MANAGER_NODES }}"; do + IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}" + for NODE in "${NODES[@]}"; do for i in {1..20}; do TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`" if [[ $services -gt 9 ]]; then echo "Wazuh Manager $NODE Services: ${services}" echo "OK" + break else curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s" From c9e0f3f099b9dc811b3b655bb7937b123a502eae Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 01:47:57 +0700 Subject: [PATCH 122/142] Change cluster worker node name --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0c22b54e..62921714 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -334,7 +334,7 @@ jobs: INDEXER_PASSWORD: admin API_USERNAME: wazuh-wui API_PASSWORD: MyS3cr37P450r.*- - MANAGER_NODES: "master,worker" + MANAGER_NODES: "master,worker01" steps: - name: Check out code From cd99438abc80b00ff26601c4b50c3308f8410c53 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 02:06:37 +0700 Subject: [PATCH 123/142] Add a last step with docker logs check --- .github/workflows/push.yml | 98 +++++++++++++++----------------------- 1 file changed, 38 insertions(+), 60 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 62921714..4f5dacaa 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -33,21 +33,16 @@ jobs: build-images: - runs-on: ubuntu-latest needs: prepare-variables - steps: - - - name: Build step - run: echo "Build Docker images here" -# uses: ./.github/workflows/Procedure_push_docker_images.yml -# secrets: inherit -# with: -# image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} -# docker_reference: ${{ github.head_ref }} -# revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} -# reference: "latest" -# id: ${{ github.run_id }} -# dev: true + uses: ./.github/workflows/Procedure_push_docker_images.yml + secrets: inherit + with: + image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} + docker_reference: ${{ github.head_ref }} + revision: ${{ needs.prepare-variables.outputs.WAZUH_TAG_REVISION }} + reference: "latest" + id: ${{ github.run_id }} + dev: true Execute-Goss-tests: needs: [prepare-variables, build-images] @@ -200,17 +195,6 @@ jobs: echo "Wazuh indexer nodes: ${nodes}" fi - - name: Docker logs - run: | - echo "===== Wazuh Manager Logs =====" - docker compose logs wazuh.manager - echo "===== Wazuh Indexer Logs =====" - docker compose logs wazuh.indexer - echo "===== Wazuh Dashboard Logs =====" - docker compose logs wazuh.dashboard - working-directory: ./single-node - - - name: Check documents into wazuh-states index run: | for i in {1..20}; do @@ -221,16 +205,6 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -311,12 +285,25 @@ jobs: - name: Check Wazuh agent enrollment run: | sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh + + - name: Docker logs + run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + working-directory: ./single-node check-multi-node: name: Check multi node on ${{ matrix.os }} @@ -434,19 +421,6 @@ jobs: exit 1 fi - - name: Docker logs - run: | - echo "===== Wazuh Manager Logs =====" - docker compose logs wazuh.master - docker compose logs wazuh.worker - echo "===== Wazuh Indexer Logs =====" - docker compose logs wazuh1.indexer - docker compose logs wazuh2.indexer - docker compose logs wazuh3.indexer - echo "===== Wazuh Dashboard Logs =====" - docker compose logs wazuh.dashboard - working-directory: ./multi-node - - name: Check Wazuh indexer nodes run: | nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`" @@ -466,15 +440,6 @@ jobs: echo "wazuh-states index has documents: ${DOCS}" exit 0 fi - INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') - for CONTAINER_NAME in $INDEXER_CONTAINERS; do - echo "" - echo "=========================================================" - echo "Container logs for $CONTAINER_NAME" - echo "=========================================================" - docker logs --tail 30 "$CONTAINER_NAME" - echo "---------------------------------------------------------" - done echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s" [ $i -lt 20 ] && sleep 60 done @@ -556,9 +521,22 @@ jobs: - name: Check Wazuh agent enrollment run: | sleep 20 - curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" env: TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") - name: Check errors in ossec.log for Wazuh manager - run: ./.github/multi-node-log-check.sh \ No newline at end of file + run: ./.github/multi-node-log-check.sh + + - name: Docker logs + run: | + INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') + for CONTAINER_NAME in $INDEXER_CONTAINERS; do + echo "" + echo "=========================================================" + echo "Container logs for $CONTAINER_NAME" + echo "=========================================================" + docker logs "$CONTAINER_NAME" + echo "---------------------------------------------------------" + done + working-directory: ./single-node \ No newline at end of file From 2c28bd04c6764fa3ab9ff9eeb360dd1f79dfed1d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Fri, 26 Dec 2025 20:02:43 +0700 Subject: [PATCH 124/142] Add changelog deleted --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6c6ecac9..96f4a5c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136)) - Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/pull/2081)) - Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-docker/pull/2058)) - Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-docker/pull/2054)) From 47ee381f48b4f17cc753a70e6a179fb8e5133400 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 27 Dec 2025 02:45:08 +0700 Subject: [PATCH 125/142] Add Changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 96f4a5c8..825717c5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Modify docker build image process ([#2131](https://github.com/wazuh/wazuh-docker/issues/2131)) - Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136)) - Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/pull/2081)) - Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-docker/pull/2058)) From e0a4e3f9fc8063db3bcddf85f6ba700edd0d31a8 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Sat, 27 Dec 2025 02:49:45 +0700 Subject: [PATCH 126/142] Add newline --- .github/workflows/push.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 4f5dacaa..0d731c50 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -539,4 +539,4 @@ jobs: docker logs "$CONTAINER_NAME" echo "---------------------------------------------------------" done - working-directory: ./single-node \ No newline at end of file + working-directory: ./single-node From eb00d13ad34f9bca68f856d051c6f7a0b3041bc7 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 20:49:11 +0700 Subject: [PATCH 127/142] change workflow name and delete trivy check workflows --- .../workflows/{push.yml => 5_pr_check.yml} | 0 .github/workflows/trivy-dashboard.yml | 76 ------------------- .github/workflows/trivy-indexer.yml | 76 ------------------- .github/workflows/trivy-manager.yml | 76 ------------------- 4 files changed, 228 deletions(-) rename .github/workflows/{push.yml => 5_pr_check.yml} (100%) delete mode 100644 .github/workflows/trivy-dashboard.yml delete mode 100644 .github/workflows/trivy-indexer.yml delete mode 100644 .github/workflows/trivy-manager.yml diff --git a/.github/workflows/push.yml b/.github/workflows/5_pr_check.yml similarity index 100% rename from .github/workflows/push.yml rename to .github/workflows/5_pr_check.yml diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml deleted file mode 100644 index 5239d93c..00000000 --- a/.github/workflows/trivy-dashboard.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh dashboard - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh dashboard - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-dashboard.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-dashboard.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml deleted file mode 100644 index 6f69f206..00000000 --- a/.github/workflows/trivy-indexer.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh indexer - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh indexer - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-indexer.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-indexer.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml deleted file mode 100644 index da75bcc7..00000000 --- a/.github/workflows/trivy-manager.yml +++ /dev/null @@ -1,76 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh manager - -on: - release: - types: - - published - pull_request: - branches: - - main - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-22.04" - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh manager - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-manager.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-manager.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file From 01c72c2c8bb485519a4adb9d775aa4cd526632b1 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 22:53:50 +0700 Subject: [PATCH 128/142] Change Wazuh agent check --- .github/workflows/5_pr_check.yml | 34 ++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 0d731c50..172e2965 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -284,10 +284,19 @@ jobs: - name: Check Wazuh agent enrollment run: | - sleep 20 - curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + for i in {1..5}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" + if [[ $agents -gt 1 ]]; then + echo "Wazuh agents: ${agents}" + echo "OK" + break + else + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" + echo "Wazuh agents: ${agents}. Retrying in 10s" + [ $i -lt 5 ] && sleep 10 + fi + done - name: Check errors in ossec.log for Wazuh manager run: ./.github/single-node-log-check.sh @@ -520,10 +529,19 @@ jobs: - name: Check Wazuh agent enrollment run: | - sleep 20 - curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" - env: - TOKEN: $(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + for i in {1..5}; do + TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X GET "https://127.0.0.1:55000/security/user/authenticate?raw=true") + agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`" + if [[ $agents -gt 1 ]]; then + echo "Wazuh agents: ${agents}" + echo "OK" + break + else + curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" + echo "Wazuh agents: ${agents}. Retrying in 10s" + [ $i -lt 5 ] && sleep 10 + fi + done - name: Check errors in ossec.log for Wazuh manager run: ./.github/multi-node-log-check.sh From 54b470d89b0579f1a1e62c388134cff50b2db7fc Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Mon, 29 Dec 2025 23:48:04 +0700 Subject: [PATCH 129/142] Change Wazuh agent check --- .github/workflows/5_pr_check.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 172e2965..f54a8164 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -302,6 +302,7 @@ jobs: run: ./.github/single-node-log-check.sh - name: Docker logs + if: always() run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do @@ -547,6 +548,7 @@ jobs: run: ./.github/multi-node-log-check.sh - name: Docker logs + if: always() run: | INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}') for CONTAINER_NAME in $INDEXER_CONTAINERS; do From 84441f9da9f08948d29086abf90b242563e65d0d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 00:54:13 +0700 Subject: [PATCH 130/142] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 46bcab1c..98ae1bde 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -23,12 +23,11 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ rm -rf /wazuh-agent.rpm && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ - curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz - + curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \ + -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ + tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From 6e93c01ab1b0f85d18f59b641ae576053b754ee6 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:01:34 +0700 Subject: [PATCH 131/142] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 98ae1bde..fd99ee2a 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -23,11 +23,13 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ rm -rf /wazuh-agent.rpm && \ dnf clean all && \ sed -i '//d' /var/ossec/etc/ossec.conf && \ + S6_ARCH="amd64" && \ + if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \ curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From 0fedd684b5bbbd9d734368c4b7a1ecac409bede3 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:13:51 +0700 Subject: [PATCH 132/142] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index fd99ee2a..08253f8f 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -29,7 +29,7 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From dc9da8aacbd1ab102c886ca5c27828dbce3575ca Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 30 Dec 2025 01:23:33 +0700 Subject: [PATCH 133/142] Fix S6 overlay arch into Wazuh agent image build --- build-docker-images/wazuh-agent/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 08253f8f..c8fc26ca 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -29,7 +29,7 @@ RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \ -o /tmp/s6-overlay-${S6_ARCH}.tar.gz && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \ tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-${S6_ARCH}.tar.gz && + rm /tmp/s6-overlay-${S6_ARCH}.tar.gz COPY config/etc/ /etc/ ENTRYPOINT [ "/init" ] From e1d072b2349774a6e06edfe9b3afb3b555b87e10 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 31 Dec 2025 08:28:38 -0300 Subject: [PATCH 134/142] Bump Docker images to alpha0 tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 2e69f4d0..1c06480c 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0-alpha0 hostname: wazuh.master container_name: multi-node-wazuh.master restart: always @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0-alpha0 hostname: wazuh.worker container_name: multi-node-wazuh.worker restart: always @@ -72,7 +72,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0-alpha0 hostname: wazuh1.indexer container_name: multi-node-wazuh1.indexer restart: always @@ -104,7 +104,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0-alpha0 hostname: wazuh2.indexer container_name: multi-node-wazuh2.indexer restart: always @@ -132,7 +132,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0-alpha0 hostname: wazuh3.indexer container_name: multi-node-wazuh3.indexer restart: always @@ -160,7 +160,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0-alpha0 hostname: wazuh.dashboard container_name: multi-node-wazuh.dashboard restart: always diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index 6c74802c..c3348e56 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0 + image: wazuh/wazuh-manager:5.0.0-alpha0 hostname: wazuh.manager container_name: single-node-wazuh.manager restart: always @@ -39,7 +39,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0 + image: wazuh/wazuh-indexer:5.0.0-alpha0 hostname: wazuh.indexer container_name: single-node-wazuh.indexer restart: always @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0 + image: wazuh/wazuh-dashboard:5.0.0-alpha0 hostname: wazuh.dashboard container_name: single-node-wazuh.dashboard restart: always From 9d08a8a66969b3d956225c8e9f3a384fdb9ac812 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 31 Dec 2025 08:36:40 -0300 Subject: [PATCH 135/142] Updated wazuh agent image --- wazuh-agent/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml index ff2c1574..a10fd959 100644 --- a/wazuh-agent/docker-compose.yml +++ b/wazuh-agent/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.agent: - image: wazuh/wazuh-agent:5.0.0 + image: wazuh/wazuh-agent:5.0.0-alpha0 restart: always environment: - WAZUH_MANAGER_SERVER= From 6d9a01750a4c3c9fb37a3905157893eb750efa3c Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 31 Dec 2025 08:42:26 -0300 Subject: [PATCH 136/142] Rollback bump 5.0.0-alpha0 tag --- multi-node/docker-compose.yml | 12 ++++++------ single-node/docker-compose.yml | 6 +++--- wazuh-agent/docker-compose.yml | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index 1c06480c..2e69f4d0 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.master: - image: wazuh/wazuh-manager:5.0.0-alpha0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.master container_name: multi-node-wazuh.master restart: always @@ -38,7 +38,7 @@ services: - ./wazuh-certificates/wazuh.master.pem:/var/ossec/etc/certs/server.pem - ./wazuh-certificates/wazuh.master-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.worker: - image: wazuh/wazuh-manager:5.0.0-alpha0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.worker container_name: multi-node-wazuh.worker restart: always @@ -72,7 +72,7 @@ services: - ./wazuh-certificates/wazuh.worker-key.pem:/var/ossec/etc/certs/server-key.pem wazuh1.indexer: - image: wazuh/wazuh-indexer:5.0.0-alpha0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh1.indexer container_name: multi-node-wazuh1.indexer restart: always @@ -104,7 +104,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh2.indexer: - image: wazuh/wazuh-indexer:5.0.0-alpha0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh2.indexer container_name: multi-node-wazuh2.indexer restart: always @@ -132,7 +132,7 @@ services: - ./wazuh-certificates/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh3.indexer: - image: wazuh/wazuh-indexer:5.0.0-alpha0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh3.indexer container_name: multi-node-wazuh3.indexer restart: always @@ -160,7 +160,7 @@ services: - ./wazuh-certificates/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0-alpha0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard container_name: multi-node-wazuh.dashboard restart: always diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index c3348e56..6c74802c 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.manager: - image: wazuh/wazuh-manager:5.0.0-alpha0 + image: wazuh/wazuh-manager:5.0.0 hostname: wazuh.manager container_name: single-node-wazuh.manager restart: always @@ -39,7 +39,7 @@ services: - ./wazuh-certificates/wazuh.manager-key.pem:/var/ossec/etc/certs/server-key.pem wazuh.indexer: - image: wazuh/wazuh-indexer:5.0.0-alpha0 + image: wazuh/wazuh-indexer:5.0.0 hostname: wazuh.indexer container_name: single-node-wazuh.indexer restart: always @@ -70,7 +70,7 @@ services: - ./wazuh-certificates/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem wazuh.dashboard: - image: wazuh/wazuh-dashboard:5.0.0-alpha0 + image: wazuh/wazuh-dashboard:5.0.0 hostname: wazuh.dashboard container_name: single-node-wazuh.dashboard restart: always diff --git a/wazuh-agent/docker-compose.yml b/wazuh-agent/docker-compose.yml index a10fd959..ff2c1574 100644 --- a/wazuh-agent/docker-compose.yml +++ b/wazuh-agent/docker-compose.yml @@ -1,7 +1,7 @@ # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2) services: wazuh.agent: - image: wazuh/wazuh-agent:5.0.0-alpha0 + image: wazuh/wazuh-agent:5.0.0 restart: always environment: - WAZUH_MANAGER_SERVER= From e53e51ff4478e4d6fdfed526d2aaa8a7fc79ddfd Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 6 Jan 2026 01:52:35 +0700 Subject: [PATCH 137/142] Add Windows and macOS prerequisites --- docs/ref/getting-started/requirements.md | 35 ++++++++++++++++++++++-- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/docs/ref/getting-started/requirements.md b/docs/ref/getting-started/requirements.md index 407cc557..d7b7cb5e 100644 --- a/docs/ref/getting-started/requirements.md +++ b/docs/ref/getting-started/requirements.md @@ -24,10 +24,10 @@ These are general recommendations. Actual needs may vary based on the number of * **Network**: * A stable network connection with sufficient bandwidth, especially if agents are reporting from remote locations. -### Software: +### Software Prerequisites: + +#### Linux: -* **Operating System**: - * A 64-bit Linux distribution is preferred (e.g., Ubuntu, CentOS, RHEL, Debian). * **Docker Engine**: * Version `20.10.0` or newer. * Install Docker by following the official instructions: [Install Docker Engine](https://docs.docker.com/engine/install/). @@ -48,6 +48,35 @@ These are general recommendations. Actual needs may vary based on the number of ``` * This is crucial for the stability of the Wazuh Indexer. +#### Windows: + +* **Docker Desktop** + * Latest version + * Install Docker Desktop by following the official instructions: [Install Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/). +* **WSL Linux distribution** + * Install Ubuntu or other compatible Linux distribution (bash in Alpine is not comptible with wazuh-certs-tool.sh): [Install Ubuntu on WSL](https://documentation.ubuntu.com/wsl/stable/howto/install-ubuntu-wsl2/) +* **Git Client**: + * Required for cloning the `wazuh-docker` repository. +* **Web Browser**: + * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh Dashboard. + +#### macOS: + +* **Docker Desktop** + * Latest version + * Install Docker Desktop by following the official instructions: [Install Docker Desktop](https://docs.docker.com/desktop/setup/install/mac-install/). +* **Bash Shell** +* **GNU versions of apps**: + * [Install GNU sed](https://formulae.brew.sh/formula/gnu-sed). + * [Install GNU awk](https://formulae.brew.sh/formula/gawk). + * [Install GNU grep](https://formulae.brew.sh/formula/grep). +* **OpenSSL**: + * [Install OpenSSL](https://formulae.brew.sh/formula/openssl@3). +* **Git Client**: + * Required for cloning the `wazuh-docker` repository. +* **Web Browser**: + * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh Dashboard. + ## Network Ports Ensure that the necessary network ports are open and available on the Docker host and any firewalls: From af1e954146f8b8504267947e143a2f4936f9a786 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 6 Jan 2026 01:58:42 +0700 Subject: [PATCH 138/142] Delete required version --- docs/ref/getting-started/requirements.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/ref/getting-started/requirements.md b/docs/ref/getting-started/requirements.md index d7b7cb5e..1b9ebeb6 100644 --- a/docs/ref/getting-started/requirements.md +++ b/docs/ref/getting-started/requirements.md @@ -51,7 +51,6 @@ These are general recommendations. Actual needs may vary based on the number of #### Windows: * **Docker Desktop** - * Latest version * Install Docker Desktop by following the official instructions: [Install Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/). * **WSL Linux distribution** * Install Ubuntu or other compatible Linux distribution (bash in Alpine is not comptible with wazuh-certs-tool.sh): [Install Ubuntu on WSL](https://documentation.ubuntu.com/wsl/stable/howto/install-ubuntu-wsl2/) @@ -63,7 +62,6 @@ These are general recommendations. Actual needs may vary based on the number of #### macOS: * **Docker Desktop** - * Latest version * Install Docker Desktop by following the official instructions: [Install Docker Desktop](https://docs.docker.com/desktop/setup/install/mac-install/). * **Bash Shell** * **GNU versions of apps**: From e2f3c816117b4cf901608575a4aa23e910c7dd27 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 6 Jan 2026 23:34:52 +0700 Subject: [PATCH 139/142] Add Changelog --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 825717c5..be7f77f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Change macOS and Windows deployment documentation ([#2150](https://github.com/wazuh/wazuh-docker/issues/2150)) - Modify docker build image process ([#2131](https://github.com/wazuh/wazuh-docker/issues/2131)) - Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136)) - Configure deployment with environment variables ([#2081](https://github.com/wazuh/wazuh-docker/pull/2081)) @@ -19,7 +20,7 @@ All notable changes to this project will be documented in this file. ### Fixed - Delete etc/lists references ([#2129](https://github.com/wazuh/wazuh-docker/pull/2129)) +- Delete etc/lists references ([#2129](https://github.com/wazuh/wazuh-docker/pull/2129)) ### Deleted From 88e46d80a3b0ee1acdef8337e0891e03904c6715 Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Wed, 7 Jan 2026 00:37:49 +0700 Subject: [PATCH 140/142] Delete multilingual statement --- docs/book.toml | 1 - docs/ref/getting-started/requirements.md | 6 +++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/book.toml b/docs/book.toml index d9b94462..10e89b86 100644 --- a/docs/book.toml +++ b/docs/book.toml @@ -2,6 +2,5 @@ title = "Wazuh Docker Documentation" description = "Technical documentation for Wazuh Docker deployment." authors = ["Victor Erenu"] -multilingual = false src = "." language = "en" \ No newline at end of file diff --git a/docs/ref/getting-started/requirements.md b/docs/ref/getting-started/requirements.md index 1b9ebeb6..48cb1c40 100644 --- a/docs/ref/getting-started/requirements.md +++ b/docs/ref/getting-started/requirements.md @@ -34,7 +34,7 @@ These are general recommendations. Actual needs may vary based on the number of * **Git Client**: * Required for cloning the `wazuh-docker` repository. * **Web Browser**: - * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh Dashboard. + * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh dashboard. * **`vm.max_map_count` (Linux Hosts for Wazuh Indexer/OpenSearch)**: * The Wazuh Indexer (OpenSearch) requires a higher `vm.max_map_count` setting than the default on most Linux systems. * Set it permanently: @@ -57,7 +57,7 @@ These are general recommendations. Actual needs may vary based on the number of * **Git Client**: * Required for cloning the `wazuh-docker` repository. * **Web Browser**: - * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh Dashboard. + * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh dashboard. #### macOS: @@ -73,7 +73,7 @@ These are general recommendations. Actual needs may vary based on the number of * **Git Client**: * Required for cloning the `wazuh-docker` repository. * **Web Browser**: - * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh Dashboard. + * A modern web browser (e.g., Chrome, Firefox, Edge, Safari) for accessing the Wazuh dashboard. ## Network Ports From 813682cfaff738dce632f209b0bc268033aa443d Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 13 Jan 2026 00:16:57 +0700 Subject: [PATCH 141/142] Modify run_as parameter value --- .../wazuh-dashboard/config/wazuh_dashboard_config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh index 5e8b9067..24480499 100644 --- a/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh +++ b/build-docker-images/wazuh-dashboard/config/wazuh_dashboard_config.sh @@ -25,7 +25,7 @@ WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}" API_PORT="${API_PORT:-55000}" API_USERNAME="${API_USERNAME:-wazuh-wui}" API_PASSWORD="${API_PASSWORD:-wazuh-wui}" -RUN_AS="${RUN_AS:-false}" +RUN_AS="${RUN_AS:-true}" # Optional Wazuh app configurations PATTERN="${PATTERN:-}" From 5b9c04a7b2b49e0a6b6886ef2b4d749b259f62ea Mon Sep 17 00:00:00 2001 From: Victor Carlos Erenu Date: Tue, 13 Jan 2026 00:23:09 +0700 Subject: [PATCH 142/142] Add changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index be7f77f6..cf6cab1d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Modify run_as parameter value - main ([#2158](https://github.com/wazuh/wazuh-docker/pull/2158)) - Change macOS and Windows deployment documentation ([#2150](https://github.com/wazuh/wazuh-docker/issues/2150)) - Modify docker build image process ([#2131](https://github.com/wazuh/wazuh-docker/issues/2131)) - Update documentation for Wazuh Docker image builder and workflow usage ([#2136](https://github.com/wazuh/wazuh-docker/issues/2136))