forked from wazuh/wazuh-docker
Resolving conflicts
This commit is contained in:
Victor Carlos Erenu
@@ -1,40 +0,0 @@
|
||||
# Wazuh Docker Image Builder
|
||||
|
||||
The creation of the images for the Wazuh stack deployment in Docker is done with the `build-docker-images/build-images.sh` script
|
||||
|
||||
This script initializes the environment variables needed to build each of the images.
|
||||
|
||||
To execute it, make sure to be in the `build-docker-images` directory:
|
||||
|
||||
```bash
|
||||
cd build-docker-images
|
||||
```
|
||||
|
||||
Then execute:
|
||||
|
||||
```bash
|
||||
./build-images.sh
|
||||
```
|
||||
|
||||
The script also allows to build images from other versions of Wazuh by using the `-v` or `--version` argument:
|
||||
|
||||
```bash
|
||||
./build-images.sh -v 4.14.3
|
||||
```
|
||||
|
||||
To get all the available script options use the -h or --help option:
|
||||
|
||||
```bash
|
||||
./build-images.sh -h
|
||||
|
||||
Usage: ./build-images.sh [OPTIONS]
|
||||
|
||||
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
|
||||
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.5.
|
||||
-r, --revision <rev> [Optional] Package revision. By default 1
|
||||
-rg, --registry <reg> [Optional] Set the Docker registry to push the images.
|
||||
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.3.
|
||||
-m, --multiarch [Optional] Enable multi-architecture builds.
|
||||
-h, --help Show this help.
|
||||
|
||||
```
|
||||
@@ -8,14 +8,18 @@
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
|
||||
IMAGE_TAG=4.14.3
|
||||
WAZUH_IMAGE_VERSION=5.0.0
|
||||
IMAGE_TAG=5.0.0
|
||||
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
|
||||
WAZUH_TAG_REVISION=1
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
|
||||
WAZUH_REGISTRY=docker.io
|
||||
|
||||
WAZUH_IMAGE_VERSION="4.14.3"
|
||||
WAZUH_IMAGE_VERSION="5.0.0"
|
||||
WAZUH_TAG_REVISION="1"
|
||||
WAZUH_DEV_STAGE=""
|
||||
FILEBEAT_MODULE_VERSION="0.5"
|
||||
WAZUH_TAG_REFERENCE=""
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
@@ -37,52 +41,43 @@ ctrl_c() {
|
||||
build() {
|
||||
|
||||
WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')"
|
||||
FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}"
|
||||
WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz"
|
||||
WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
|
||||
WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}"
|
||||
|
||||
if [ "${WAZUH_DEV_STAGE}" ];then
|
||||
FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}"
|
||||
if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
|
||||
echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
|
||||
clean 1
|
||||
fi
|
||||
# Variables
|
||||
ARTIFACT_URLS_FILE="artifact_urls.yml"
|
||||
|
||||
if [[ -f "$ARTIFACT_URLS_FILE" ]]; then
|
||||
echo "$ARTIFACT_URLS_FILE exists. Using existing file."
|
||||
else
|
||||
if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then
|
||||
FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}"
|
||||
elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
|
||||
FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}"
|
||||
TAG="v${WAZUH_VERSION}"
|
||||
REPO="wazuh/wazuh-docker"
|
||||
GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
|
||||
|
||||
if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
|
||||
curl -fsSL -o "$ARTIFACT_URLS_FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/${ARTIFACT_URLS_FILE}"
|
||||
else
|
||||
echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
|
||||
clean 1
|
||||
curl -fsSL -o "$ARTIFACT_URLS_FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/${ARTIFACT_URLS_FILE}"
|
||||
fi
|
||||
fi
|
||||
|
||||
awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt
|
||||
|
||||
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
|
||||
echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
|
||||
echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
|
||||
echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> ../.env
|
||||
echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> ../.env
|
||||
echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env
|
||||
echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
|
||||
echo IMAGE_TAG=$IMAGE_TAG >> ../.env
|
||||
|
||||
set -a
|
||||
source ../.env
|
||||
source ./artifacts_env.txt
|
||||
set +a
|
||||
|
||||
if [ "${MULTIARCH}" ];then
|
||||
docker buildx bake \
|
||||
--file build-images.yml \
|
||||
--push \
|
||||
--set *.platform=linux/amd64,linux/arm64 \
|
||||
--no-cache || clean 1
|
||||
docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1
|
||||
else
|
||||
docker buildx bake \
|
||||
--file build-images.yml \
|
||||
--load \
|
||||
--no-cache || clean 1
|
||||
docker buildx bake --file build-images.yml --no-cache|| clean 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
@@ -93,9 +88,9 @@ help() {
|
||||
echo
|
||||
echo "Usage: $0 [OPTIONS]"
|
||||
echo
|
||||
echo " -d, --dev <ref> [Optional] Set the development stage you want to build, example rc4 or beta1, not used by default."
|
||||
echo " -f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}."
|
||||
echo " -d, --dev <ref> [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
|
||||
echo " -r, --revision <rev> [Optional] Package revision. By default ${WAZUH_TAG_REVISION}"
|
||||
echo " -ref, --reference <ref> [Optional] Set the Wazuh reference to build development images. By default, the latest stable release."
|
||||
echo " -rg, --registry <reg> [Optional] Set the Docker registry to push the images."
|
||||
echo " -v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}."
|
||||
echo " -m, --multiarch [Optional] Enable multi-architecture builds."
|
||||
@@ -121,14 +116,6 @@ main() {
|
||||
help 1
|
||||
fi
|
||||
;;
|
||||
"-f"|"--filebeat-module")
|
||||
if [ -n "${2}" ]; then
|
||||
FILEBEAT_MODULE_VERSION="${2}"
|
||||
shift 2
|
||||
else
|
||||
help 1
|
||||
fi
|
||||
;;
|
||||
"-m"|"--multiarch")
|
||||
MULTIARCH="true"
|
||||
shift
|
||||
@@ -141,6 +128,14 @@ main() {
|
||||
help 1
|
||||
fi
|
||||
;;
|
||||
"-ref"|"--reference")
|
||||
if [ -n "${2}" ]; then
|
||||
WAZUH_TAG_REFERENCE="${2}"
|
||||
shift 2
|
||||
else
|
||||
help 1
|
||||
fi
|
||||
;;
|
||||
"-rg"|"--registry")
|
||||
if [ -n "${2}" ]; then
|
||||
WAZUH_REGISTRY="${2}"
|
||||
|
||||
@@ -6,8 +6,10 @@ services:
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
|
||||
WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
|
||||
wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm}
|
||||
wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
@@ -20,19 +22,14 @@ services:
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=none
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||
- wazuh_etc:/var/ossec/etc
|
||||
- wazuh_logs:/var/ossec/logs
|
||||
- wazuh_queue:/var/ossec/queue
|
||||
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||
- wazuh_integrations:/var/ossec/integrations
|
||||
- wazuh_active_response:/var/ossec/active-response/bin
|
||||
- wazuh_agentless:/var/ossec/agentless
|
||||
- wazuh_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
|
||||
wazuh.agent:
|
||||
build:
|
||||
@@ -40,6 +37,8 @@ services:
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm}
|
||||
wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
|
||||
hostname: wazuh.agent
|
||||
restart: always
|
||||
@@ -50,6 +49,10 @@ services:
|
||||
args:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm}
|
||||
wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
@@ -72,6 +75,10 @@ services:
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
|
||||
wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm}
|
||||
wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm}
|
||||
wazuh_certs_tool: ${wazuh_certs_tool}
|
||||
wazuh_config_yml: ${wazuh_config_yml}
|
||||
image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
@@ -94,9 +101,6 @@ volumes:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_integrations:
|
||||
wazuh_active_response:
|
||||
wazuh_agentless:
|
||||
wazuh_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
|
||||
|
||||
@@ -13,17 +13,16 @@ ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
|
||||
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
|
||||
ARG WAZUH_AGENT_GROUPS='CHANGE_AGENT_GROUPS'
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_agent_url_amd64_rpm
|
||||
ARG wazuh_agent_url_arm64_rpm
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
|
||||
RUN yum install curl-minimal tar gzip procps -y &&\
|
||||
yum clean all
|
||||
|
||||
RUN chmod 775 /check_repository.sh
|
||||
RUN source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all && \
|
||||
RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \
|
||||
agent_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal tar gzip procps -y &&\
|
||||
curl -o /wazuh-agent.rpm "${agent_url}" && \
|
||||
dnf install /wazuh-agent.rpm -y && \
|
||||
rm -rf /wazuh-agent.rpm && \
|
||||
dnf clean all && \
|
||||
sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
|
||||
S6_ARCH="amd64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
|
||||
@@ -32,9 +31,6 @@ RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C / --exclude="./bin" && \
|
||||
tar xzf /tmp/s6-overlay-${S6_ARCH}.tar.gz -C /usr ./bin && \
|
||||
rm /tmp/s6-overlay-${S6_ARCH}.tar.gz
|
||||
|
||||
COPY config/etc/ /etc/
|
||||
|
||||
RUN rm /etc/yum.repos.d/wazuh.repo
|
||||
|
||||
ENTRYPOINT [ "/init" ]
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
||||
fi
|
||||
|
||||
rpm --import "${APT_KEY}"
|
||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
|
||||
@@ -5,36 +5,33 @@ ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG WAZUH_UI_REVISION
|
||||
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_dashboard_url_amd64_rpm
|
||||
ARG wazuh_dashboard_url_arm64_rpm
|
||||
ARG wazuh_config_yml
|
||||
|
||||
# Update and install dependencies
|
||||
RUN yum install curl-minimal libcap openssl -y
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
RUN chmod 775 /check_repository.sh && \
|
||||
source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all
|
||||
RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
|
||||
dashboard_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal libcap openssl -y && \
|
||||
curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
|
||||
dnf install /wazuh-dashboard.rpm -y && \
|
||||
rm -rf /wazuh-dashboard.rpm && \
|
||||
dnf clean all
|
||||
|
||||
# Create and set permissions to data directories
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
|
||||
COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
|
||||
|
||||
# Generate certificates
|
||||
COPY config/config.sh .
|
||||
COPY config/config.yml /
|
||||
RUN bash config.sh
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the current Wazuh dashboard image):
|
||||
#
|
||||
# Copy wazuh-dashboard from stage 0
|
||||
# Add entrypoint
|
||||
# Add wazuh_app_config
|
||||
# Add wazuh_dashboard_config
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
@@ -42,10 +39,8 @@ FROM amazonlinux:2023
|
||||
ENV USER="wazuh-dashboard" \
|
||||
GROUP="wazuh-dashboard" \
|
||||
NAME="wazuh-dashboard" \
|
||||
INSTALL_DIR="/usr/share/wazuh-dashboard"
|
||||
|
||||
# Set Wazuh app variables
|
||||
ENV PATTERN="" \
|
||||
INSTALL_DIR="/usr/share/wazuh-dashboard" \
|
||||
PATTERN="" \
|
||||
CHECKS_PATTERN="" \
|
||||
CHECKS_TEMPLATE="" \
|
||||
CHECKS_API="" \
|
||||
@@ -59,33 +54,32 @@ ENV PATTERN="" \
|
||||
WAZUH_MONITORING_SHARDS="" \
|
||||
WAZUH_MONITORING_REPLICAS=""
|
||||
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y
|
||||
# Copy and set permissions to scripts
|
||||
COPY config/entrypoint.sh /
|
||||
COPY config/wazuh_dashboard_config.sh /
|
||||
|
||||
# Create wazuh-dashboard user and group
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
RUN useradd --system \
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
|
||||
useradd --system \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER
|
||||
|
||||
# Copy and set permissions to scripts
|
||||
COPY config/entrypoint.sh /
|
||||
COPY config/wazuh_app_config.sh /
|
||||
RUN chmod 700 /entrypoint.sh
|
||||
RUN chmod 700 /wazuh_app_config.sh
|
||||
RUN chown 1000:1000 /*.sh
|
||||
$USER && \
|
||||
chmod 700 /entrypoint.sh && \
|
||||
chmod 700 /wazuh_dashboard_config.sh && \
|
||||
mkdir -p $INSTALL_DIR && \
|
||||
chown 1000:1000 $INSTALL_DIR && \
|
||||
chown 1000:1000 /*.sh && \
|
||||
mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
|
||||
# Copy Install dir from builder to current image
|
||||
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
|
||||
|
||||
# Create custom directory
|
||||
RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
|
||||
|
||||
# Set workdir and user
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
||||
fi
|
||||
|
||||
rpm --import "${APT_KEY}"
|
||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
|
||||
@@ -1,42 +0,0 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
# This has to be exported to make some magic below work.
|
||||
export DH_OPTIONS
|
||||
|
||||
export NAME=wazuh-dashboard
|
||||
export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
## If cert tool exists in some bucket, download it, if not exit 1
|
||||
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages bucket"
|
||||
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages-dev bucket"
|
||||
else
|
||||
echo "Cert tool does not exist in any bucket"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A
|
||||
|
||||
# Create certs directory
|
||||
mkdir -p ${CONFIG_DIR}/certs
|
||||
|
||||
# Copy Wazuh dashboard certs to install config dir
|
||||
cp /wazuh-certificates/demo.dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
|
||||
cp /wazuh-certificates/demo.dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
|
||||
cp /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
|
||||
|
||||
chmod -R 500 ${CONFIG_DIR}/certs
|
||||
chmod -R 400 ${CONFIG_DIR}/certs/*
|
||||
@@ -1,5 +0,0 @@
|
||||
nodes:
|
||||
# Wazuh dashboard server nodes
|
||||
dashboard:
|
||||
- name: demo.dashboard
|
||||
ip: demo.dashboard
|
||||
@@ -1,20 +1,87 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
# Run Wazuh dashboard, using environment variables to
|
||||
# set longopts defining Wazuh dashboard's configuration.
|
||||
#
|
||||
# eg. Setting the environment variable:
|
||||
#
|
||||
# OPENSEARCH_STARTUPTIMEOUT=60
|
||||
#
|
||||
# will cause OpenSearch-Dashboards to be invoked with:
|
||||
#
|
||||
# --opensearch.startupTimeout=60
|
||||
|
||||
# Setup Home Directory
|
||||
export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard
|
||||
export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH
|
||||
DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
|
||||
DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
|
||||
|
||||
# Create and configure Wazuh dashboard keystore
|
||||
|
||||
yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
|
||||
##############################################################################
|
||||
# Start Wazuh dashboard
|
||||
##############################################################################
|
||||
/wazuh_dashboard_config.sh
|
||||
|
||||
/wazuh_app_config.sh $WAZUH_UI_REVISION
|
||||
opensearch_dashboards_vars=(
|
||||
opensearch.hosts
|
||||
server.port
|
||||
server.host
|
||||
opensearch.username
|
||||
opensearch.password
|
||||
)
|
||||
|
||||
/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
function runOpensearchDashboards {
|
||||
longopts=()
|
||||
for opensearch_dashboards_var in ${opensearch_dashboards_vars[*]}; do
|
||||
# 'opensearch.hosts' -> 'OPENSEARCH_URL'
|
||||
env_var=$(echo ${opensearch_dashboards_var^^} | tr . _)
|
||||
|
||||
# Indirectly lookup env var values via the name of the var.
|
||||
# REF: http://tldp.org/LDP/abs/html/bashver2.html#EX78
|
||||
value=${!env_var}
|
||||
if [[ -n $value ]]; then
|
||||
longopt="--${opensearch_dashboards_var}=${value}"
|
||||
longopts+=("${longopt}")
|
||||
fi
|
||||
done
|
||||
|
||||
# Files created at run-time should be group-writable, for Openshift's sake.
|
||||
umask 0002
|
||||
|
||||
# TO DO:
|
||||
# Confirm with Mihir if this is necessary
|
||||
|
||||
# The virtual file /proc/self/cgroup should list the current cgroup
|
||||
# membership. For each hierarchy, you can follow the cgroup path from
|
||||
# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and
|
||||
# introspect the statistics for the cgroup for the given
|
||||
# hierarchy. Alas, Docker breaks this by mounting the container
|
||||
# statistics at the root while leaving the cgroup paths as the actual
|
||||
# paths. Therefore, OpenSearch-Dashboards provides a mechanism to override
|
||||
# reading the cgroup path from /proc/self/cgroup and instead uses the
|
||||
# cgroup path defined the configuration properties
|
||||
# cpu.cgroup.path.override and cpuacct.cgroup.path.override.
|
||||
# Therefore, we set this value here so that cgroup statistics are
|
||||
# available for the container this process will run in.
|
||||
|
||||
exec "$@" \
|
||||
--ops.cGroupOverrides.cpuPath=/ \
|
||||
--ops.cGroupOverrides.cpuAcctPath=/ \
|
||||
"${longopts[@]}"
|
||||
}
|
||||
|
||||
# Prepend "opensearch-dashboards" command if no argument was provided or if the
|
||||
# first argument looks like a flag (i.e. starts with a dash).
|
||||
if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then
|
||||
set -- opensearch-dashboards "$@"
|
||||
fi
|
||||
|
||||
if [ "$1" = "opensearch-dashboards" ]; then
|
||||
runOpensearchDashboards "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
@@ -1,155 +0,0 @@
|
||||
---
|
||||
#
|
||||
# Wazuh app - App configuration file
|
||||
# Copyright (C) 2017, Wazuh Inc.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Find more information about this on the LICENSE file.
|
||||
#
|
||||
# ======================== Wazuh app configuration file ========================
|
||||
#
|
||||
# Please check the documentation for more information on configuration options:
|
||||
# https://documentation.wazuh.com/current/installation-guide/index.html
|
||||
#
|
||||
# Also, you can check our repository:
|
||||
# https://github.com/wazuh/wazuh-dashboard-plugins
|
||||
#
|
||||
# ------------------------------- Index patterns -------------------------------
|
||||
#
|
||||
# Default index pattern to use.
|
||||
#pattern: wazuh-alerts-*
|
||||
#
|
||||
# ----------------------------------- Checks -----------------------------------
|
||||
#
|
||||
# Defines which checks must to be consider by the healthcheck
|
||||
# step once the Wazuh app starts. Values must to be true or false.
|
||||
#checks.pattern : true
|
||||
#checks.template: true
|
||||
#checks.api : true
|
||||
#checks.setup : true
|
||||
#checks.metaFields: true
|
||||
#
|
||||
# --------------------------------- Extensions ---------------------------------
|
||||
#
|
||||
# Defines which extensions should be activated when you add a new API entry.
|
||||
# You can change them after Wazuh app starts.
|
||||
# Values must to be true or false.
|
||||
#extensions.pci : true
|
||||
#extensions.gdpr : true
|
||||
#extensions.hipaa : true
|
||||
#extensions.nist : true
|
||||
#extensions.tsc : true
|
||||
#extensions.audit : true
|
||||
#extensions.oscap : false
|
||||
#extensions.ciscat : false
|
||||
#extensions.aws : false
|
||||
#extensions.gcp : false
|
||||
#extensions.virustotal: false
|
||||
#extensions.osquery : false
|
||||
#extensions.docker : false
|
||||
#
|
||||
# ---------------------------------- Time out ----------------------------------
|
||||
#
|
||||
# Defines maximum timeout to be used on the Wazuh app requests.
|
||||
# It will be ignored if it is bellow 1500.
|
||||
# It means milliseconds before we consider a request as failed.
|
||||
# Default: 20000
|
||||
#timeout: 20000
|
||||
#
|
||||
# -------------------------------- API selector --------------------------------
|
||||
#
|
||||
# Defines if the user is allowed to change the selected
|
||||
# API directly from the Wazuh app top menu.
|
||||
# Default: true
|
||||
#api.selector: true
|
||||
#
|
||||
# --------------------------- Index pattern selector ---------------------------
|
||||
#
|
||||
# Defines if the user is allowed to change the selected
|
||||
# index pattern directly from the Wazuh app top menu.
|
||||
# Default: true
|
||||
#ip.selector: true
|
||||
#
|
||||
# List of index patterns to be ignored
|
||||
#ip.ignore: []
|
||||
#
|
||||
# ------------------------------ wazuh-monitoring ------------------------------
|
||||
#
|
||||
# Custom setting to enable/disable wazuh-monitoring indices.
|
||||
# Values: true, false, worker
|
||||
# If worker is given as value, the app will show the Agents status
|
||||
# visualization but won't insert data on wazuh-monitoring indices.
|
||||
# Default: true
|
||||
#wazuh.monitoring.enabled: true
|
||||
#
|
||||
# Custom setting to set the frequency for wazuh-monitoring indices cron task.
|
||||
# Default: 900 (s)
|
||||
#wazuh.monitoring.frequency: 900
|
||||
#
|
||||
# Configure wazuh-monitoring-* indices shards and replicas.
|
||||
#wazuh.monitoring.shards: 2
|
||||
#wazuh.monitoring.replicas: 0
|
||||
#
|
||||
# Configure wazuh-monitoring-* indices custom creation interval.
|
||||
# Values: h (hourly), d (daily), w (weekly), m (monthly)
|
||||
# Default: d
|
||||
#wazuh.monitoring.creation: d
|
||||
#
|
||||
# Default index pattern to use for Wazuh monitoring
|
||||
#wazuh.monitoring.pattern: wazuh-monitoring-*
|
||||
#
|
||||
# --------------------------------- wazuh-cron ----------------------------------
|
||||
#
|
||||
# Customize the index prefix of predefined jobs
|
||||
# This change is not retroactive, if you change it new indexes will be created
|
||||
# cron.prefix: test
|
||||
#
|
||||
# ------------------------------ wazuh-statistics -------------------------------
|
||||
#
|
||||
# Custom setting to enable/disable statistics tasks.
|
||||
#cron.statistics.status: true
|
||||
#
|
||||
# Enter the ID of the APIs you want to save data from, leave this empty to run
|
||||
# the task on all configured APIs
|
||||
#cron.statistics.apis: []
|
||||
#
|
||||
# Define the frequency of task execution using cron schedule expressions
|
||||
#cron.statistics.interval: 0 0 * * * *
|
||||
#
|
||||
# Define the name of the index in which the documents are to be saved.
|
||||
#cron.statistics.index.name: statistics
|
||||
#
|
||||
# Define the interval in which the index will be created
|
||||
#cron.statistics.index.creation: w
|
||||
#
|
||||
# ------------------------------- App privileges --------------------------------
|
||||
#admin: true
|
||||
#
|
||||
# ---------------------------- Hide manager alerts ------------------------------
|
||||
# Hide the alerts of the manager in all dashboards and discover
|
||||
#hideManagerAlerts: false
|
||||
#
|
||||
# ------------------------------- App logging level -----------------------------
|
||||
# Set the logging level for the Wazuh App log files.
|
||||
# Default value: info
|
||||
# Allowed values: info, debug
|
||||
#logs.level: info
|
||||
#
|
||||
# -------------------------------- Enrollment DNS -------------------------------
|
||||
# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
|
||||
# Default value: ''
|
||||
#enrollment.dns: ''
|
||||
#
|
||||
#-------------------------------- API entries -----------------------------------
|
||||
#The following configuration is the default structure to define an API entry.
|
||||
#
|
||||
#hosts:
|
||||
# - <id>:
|
||||
# url: http(s)://<url>
|
||||
# port: <port>
|
||||
# username: <username>
|
||||
# password: <password>
|
||||
@@ -0,0 +1,110 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Environment variables with defaults
|
||||
SERVER_HOST="${SERVER_HOST:-0.0.0.0}"
|
||||
SERVER_PORT="${SERVER_PORT:-443}"
|
||||
OPENSEARCH_HOSTS="${OPENSEARCH_HOSTS:-https://wazuh.indexer:9200}"
|
||||
OPENSEARCH_SSL_VERIFICATION_MODE="${OPENSEARCH_SSL_VERIFICATION_MODE:-certificate}"
|
||||
OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-}"
|
||||
OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}"
|
||||
OPENSEARCH_REQUEST_HEADERS_ALLOWLIST="${OPENSEARCH_REQUEST_HEADERS_ALLOWLIST:-[\"securitytenant\",\"Authorization\"]}"
|
||||
OPENSEARCH_SECURITY_MULTITENANCY_ENABLED="${OPENSEARCH_SECURITY_MULTITENANCY_ENABLED:-false}"
|
||||
OPENSEARCH_SECURITY_READONLY_MODE_ROLES="${OPENSEARCH_SECURITY_READONLY_MODE_ROLES:-[\"kibana_read_only\"]}"
|
||||
SERVER_SSL_ENABLED="${SERVER_SSL_ENABLED:-true}"
|
||||
SERVER_SSL_KEY="${SERVER_SSL_KEY:-/etc/wazuh-dashboard/certs/dashboard-key.pem}"
|
||||
SERVER_SSL_CERTIFICATE="${SERVER_SSL_CERTIFICATE:-/etc/wazuh-dashboard/certs/dashboard.pem}"
|
||||
OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES="${OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES:-[/etc/wazuh-dashboard/certs/root-ca.pem]}"
|
||||
UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE="${UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE:-/app/wz-home}"
|
||||
OPENSEARCH_SECURITY_COOKIE_TTL="${OPENSEARCH_SECURITY_COOKIE_TTL:-900000}"
|
||||
OPENSEARCH_SECURITY_SESSION_TTL="${OPENSEARCH_SECURITY_SESSION_TTL:-900000}"
|
||||
OPENSEARCH_SECURITY_SESSION_KEEPALIVE="${OPENSEARCH_SECURITY_SESSION_KEEPALIVE:-true}"
|
||||
|
||||
# Wazuh API configuration
|
||||
WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}"
|
||||
API_PORT="${API_PORT:-55000}"
|
||||
API_USERNAME="${API_USERNAME:-wazuh-wui}"
|
||||
API_PASSWORD="${API_PASSWORD:-wazuh-wui}"
|
||||
RUN_AS="${RUN_AS:-true}"
|
||||
|
||||
# Optional Wazuh app configurations
|
||||
PATTERN="${PATTERN:-}"
|
||||
CHECKS_PATTERN="${CHECKS_PATTERN:-}"
|
||||
CHECKS_TEMPLATE="${CHECKS_TEMPLATE:-}"
|
||||
CHECKS_API="${CHECKS_API:-}"
|
||||
CHECKS_SETUP="${CHECKS_SETUP:-}"
|
||||
APP_TIMEOUT="${APP_TIMEOUT:-}"
|
||||
API_SELECTOR="${API_SELECTOR:-}"
|
||||
IP_SELECTOR="${IP_SELECTOR:-}"
|
||||
IP_IGNORE="${IP_IGNORE:-}"
|
||||
WAZUH_MONITORING_ENABLED="${WAZUH_MONITORING_ENABLED:-}"
|
||||
WAZUH_MONITORING_FREQUENCY="${WAZUH_MONITORING_FREQUENCY:-}"
|
||||
WAZUH_MONITORING_SHARDS="${WAZUH_MONITORING_SHARDS:-}"
|
||||
WAZUH_MONITORING_REPLICAS="${WAZUH_MONITORING_REPLICAS:-}"
|
||||
|
||||
# Configuration file path
|
||||
DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml}"
|
||||
|
||||
# Map of configuration keys to their values
|
||||
declare -A CONFIG_MAP=(
|
||||
[server.host]="$SERVER_HOST"
|
||||
[server.port]="$SERVER_PORT"
|
||||
[opensearch.hosts]="$OPENSEARCH_HOSTS"
|
||||
[opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
|
||||
[opensearch.username]="$OPENSEARCH_USERNAME"
|
||||
[opensearch.password]="$OPENSEARCH_PASSWORD"
|
||||
[opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
|
||||
[opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
|
||||
[opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
|
||||
[server.ssl.enabled]="$SERVER_SSL_ENABLED"
|
||||
[server.ssl.key]="\"$SERVER_SSL_KEY\""
|
||||
[server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
|
||||
[opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
|
||||
[uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
|
||||
[opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
|
||||
[opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
|
||||
[opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
|
||||
[pattern]="$PATTERN"
|
||||
[checks.pattern]="$CHECKS_PATTERN"
|
||||
[checks.template]="$CHECKS_TEMPLATE"
|
||||
[checks.api]="$CHECKS_API"
|
||||
[checks.setup]="$CHECKS_SETUP"
|
||||
[timeout]="$APP_TIMEOUT"
|
||||
[api.selector]="$API_SELECTOR"
|
||||
[ip.selector]="$IP_SELECTOR"
|
||||
[ip.ignore]="$IP_IGNORE"
|
||||
[wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
|
||||
[wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
|
||||
[wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
|
||||
[wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
|
||||
)
|
||||
|
||||
# Replace configuration values in the dashboard config file
|
||||
for key in "${!CONFIG_MAP[@]}"; do
|
||||
value="${CONFIG_MAP[$key]}"
|
||||
|
||||
# Skip empty values for optional configurations
|
||||
if [ -z "$value" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
# Escape special characters for sed
|
||||
escaped_key=$(echo "$key" | sed 's/[.[\*^$()+?{|]/\\&/g')
|
||||
|
||||
# Try to replace existing line (commented or uncommented)
|
||||
if grep -q "^[#[:space:]]*${escaped_key}:" "$DASHBOARD_CONFIG_FILE"; then
|
||||
sed -i "s|^[#[:space:]]*${escaped_key}:.*|${key}: ${value}|" "$DASHBOARD_CONFIG_FILE"
|
||||
fi
|
||||
done
|
||||
|
||||
# Handle wazuh_core.hosts section separately
|
||||
if grep -q "^wazuh_core.hosts:" "$DASHBOARD_CONFIG_FILE"; then
|
||||
# Update existing wazuh_core.hosts section
|
||||
sed -i "/^wazuh_core.hosts:/,/^[^ ]/ {
|
||||
s|url:.*|url: $WAZUH_API_URL|
|
||||
s|port:.*|port: $API_PORT|
|
||||
s|username:.*|username: $API_USERNAME|
|
||||
s|password:.*|password: $API_PASSWORD|
|
||||
s|run_as:.*|run_as: $RUN_AS|
|
||||
}" "$DASHBOARD_CONFIG_FILE"
|
||||
fi
|
||||
@@ -3,38 +3,28 @@ FROM amazonlinux:2023 AS builder
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
|
||||
RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
RUN chmod 775 /check_repository.sh && \
|
||||
source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all
|
||||
|
||||
COPY config/opensearch.yml /
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_indexer_url_amd64_rpm
|
||||
ARG wazuh_indexer_url_arm64_rpm
|
||||
ARG wazuh_certs_tool
|
||||
ARG wazuh_config_yml
|
||||
|
||||
COPY config/config.sh .
|
||||
|
||||
COPY config/config.yml /
|
||||
|
||||
COPY config/action_groups.yml /
|
||||
|
||||
COPY config/internal_users.yml /
|
||||
|
||||
COPY config/roles_mapping.yml /
|
||||
|
||||
COPY config/roles.yml /
|
||||
|
||||
RUN bash config.sh
|
||||
RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
|
||||
indexer_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
|
||||
curl -o /wazuh-indexer.rpm "${indexer_url}" && \
|
||||
dnf install /wazuh-indexer.rpm -y && \
|
||||
rm -rf /wazuh-indexer.rpm && \
|
||||
dnf clean all && \
|
||||
bash config.sh
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual Wazuh indexer image):
|
||||
#
|
||||
# Copy wazuh-indexer from stage 0
|
||||
# Add entrypoint
|
||||
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
@@ -43,51 +33,43 @@ ENV USER="wazuh-indexer" \
|
||||
NAME="wazuh-indexer" \
|
||||
INSTALL_DIR="/usr/share/wazuh-indexer"
|
||||
|
||||
RUN yum install curl-minimal shadow-utils findutils hostname -y
|
||||
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
COPY config/entrypoint.sh /
|
||||
COPY config/securityadmin.sh /
|
||||
|
||||
RUN useradd --system \
|
||||
RUN yum install curl-minimal shadow-utils findutils hostname -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
|
||||
useradd --system \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER
|
||||
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
COPY config/entrypoint.sh /
|
||||
|
||||
COPY config/securityadmin.sh /
|
||||
|
||||
RUN chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
|
||||
mkdir -p /usr/share/wazuh-indexer && \
|
||||
chown 1000:1000 /usr/share/wazuh-indexer && \
|
||||
chown 1000:1000 /*.sh
|
||||
|
||||
COPY --from=builder --chown=1000:1000 /usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-indexer /usr/share/wazuh-indexer/config
|
||||
COPY --from=builder --chown=1000:1000 /debian/wazuh-indexer/usr/share/wazuh-indexer /usr/share/wazuh-indexer
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/systemd
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
|
||||
|
||||
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
|
||||
$USER && \
|
||||
chmod 700 /entrypoint.sh && chmod 700 /securityadmin.sh && \
|
||||
mkdir -p $INSTALL_DIR && \
|
||||
chown 1000:1000 $INSTALL_DIR && \
|
||||
chown 1000:1000 /*.sh && \
|
||||
mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p $INSTALL_DIR/logs && chown 1000:1000 $INSTALL_DIR/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
|
||||
chmod 700 /usr/share/wazuh-indexer && \
|
||||
chmod 700 /usr/share/wazuh-indexer/config && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer
|
||||
|
||||
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
|
||||
|
||||
RUN chmod 700 $INSTALL_DIR && \
|
||||
chmod 700 $INSTALL_DIR/config && \
|
||||
chmod 600 $INSTALL_DIR/config/jvm.options && \
|
||||
chmod 600 $INSTALL_DIR/config/opensearch.yml
|
||||
|
||||
USER wazuh-indexer
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
# Services ports
|
||||
EXPOSE 9200
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
# Dummy overridable parameter parsed by entrypoint
|
||||
CMD ["opensearchwrapper"]
|
||||
CMD ["opensearch"]
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
_meta:
|
||||
type: "actiongroups"
|
||||
config_version: 2
|
||||
|
||||
# ISM API permissions group
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
allowed_actions:
|
||||
- "cluster:admin/opendistro/ism/*"
|
||||
static: false
|
||||
@@ -1,15 +0,0 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
||||
fi
|
||||
|
||||
rpm --import "${APT_KEY}"
|
||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
|
||||
@@ -3,99 +3,21 @@
|
||||
export DH_OPTIONS
|
||||
|
||||
export NAME=wazuh-indexer
|
||||
export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
|
||||
# Package build options
|
||||
export USER=${NAME}
|
||||
export GROUP=${NAME}
|
||||
export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
|
||||
export LOG_DIR=/var/log/${NAME}
|
||||
export LIB_DIR=/var/lib/${NAME}
|
||||
export PID_DIR=/run/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
export BASE_DIR=${NAME}-*
|
||||
export INDEXER_FILE=wazuh-indexer-base.tar.xz
|
||||
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
|
||||
export REPO_DIR=/unattended_installer
|
||||
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
## If cert tool exists in some bucket, download it, if not exit 1
|
||||
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages bucket"
|
||||
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages-dev bucket"
|
||||
else
|
||||
echo "Cert tool does not exist in any bucket"
|
||||
exit 1
|
||||
# Modify opensearch.yml config paths
|
||||
if [ -d "/etc/wazuh-indexer" ]; then
|
||||
mkdir -p ${CONFIG_DIR}
|
||||
mkdir -p ${CONFIG_DIR}/certs
|
||||
mv /etc/wazuh-indexer/* ${CONFIG_DIR}/
|
||||
rmdir /etc/wazuh-indexer
|
||||
fi
|
||||
sed -i "s|/etc/wazuh-indexer|${CONFIG_DIR}|g" ${CONFIG_DIR}/opensearch.yml
|
||||
|
||||
sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' ${CONFIG_DIR}/jvm.options
|
||||
|
||||
## Check if the password tool exists in S3 buckets
|
||||
PASSWORD_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
PASSWORD_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$PASSWORD_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
## If password tool exists in some bucket, download it, if not exit 1
|
||||
if [ "$PASSWORD_TOOL_PACKAGES" = "200" ]; then
|
||||
curl -o $PASSWORD_TOOL $PACKAGES_URL$PASSWORD_TOOL
|
||||
echo "Password tool exists in Packages bucket"
|
||||
elif [ "$PASSWORD_TOOL_PACKAGES_DEV" = "200" ]; then
|
||||
curl -o $PASSWORD_TOOL $PACKAGES_DEV_URL$PASSWORD_TOOL
|
||||
echo "Password tool exists in Packages-dev bucket"
|
||||
else
|
||||
echo "Password tool does not exist in any bucket"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A
|
||||
|
||||
# copy to target
|
||||
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
mkdir -p ${TARGET_DIR}${CONFIG_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LIB_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LOG_DIR}
|
||||
mkdir -p ${TARGET_DIR}/etc/init.d
|
||||
mkdir -p ${TARGET_DIR}/etc/default
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/tmpfiles.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/sysctl.d
|
||||
mkdir -p ${TARGET_DIR}/usr/lib/systemd/system
|
||||
mkdir -p ${TARGET_DIR}${CONFIG_DIR}/certs
|
||||
# Copy Wazuh's config files for the security plugin
|
||||
cp -pr /roles_mapping.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
|
||||
cp -pr /roles.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
|
||||
cp -pr /action_groups.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
|
||||
cp -pr /internal_users.yml ${TARGET_DIR}${CONFIG_DIR}/opensearch-security/
|
||||
cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
|
||||
# Copy Wazuh indexer's certificates
|
||||
cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem
|
||||
cp -pr /wazuh-certificates/demo.indexer-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer-key.pem
|
||||
cp -pr /wazuh-certificates/root-ca.key ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.key
|
||||
cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.pem
|
||||
cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem
|
||||
cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem
|
||||
|
||||
# Delete xms and xmx parameters in jvm.options
|
||||
sed '/-Xms/d' -i /etc/wazuh-indexer/jvm.options
|
||||
sed '/-Xmx/d' -i /etc/wazuh-indexer/jvm.options
|
||||
sed -i 's/-Djava.security.policy=file:\/\/\/etc\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/-Djava.security.policy=file:\/\/\/usr\/share\/wazuh-indexer\/opensearch-performance-analyzer\/opensearch_security.policy/g' /etc/wazuh-indexer/jvm.options
|
||||
|
||||
|
||||
chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs
|
||||
chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/*
|
||||
|
||||
find ${TARGET_DIR} -type d -exec chmod 750 {} \;
|
||||
find ${TARGET_DIR} -type f -perm 644 -exec chmod 640 {} \;
|
||||
find ${TARGET_DIR} -type f -perm 664 -exec chmod 660 {} \;
|
||||
find ${TARGET_DIR} -type f -perm 755 -exec chmod 750 {} \;
|
||||
find ${TARGET_DIR} -type f -perm 744 -exec chmod 740 {} \;
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: demo.indexer
|
||||
ip: demo.indexer
|
||||
@@ -1,93 +1,109 @@
|
||||
#!/usr/bin/env bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
set -e
|
||||
#!/bin/bash
|
||||
|
||||
umask 0002
|
||||
# Copyright OpenSearch Contributors
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CERT="${OPENSEARCH_PATH_CONF}/certs/admin.pem"
|
||||
export KEY="${OPENSEARCH_PATH_CONF}/certs/admin-key.pem"
|
||||
# This script specify the entrypoint startup actions for opensearch
|
||||
# It will start both opensearch and performance analyzer plugin cli
|
||||
# If either process failed, the entire docker container will be removed
|
||||
# in favor of a newly started container
|
||||
|
||||
# Export OpenSearch Home
|
||||
export OPENSEARCH_HOME=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=$OPENSEARCH_HOME/config
|
||||
export CONFIG_FILE=${OPENSEARCH_PATH_CONF}/opensearch.yml
|
||||
export PATH=$OPENSEARCH_HOME/bin:$PATH
|
||||
|
||||
|
||||
# The virtual file /proc/self/cgroup should list the current cgroup
|
||||
# membership. For each hierarchy, you can follow the cgroup path from
|
||||
# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and
|
||||
# introspect the statistics for the cgroup for the given
|
||||
# hierarchy. Alas, Docker breaks this by mounting the container
|
||||
# statistics at the root while leaving the cgroup paths as the actual
|
||||
# paths. Therefore, OpenSearch provides a mechanism to override
|
||||
# reading the cgroup path from /proc/self/cgroup and instead uses the
|
||||
# cgroup path defined the JVM system property
|
||||
# opensearch.cgroups.hierarchy.override. Therefore, we set this value here so
|
||||
# that cgroup statistics are available for the container this process
|
||||
# will run in.
|
||||
export OPENSEARCH_JAVA_OPTS="-Dopensearch.cgroups.hierarchy.override=/ $OPENSEARCH_JAVA_OPTS"
|
||||
|
||||
# Start up the opensearch and performance analyzer agent processes.
|
||||
# When either of them halts, this script exits, or we receive a SIGTERM or SIGINT signal then we want to kill both these processes.
|
||||
function runOpensearch {
|
||||
# Files created by OpenSearch should always be group writable too
|
||||
umask 0002
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
echo "Wazuh indexer cannot run as root. Please start your container as another user."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Parse Docker env vars to customize Wazuh indexer / OpenSearch configuration
|
||||
#
|
||||
# e.g. Setting the env var cluster.name=testcluster
|
||||
# will cause Wazuh indexer to be invoked with -Ecluster.name=testcluster
|
||||
opensearch_opts=()
|
||||
while IFS='=' read -r envvar_key envvar_value
|
||||
do
|
||||
# OpenSearch settings need to have at least two dot separated lowercase
|
||||
# words, e.g. `cluster.name`, except for `processors` which we handle
|
||||
# specially
|
||||
if [[ "$envvar_key" =~ ^[a-z0-9_]+\.[a-z0-9_]+ || "$envvar_key" == "processors" ]]; then
|
||||
if [[ ! -z $envvar_value ]]; then
|
||||
opensearch_opt="-E${envvar_key}=${envvar_value}"
|
||||
opensearch_opts+=("${opensearch_opt}")
|
||||
fi
|
||||
fi
|
||||
done < <(env)
|
||||
|
||||
# Start opensearch
|
||||
exec "$@" "${opensearch_opts[@]}"
|
||||
|
||||
run_as_other_user_if_needed() {
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If running as root, drop to specified UID and run command
|
||||
exec chroot --userspec=1000:0 / "${@}"
|
||||
else
|
||||
# Either we are running in Openshift with random uid and are a member of the root group
|
||||
# or with a custom --user
|
||||
exec "${@}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Allow user specify custom CMD, maybe bin/opensearch itself
|
||||
# for example to directly specify `-E` style parameters for opensearch on k8s
|
||||
# or simply to run /bin/bash to check the image
|
||||
if [[ "$1" != "opensearchwrapper" ]]; then
|
||||
if [[ "$(id -u)" == "0" && $(basename "$1") == "opensearch" ]]; then
|
||||
# Rewrite CMD args to replace $1 with `opensearch` explicitly,
|
||||
# Without this, user could specify `opensearch -E x.y=z` but
|
||||
# `bin/opensearch -E x.y=z` would not work.
|
||||
set -- "opensearch" "${@:2}"
|
||||
# Use chroot to switch to UID 1000 / GID 0
|
||||
exec chroot --userspec=1000:0 / "$@"
|
||||
else
|
||||
# User probably wants to run something else, like /bin/bash, with another uid forced (Openshift?)
|
||||
function configureOpensearch {
|
||||
# Update opensearch.yml with NODES_DN if set
|
||||
if [ -n "$NODES_DN" ]; then
|
||||
|
||||
CLEAN_NODES_DN=$(echo "$NODES_DN" | sed 's/^["'\'']//; s/["'\'']$//; s/""/"/g')
|
||||
NODES_DN_YAML=$(echo $CLEAN_NODES_DN | tr ';' '\n' | sed 's/^/- "/; s/$/"/')
|
||||
|
||||
awk '
|
||||
/^plugins\.security\.nodes_dn:/ {in_block=1; print; next}
|
||||
in_block && /^[^#[:space:]-]/ {in_block=0}
|
||||
!in_block || /^plugins\.security\.nodes_dn:/ {next}
|
||||
{print}
|
||||
' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
|
||||
|
||||
awk -v repl="$NODES_DN_YAML" '
|
||||
/^plugins\.security\.nodes_dn:/ {
|
||||
print "plugins.security.nodes_dn:";
|
||||
print repl;
|
||||
skip=1; next
|
||||
}
|
||||
skip && /^[^#[:space:]-]/ {skip=0}
|
||||
!skip
|
||||
' "${CONFIG_FILE}" > "${CONFIG_FILE}.new"
|
||||
mv "${CONFIG_FILE}.new" "$CONFIG_FILE"
|
||||
rm -f "${CONFIG_FILE}.tmp"
|
||||
fi
|
||||
}
|
||||
|
||||
# Prepend "opensearch" command if no argument was provided or if the first
|
||||
# argument looks like a flag (i.e. starts with a dash).
|
||||
|
||||
configureOpensearch
|
||||
|
||||
if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then
|
||||
set -- opensearch "$@"
|
||||
fi
|
||||
|
||||
if [ "$1" = "opensearch" ]; then
|
||||
# If the first argument is opensearch, then run the setup script.
|
||||
runOpensearch "$@"
|
||||
else
|
||||
# Otherwise, just exec the command.
|
||||
exec "$@"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Allow environment variables to be set by creating a file with the
|
||||
# contents, and setting an environment variable with the suffix _FILE to
|
||||
# point to it. This can be used to provide secrets to a container, without
|
||||
# the values being specified explicitly when running the container.
|
||||
#
|
||||
# This is also sourced in opensearch-env, and is only needed here
|
||||
# as well because we use INDEXER_PASSWORD below. Sourcing this script
|
||||
# is idempotent.
|
||||
source /usr/share/wazuh-indexer/bin/opensearch-env-from-file
|
||||
|
||||
if [[ -f bin/opensearch-users ]]; then
|
||||
# Check for the INDEXER_PASSWORD environment variable to set the
|
||||
# bootstrap password for Security.
|
||||
#
|
||||
# This is only required for the first node in a cluster with Security
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$INDEXER_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
(run_as_other_user_if_needed echo "$INDEXER_PASSWORD" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
else
|
||||
# keystore requires password
|
||||
if ! (run_as_other_user_if_needed echo "$KEYSTORE_PASSWORD" \
|
||||
| opensearch-keystore list | grep -q '^bootstrap.password$') ; then
|
||||
COMMANDS="$(printf "%s\n%s" "$KEYSTORE_PASSWORD" "$INDEXER_PASSWORD")"
|
||||
(run_as_other_user_if_needed echo "$COMMANDS" | opensearch-keystore add -x 'bootstrap.password')
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
# If requested and running as root, mutate the ownership of bind-mounts
|
||||
if [[ -n "$TAKE_FILE_OWNERSHIP" ]]; then
|
||||
chown -R 1000:0 /usr/share/wazuh-indexer/{data,logs}
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
|
||||
# run securityadmin.sh for single node with CACERT, CERT and KEY parameter
|
||||
# nohup /securityadmin.sh &
|
||||
# touch "/var/lib/wazuh-indexer/.flag"
|
||||
#fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
||||
fi
|
||||
@@ -1,74 +0,0 @@
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Define your internal users here
|
||||
|
||||
## Demo users
|
||||
|
||||
admin:
|
||||
hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Demo admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
||||
reserved: true
|
||||
description: "Demo kibanaserver user"
|
||||
|
||||
kibanaro:
|
||||
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
- "readall"
|
||||
attributes:
|
||||
attribute1: "value1"
|
||||
attribute2: "value2"
|
||||
attribute3: "value3"
|
||||
description: "Demo kibanaro user"
|
||||
|
||||
logstash:
|
||||
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
description: "Demo logstash user"
|
||||
|
||||
readall:
|
||||
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
description: "Demo readall user"
|
||||
|
||||
snapshotrestore:
|
||||
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
description: "Demo snapshotrestore user"
|
||||
|
||||
wazuh_admin:
|
||||
hash: "$2y$12$d2awHiOYvZjI88VfsDON.u6buoBol0gYPJEgdG1ArKVE0OMxViFfu"
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
attributes: {}
|
||||
opendistro_security_roles: []
|
||||
static: false
|
||||
|
||||
wazuh_user:
|
||||
hash: "$2y$12$BQixeoQdRubZdVf/7sq1suHwiVRnSst1.lPI2M0.GPZms4bq2D9vO"
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
attributes: {}
|
||||
opendistro_security_roles: []
|
||||
static: false
|
||||
@@ -1,34 +0,0 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
cluster.name: "wazuh-cluster"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
plugins.security.ssl.http.enabled_ciphers:
|
||||
- "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
|
||||
- "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||||
- "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
- "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
|
||||
plugins.security.ssl.http.enabled_protocols:
|
||||
- "TLSv1.2"
|
||||
plugins.security.authcz.admin_dn:
|
||||
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.nodes_dn:
|
||||
- "CN=demo.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
|
||||
@@ -1,171 +0,0 @@
|
||||
_meta:
|
||||
type: "roles"
|
||||
config_version: 2
|
||||
|
||||
# Restrict users so they can only view visualization and dashboards on kibana
|
||||
kibana_read_only:
|
||||
reserved: true
|
||||
|
||||
# The security REST API access role is used to assign specific users access to change the security settings through the REST API.
|
||||
security_rest_api_access:
|
||||
reserved: true
|
||||
|
||||
# Allows users to view monitors, destinations and alerts
|
||||
alerting_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/alerting/alerts/get'
|
||||
- 'cluster:admin/opendistro/alerting/destination/get'
|
||||
- 'cluster:admin/opendistro/alerting/monitor/get'
|
||||
- 'cluster:admin/opendistro/alerting/monitor/search'
|
||||
|
||||
# Allows users to view and acknowledge alerts
|
||||
alerting_ack_alerts:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/alerting/alerts/*'
|
||||
|
||||
# Allows users to use all alerting functionality
|
||||
alerting_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster_monitor'
|
||||
- 'cluster:admin/opendistro/alerting/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices_monitor'
|
||||
- 'indices:admin/aliases/get'
|
||||
- 'indices:admin/mappings/get'
|
||||
|
||||
# Allow users to read Anomaly Detection detectors and results
|
||||
anomaly_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/ad/detector/info'
|
||||
- 'cluster:admin/opendistro/ad/detector/search'
|
||||
- 'cluster:admin/opendistro/ad/detectors/get'
|
||||
- 'cluster:admin/opendistro/ad/result/search'
|
||||
- 'cluster:admin/opendistro/ad/tasks/search'
|
||||
|
||||
# Allows users to use all Anomaly Detection functionality
|
||||
anomaly_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster_monitor'
|
||||
- 'cluster:admin/opendistro/ad/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices_monitor'
|
||||
- 'indices:admin/aliases/get'
|
||||
- 'indices:admin/mappings/get'
|
||||
|
||||
# Allows users to read Notebooks
|
||||
notebooks_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/notebooks/list'
|
||||
- 'cluster:admin/opendistro/notebooks/get'
|
||||
|
||||
# Allows users to all Notebooks functionality
|
||||
notebooks_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/notebooks/create'
|
||||
- 'cluster:admin/opendistro/notebooks/update'
|
||||
- 'cluster:admin/opendistro/notebooks/delete'
|
||||
- 'cluster:admin/opendistro/notebooks/get'
|
||||
- 'cluster:admin/opendistro/notebooks/list'
|
||||
|
||||
# Allows users to read and download Reports
|
||||
reports_instances_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to read and download Reports and Report-definitions
|
||||
reports_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/definition/get'
|
||||
- 'cluster:admin/opendistro/reports/definition/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to all Reports functionality
|
||||
reports_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/reports/definition/create'
|
||||
- 'cluster:admin/opendistro/reports/definition/update'
|
||||
- 'cluster:admin/opendistro/reports/definition/on_demand'
|
||||
- 'cluster:admin/opendistro/reports/definition/delete'
|
||||
- 'cluster:admin/opendistro/reports/definition/get'
|
||||
- 'cluster:admin/opendistro/reports/definition/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/list'
|
||||
- 'cluster:admin/opendistro/reports/instance/get'
|
||||
- 'cluster:admin/opendistro/reports/menu/download'
|
||||
|
||||
# Allows users to use all asynchronous-search functionality
|
||||
asynchronous_search_full_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/asynchronous_search/*'
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- '*'
|
||||
allowed_actions:
|
||||
- 'indices:data/read/search*'
|
||||
|
||||
# Allows users to read stored asynchronous-search results
|
||||
asynchronous_search_read_access:
|
||||
reserved: true
|
||||
cluster_permissions:
|
||||
- 'cluster:admin/opendistro/asynchronous_search/get'
|
||||
|
||||
wazuh_ui_user:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions: []
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- "wazuh-*"
|
||||
dls: ""
|
||||
fls: []
|
||||
masked_fields: []
|
||||
allowed_actions:
|
||||
- "read"
|
||||
tenant_permissions: []
|
||||
static: false
|
||||
|
||||
wazuh_ui_admin:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions: []
|
||||
index_permissions:
|
||||
- index_patterns:
|
||||
- "wazuh-*"
|
||||
dls: ""
|
||||
fls: []
|
||||
masked_fields: []
|
||||
allowed_actions:
|
||||
- "read"
|
||||
- "delete"
|
||||
- "manage"
|
||||
- "index"
|
||||
tenant_permissions: []
|
||||
static: false
|
||||
|
||||
# ISM API permissions role
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
cluster_permissions:
|
||||
- "manage_ism"
|
||||
static: false
|
||||
@@ -1,78 +0,0 @@
|
||||
---
|
||||
# In this file users, backendroles and hosts can be mapped to Wazuh indexer Security roles.
|
||||
# Permissions for Wazuh indexer roles are configured in roles.yml
|
||||
|
||||
_meta:
|
||||
type: "rolesmapping"
|
||||
config_version: 2
|
||||
|
||||
# Define your roles mapping here
|
||||
|
||||
## Demo roles mapping
|
||||
|
||||
all_access:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Maps admin to all_access"
|
||||
|
||||
own_index:
|
||||
reserved: false
|
||||
users:
|
||||
- "*"
|
||||
description: "Allow full access to an index named like the username"
|
||||
|
||||
logstash:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
|
||||
kibana_user:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
users:
|
||||
- "wazuh_user"
|
||||
- "wazuh_admin"
|
||||
description: "Maps kibanauser to kibana_user"
|
||||
|
||||
readall:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
|
||||
manage_snapshots:
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
|
||||
kibana_server:
|
||||
reserved: true
|
||||
users:
|
||||
- "kibanaserver"
|
||||
|
||||
wazuh_ui_admin:
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
hosts: []
|
||||
users:
|
||||
- "wazuh_admin"
|
||||
- "kibanaserver"
|
||||
and_backend_roles: []
|
||||
|
||||
wazuh_ui_user:
|
||||
reserved: true
|
||||
hidden: false
|
||||
backend_roles: []
|
||||
hosts: []
|
||||
users:
|
||||
- "wazuh_user"
|
||||
and_backend_roles: []
|
||||
|
||||
# ISM API permissions role mapping
|
||||
manage_ism:
|
||||
reserved: true
|
||||
hidden: false
|
||||
users:
|
||||
- "kibanaserver"
|
||||
@@ -5,29 +5,19 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG FILEBEAT_TEMPLATE_BRANCH
|
||||
ARG FILEBEAT_CHANNEL=filebeat-oss
|
||||
ARG FILEBEAT_VERSION=7.10.2
|
||||
ARG FILEBEAT_REVISION=2
|
||||
ARG WAZUH_FILEBEAT_MODULE
|
||||
ARG S6_VERSION="v2.2.0.3"
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_manager_url_amd64_rpm
|
||||
ARG wazuh_manager_url_arm64_rpm
|
||||
|
||||
RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
|
||||
yum clean all
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
COPY config/filebeat_module.sh /
|
||||
COPY config/permanent_data.env config/permanent_data.sh /
|
||||
|
||||
RUN chmod 775 /check_repository.sh
|
||||
RUN source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all && \
|
||||
chmod 775 /filebeat_module.sh && \
|
||||
source /filebeat_module.sh && \
|
||||
rm /filebeat_module.sh && \
|
||||
RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
|
||||
manager_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
|
||||
dnf clean all && \
|
||||
curl -o /wazuh-manager.rpm "${manager_url}" && \
|
||||
dnf install /wazuh-manager.rpm -y && \
|
||||
rm -rf /wazuh-manager.rpm && \
|
||||
dnf clean all && \
|
||||
S6_ARCH="amd64" && \
|
||||
if [ "${TARGETARCH}" = "arm64" ]; then S6_ARCH="aarch64"; fi && \
|
||||
curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-${S6_ARCH}.tar.gz \
|
||||
@@ -41,24 +31,16 @@ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
COPY config/etc/ /etc/
|
||||
COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
|
||||
|
||||
COPY config/filebeat.yml /etc/filebeat/
|
||||
|
||||
RUN chmod go-w /etc/filebeat/filebeat.yml
|
||||
|
||||
ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
|
||||
RUN chmod go-w /etc/filebeat/wazuh-template.json
|
||||
|
||||
# Prepare permanent data
|
||||
# Sync calls are due to https://github.com/docker/docker/issues/9547
|
||||
|
||||
COPY config/permanent_data.env config/permanent_data.sh /
|
||||
|
||||
#Make mount directories for keep permissions
|
||||
|
||||
RUN mkdir -p /var/ossec/var/multigroups && \
|
||||
chown root:wazuh /var/ossec/var/multigroups && \
|
||||
chmod 770 /var/ossec/var/multigroups && \
|
||||
mkdir -p /var/ossec/agentless && \
|
||||
chown root:wazuh /var/ossec/agentless && \
|
||||
chmod 770 /var/ossec/agentless && \
|
||||
mkdir -p /var/ossec/active-response/bin && \
|
||||
chown root:wazuh /var/ossec/active-response/bin && \
|
||||
chmod 770 /var/ossec/active-response/bin && \
|
||||
@@ -66,8 +48,6 @@ RUN mkdir -p /var/ossec/var/multigroups && \
|
||||
sync && /permanent_data.sh && \
|
||||
sync && rm /permanent_data.sh
|
||||
|
||||
RUN rm /etc/yum.repos.d/wazuh.repo
|
||||
|
||||
# Services ports
|
||||
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp
|
||||
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
||||
fi
|
||||
|
||||
rpm --import "${APT_KEY}"
|
||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
|
||||
@@ -159,18 +159,83 @@ set_custom_hostname() {
|
||||
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Allow users to set the container cluster key dynamically on
|
||||
# container start.
|
||||
#
|
||||
# To use this:
|
||||
# 1. Create your own ossec.conf file
|
||||
# 2. In your ossec.conf file, set to_be_replaced_by_cluster_key as your key
|
||||
# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
|
||||
##############################################################################
|
||||
function_configure_ossec_conf() {
|
||||
OSSEC_CONF="${WAZUH_INSTALL_PATH}/etc/ossec.conf"
|
||||
|
||||
set_custom_cluster_key() {
|
||||
sed -i 's/<key>to_be_replaced_by_cluster_key<\/key>/<key>'"${WAZUH_CLUSTER_KEY}"'<\/key>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
# --------------------------
|
||||
# Defaults based on OSSEC_CONF
|
||||
# --------------------------
|
||||
if [[ -z "$WAZUH_CLUSTER_KEY" ]]; then
|
||||
WAZUH_CLUSTER_KEY=$(sed -n '/<cluster>/,/<\/cluster>/s/.*<key>\(.*\)<\/key>.*/\1/p' "$OSSEC_CONF" | head -n1)
|
||||
fi
|
||||
|
||||
# Node type logic
|
||||
if [[ "$WAZUH_NODE_TYPE" != "worker" ]]; then
|
||||
WAZUH_NODE_TYPE="master"
|
||||
fi
|
||||
|
||||
# Default node name → HOSTNAME if not defined
|
||||
WAZUH_NODE_NAME="${WAZUH_NODE_NAME:-$HOSTNAME}"
|
||||
|
||||
# --------------------------
|
||||
# Replace Indexer Hosts
|
||||
# --------------------------
|
||||
if [[ -n "$WAZUH_INDEXER_HOSTS" ]]; then
|
||||
TMP_HOSTS=$(mktemp)
|
||||
{
|
||||
echo " <hosts>"
|
||||
IFS=',' read -ra NODES <<< "$WAZUH_INDEXER_HOSTS"
|
||||
for NODE in "${NODES[@]}"; do
|
||||
IP="${NODE%:*}"
|
||||
PORT="${NODE#*:}"
|
||||
echo " <host>https://$IP:$PORT</host>"
|
||||
done
|
||||
echo " </hosts>"
|
||||
} > "$TMP_HOSTS";
|
||||
sed -i -e '/<indexer>/,/<\/indexer>/{ /<hosts>/,/<\/hosts>/{ /<hosts>/r '"$TMP_HOSTS" \
|
||||
-e 'd }}' "$OSSEC_CONF";
|
||||
rm -f "$TMP_HOSTS";
|
||||
|
||||
fi
|
||||
|
||||
# --------------------------
|
||||
# Cluster: node_name
|
||||
# --------------------------
|
||||
sed -i "/<cluster>/,/<\/cluster>/ s|<node_name>.*</node_name>|<node_name>$WAZUH_NODE_NAME</node_name>|" "$OSSEC_CONF"
|
||||
|
||||
# --------------------------
|
||||
# Cluster: node_type
|
||||
# --------------------------
|
||||
sed -i "/<cluster>/,/<\/cluster>/ s|<node_type>.*</node_type>|<node_type>$WAZUH_NODE_TYPE</node_type>|" "$OSSEC_CONF"
|
||||
|
||||
# --------------------------
|
||||
# Cluster: key
|
||||
# --------------------------
|
||||
sed -i "/<cluster>/,/<\/cluster>/ s|<key>.*</key>|<key>$WAZUH_CLUSTER_KEY</key>|" "$OSSEC_CONF"
|
||||
|
||||
# --------------------------
|
||||
# Cluster: bind_addr
|
||||
# --------------------------
|
||||
sed -i "/<cluster>/,/<\/cluster>/ s|<bind_addr>.*</bind_addr>|<bind_addr>$WAZUH_CLUSTER_BIND_ADDR</bind_addr>|" "$OSSEC_CONF"
|
||||
|
||||
# --------------------------
|
||||
# Cluster: nodes list
|
||||
# --------------------------
|
||||
if [[ -n "$WAZUH_CLUSTER_NODES" ]]; then
|
||||
TMP_NODES=$(mktemp)
|
||||
{
|
||||
echo " <nodes>"
|
||||
for N in $WAZUH_CLUSTER_NODES; do
|
||||
echo " <node>$N</node>"
|
||||
done
|
||||
echo " </nodes>"
|
||||
} > "$TMP_NODES";
|
||||
sed -i -e '/<cluster>/,/<\/cluster>/{ /<nodes>/,/<\/nodes>/{ /<nodes>/r '"$TMP_NODES" \
|
||||
-e 'd }}' "$OSSEC_CONF";
|
||||
rm -f "$TMP_NODES";
|
||||
fi
|
||||
|
||||
echo "Wazuh manager config modified successfully."
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
@@ -180,7 +245,6 @@ set_custom_cluster_key() {
|
||||
|
||||
configure_permissions() {
|
||||
chown -R wazuh:wazuh /var/ossec/queue/rids
|
||||
chown -R wazuh:wazuh /var/ossec/etc/lists
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
@@ -225,8 +289,8 @@ main() {
|
||||
# Allow setting custom hostname
|
||||
set_custom_hostname
|
||||
|
||||
# Allow setting custom cluster key
|
||||
set_custom_cluster_key
|
||||
# Configure ossec.conf based on environment variables
|
||||
function_configure_ossec_conf
|
||||
|
||||
# Delete temporary data folder
|
||||
rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
#!/usr/bin/with-contenv bash
|
||||
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
if [ "$INDEXER_URL" != "" ]; then
|
||||
>&2 echo "Customize Elasticsearch output IP"
|
||||
sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
# Configure filebeat.yml security settings
|
||||
|
||||
if [ "$INDEXER_USERNAME" != "" ]; then
|
||||
>&2 echo "Configuring username."
|
||||
sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$INDEXER_PASSWORD" != "" ]; then
|
||||
>&2 echo "Configuring password."
|
||||
sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
|
||||
>&2 echo "Configuring SSL verification mode."
|
||||
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
|
||||
>&2 echo "Configuring Certificate Authorities."
|
||||
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_CERTIFICATE" != "" ]; then
|
||||
>&2 echo "Configuring SSL Certificate."
|
||||
sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_KEY" != "" ]; then
|
||||
>&2 echo "Configuring SSL Key."
|
||||
sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
|
||||
chmod go-w /etc/filebeat/filebeat.yml || true
|
||||
chown root: /etc/filebeat/filebeat.yml || true
|
||||
-6
@@ -60,12 +60,6 @@ function_wazuh_migration(){
|
||||
chown wazuh:wazuh /var/ossec/etc/rules/*
|
||||
chmod 660 /var/ossec/etc/rules/*
|
||||
|
||||
if [ -e /wazuh-migration/data/agentless/.passlist ]; then
|
||||
\cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
|
||||
chown root:wazuh /var/ossec/agentless/.passlist
|
||||
chmod 640 /var/ossec/agentless/.passlist
|
||||
fi
|
||||
|
||||
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
|
||||
chown wazuh:wazuh /var/ossec/queue/db/global.db
|
||||
chmod 640 /var/ossec/queue/db/global.db
|
||||
@@ -1,6 +0,0 @@
|
||||
#!/usr/bin/env sh
|
||||
echo >&2 "Filebeat exited. code=${1}"
|
||||
|
||||
# terminate other services to exit from the container
|
||||
exec s6-svscanctl -t /var/run/s6/services
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
#!/usr/bin/with-contenv sh
|
||||
echo >&2 "starting Filebeat"
|
||||
|
||||
exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
|
||||
@@ -1,31 +0,0 @@
|
||||
|
||||
# Wazuh - Filebeat configuration file
|
||||
filebeat.modules:
|
||||
- module: wazuh
|
||||
alerts:
|
||||
enabled: true
|
||||
archives:
|
||||
enabled: false
|
||||
|
||||
setup.template.json.enabled: true
|
||||
setup.template.overwrite: true
|
||||
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
|
||||
setup.template.json.name: 'wazuh'
|
||||
setup.ilm.enabled: false
|
||||
output.elasticsearch:
|
||||
hosts: ['https://wazuh.indexer:9200']
|
||||
#username:
|
||||
#password:
|
||||
#ssl.verification_mode:
|
||||
#ssl.certificate_authorities:
|
||||
#ssl.certificate:
|
||||
#ssl.key:
|
||||
|
||||
logging.metrics.enabled: false
|
||||
|
||||
seccomp:
|
||||
default_action: allow
|
||||
syscalls:
|
||||
- action: allow
|
||||
names:
|
||||
- rseq
|
||||
@@ -1,11 +0,0 @@
|
||||
## variables
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
REPOSITORY="packages.wazuh.com/4.x"
|
||||
fi
|
||||
|
||||
yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \
|
||||
curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
|
||||
@@ -4,28 +4,15 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/etc"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/logs"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/queue"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/integrations"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
|
||||
PERMANENT_DATA[((i++))]="/var/ossec/wodles"
|
||||
PERMANENT_DATA[((i++))]="/etc/filebeat"
|
||||
|
||||
export PERMANENT_DATA
|
||||
|
||||
# Files mounted in a volume that should not be permanent
|
||||
i=0
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
|
||||
@@ -41,18 +28,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
|
||||
@@ -97,11 +72,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
|
||||
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
|
||||
export PERMANENT_DATA_EXCP
|
||||
|
||||
# Files mounted in a volume that should be deleted
|
||||
|
||||
Reference in New Issue
Block a user