forked from wazuh/wazuh-docker
Resolving conflicts
This commit is contained in:
Victor Carlos Erenu
@@ -5,36 +5,33 @@ ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG WAZUH_UI_REVISION
|
||||
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
ARG TARGETARCH
|
||||
ARG wazuh_dashboard_url_amd64_rpm
|
||||
ARG wazuh_dashboard_url_arm64_rpm
|
||||
ARG wazuh_config_yml
|
||||
|
||||
# Update and install dependencies
|
||||
RUN yum install curl-minimal libcap openssl -y
|
||||
|
||||
COPY config/check_repository.sh /
|
||||
RUN chmod 775 /check_repository.sh && \
|
||||
source /check_repository.sh
|
||||
|
||||
RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
|
||||
yum clean all
|
||||
RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
|
||||
dashboard_url="${!URL_VAR}" && \
|
||||
dnf install curl-minimal libcap openssl -y && \
|
||||
curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
|
||||
dnf install /wazuh-dashboard.rpm -y && \
|
||||
rm -rf /wazuh-dashboard.rpm && \
|
||||
dnf clean all
|
||||
|
||||
# Create and set permissions to data directories
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
|
||||
RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
|
||||
COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
|
||||
RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
|
||||
|
||||
# Generate certificates
|
||||
COPY config/config.sh .
|
||||
COPY config/config.yml /
|
||||
RUN bash config.sh
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the current Wazuh dashboard image):
|
||||
#
|
||||
# Copy wazuh-dashboard from stage 0
|
||||
# Add entrypoint
|
||||
# Add wazuh_app_config
|
||||
# Add wazuh_dashboard_config
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
@@ -42,10 +39,8 @@ FROM amazonlinux:2023
|
||||
ENV USER="wazuh-dashboard" \
|
||||
GROUP="wazuh-dashboard" \
|
||||
NAME="wazuh-dashboard" \
|
||||
INSTALL_DIR="/usr/share/wazuh-dashboard"
|
||||
|
||||
# Set Wazuh app variables
|
||||
ENV PATTERN="" \
|
||||
INSTALL_DIR="/usr/share/wazuh-dashboard" \
|
||||
PATTERN="" \
|
||||
CHECKS_PATTERN="" \
|
||||
CHECKS_TEMPLATE="" \
|
||||
CHECKS_API="" \
|
||||
@@ -59,33 +54,32 @@ ENV PATTERN="" \
|
||||
WAZUH_MONITORING_SHARDS="" \
|
||||
WAZUH_MONITORING_REPLICAS=""
|
||||
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y
|
||||
# Copy and set permissions to scripts
|
||||
COPY config/entrypoint.sh /
|
||||
COPY config/wazuh_dashboard_config.sh /
|
||||
|
||||
# Create wazuh-dashboard user and group
|
||||
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
|
||||
RUN useradd --system \
|
||||
# Update and install dependencies
|
||||
RUN yum install shadow-utils -y && \
|
||||
yum clean all && \
|
||||
getent group $GROUP || groupadd -r -g 1000 $GROUP && \
|
||||
useradd --system \
|
||||
--uid 1000 \
|
||||
--no-create-home \
|
||||
--home-dir $INSTALL_DIR \
|
||||
--gid $GROUP \
|
||||
--shell /sbin/nologin \
|
||||
--comment "$USER user" \
|
||||
$USER
|
||||
|
||||
# Copy and set permissions to scripts
|
||||
COPY config/entrypoint.sh /
|
||||
COPY config/wazuh_app_config.sh /
|
||||
RUN chmod 700 /entrypoint.sh
|
||||
RUN chmod 700 /wazuh_app_config.sh
|
||||
RUN chown 1000:1000 /*.sh
|
||||
$USER && \
|
||||
chmod 700 /entrypoint.sh && \
|
||||
chmod 700 /wazuh_dashboard_config.sh && \
|
||||
mkdir -p $INSTALL_DIR && \
|
||||
chown 1000:1000 $INSTALL_DIR && \
|
||||
chown 1000:1000 /*.sh && \
|
||||
mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
|
||||
# Copy Install dir from builder to current image
|
||||
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
|
||||
|
||||
# Create custom directory
|
||||
RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
COPY --from=builder --chown=1000:1000 /etc/wazuh-dashboard $INSTALL_DIR/config/
|
||||
|
||||
# Set workdir and user
|
||||
WORKDIR $INSTALL_DIR
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
## variables
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
|
||||
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
|
||||
|
||||
## check tag to use the correct repository
|
||||
if [[ -n "${WAZUH_TAG}" ]]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
|
||||
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
|
||||
fi
|
||||
|
||||
rpm --import "${APT_KEY}"
|
||||
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo
|
||||
@@ -1,42 +0,0 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
# This has to be exported to make some magic below work.
|
||||
export DH_OPTIONS
|
||||
|
||||
export NAME=wazuh-dashboard
|
||||
export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.14/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
||||
## If cert tool exists in some bucket, download it, if not exit 1
|
||||
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages bucket"
|
||||
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
|
||||
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
|
||||
echo "Cert tool exists in Packages-dev bucket"
|
||||
else
|
||||
echo "Cert tool does not exist in any bucket"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A
|
||||
|
||||
# Create certs directory
|
||||
mkdir -p ${CONFIG_DIR}/certs
|
||||
|
||||
# Copy Wazuh dashboard certs to install config dir
|
||||
cp /wazuh-certificates/demo.dashboard.pem ${CONFIG_DIR}/certs/dashboard.pem
|
||||
cp /wazuh-certificates/demo.dashboard-key.pem ${CONFIG_DIR}/certs/dashboard-key.pem
|
||||
cp /wazuh-certificates/root-ca.pem ${CONFIG_DIR}/certs/root-ca.pem
|
||||
|
||||
chmod -R 500 ${CONFIG_DIR}/certs
|
||||
chmod -R 400 ${CONFIG_DIR}/certs/*
|
||||
@@ -1,5 +0,0 @@
|
||||
nodes:
|
||||
# Wazuh dashboard server nodes
|
||||
dashboard:
|
||||
- name: demo.dashboard
|
||||
ip: demo.dashboard
|
||||
@@ -1,20 +1,87 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
# Run Wazuh dashboard, using environment variables to
|
||||
# set longopts defining Wazuh dashboard's configuration.
|
||||
#
|
||||
# eg. Setting the environment variable:
|
||||
#
|
||||
# OPENSEARCH_STARTUPTIMEOUT=60
|
||||
#
|
||||
# will cause OpenSearch-Dashboards to be invoked with:
|
||||
#
|
||||
# --opensearch.startupTimeout=60
|
||||
|
||||
# Setup Home Directory
|
||||
export OPENSEARCH_DASHBOARDS_HOME=/usr/share/wazuh-dashboard
|
||||
export PATH=$OPENSEARCH_DASHBOARDS_HOME/bin:$PATH
|
||||
DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
|
||||
DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
|
||||
|
||||
# Create and configure Wazuh dashboard keystore
|
||||
|
||||
yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
yes | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo $DASHBOARD_USERNAME | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo $DASHBOARD_PASSWORD | $OPENSEARCH_DASHBOARDS_HOME/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
|
||||
##############################################################################
|
||||
# Start Wazuh dashboard
|
||||
##############################################################################
|
||||
/wazuh_dashboard_config.sh
|
||||
|
||||
/wazuh_app_config.sh $WAZUH_UI_REVISION
|
||||
opensearch_dashboards_vars=(
|
||||
opensearch.hosts
|
||||
server.port
|
||||
server.host
|
||||
opensearch.username
|
||||
opensearch.password
|
||||
)
|
||||
|
||||
/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
function runOpensearchDashboards {
|
||||
longopts=()
|
||||
for opensearch_dashboards_var in ${opensearch_dashboards_vars[*]}; do
|
||||
# 'opensearch.hosts' -> 'OPENSEARCH_URL'
|
||||
env_var=$(echo ${opensearch_dashboards_var^^} | tr . _)
|
||||
|
||||
# Indirectly lookup env var values via the name of the var.
|
||||
# REF: http://tldp.org/LDP/abs/html/bashver2.html#EX78
|
||||
value=${!env_var}
|
||||
if [[ -n $value ]]; then
|
||||
longopt="--${opensearch_dashboards_var}=${value}"
|
||||
longopts+=("${longopt}")
|
||||
fi
|
||||
done
|
||||
|
||||
# Files created at run-time should be group-writable, for Openshift's sake.
|
||||
umask 0002
|
||||
|
||||
# TO DO:
|
||||
# Confirm with Mihir if this is necessary
|
||||
|
||||
# The virtual file /proc/self/cgroup should list the current cgroup
|
||||
# membership. For each hierarchy, you can follow the cgroup path from
|
||||
# this file to the cgroup filesystem (usually /sys/fs/cgroup/) and
|
||||
# introspect the statistics for the cgroup for the given
|
||||
# hierarchy. Alas, Docker breaks this by mounting the container
|
||||
# statistics at the root while leaving the cgroup paths as the actual
|
||||
# paths. Therefore, OpenSearch-Dashboards provides a mechanism to override
|
||||
# reading the cgroup path from /proc/self/cgroup and instead uses the
|
||||
# cgroup path defined the configuration properties
|
||||
# cpu.cgroup.path.override and cpuacct.cgroup.path.override.
|
||||
# Therefore, we set this value here so that cgroup statistics are
|
||||
# available for the container this process will run in.
|
||||
|
||||
exec "$@" \
|
||||
--ops.cGroupOverrides.cpuPath=/ \
|
||||
--ops.cGroupOverrides.cpuAcctPath=/ \
|
||||
"${longopts[@]}"
|
||||
}
|
||||
|
||||
# Prepend "opensearch-dashboards" command if no argument was provided or if the
|
||||
# first argument looks like a flag (i.e. starts with a dash).
|
||||
if [ $# -eq 0 ] || [ "${1:0:1}" = '-' ]; then
|
||||
set -- opensearch-dashboards "$@"
|
||||
fi
|
||||
|
||||
if [ "$1" = "opensearch-dashboards" ]; then
|
||||
runOpensearchDashboards "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
@@ -1,155 +0,0 @@
|
||||
---
|
||||
#
|
||||
# Wazuh app - App configuration file
|
||||
# Copyright (C) 2017, Wazuh Inc.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Find more information about this on the LICENSE file.
|
||||
#
|
||||
# ======================== Wazuh app configuration file ========================
|
||||
#
|
||||
# Please check the documentation for more information on configuration options:
|
||||
# https://documentation.wazuh.com/current/installation-guide/index.html
|
||||
#
|
||||
# Also, you can check our repository:
|
||||
# https://github.com/wazuh/wazuh-dashboard-plugins
|
||||
#
|
||||
# ------------------------------- Index patterns -------------------------------
|
||||
#
|
||||
# Default index pattern to use.
|
||||
#pattern: wazuh-alerts-*
|
||||
#
|
||||
# ----------------------------------- Checks -----------------------------------
|
||||
#
|
||||
# Defines which checks must to be consider by the healthcheck
|
||||
# step once the Wazuh app starts. Values must to be true or false.
|
||||
#checks.pattern : true
|
||||
#checks.template: true
|
||||
#checks.api : true
|
||||
#checks.setup : true
|
||||
#checks.metaFields: true
|
||||
#
|
||||
# --------------------------------- Extensions ---------------------------------
|
||||
#
|
||||
# Defines which extensions should be activated when you add a new API entry.
|
||||
# You can change them after Wazuh app starts.
|
||||
# Values must to be true or false.
|
||||
#extensions.pci : true
|
||||
#extensions.gdpr : true
|
||||
#extensions.hipaa : true
|
||||
#extensions.nist : true
|
||||
#extensions.tsc : true
|
||||
#extensions.audit : true
|
||||
#extensions.oscap : false
|
||||
#extensions.ciscat : false
|
||||
#extensions.aws : false
|
||||
#extensions.gcp : false
|
||||
#extensions.virustotal: false
|
||||
#extensions.osquery : false
|
||||
#extensions.docker : false
|
||||
#
|
||||
# ---------------------------------- Time out ----------------------------------
|
||||
#
|
||||
# Defines maximum timeout to be used on the Wazuh app requests.
|
||||
# It will be ignored if it is bellow 1500.
|
||||
# It means milliseconds before we consider a request as failed.
|
||||
# Default: 20000
|
||||
#timeout: 20000
|
||||
#
|
||||
# -------------------------------- API selector --------------------------------
|
||||
#
|
||||
# Defines if the user is allowed to change the selected
|
||||
# API directly from the Wazuh app top menu.
|
||||
# Default: true
|
||||
#api.selector: true
|
||||
#
|
||||
# --------------------------- Index pattern selector ---------------------------
|
||||
#
|
||||
# Defines if the user is allowed to change the selected
|
||||
# index pattern directly from the Wazuh app top menu.
|
||||
# Default: true
|
||||
#ip.selector: true
|
||||
#
|
||||
# List of index patterns to be ignored
|
||||
#ip.ignore: []
|
||||
#
|
||||
# ------------------------------ wazuh-monitoring ------------------------------
|
||||
#
|
||||
# Custom setting to enable/disable wazuh-monitoring indices.
|
||||
# Values: true, false, worker
|
||||
# If worker is given as value, the app will show the Agents status
|
||||
# visualization but won't insert data on wazuh-monitoring indices.
|
||||
# Default: true
|
||||
#wazuh.monitoring.enabled: true
|
||||
#
|
||||
# Custom setting to set the frequency for wazuh-monitoring indices cron task.
|
||||
# Default: 900 (s)
|
||||
#wazuh.monitoring.frequency: 900
|
||||
#
|
||||
# Configure wazuh-monitoring-* indices shards and replicas.
|
||||
#wazuh.monitoring.shards: 2
|
||||
#wazuh.monitoring.replicas: 0
|
||||
#
|
||||
# Configure wazuh-monitoring-* indices custom creation interval.
|
||||
# Values: h (hourly), d (daily), w (weekly), m (monthly)
|
||||
# Default: d
|
||||
#wazuh.monitoring.creation: d
|
||||
#
|
||||
# Default index pattern to use for Wazuh monitoring
|
||||
#wazuh.monitoring.pattern: wazuh-monitoring-*
|
||||
#
|
||||
# --------------------------------- wazuh-cron ----------------------------------
|
||||
#
|
||||
# Customize the index prefix of predefined jobs
|
||||
# This change is not retroactive, if you change it new indexes will be created
|
||||
# cron.prefix: test
|
||||
#
|
||||
# ------------------------------ wazuh-statistics -------------------------------
|
||||
#
|
||||
# Custom setting to enable/disable statistics tasks.
|
||||
#cron.statistics.status: true
|
||||
#
|
||||
# Enter the ID of the APIs you want to save data from, leave this empty to run
|
||||
# the task on all configured APIs
|
||||
#cron.statistics.apis: []
|
||||
#
|
||||
# Define the frequency of task execution using cron schedule expressions
|
||||
#cron.statistics.interval: 0 0 * * * *
|
||||
#
|
||||
# Define the name of the index in which the documents are to be saved.
|
||||
#cron.statistics.index.name: statistics
|
||||
#
|
||||
# Define the interval in which the index will be created
|
||||
#cron.statistics.index.creation: w
|
||||
#
|
||||
# ------------------------------- App privileges --------------------------------
|
||||
#admin: true
|
||||
#
|
||||
# ---------------------------- Hide manager alerts ------------------------------
|
||||
# Hide the alerts of the manager in all dashboards and discover
|
||||
#hideManagerAlerts: false
|
||||
#
|
||||
# ------------------------------- App logging level -----------------------------
|
||||
# Set the logging level for the Wazuh App log files.
|
||||
# Default value: info
|
||||
# Allowed values: info, debug
|
||||
#logs.level: info
|
||||
#
|
||||
# -------------------------------- Enrollment DNS -------------------------------
|
||||
# Set the variable WAZUH_REGISTRATION_SERVER in agents deployment.
|
||||
# Default value: ''
|
||||
#enrollment.dns: ''
|
||||
#
|
||||
#-------------------------------- API entries -----------------------------------
|
||||
#The following configuration is the default structure to define an API entry.
|
||||
#
|
||||
#hosts:
|
||||
# - <id>:
|
||||
# url: http(s)://<url>
|
||||
# port: <port>
|
||||
# username: <username>
|
||||
# password: <password>
|
||||
@@ -0,0 +1,110 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Environment variables with defaults
|
||||
SERVER_HOST="${SERVER_HOST:-0.0.0.0}"
|
||||
SERVER_PORT="${SERVER_PORT:-443}"
|
||||
OPENSEARCH_HOSTS="${OPENSEARCH_HOSTS:-https://wazuh.indexer:9200}"
|
||||
OPENSEARCH_SSL_VERIFICATION_MODE="${OPENSEARCH_SSL_VERIFICATION_MODE:-certificate}"
|
||||
OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-}"
|
||||
OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}"
|
||||
OPENSEARCH_REQUEST_HEADERS_ALLOWLIST="${OPENSEARCH_REQUEST_HEADERS_ALLOWLIST:-[\"securitytenant\",\"Authorization\"]}"
|
||||
OPENSEARCH_SECURITY_MULTITENANCY_ENABLED="${OPENSEARCH_SECURITY_MULTITENANCY_ENABLED:-false}"
|
||||
OPENSEARCH_SECURITY_READONLY_MODE_ROLES="${OPENSEARCH_SECURITY_READONLY_MODE_ROLES:-[\"kibana_read_only\"]}"
|
||||
SERVER_SSL_ENABLED="${SERVER_SSL_ENABLED:-true}"
|
||||
SERVER_SSL_KEY="${SERVER_SSL_KEY:-/etc/wazuh-dashboard/certs/dashboard-key.pem}"
|
||||
SERVER_SSL_CERTIFICATE="${SERVER_SSL_CERTIFICATE:-/etc/wazuh-dashboard/certs/dashboard.pem}"
|
||||
OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES="${OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES:-[/etc/wazuh-dashboard/certs/root-ca.pem]}"
|
||||
UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE="${UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE:-/app/wz-home}"
|
||||
OPENSEARCH_SECURITY_COOKIE_TTL="${OPENSEARCH_SECURITY_COOKIE_TTL:-900000}"
|
||||
OPENSEARCH_SECURITY_SESSION_TTL="${OPENSEARCH_SECURITY_SESSION_TTL:-900000}"
|
||||
OPENSEARCH_SECURITY_SESSION_KEEPALIVE="${OPENSEARCH_SECURITY_SESSION_KEEPALIVE:-true}"
|
||||
|
||||
# Wazuh API configuration
|
||||
WAZUH_API_URL="${WAZUH_API_URL:-https://localhost}"
|
||||
API_PORT="${API_PORT:-55000}"
|
||||
API_USERNAME="${API_USERNAME:-wazuh-wui}"
|
||||
API_PASSWORD="${API_PASSWORD:-wazuh-wui}"
|
||||
RUN_AS="${RUN_AS:-true}"
|
||||
|
||||
# Optional Wazuh app configurations
|
||||
PATTERN="${PATTERN:-}"
|
||||
CHECKS_PATTERN="${CHECKS_PATTERN:-}"
|
||||
CHECKS_TEMPLATE="${CHECKS_TEMPLATE:-}"
|
||||
CHECKS_API="${CHECKS_API:-}"
|
||||
CHECKS_SETUP="${CHECKS_SETUP:-}"
|
||||
APP_TIMEOUT="${APP_TIMEOUT:-}"
|
||||
API_SELECTOR="${API_SELECTOR:-}"
|
||||
IP_SELECTOR="${IP_SELECTOR:-}"
|
||||
IP_IGNORE="${IP_IGNORE:-}"
|
||||
WAZUH_MONITORING_ENABLED="${WAZUH_MONITORING_ENABLED:-}"
|
||||
WAZUH_MONITORING_FREQUENCY="${WAZUH_MONITORING_FREQUENCY:-}"
|
||||
WAZUH_MONITORING_SHARDS="${WAZUH_MONITORING_SHARDS:-}"
|
||||
WAZUH_MONITORING_REPLICAS="${WAZUH_MONITORING_REPLICAS:-}"
|
||||
|
||||
# Configuration file path
|
||||
DASHBOARD_CONFIG_FILE="${DASHBOARD_CONFIG_FILE:-/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml}"
|
||||
|
||||
# Map of configuration keys to their values
|
||||
declare -A CONFIG_MAP=(
|
||||
[server.host]="$SERVER_HOST"
|
||||
[server.port]="$SERVER_PORT"
|
||||
[opensearch.hosts]="$OPENSEARCH_HOSTS"
|
||||
[opensearch.ssl.verificationMode]="$OPENSEARCH_SSL_VERIFICATION_MODE"
|
||||
[opensearch.username]="$OPENSEARCH_USERNAME"
|
||||
[opensearch.password]="$OPENSEARCH_PASSWORD"
|
||||
[opensearch.requestHeadersAllowlist]="$OPENSEARCH_REQUEST_HEADERS_ALLOWLIST"
|
||||
[opensearch_security.multitenancy.enabled]="$OPENSEARCH_SECURITY_MULTITENANCY_ENABLED"
|
||||
[opensearch_security.readonly_mode.roles]="$OPENSEARCH_SECURITY_READONLY_MODE_ROLES"
|
||||
[server.ssl.enabled]="$SERVER_SSL_ENABLED"
|
||||
[server.ssl.key]="\"$SERVER_SSL_KEY\""
|
||||
[server.ssl.certificate]="\"$SERVER_SSL_CERTIFICATE\""
|
||||
[opensearch.ssl.certificateAuthorities]="$OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES"
|
||||
[uiSettings.overrides.defaultRoute]="$UI_SETTINGS_OVERRIDES_DEFAULT_ROUTE"
|
||||
[opensearch_security.cookie.ttl]="$OPENSEARCH_SECURITY_COOKIE_TTL"
|
||||
[opensearch_security.session.ttl]="$OPENSEARCH_SECURITY_SESSION_TTL"
|
||||
[opensearch_security.session.keepalive]="$OPENSEARCH_SECURITY_SESSION_KEEPALIVE"
|
||||
[pattern]="$PATTERN"
|
||||
[checks.pattern]="$CHECKS_PATTERN"
|
||||
[checks.template]="$CHECKS_TEMPLATE"
|
||||
[checks.api]="$CHECKS_API"
|
||||
[checks.setup]="$CHECKS_SETUP"
|
||||
[timeout]="$APP_TIMEOUT"
|
||||
[api.selector]="$API_SELECTOR"
|
||||
[ip.selector]="$IP_SELECTOR"
|
||||
[ip.ignore]="$IP_IGNORE"
|
||||
[wazuh.monitoring.enabled]="$WAZUH_MONITORING_ENABLED"
|
||||
[wazuh.monitoring.frequency]="$WAZUH_MONITORING_FREQUENCY"
|
||||
[wazuh.monitoring.shards]="$WAZUH_MONITORING_SHARDS"
|
||||
[wazuh.monitoring.replicas]="$WAZUH_MONITORING_REPLICAS"
|
||||
)
|
||||
|
||||
# Replace configuration values in the dashboard config file
|
||||
for key in "${!CONFIG_MAP[@]}"; do
|
||||
value="${CONFIG_MAP[$key]}"
|
||||
|
||||
# Skip empty values for optional configurations
|
||||
if [ -z "$value" ]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
# Escape special characters for sed
|
||||
escaped_key=$(echo "$key" | sed 's/[.[\*^$()+?{|]/\\&/g')
|
||||
|
||||
# Try to replace existing line (commented or uncommented)
|
||||
if grep -q "^[#[:space:]]*${escaped_key}:" "$DASHBOARD_CONFIG_FILE"; then
|
||||
sed -i "s|^[#[:space:]]*${escaped_key}:.*|${key}: ${value}|" "$DASHBOARD_CONFIG_FILE"
|
||||
fi
|
||||
done
|
||||
|
||||
# Handle wazuh_core.hosts section separately
|
||||
if grep -q "^wazuh_core.hosts:" "$DASHBOARD_CONFIG_FILE"; then
|
||||
# Update existing wazuh_core.hosts section
|
||||
sed -i "/^wazuh_core.hosts:/,/^[^ ]/ {
|
||||
s|url:.*|url: $WAZUH_API_URL|
|
||||
s|port:.*|port: $API_PORT|
|
||||
s|username:.*|username: $API_USERNAME|
|
||||
s|password:.*|password: $API_PASSWORD|
|
||||
s|run_as:.*|run_as: $RUN_AS|
|
||||
}" "$DASHBOARD_CONFIG_FILE"
|
||||
fi
|
||||
Reference in New Issue
Block a user