Merge pull request #22 from wazuh/revert-21-dev

Revert "Adding Nginx container"

README.md

@@ -1,4 +1,4 @@
-# Wazuh containers for Docker 
+# Wazuh containers for Docker
 
 In this repository you will find the containers to run:
 
@@ -10,7 +10,7 @@ In addition, a docker-compose file is provided to launch the containers mentione
 
 ## Current release
 
-Containers are currently tested on Wazuh version 2.0 and Elastic Stack version 5.4.2. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack.
+Containers are currently tested on Wazuh version 2.0 and Elastic Stack version 5.5.2. We will do our best to keep this repository updated to latest versions of both Wazuh and Elastic Stack.
 
 ## Installation notes
 

docker-compose.yml

@@ -26,7 +26,7 @@ services:
 #      - my-path:/etc/logstash/conf.d
     links:
      - kibana
-     - elasticsearch
+     - elasticsearch:elasticsearch
     ports:
       - "5000:5000"
     networks:
@@ -36,7 +36,7 @@ services:
     environment:
       - LS_HEAP_SIZE=2048m
   elasticsearch:
-    image: elasticsearch:5.5.0
+    image: elasticsearch:5.5.2
     hostname: elasticsearch
     restart: always
     command: elasticsearch -E node.name="node-1" -E cluster.name="wazuh" -E network.host=0.0.0.0
@@ -59,9 +59,12 @@ services:
         - docker_elk
     depends_on:
       - elasticsearch
+    links:
+      - elasticsearch:elasticsearch
+      - wazuh
     entrypoint: sh wait-for-it.sh elasticsearch
 #    environment:
-#      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.0_5.4.2.zip"
+#      - "WAZUH_KIBANA_PLUGIN_URL=http://your.repo/wazuhapp-2.1.0-5.5.1.zip"
 
 networks:
   docker_elk:

kibana/Dockerfile

@@ -1,4 +1,4 @@
-FROM kibana:5.5.0
+FROM kibana:5.5.2
 
 RUN apt-get update && apt-get install -y curl
 

kibana/config/kibana.yml

@@ -81,7 +81,7 @@ elasticsearch.url: "http://elasticsearch:9200"
 # logging.silent: false
 
 # Set the value of this setting to true to suppress all logging output other than error messages.
-# logging.quiet: false
+logging.quiet: true
 
 # Set the value of this setting to true to log all events, including system usage information
 # and all requests.

kibana/config/wait-for-it.sh

@@ -5,7 +5,7 @@ set -e
 host="$1"
 shift
 cmd="kibana"
-WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-2.0.1_5.5.0.zip}
+WAZUH_KIBANA_PLUGIN_URL=${WAZUH_KIBANA_PLUGIN_URL:-https://packages.wazuh.com/wazuhapp/wazuhapp-2.1.0_5.5.2.zip}
 
 until curl -XGET $host:9200; do
   >&2 echo "Elastic is unavailable - sleeping"
@@ -22,4 +22,37 @@ else
   /usr/share/kibana/bin/kibana-plugin install ${WAZUH_KIBANA_PLUGIN_URL}
 fi
 
+sleep 30
+
+echo "Configuring defaultIndex to wazuh-alerts-*"
+
+curl -s -XPUT http://$host:9200/.kibana/config/5.5.2 -d '{"defaultIndex" : "wazuh-alerts-*"}' > /dev/null
+
+sleep 30
+
+echo "Setting API credentials into Wazuh APP"
+
+CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET http://$host:9200/.wazuh/wazuh-configuration/apiconfig)
+if [ "x$CONFIG_CODE" = "x404" ]; then
+  curl -s -XPOST http://$host:9200/.wazuh/wazuh-configuration/apiconfig -H 'Content-Type: application/json' -d'
+  {
+    "api_user": "foo",
+    "api_password": "YmFy",
+    "url": "http://wazuh",
+    "api_port": "55000",
+    "insecure": "true",
+    "component": "API",
+    "active": "true",
+    "manager": "wazuh-manager",
+    "extensions": {
+      "oscap": true,
+      "audit": true,
+      "pci": true
+    }
+  }
+  ' > /dev/null
+else
+  echo "Wazuh APP already configured"
+fi
+
 exec $cmd

logstash/Dockerfile

@@ -1,4 +1,4 @@
-FROM logstash:5.5.0
+FROM logstash:5.5.2
 
 RUN apt-get update
 

wazuh/Dockerfile

@@ -1,5 +1,5 @@
 FROM centos:latest
-
+ARG FILEBEAT_VERSION=5.5.2
 COPY config/*.repo /etc/yum.repos.d/
 
 RUN yum -y update; yum clean all;
@@ -7,6 +7,8 @@ RUN yum -y install epel-release openssl useradd; yum clean all
 RUN yum -y install postfix mailx cyrus-sasl cyrus-sasl-plain; yum clean all
 RUN groupadd -g 1000 ossec
 RUN useradd -u 1000 -g 1000 ossec
+RUN curl --silent --location https://rpm.nodesource.com/setup_6.x | bash - &&\
+    yum install -y nodejs
 RUN yum install -y wazuh-manager wazuh-api
 
 
@@ -18,8 +20,8 @@ RUN chmod 755 /init.bash &&\
   sync && rm /init.bash
 
 
-RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.5.0-x86_64.rpm &&\
-  rpm -vi filebeat-5.5.0-x86_64.rpm && rm filebeat-5.5.0-x86_64.rpm
+RUN  curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm &&\
+  rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm filebeat-${FILEBEAT_VERSION}-x86_64.rpm
 
 COPY config/filebeat.yml /etc/filebeat/