Bump version 3732

Add env credentials for nginx

CHANGELOG.md

@@ -3,9 +3,19 @@ All notable changes to this project will be documented in this file.
 
 ## Wazuh Docker v3.7.2_6.5.4
 
+### Added
+
+- Add Kibana environmental variables for Wazuh APP config.yml. ([#89](https://github.com/wazuh/wazuh-docker/pull/89))
+
 ### Changed
 
 - Update Elastic Stack version to 6.5.4. ([#82](https://github.com/wazuh/wazuh-docker/pull/82))
+- Add env credentials for nginx. ([#86](https://github.com/wazuh/wazuh-docker/pull/86))
+- Improve filebeat configuration ([#88](https://github.com/wazuh/wazuh-docker/pull/88))
+
+### Fixed 
+
+- Temporary fix for Wazuh cluster master node in Kubernetes. ([#84](https://github.com/wazuh/wazuh-docker/pull/84))
 
 ## Wazuh Docker v3.7.2_6.5.3
 

VERSION

@@ -1,2 +1,2 @@
 WAZUH-DOCKER_VERSION="3.7.2_6.5.4"
-REVISION="3729"
+REVISION="3732"

kibana/Dockerfile

@@ -16,4 +16,37 @@ RUN chmod 755 /entrypoint.sh
 
 USER kibana
 
+ENV PATTERN="" \
+    CHECKS_PATTERN="" \
+    CHECKS_TEMPLATE="" \
+    CHECKS_API="" \
+    CHECKS_SETUP="" \
+    EXTENSIONS_PCI="" \
+    EXTENSIONS_GDPR="" \
+    EXTENSIONS_AUDIT="" \
+    EXTENSIONS_OSCAP="" \
+    EXTENSIONS_CISCAT="" \
+    EXTENSIONS_AWS="" \
+    EXTENSIONS_VIRUSTOTAL="" \
+    EXTENSIONS_OSQUERY="" \
+    APP_TIMEOUT="" \
+    WAZUH_SHARDS="" \
+    WAZUH_REPLICAS="" \
+    WAZUH_VERSION_SHARDS="" \
+    WAZUH_VERSION_REPLICAS="" \
+    IP_SELECTOR="" \
+    IP_IGNORE="" \
+    XPACK_RBAC_ENABLED="" \
+    WAZUH_MONITORING_ENABLED="" \
+    WAZUH_MONITORING_FREQUENCY="" \
+    WAZUH_MONITORING_SHARDS="" \
+    WAZUH_MONITORING_REPLICAS="" \
+    ADMIN_PRIVILEGES=""
+
+
+COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
+
+RUN chmod +x ./wazuh_app_config.sh
+
 ENTRYPOINT /entrypoint.sh
+

kibana/config/entrypoint.sh

@@ -50,6 +50,9 @@ if [ "x$CONFIG_CODE" = "x404" ]; then
 else
   echo "Wazuh APP already configured"
 fi
+sleep 5
+
+./wazuh_app_config.sh
 
 sleep 5
 

kibana/config/wazuh_app_config.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
+
+kibana_config_file="/usr/share/kibana/plugins/wazuh/config.yml"
+
+declare -A CONFIG_MAP=(
+  [pattern]=$PATTERN
+  [checks.pattern]=$CHECKS_PATTERN
+  [checks.template]=$CHECKS_TEMPLATE
+  [checks.api]=$CHECKS_API
+  [checks.setup]=$CHECKS_SETUP
+  [extensions.pci]=$EXTENSIONS_PCI
+  [extensions.gdpr]=$EXTENSIONS_GDPR
+  [extensions.audit]=$EXTENSIONS_AUDIT
+  [extensions.oscap]=$EXTENSIONS_OSCAP
+  [extensions.ciscat]=$EXTENSIONS_CISCAT
+  [extensions.aws]=$EXTENSIONS_AWS
+  [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL
+  [extensions.osquery]=$EXTENSIONS_OSQUERY
+  [timeout]=$APP_TIMEOUT
+  [wazuh.shards]=$WAZUH_SHARDS
+  [wazuh.replicas]=$WAZUH_REPLICAS
+  [wazuh-version.shards]=$WAZUH_VERSION_SHARDS
+  [wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS
+  [ip.selector]=$IP_SELECTOR
+  [ip.ignore]=$IP_IGNORE
+  [xpack.rbac.enabled]=$XPACK_RBAC_ENABLED
+  [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
+  [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
+  [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
+  [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS
+  [admin]=$ADMIN_PRIVILEGES
+)
+
+for i in "${!CONFIG_MAP[@]}"
+do
+    if [ "${CONFIG_MAP[$i]}" != "" ]; then
+        sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
+    fi
+done

nginx/Dockerfile

@@ -13,4 +13,7 @@ RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 VOLUME ["/etc/nginx/conf.d"]
 
+ENV NGINX_NAME="foo" \
+    NGINX_PWD="bar"
+
 ENTRYPOINT /entrypoint.sh

nginx/config/entrypoint.sh

@@ -15,7 +15,7 @@ fi
 # Configuring default credentiales.
 if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
   echo "Setting Nginx credentials"
-  echo bar|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd foo >/dev/null
+  echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
 else
   echo "Kibana credentials already configured"
 fi

wazuh/Dockerfile

@@ -76,6 +76,8 @@ RUN mkdir /etc/service/filebeat
 COPY config/filebeat.runit.service /etc/service/filebeat/run
 RUN chmod +x /etc/service/filebeat/run
 
+# Temporary fix for Wazuh cluster master node in Kubernetes
+RUN sed -i '87d;88d' /var/ossec/framework/wazuh/cluster/cluster.py
 
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]

wazuh/config/filebeat.yml

@@ -1,11 +1,10 @@
 # Wazuh App Copyright (C) 2018 Wazuh Inc. (License GPLv2)
 filebeat:
- inputs:
+ prospectors:
   - type: log
     paths:
-     - "/var/ossec/data/logs/alerts/alerts.json"
+     - "/var/ossec/logs/alerts/alerts.json"
-    fields:
+    document_type: json
-      document_type: wazuh-alerts
     json.message_key: log
     json.keys_under_root: true
     json.overwrite_keys: true