Test CI

Bump 4.3.3 into 4.3

.env

@@ -0,0 +1,2 @@
+WAZUH_VERSION=4.3.3
+WAZUH_IMAGE_VERSION=4.3.3

.github/.goss.yaml

@@ -1,53 +1,3 @@
-file:
-  /etc/filebeat/filebeat.yml:
-    exists: true
-    mode: "0644"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
-  /var/ossec/bin/wazuh-control:
-    exists: true
-    mode: "0750"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
-  /var/ossec/etc/lists/audit-keys:
-    exists: true
-    mode: "0660"
-    owner: wazuh
-    group: wazuh
-    filetype: file
-    contains: []
-  /var/ossec/etc/ossec.conf:
-    exists: true
-    mode: "0660"
-    owner: root
-    group: wazuh
-    filetype: file
-    contains: []
-  /var/ossec/etc/rules/local_rules.xml:
-    exists: true
-    mode: "0660"
-    owner: wazuh
-    group: wazuh
-    filetype: file
-    contains: []
-  /var/ossec/etc/sslmanager.cert:
-    exists: true
-    mode: "0640"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
-  /var/ossec/etc/sslmanager.key:
-    exists: true
-    mode: "0640"
-    owner: root
-    group: root
-    filetype: file
-    contains: []
 package:
   filebeat:
     installed: true
@@ -56,7 +6,7 @@ package:
   wazuh-manager:
     installed: true
     versions:
-    - 4.3.0
+    - 4.3.4-1
 port:
   tcp:1514:
     listening: true
@@ -70,28 +20,6 @@ port:
     listening: true
     ip:
     - 0.0.0.0
-user:
-  wazuh:
-    exists: true
-    groups:
-    - wazuh
-    home: /var/ossec
-    shell: /sbin/nologin
-  wazuh:
-    exists: true
-    groups:
-    - wazuh
-    home: /var/ossec
-    shell: /sbin/nologin
-  wazuh:
-    exists: true
-    groups:
-    - wazuh
-    home: /var/ossec
-    shell: /sbin/nologin
-group:
-  wazuh:
-    exists: true
 process:
   filebeat:
     running: true

.github/multi-node-fb-check.sh

@@ -0,0 +1,18 @@
+fbout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
+fbstatus1=$(echo "${fbout1}" | grep -c OK)
+if [[ fbstatus1 -eq 7 ]]; then
+ echo "No errors in master filebeat"
+else
+ echo "Errors in master filebeat"
+ echo "${fbout1}"
+ exit 1
+fi
+fbout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
+fbstatus2=$(echo "${fbout2}" | grep -c OK)
+if [[ fbstatus2 -eq 7 ]]; then
+ echo "No errors in worker filebeat"
+else
+ echo "Errors in worker filebeat"
+ echo "${fbout2}"
+ exit 1
+fi

.github/multi-node-log-check.sh

@@ -0,0 +1,16 @@
+log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "$log1" ]]; then
+ echo "No errors in master ossec.log"
+else
+ echo "Errors in master ossec.log:"
+ echo "${log1}"
+ exit 1
+fi
+log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "${log2}" ]]; then
+ echo "No errors in worker ossec.log"
+else
+ echo "Errors in worker ossec.log:"
+ echo "${log2}"
+ exit 1
+fi

.github/single-node-fb-check.sh

@@ -0,0 +1,9 @@
+fbout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
+fbstatus=$(echo "${fbout}" | grep -c OK)
+if [[ fbstatus -eq 7 ]]; then
+  echo "No errors in filebeat"
+else
+  echo "Errors in filebeat"
+  echo "${fbout}"
+  exit 1
+fi

.github/single-node-log-check.sh

@@ -0,0 +1,8 @@
+log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
+if [[ -z "$log" ]]; then
+ echo "No errors in ossec.log"
+else
+ echo "Errors in ossec.log:"
+ echo "${log}"
+ exit 1
+fi

.github/workflows/push.yml

@@ -1,6 +1,6 @@
 name: Wazuh Docker pipeline
 
-on: [push]
+on: [pull_request]
 
 jobs:
   build-stack:
@@ -8,24 +8,210 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
 
-    - name: Build the docker-compose stack
-      run: docker-compose -f build-wazuh-images.yml up -d --build
+    - name: Build Wazuh images
+      run: build-docker-images/build-images.sh
 
-    - name: Check running containers
-      run: docker ps -a
-
-    - name: Shutdown the stack
-      run: docker-compose -f build-wazuh-images.yml kill
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
 
     - name: Install Goss
       uses: e1himself/goss-installation-action@v1.0.3
       with:
         version: v0.3.16
 
-    - name: Execute Goss tests (wazuh-odfe)
-      run: dgoss run wazuh/wazuh-manager:4.3.0
+    - name: Execute Goss tests (wazuh-manager)
+      run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}
       env:
         GOSS_SLEEP: 30
-        GOSS_FILE: .github/.goss.yaml
+        GOSS_FILE: .github/.goss.yaml
+
+    - name: Create single node certficates
+      run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start single node stack
+      run: docker-compose -f single-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       sleep 60
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 1 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
+       if [[ $docs -gt 100 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics"`"
+       if [[ $qty_templates -eq 3 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 9 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check errors in ossec.log
+      run: ./.github/single-node-log-check.sh
+
+
+    - name: Check filebeat output
+      run: ./.github/single-node-fb-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi
+
+    - name: Stop single node stack
+      run: docker-compose -f single-node/docker-compose.yml down
+
+    - name: Create multi node certficates
+      run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start multi node stack
+      run: docker-compose -f multi-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       sleep 120
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 3 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
+       if [[ $docs -gt 200 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
+       if [[ $qty_templates -gt 0 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 10 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+        nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l)
+        if [[ $nodes -eq 2 ]]; then
+         echo "Wazuh manager nodes: ${nodes}"
+        else
+         echo "Wazuh manager nodes: ${nodes}"
+         exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check errors in ossec.log
+      run: ./.github/multi-node-log-check.sh
+
+
+    - name: Check filebeat output
+      run: ./.github/multi-node-fb-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi

.gitignore

@@ -1,4 +1,4 @@
 single-node/config/wazuh_indexer_ssl_certs/*.pem
 single-node/config/wazuh_indexer_ssl_certs/*.key
 multi-node/config/wazuh_indexer_ssl_certs/*.pem
-multi-node/config/wazuh_indexer_ssl_certs/*.key
+multi-node/config/wazuh_indexer_ssl_certs/*.key

CHANGELOG.md

@@ -1,11 +1,41 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## Wazuh Docker v4.3.4
+### Added
+
+- Update Wazuh to version [4.3.4](https://github.com/wazuh/wazuh/blob/v4.3.4/CHANGELOG.md#v434)
+
+## Wazuh Docker v4.3.3
+### Added
+
+- Update Wazuh to version [4.3.3](https://github.com/wazuh/wazuh/blob/v4.3.3/CHANGELOG.md#v433)
+
+## Wazuh Docker v4.3.2
+### Added
+
+- Update Wazuh to version [4.3.2](https://github.com/wazuh/wazuh/blob/v4.3.2/CHANGELOG.md#v432)
+
+## Wazuh Docker v4.3.1
+### Added
+
+- Update Wazuh to version [4.3.1](https://github.com/wazuh/wazuh/blob/v4.3.1/CHANGELOG.md#v431)
+
 ## Wazuh Docker v4.3.0
 ### Added
 
 - Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430)
 
+## Wazuh Docker v4.2.7
+### Added
+
+- Update Wazuh to version [4.2.7](https://github.com/wazuh/wazuh/blob/v4.2.7/CHANGELOG.md#v427)
+
+## Wazuh Docker v4.2.6
+### Added
+
+- Update Wazuh to version [4.2.6](https://github.com/wazuh/wazuh/blob/v4.2.6/CHANGELOG.md#v426)
+
 ## Wazuh Docker v4.2.5
 ### Added
 

LICENSE

@@ -1,5 +1,5 @@
 
- Portions Copyright (C) 2021 Wazuh, Inc.
+ Portions Copyright (C) 2017, Wazuh Inc.
  Based on work Copyright (C) 2003 - 2013 Trend Micro, Inc.
 
  This program is a free software; you can redistribute it and/or modify

README.md

@@ -193,7 +193,13 @@ WAZUH_MONITORING_REPLICAS=0         #
 
 | Wazuh version | ODFE    | XPACK  |
 |---------------|---------|--------|
+| v4.3.4        |         |        |
+| v4.3.3        |         |        |
+| v4.3.2        |         |        |
+| v4.3.1        |         |        |
 | v4.3.0        |         |        |
+| v4.2.7        | 1.13.2  | 7.11.2 |
+| v4.2.6        | 1.13.2  | 7.11.2 |
 | v4.2.5        | 1.13.2  | 7.11.2 |
 | v4.2.4        | 1.13.2  | 7.11.2 |
 | v4.2.3        | 1.13.2  | 7.11.2 |
@@ -223,7 +229,7 @@ We thank you them and everyone else who has contributed to this project.
 
 ## License and copyright
 
-Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 ## Web references
 

VERSION

@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.3.0"
-REVISION="43100"
+WAZUH-DOCKER_VERSION="4.3.4"
+REVISION="40316"

build-docker-images/build-images.sh

@@ -0,0 +1,15 @@
+WAZUH_IMAGE_VERSION=4.3.4
+WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
+WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
+
+## If wazuh manager exists in apt dev repository, change variables, if not, exit 1
+if [ "$WAZUH_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
+  IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
+else
+  IMAGE_VERSION=${WAZUH_IMAGE_VERSION}-dev
+fi
+
+echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
+echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env
+
+docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache

build-docker-images/build-images.yml

@@ -1,10 +1,13 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 version: '3.7'
 
 services:
   wazuh.manager:
-    build:  wazuh-manager/
-    image: wazuh/wazuh-manager:4.3.0
+    build:
+      context: wazuh-manager/
+      args:
+        - WAZUH_VERSION=${WAZUH_VERSION}
+    image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
     hostname: wazuh.manager
     restart: always
     ports:
@@ -31,8 +34,11 @@ services:
       - filebeat_var:/var/lib/filebeat
 
   wazuh.indexer:
-    build: wazuh-indexer/
-    image: wazuh/wazuh-indexer:4.3.0
+    build:
+      context: wazuh-indexer/
+      args:
+        - WAZUH_VERSION=${WAZUH_VERSION}
+    image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -48,8 +54,11 @@ services:
         hard: 65536
 
   wazuh.dashboard:
-    build: wazuh-dashboard/
-    image: wazuh/wazuh-dashboard:4.3.0
+    build:
+      context: wazuh-dashboard/
+      args:
+        - WAZUH_VERSION=${WAZUH_VERSION}
+    image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
     hostname: wazuh.dashboard
     restart: always
     ports:

build-docker-images/wazuh-dashboard/Dockerfile

@@ -1,7 +1,7 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 FROM ubuntu:focal AS builder
 
-ARG WAZUH_VERSION=4.3.0
+ARG WAZUH_VERSION
 ARG INSTALL_DIR=/usr/share/wazuh-dashboard
 
 # Update and install dependencies
@@ -11,7 +11,7 @@ RUN apt-get update && apt install curl libcap2-bin xz-utils -y
 RUN mkdir -p $INSTALL_DIR
 
 # Download and extract Wazuh dashboard base
-RUN curl -o wazuh-dashboard-base.tar.xz https://packages-dev.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \
+RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \
     tar -xf wazuh-dashboard-base.tar.xz --directory  $INSTALL_DIR --strip-components=1
 
 # Generate certificates
@@ -24,8 +24,9 @@ RUN $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
     echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
     echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
 
-# Install Wazuh App
-RUN $INSTALL_DIR/bin/opensearch-dashboards-plugin install https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}.zip --allow-root
+COPY config/install_wazuh_app.sh /
+RUN chmod 775 /install_wazuh_app.sh
+RUN bash /install_wazuh_app.sh
 
 # Copy and set permissions to config files
 COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/
@@ -80,6 +81,9 @@ ENV PATTERN="" \
     WAZUH_MONITORING_SHARDS="" \
     WAZUH_MONITORING_REPLICAS=""
 
+# Install dependencies
+RUN apt update && apt install -y libnss3-dev fonts-liberation libfontconfig1
+
 # Create wazuh-dashboard user and group
 RUN getent group $GROUP || groupadd -r -g 1000 $GROUP
 RUN useradd --system \

build-docker-images/wazuh-dashboard/config/config.sh

@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
 export DH_OPTIONS
 

build-docker-images/wazuh-dashboard/config/entrypoint.sh

@@ -1,5 +1,15 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
+
+INSTALL_DIR=/usr/share/wazuh-dashboard
+DASHBOARD_USERNAME="${DASHBOARD_USERNAME:-kibanaserver}"
+DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
+
+# Create and configure Wazuh dashboard keystore
+
+$INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
+echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
+echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
 
 ##############################################################################
 # Start Wazuh dashboard

build-docker-images/wazuh-dashboard/config/install_wazuh_app.sh

@@ -0,0 +1,12 @@
+## Variables
+WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
+WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
+## If wazuh manager exists in apt dev repository, change variables, if not exit 1
+if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
+  WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
+else
+  WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
+fi
+
+# Install Wazuh App
+$INSTALL_DIR/bin/opensearch-dashboards-plugin install $WAZUH_APP --allow-root

build-docker-images/wazuh-dashboard/config/opensearch_dashboards.yml

@@ -1,5 +1,5 @@
 server.host: 0.0.0.0
-server.port: 443
+server.port: 5601
 opensearch.hosts: https://wazuh.indexer:9200
 opensearch.ssl.verificationMode: none
 opensearch.requestHeadersWhitelist: [ authorization,securitytenant ]

build-docker-images/wazuh-dashboard/config/wazuh.yml

@@ -1,7 +1,7 @@
 ---
 #
 # Wazuh app - App configuration file
-# Copyright (C) 2015-2021 Wazuh, Inc.
+# Copyright (C) 2017, Wazuh Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

build-docker-images/wazuh-dashboard/config/wazuh_app_config.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"

build-docker-images/wazuh-indexer/Dockerfile

@@ -1,6 +1,8 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 FROM ubuntu:focal AS builder
 
+ARG WAZUH_VERSION
+
 RUN apt-get update -y && apt-get install curl openssl xz-utils -y
 
 COPY config/opensearch.yml /

build-docker-images/wazuh-indexer/config/config.sh

@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 # This has to be exported to make some magic below work.
 export DH_OPTIONS
 
@@ -8,7 +8,7 @@ export TARGET_DIR=${CURDIR}/debian/${NAME}
 # Package build options
 export USER=${NAME}
 export GROUP=${NAME}
-export VERSION=4.3.0
+export VERSION=${WAZUH_VERSION}
 export LOG_DIR=/var/log/${NAME}
 export LIB_DIR=/var/lib/${NAME}
 export PID_DIR=/run/${NAME}
@@ -22,7 +22,7 @@ export REPO_DIR=/unattended_installer
 
 rm -rf ${INSTALLATION_DIR}/
 
-curl -o ${INDEXER_FILE} https://packages-dev.wazuh.com/stack/indexer/base/${BASE_FILE}
+curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE}
 tar -xf ${INDEXER_FILE}
 
 ## TOOLS

build-docker-images/wazuh-indexer/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 set -e
 
 umask 0002
@@ -84,9 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then
 fi
 
 
-if [[ "$DISCOVERY" == "single-node" ]]; then
+if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
   # run securityadmin.sh for single node with CACERT, CERT and KEY parameter
   nohup /securityadmin.sh &
+  touch "/var/lib/wazuh-indexer/.flag"
 fi
 
 run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"

build-docker-images/wazuh-indexer/config/securityadmin.sh

@@ -1,3 +1,3 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 sleep 30
 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9300 -icl

build-docker-images/wazuh-manager/Dockerfile

@@ -1,17 +1,22 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 FROM ubuntu:focal
 
-ARG WAZUH_VERSION=4.3.0
+RUN rm /bin/sh && ln -s /bin/bash /bin/sh
+
+ARG WAZUH_VERSION
 ARG TEMPLATE_VERSION=4.3
 ARG FILEBEAT_CHANNEL=filebeat-oss
 ARG FILEBEAT_VERSION=7.10.2
-ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
+ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
 
 RUN apt-get update && apt install curl apt-transport-https lsb-release gnupg -y
 
-RUN apt-key adv --fetch-keys https://packages.wazuh.com/key/GPG-KEY-WAZUH && \
-    echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list && \
-    apt-get update && \
+COPY config/check_repository.sh /
+
+RUN chmod 775 /check_repository.sh
+RUN source /check_repository.sh
+
+RUN apt-get update && \
     apt-get install wazuh-manager=${WAZUH_VERSION}-1
 
 RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\

build-docker-images/wazuh-manager/config/check_repository.sh

@@ -0,0 +1,13 @@
+## Variables
+WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
+WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
+## If wazuh manager exists in apt dev repository, change variables, if not exit 1
+if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
+  APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
+  REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
+else
+  APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
+  REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
+fi
+apt-key adv --fetch-keys ${APT_KEY}
+echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list

build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init

@@ -1,5 +1,5 @@
 #!/usr/bin/with-contenv bash
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 # Variables
 source /permanent_data.env

build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat

@@ -1,5 +1,5 @@
 #!/usr/bin/with-contenv bash
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 set -e
 

build-docker-images/wazuh-manager/config/permanent_data.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 # Variables
 source /permanent_data.env

indexer-certs-creator/Dockerfile

@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 FROM ubuntu:focal
 
 RUN apt-get update && apt-get install openssl curl -y

indexer-certs-creator/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 
 ##############################################################################
 # Downloading Cert Gen Tool

multi-node/Migration-to-Wazuh-4.3.md

@@ -17,7 +17,7 @@ Assuming that you have a v4.2 production deployment, perform the following steps
 **4. Spin down the 4.2 environment.**
 `docker-compose -f production-cluster.yml down`
 
-**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.**
+**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker compose version and project name as parameters.**
 
 Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
 

multi-node/config/wazuh_cluster/wazuh_manager.conf

@@ -222,7 +222,6 @@
   <global>
     <white_list>127.0.0.1</white_list>
     <white_list>^localhost.localdomain$</white_list>
-    <white_list>127.0.0.53</white_list>
   </global>
 
   <command>
@@ -350,24 +349,9 @@
     <location>/var/ossec/logs/active-responses.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/auth.log</location>
-  </localfile>
-
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/syslog</location>
-  </localfile>
-
   <localfile>
     <log_format>syslog</log_format>
     <location>/var/log/dpkg.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/kern.log</location>
-  </localfile>
-
 </ossec_config>

multi-node/config/wazuh_cluster/wazuh_worker.conf

@@ -222,7 +222,6 @@
   <global>
     <white_list>127.0.0.1</white_list>
     <white_list>^localhost.localdomain$</white_list>
-    <white_list>127.0.0.53</white_list>
   </global>
 
   <command>
@@ -350,24 +349,9 @@
     <location>/var/ossec/logs/active-responses.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/auth.log</location>
-  </localfile>
-
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/syslog</location>
-  </localfile>
-
   <localfile>
     <log_format>syslog</log_format>
     <location>/var/log/dpkg.log</location>
   </localfile>
 
-  <localfile>
-    <log_format>syslog</log_format>
-    <location>/var/log/kern.log</location>
-  </localfile>
-
 </ossec_config>

multi-node/config/wazuh_dashboard/opensearch_dashboards.yml

@@ -1,5 +1,5 @@
 server.host: 0.0.0.0
-server.port: 443
+server.port: 5601
 opensearch.hosts: https://wazuh1.indexer:9200
 opensearch.ssl.verificationMode: certificate
 opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]

multi-node/config/wazuh_dashboard/wazuh.yml

@@ -2,6 +2,6 @@ hosts:
   - 1513629884013:
       url: "https://wazuh.master"
       port: 55000
-      username: acme-user
+      username: wazuh-wui
       password: MyS3cr37P450r.*-
       run_as: false

multi-node/docker-compose.yml

@@ -1,9 +1,9 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 version: '3.7'
 
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:4.3.0
+    image: wazuh/wazuh-manager:4.3.4
     hostname: wazuh.master
     restart: always
     ports:
@@ -18,7 +18,7 @@ services:
       - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
       - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
       - SSL_KEY=/etc/ssl/filebeat.key
-      - API_USERNAME=acme-user
+      - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - master-wazuh-api-configuration:/var/ossec/api/configuration
@@ -38,7 +38,7 @@ services:
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh.worker:
-    image: wazuh/wazuh-manager:4.3.0
+    image: wazuh/wazuh-manager:4.3.4
     hostname: wazuh.worker
     restart: always
     environment:
@@ -67,7 +67,7 @@ services:
       - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:4.3.0
+    image: wazuh/wazuh-indexer:4.3.4
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -93,7 +93,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:4.3.0
+    image: wazuh/wazuh-indexer:4.3.4
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -115,7 +115,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:4.3.0
+    image: wazuh/wazuh-indexer:4.3.4
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -137,15 +137,15 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:4.3.0
+    image: wazuh/wazuh-dashboard:4.3.4
     hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:443
+      - 443:5601
     environment:
       - OPENSEARCH_HOSTS="https://wazuh1.indexer:9200"
       - WAZUH_API_URL="https://wazuh.master"
-      - API_USERNAME=acme-user
+      - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem

multi-node/generate-indexer-certs.yml

@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 version: '3'
 
 services:

single-node/config/wazuh_cluster/wazuh_manager.conf

@@ -222,7 +222,6 @@
   <global>
     <white_list>127.0.0.1</white_list>
     <white_list>^localhost.localdomain$</white_list>
-    <white_list>10.0.0.106</white_list>
   </global>
 
   <command>

single-node/config/wazuh_dashboard/opensearch_dashboards.yml

@@ -1,5 +1,5 @@
 server.host: 0.0.0.0
-server.port: 443
+server.port: 5601
 opensearch.hosts: https://wazuh.indexer:9200
 opensearch.ssl.verificationMode: certificate
 opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]

single-node/config/wazuh_dashboard/wazuh.yml

@@ -2,6 +2,6 @@ hosts:
   - 1513629884013:
       url: "https://wazuh.manager"
       port: 55000
-      username: acme-user
+      username: wazuh-wui
       password: MyS3cr37P450r.*-
       run_as: false

single-node/docker-compose.yml

@@ -1,9 +1,9 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 version: '3.7'
 
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:4.3.0
+    image: wazuh/wazuh-manager:4.3.4
     hostname: wazuh.manager
     restart: always
     ports:
@@ -19,7 +19,7 @@ services:
       - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
       - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
       - SSL_KEY=/etc/ssl/filebeat.key
-      - API_USERNAME=acme-user
+      - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - wazuh_api_configuration:/var/ossec/api/configuration
@@ -39,7 +39,7 @@ services:
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:4.3.0
+    image: wazuh/wazuh-indexer:4.3.4
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -64,16 +64,16 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:4.3.0
+    image: wazuh/wazuh-dashboard:4.3.4
     hostname: wazuh.dashboard
     restart: always
     ports:
-      - 443:443
+      - 443:5601
     environment:
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=SecretPassword
       - WAZUH_API_URL=https://wazuh.manager
-      - API_USERNAME=acme-user
+      - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem

single-node/generate-indexer-certs.yml

@@ -1,4 +1,4 @@
-# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 version: '3'
 
 services:

single-node/prueba.sh

@@ -0,0 +1,6 @@
+nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k  | grep -E "indexer" | wc -l`"
+if [[ $nodes -eq 1 ]]; then
+ echo "bien"
+else
+ echo "mal"
+fi