forked from wazuh/wazuh-docker
130 lines
4.4 KiB
Plaintext
130 lines
4.4 KiB
Plaintext
#!/usr/bin/with-contenv bash
|
|
|
|
##############################################################################
|
|
# Migration sequence
|
|
# Detect if there is a mounted volume on /wazuh-migration and copy the data
|
|
# to /var/wazuh-manager, finally it will create a flag ".migration-completed" inside
|
|
# the mounted volume
|
|
##############################################################################
|
|
|
|
function __colortext()
|
|
{
|
|
echo -e " \e[1;$2m$1\e[0m"
|
|
}
|
|
|
|
function echogreen()
|
|
{
|
|
echo $(__colortext "$1" "32")
|
|
}
|
|
|
|
function echoyellow()
|
|
{
|
|
echo $(__colortext "$1" "33")
|
|
}
|
|
|
|
function echored()
|
|
{
|
|
echo $(__colortext "$1" "31")
|
|
}
|
|
|
|
function_wazuh_migration(){
|
|
if [ -d "/wazuh-migration" ]; then
|
|
if [ ! -e /wazuh-migration/.migration-completed ]; then
|
|
if [ ! -e /wazuh-migration/global.db ]; then
|
|
echoyellow "The volume mounted on /wazuh-migration does not contain all the correct files."
|
|
return
|
|
fi
|
|
|
|
\cp -f /wazuh-migration/data/etc/wazuh-manager.conf /var/wazuh-manager/etc/wazuh-manager.conf
|
|
chown root:wazuh-manager /var/wazuh-manager/etc/wazuh-manager.conf
|
|
chmod 640 /var/wazuh-manager/etc/wazuh-manager.conf
|
|
|
|
\cp -f /wazuh-migration/data/etc/client.keys /var/wazuh-manager/etc/client.keys
|
|
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/client.keys
|
|
chmod 640 /var/wazuh-manager/etc/client.keys
|
|
|
|
\cp -f /wazuh-migration/data/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.cert
|
|
\cp -f /wazuh-migration/data/etc/sslmanager.key /var/wazuh-manager/etc/sslmanager.key
|
|
chown root:root /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
|
|
chmod 640 /var/wazuh-manager/etc/sslmanager.cert /var/wazuh-manager/etc/sslmanager.key
|
|
|
|
\cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/wazuh-manager/etc/shared/default/agent.conf
|
|
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/shared/default/agent.conf
|
|
chmod 660 /var/wazuh-manager/etc/shared/default/agent.conf
|
|
|
|
\cp -f /wazuh-migration/data/etc/decoders/* /var/wazuh-manager/etc/decoders/
|
|
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/decoders/*
|
|
chmod 660 /var/wazuh-manager/etc/decoders/*
|
|
\cp -f /wazuh-migration/data/etc/rules/* /var/wazuh-manager/etc/rules/
|
|
chown wazuh-manager:wazuh-manager /var/wazuh-manager/etc/rules/*
|
|
chmod 660 /var/wazuh-manager/etc/rules/*
|
|
|
|
\cp -f /wazuh-migration/global.db /var/wazuh-manager/queue/db/global.db
|
|
chown wazuh-manager:wazuh-manager /var/wazuh-manager/queue/db/global.db
|
|
chmod 640 /var/wazuh-manager/queue/db/global.db
|
|
|
|
# mark volume as migrated
|
|
touch /wazuh-migration/.migration-completed
|
|
|
|
echogreen "Migration completed succesfully"
|
|
else
|
|
echoyellow "This volume has already been migrated. You may proceed and remove it from the mount point (/wazuh-migration)"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
function_create_custom_user() {
|
|
if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
|
|
cat << EOF > /var/wazuh-manager/api/configuration/admin.json
|
|
{
|
|
"username": "$API_USERNAME",
|
|
"password": "$API_PASSWORD"
|
|
}
|
|
EOF
|
|
|
|
# create or customize API user
|
|
if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then
|
|
# remove json if exit code is 0
|
|
rm /var/wazuh-manager/api/configuration/admin.json
|
|
else
|
|
echored "There was an error configuring the API user"
|
|
# terminate container to avoid unpredictable behavior
|
|
exec s6-svscanctl -t /var/run/s6/services
|
|
exit 1
|
|
fi
|
|
fi
|
|
}
|
|
|
|
function_entrypoint_scripts() {
|
|
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
|
|
if [ -d "/entrypoint-scripts/" ]
|
|
then
|
|
for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
|
|
bash "$script"
|
|
done
|
|
fi
|
|
}
|
|
|
|
function_configure_vulnerability_detection() {
|
|
if [ "$INDEXER_PASSWORD" != "" ]; then
|
|
>&2 echo "Configuring password."
|
|
echo "$INDEXER_USERNAME" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k username
|
|
echo "$INDEXER_PASSWORD" | /var/wazuh-manager/bin/wazuh-keystore -f indexer -k password
|
|
fi
|
|
}
|
|
|
|
# Migrate data from /wazuh-migration volume
|
|
function_wazuh_migration
|
|
|
|
# create API custom user
|
|
function_create_custom_user
|
|
|
|
# configure Vulnerabilty detection
|
|
function_configure_vulnerability_detection
|
|
|
|
# run entrypoint scripts
|
|
function_entrypoint_scripts
|
|
|
|
# Start Wazuh
|
|
/var/wazuh-manager/bin/wazuh-control start
|