mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-11-02 13:03:20 +00:00
Merge remote-tracking branch 'origin/4.3' into 602-certificate_permissions-to4.3
This commit is contained in:
Alberto R
0
.goss.yaml → .github/.goss.yaml
vendored
0
.goss.yaml → .github/.goss.yaml
vendored
2
.github/workflows/push.yml
vendored
2
.github/workflows/push.yml
vendored
@@ -28,4 +28,4 @@ jobs:
|
||||
run: dgoss run wazuh/wazuh-manager:4.3.0
|
||||
env:
|
||||
GOSS_SLEEP: 30
|
||||
GOSS_FILE: .goss.yaml
|
||||
GOSS_FILE: .github/.goss.yaml
|
||||
@@ -1,69 +0,0 @@
|
||||
# Opendistro data migration to Wazuh indexer on docker.
|
||||
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
|
||||
The example is migrating from v4.2.5 to v4.3.0.
|
||||
|
||||
## Procedure
|
||||
Assuming that you have a v4.2.5 production deployment, perform the following steps.
|
||||
|
||||
**1. Stop 4.2.5 environment**
|
||||
`docker-compose -f production-cluster.yml stop`
|
||||
|
||||
**2. List Elastic volumesStop 4.2.5 environment**
|
||||
`docker volume ls --filter name='wazuh-docker_elastic-data'`
|
||||
|
||||
**3. Inspect Elastic volume**
|
||||
`docker volume inspect wazuh-docker_elastic-data-1`
|
||||
|
||||
**4. Run the volume create command:** create 3 new Indexer volumes using the `com.docker.compose.version` label value from the previous command.
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=wazuh-docker \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-1 \
|
||||
wazuh-docker_wazuh-indexer-data-1
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=wazuh-docker \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-2 \
|
||||
wazuh-docker_wazuh-indexer-data-2
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=wazuh-docker \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-3 \
|
||||
wazuh-docker_wazuh-indexer-data-3
|
||||
```
|
||||
|
||||
**5. Copy the volume content from Elastic to Wazuh indexer volumes.**
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-1:/from \
|
||||
-v wazuh-docker_wazuh-indexer-data-1:/to \
|
||||
alpine ash -c "cd /from ; cp -av . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-2:/from \
|
||||
-v wazuh-docker_wazuh-indexer-data-2:/to \
|
||||
alpine ash -c "cd /from ; cp -av . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-3:/from \
|
||||
-v wazuh-docker_wazuh-indexer-data-3:/to \
|
||||
alpine ash -c "cd /from ; cp -av . /to"
|
||||
```
|
||||
|
||||
**6. Delete the 4.2.5 environment.**
|
||||
`docker-compose -f production-cluster.yml down`
|
||||
|
||||
**7. Start the 4.3 environment.**
|
||||
```
|
||||
git checkout 4.3
|
||||
docker-compose -f production-cluster.yml up -d
|
||||
```
|
||||
|
||||
**8. Check the access to Wazuh dashboard**: go to the Wazuh Dashboard WebUI and check if everything is working.
|
||||
159
README.md
159
README.md
@@ -39,7 +39,7 @@ API_USERNAME="wazuh" # Wazuh API username
|
||||
API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements
|
||||
# (8+ length, uppercase, lowercase, specials chars)
|
||||
|
||||
INDEXER_URL=https://wazuh1.indexer:9200 # Wazuh indexer URL
|
||||
INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL
|
||||
INDEXER_USERNAME=admin # Wazuh indexer Username
|
||||
INDEXER_PASSWORD=admin # Wazuh indexer Password
|
||||
FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none)
|
||||
@@ -87,73 +87,102 @@ ADMIN_PRIVILEGES=true # App privileges
|
||||
|
||||
## Directory structure
|
||||
|
||||
├── build-wazuh-images.yml
|
||||
├── build-docker-images
|
||||
│ ├── docker-compose.yml
|
||||
│ ├── wazuh-dashboard
|
||||
│ │ ├── config
|
||||
│ │ │ ├── config.sh
|
||||
│ │ │ ├── config.yml
|
||||
│ │ │ ├── entrypoint.sh
|
||||
│ │ │ ├── opensearch_dashboards.yml
|
||||
│ │ │ ├── wazuh_app_config.sh
|
||||
│ │ │ └── wazuh.yml
|
||||
│ │ └── Dockerfile
|
||||
│ ├── wazuh-indexer
|
||||
│ │ ├── config
|
||||
│ │ │ ├── config.sh
|
||||
│ │ │ ├── config.yml
|
||||
│ │ │ ├── entrypoint.sh
|
||||
│ │ │ ├── internal_users.yml
|
||||
│ │ │ ├── opensearch.yml
|
||||
│ │ │ ├── roles_mapping.yml
|
||||
│ │ │ ├── roles.yml
|
||||
│ │ │ └── securityadmin.sh
|
||||
│ │ └── Dockerfile
|
||||
│ └── wazuh-manager
|
||||
│ ├── config
|
||||
│ │ ├── create_user.py
|
||||
│ │ ├── etc
|
||||
│ │ │ ├── cont-init.d
|
||||
│ │ │ │ ├── 0-wazuh-init
|
||||
│ │ │ │ ├── 1-config-filebeat
|
||||
│ │ │ │ └── 2-manager
|
||||
│ │ │ └── services.d
|
||||
│ │ │ ├── filebeat
|
||||
│ │ │ │ ├── finish
|
||||
│ │ │ │ └── run
|
||||
│ │ │ └── ossec-logs
|
||||
│ │ │ └── run
|
||||
│ │ ├── filebeat.yml
|
||||
│ │ ├── permanent_data.env
|
||||
│ │ ├── permanent_data.sh
|
||||
│ │ └── wazuh.repo
|
||||
│ └── Dockerfile
|
||||
├── CHANGELOG.md
|
||||
├── docker-compose.yml
|
||||
├── generate-indexer-certs.yml
|
||||
├── indexer_certs_creator
|
||||
│ ├── config
|
||||
│ │ └── entrypoint.sh
|
||||
│ └── Dockerfile
|
||||
├── indexer-certs-creator
|
||||
│ ├── config
|
||||
│ │ └── entrypoint.sh
|
||||
│ └── Dockerfile
|
||||
├── LICENSE
|
||||
├── production_cluster
|
||||
│ ├── nginx
|
||||
│ │ ├── nginx.conf
|
||||
│ │ └── ssl
|
||||
│ │ └── generate-self-signed-cert.sh
|
||||
│ ├── wazuh_cluster
|
||||
│ │ ├── wazuh_manager.conf
|
||||
│ │ └── wazuh_worker.conf
|
||||
│ ├── wazuh_dashboard
|
||||
│ │ ├── opensearch_dashboards.yml
|
||||
│ │ └── wazuh.yml
|
||||
│ ├── wazuh-indexer
|
||||
│ │ ├── internal_users.yml
|
||||
│ │ ├── wazuh1.indexer.yml
|
||||
│ │ ├── wazuh2.indexer.yml
|
||||
│ │ └── wazuh3.indexer.yml
|
||||
│ └── wazuh_indexer_ssl_certs
|
||||
│ └── certs.yml
|
||||
├── production-cluster.yml
|
||||
├── multi-node
|
||||
│ ├── config
|
||||
│ │ ├── nginx
|
||||
│ │ │ └── nginx.conf
|
||||
│ │ ├── wazuh_cluster
|
||||
│ │ │ ├── wazuh_manager.conf
|
||||
│ │ │ └── wazuh_worker.conf
|
||||
│ │ ├── wazuh_dashboard
|
||||
│ │ │ ├── opensearch_dashboards.yml
|
||||
│ │ │ └── wazuh.yml
|
||||
│ │ ├── wazuh_indexer
|
||||
│ │ │ ├── internal_users.yml
|
||||
│ │ │ ├── wazuh1.indexer.yml
|
||||
│ │ │ ├── wazuh2.indexer.yml
|
||||
│ │ │ └── wazuh3.indexer.yml
|
||||
│ │ └── wazuh_indexer_ssl_certs
|
||||
│ │ └── certs.yml
|
||||
│ ├── docker-compose.yml
|
||||
│ ├── generate-indexer-certs.yml
|
||||
│ ├── Migration-to-Wazuh-4.3.md
|
||||
│ └── volume-migrator.sh
|
||||
├── README.md
|
||||
├── VERSION
|
||||
├── wazuh-dashboard
|
||||
│ ├── config
|
||||
│ │ ├── entrypoint.sh
|
||||
│ │ ├── opensearch_dashboards.yml
|
||||
│ │ ├── wazuh_app_config.sh
|
||||
│ │ └── wazuh.yml
|
||||
│ └── Dockerfile
|
||||
├── wazuh-indexer
|
||||
│ ├── config
|
||||
│ │ ├── config.sh
|
||||
│ │ ├── config.yml
|
||||
│ │ ├── entrypoint.sh
|
||||
│ │ ├── internal_users.yml
|
||||
│ │ ├── opensearch.yml
|
||||
│ │ ├── roles_mapping.yml
|
||||
│ │ ├── roles.yml
|
||||
│ │ └── securityadmin.sh
|
||||
│ └── Dockerfile
|
||||
└── wazuh-manager
|
||||
├── config
|
||||
│ ├── create_user.py
|
||||
│ ├── etc
|
||||
│ │ ├── cont-init.d
|
||||
│ │ │ ├── 0-wazuh-init
|
||||
│ │ │ ├── 1-config-filebeat
|
||||
│ │ │ └── 2-manager
|
||||
│ │ └── services.d
|
||||
│ │ ├── filebeat
|
||||
│ │ │ ├── finish
|
||||
│ │ │ └── run
|
||||
│ │ └── ossec-logs
|
||||
│ │ └── run
|
||||
│ ├── filebeat.yml
|
||||
│ ├── permanent_data.env
|
||||
│ ├── permanent_data.sh
|
||||
│ └── wazuh.repo
|
||||
└── Dockerfile
|
||||
├── single-node
|
||||
│ ├── config
|
||||
│ │ ├── wazuh_cluster
|
||||
│ │ │ └── wazuh_manager.conf
|
||||
│ │ ├── wazuh_dashboard
|
||||
│ │ │ ├── opensearch_dashboards.yml
|
||||
│ │ │ └── wazuh.yml
|
||||
│ │ ├── wazuh_indexer
|
||||
│ │ │ ├── internal_users.yml
|
||||
│ │ │ └── wazuh.indexer.yml
|
||||
│ │ └── wazuh_indexer_ssl_certs
|
||||
│ │ ├── admin-key.pem
|
||||
│ │ ├── admin.pem
|
||||
│ │ ├── certs.yml
|
||||
│ │ ├── root-ca.key
|
||||
│ │ ├── root-ca.pem
|
||||
│ │ ├── wazuh.dashboard-key.pem
|
||||
│ │ ├── wazuh.dashboard.pem
|
||||
│ │ ├── wazuh.indexer-key.pem
|
||||
│ │ ├── wazuh.indexer.pem
|
||||
│ │ ├── wazuh.manager-key.pem
|
||||
│ │ └── wazuh.manager.pem
|
||||
│ ├── docker-compose.yml
|
||||
│ ├── generate-indexer-certs.yml
|
||||
│ └── README.md
|
||||
└── VERSION
|
||||
|
||||
|
||||
|
||||
## Branches
|
||||
|
||||
13
build-docker-images/README.md
Normal file
13
build-docker-images/README.md
Normal file
@@ -0,0 +1,13 @@
|
||||
# Wazuh Docker Image Builder
|
||||
|
||||
This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command:
|
||||
|
||||
```
|
||||
$ docker-compose up -d --build
|
||||
```
|
||||
|
||||
Once the image creation process is finished, a Wazuh single-node environment will be spinned up. It can be terminated with the following command:
|
||||
|
||||
```
|
||||
$ docker-compose down
|
||||
```
|
||||
@@ -13,27 +13,27 @@ services:
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=none
|
||||
volumes:
|
||||
- ossec_api_configuration:/var/ossec/api/configuration
|
||||
- ossec_etc:/var/ossec/etc
|
||||
- ossec_logs:/var/ossec/logs
|
||||
- ossec_queue:/var/ossec/queue
|
||||
- ossec_var_multigroups:/var/ossec/var/multigroups
|
||||
- ossec_integrations:/var/ossec/integrations
|
||||
- ossec_active_response:/var/ossec/active-response/bin
|
||||
- ossec_agentless:/var/ossec/agentless
|
||||
- ossec_wodles:/var/ossec/wodles
|
||||
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||
- wazuh_etc:/var/ossec/etc
|
||||
- wazuh_logs:/var/ossec/logs
|
||||
- wazuh_queue:/var/ossec/queue
|
||||
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||
- wazuh_integrations:/var/ossec/integrations
|
||||
- wazuh_active_response:/var/ossec/active-response/bin
|
||||
- wazuh_agentless:/var/ossec/agentless
|
||||
- wazuh_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
|
||||
wazuh1.indexer:
|
||||
wazuh.indexer:
|
||||
build: wazuh-indexer/
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh1.indexer
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
@@ -60,20 +60,20 @@ services:
|
||||
- SERVER_SSL_ENABLED=false
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
depends_on:
|
||||
- wazuh1.indexer
|
||||
- wazuh.indexer
|
||||
links:
|
||||
- wazuh1.indexer:wazuh1.indexer
|
||||
- wazuh.indexer:wazuh.indexer
|
||||
- wazuh.manager:wazuh.manager
|
||||
|
||||
volumes:
|
||||
ossec_api_configuration:
|
||||
ossec_etc:
|
||||
ossec_logs:
|
||||
ossec_queue:
|
||||
ossec_var_multigroups:
|
||||
ossec_integrations:
|
||||
ossec_active_response:
|
||||
ossec_agentless:
|
||||
ossec_wodles:
|
||||
wazuh_api_configuration:
|
||||
wazuh_etc:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_integrations:
|
||||
wazuh_active_response:
|
||||
wazuh_agentless:
|
||||
wazuh_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
@@ -1,6 +1,6 @@
|
||||
server.host: 0.0.0.0
|
||||
server.port: 443
|
||||
opensearch.hosts: https://wazuh1.indexer:9200
|
||||
opensearch.hosts: https://wazuh.indexer:9200
|
||||
opensearch.ssl.verificationMode: none
|
||||
opensearch.requestHeadersWhitelist: [ authorization,securitytenant ]
|
||||
opensearch_security.multitenancy.enabled: true
|
||||
@@ -1,5 +1,5 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh1.indexer"
|
||||
node.name: "wazuh.indexer"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
@@ -13,7 +13,7 @@ setup.template.json.name: 'wazuh'
|
||||
setup.template.overwrite: true
|
||||
setup.ilm.enabled: false
|
||||
output.elasticsearch:
|
||||
hosts: ['https://wazuh1.indexer:9200']
|
||||
hosts: ['https://wazuh.indexer:9200']
|
||||
#username:
|
||||
#password:
|
||||
#ssl.verification_mode:
|
||||
@@ -1,75 +0,0 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=none
|
||||
volumes:
|
||||
- ossec_api_configuration:/var/ossec/api/configuration
|
||||
- ossec_etc:/var/ossec/etc
|
||||
- ossec_logs:/var/ossec/logs
|
||||
- ossec_queue:/var/ossec/queue
|
||||
- ossec_var_multigroups:/var/ossec/var/multigroups
|
||||
- ossec_integrations:/var/ossec/integrations
|
||||
- ossec_active_response:/var/ossec/active-response/bin
|
||||
- ossec_agentless:/var/ossec/agentless
|
||||
- ossec_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh1.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
- 443:443
|
||||
environment:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
depends_on:
|
||||
- wazuh1.indexer
|
||||
links:
|
||||
- wazuh1.indexer:wazuh1.indexer
|
||||
- wazuh.manager:wazuh.manager
|
||||
|
||||
volumes:
|
||||
ossec_api_configuration:
|
||||
ossec_etc:
|
||||
ossec_logs:
|
||||
ossec_queue:
|
||||
ossec_var_multigroups:
|
||||
ossec_integrations:
|
||||
ossec_active_response:
|
||||
ossec_agentless:
|
||||
ossec_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
9
indexer-certs-creator/README.md
Normal file
9
indexer-certs-creator/README.md
Normal file
@@ -0,0 +1,9 @@
|
||||
# Certificate creation image build
|
||||
|
||||
The dockerfile hosted in this directory is used to build the image used to boot Wazuh's single node and multi node stacks.
|
||||
|
||||
To create the image, the following command must be executed:
|
||||
|
||||
```
|
||||
$ docker build -t wazuh/wazuh-certs-generator:0.0.1 .
|
||||
```
|
||||
360
multi-node/Migration-to-Wazuh-4.3.md
Normal file
360
multi-node/Migration-to-Wazuh-4.3.md
Normal file
@@ -0,0 +1,360 @@
|
||||
# Opendistro data migration to Wazuh indexer on docker.
|
||||
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
|
||||
The example is migrating from v4.2 to v4.3.
|
||||
|
||||
## Procedure
|
||||
Assuming that you have a v4.2 production deployment, perform the following steps.
|
||||
|
||||
**1. Stop 4.2 environment**
|
||||
`docker-compose -f production-cluster.yml stop`
|
||||
|
||||
**2. List elasticsearch volumes**
|
||||
`docker volume ls --filter name='wazuh-docker_elastic-data'`
|
||||
|
||||
**3. Inspect elasticsearch volume**
|
||||
`docker volume inspect wazuh-docker_elastic-data-1`
|
||||
|
||||
**4. Spin down the 4.2 environment.**
|
||||
`docker-compose -f production-cluster.yml down`
|
||||
|
||||
**5. Run the volume create command:** create new indexer and Wazuh manager volumes using the `com.docker.compose.version` label value from the previous command.
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-1 \
|
||||
multi-node_wazuh-indexer-data-1
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-2 \
|
||||
multi-node_wazuh-indexer-data-2
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-3 \
|
||||
multi-node_wazuh-indexer-data-3
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master_wazuh_api_configuration \
|
||||
multi-node_master_wazuh_api_configuration
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master_wazuh_etc \
|
||||
multi-node_docker_wazuh_etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-logs \
|
||||
multi-node_master-wazuh-logs
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-queue \
|
||||
multi-node_master-wazuh-queue
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-var-multigroups \
|
||||
multi-node_master-wazuh-var-multigroups
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-integrations \
|
||||
multi-node_master-wazuh-integrations
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-active-response \
|
||||
multi-node_master-wazuh-active-response
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-agentless \
|
||||
multi-node_master-wazuh-agentless
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-wazuh-wodles \
|
||||
multi-node_master-wazuh-wodles
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-filebeat-etc \
|
||||
multi-node_master-filebeat-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=master-filebeat-var \
|
||||
multi-node_master-filebeat-var
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker_wazuh_api_configuration \
|
||||
multi-node_worker_wazuh_api_configuration
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker_wazuh_etc \
|
||||
multi-node_worker-wazuh-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-logs \
|
||||
multi-node_worker-wazuh-logs
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-queue \
|
||||
multi-node_worker-wazuh-queue
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
|
||||
multi-node_worker-wazuh-var-multigroups
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-integrations \
|
||||
multi-node_worker-wazuh-integrations
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-active-response \
|
||||
multi-node_worker-wazuh-active-response
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-agentless \
|
||||
multi-node_worker-wazuh-agentless
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-wazuh-wodles \
|
||||
multi-node_worker-wazuh-wodles
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-filebeat-etc \
|
||||
multi-node_worker-filebeat-etc
|
||||
```
|
||||
```
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=multi-node \
|
||||
--label com.docker.compose.version=1.25.0 \
|
||||
--label com.docker.compose.volume=worker-filebeat-var \
|
||||
multi-node_worker-filebeat-var
|
||||
```
|
||||
**6. Copy the volume content from elasticsearch to Wazuh indexer volumes and old Wazuh manager content to new volumes.**
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-1:/from \
|
||||
-v multi-node_wazuh-indexer-data-1:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-2:/from \
|
||||
-v multi-node_wazuh-indexer-data-2:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-3:/from \
|
||||
-v multi-node_wazuh-indexer-data-3:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-api-configuration:/from \
|
||||
-v multi-node_master-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-etc:/from \
|
||||
-v multi-node_master-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-logs:/from \
|
||||
-v multi-node_master-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-queue:/from \
|
||||
-v multi-node_master-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-var-multigroups:/from \
|
||||
-v multi-node_master-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-integrations:/from \
|
||||
-v multi-node_master-wazuh-integrations:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-active-response:/from \
|
||||
-v multi-node_master-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-agentless:/from \
|
||||
-v multi-node_master-wazuh-agentless:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-wodles:/from \
|
||||
-v multi-node_master-wazuh-wodles:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_filebeat-etc:/from \
|
||||
-v multi-node_master-filebeat-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_filebeat-var:/from \
|
||||
-v multi-node_master-filebeat-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-api-configuration:/from \
|
||||
-v multi-node_worker-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-etc:/from \
|
||||
-v multi-node_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-logs:/from \
|
||||
-v multi-node_worker-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-queue:/from \
|
||||
-v multi-node_worker-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-var-multigroups:/from \
|
||||
-v multi-node_worker-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-integrations:/from \
|
||||
-v multi-node_worker-wazuh-integrations:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-active-response:/from \
|
||||
-v multi-node_worker-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-agentless:/from \
|
||||
-v multi-node_worker-wazuh-agentless:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-wodles:/from \
|
||||
-v multi-node_worker-wazuh-wodles:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-filebeat-etc:/from \
|
||||
-v multi-node_worker-filebeat-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
```
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-filebeat-var:/from \
|
||||
-v multi-node_worker-filebeat-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
|
||||
**Steps 5 and 6 can be done with the volume-migrator.sh script, specifying Docker version and project name as parameters.**
|
||||
|
||||
Ex: $ multi-node/volume-migrator.sh 1.25.0 multi-node
|
||||
|
||||
**7. Start the 4.3 environment.**
|
||||
```
|
||||
git checkout 4.3
|
||||
cd multi-node
|
||||
docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
**8. Check the access to Wazuh dashboard**: go to the Wazuh dashboard using the web browser and check the data.
|
||||
26
multi-node/README.md
Normal file
26
multi-node/README.md
Normal file
@@ -0,0 +1,26 @@
|
||||
# Deploy Wazuh Docker in multi node configuration
|
||||
|
||||
This deployment is defined in the `docker-compose.yml` file with two Wazuh manager containers, three Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps:
|
||||
|
||||
1) Increase max_map_count on your host (Linux). This command must be run with root permissions:
|
||||
```
|
||||
$ sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
2) Run the certificate creation script:
|
||||
```
|
||||
$ docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
```
|
||||
3) Start the environment with docker-compose:
|
||||
|
||||
- In the foregroud:
|
||||
```
|
||||
$ docker-compose up
|
||||
```
|
||||
|
||||
- In the background:
|
||||
```
|
||||
$ docker-compose up -d
|
||||
```
|
||||
|
||||
|
||||
The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated.
|
||||
@@ -28,27 +28,6 @@ http {
|
||||
server_tokens off;
|
||||
gzip on;
|
||||
|
||||
# Dashboard UI
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
return 301 https://$host:443$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 default_server ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
ssl_certificate /etc/nginx/ssl/cert.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/key.pem;
|
||||
location / {
|
||||
proxy_pass https://wazuh.dashboard:443/;
|
||||
proxy_ssl_verify off;
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 4 256k;
|
||||
proxy_busy_buffers_size 256k;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
@@ -332,7 +332,7 @@
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>wazuh-master</node>
|
||||
<node>wazuh.master</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>no</disabled>
|
||||
@@ -332,7 +332,7 @@
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>wazuh-master</node>
|
||||
<node>wazuh.master</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>no</disabled>
|
||||
204
multi-node/docker-compose.yml
Normal file
204
multi-node/docker-compose.yml
Normal file
@@ -0,0 +1,204 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.master:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.master
|
||||
restart: always
|
||||
ports:
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- master-wazuh-api-configuration:/var/ossec/api/configuration
|
||||
- master-wazuh-etc:/var/ossec/etc
|
||||
- master-wazuh-logs:/var/ossec/logs
|
||||
- master-wazuh-queue:/var/ossec/queue
|
||||
- master-wazuh-var-multigroups:/var/ossec/var/multigroups
|
||||
- master-wazuh-integrations:/var/ossec/integrations
|
||||
- master-wazuh-active-response:/var/ossec/active-response/bin
|
||||
- master-wazuh-agentless:/var/ossec/agentless
|
||||
- master-wazuh-wodles:/var/ossec/wodles
|
||||
- master-filebeat-etc:/etc/filebeat
|
||||
- master-filebeat-var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.worker:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.worker
|
||||
restart: always
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
volumes:
|
||||
- worker-wazuh-api-configuration:/var/ossec/api/configuration
|
||||
- worker-wazuh-etc:/var/ossec/etc
|
||||
- worker-wazuh-logs:/var/ossec/logs
|
||||
- worker-wazuh-queue:/var/ossec/queue
|
||||
- worker-wazuh-var-multigroups:/var/ossec/var/multigroups
|
||||
- worker-wazuh-integrations:/var/ossec/integrations
|
||||
- worker-wazuh-active-response:/var/ossec/active-response/bin
|
||||
- worker-wazuh-agentless:/var/ossec/agentless
|
||||
- worker-wazuh-wodles:/var/ossec/wodles
|
||||
- worker-filebeat-etc:/etc/filebeat
|
||||
- worker-filebeat-var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key
|
||||
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh1.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh2.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh2.indexer
|
||||
restart: always
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh3.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh3.indexer
|
||||
restart: always
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
- 443:443
|
||||
environment:
|
||||
- OPENSEARCH_HOSTS="https://wazuh1.indexer:9200"
|
||||
- WAZUH_API_URL="https://wazuh.master"
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
depends_on:
|
||||
- wazuh1.indexer
|
||||
links:
|
||||
- wazuh1.indexer:wazuh1.indexer
|
||||
- wazuh.master:wazuh.master
|
||||
|
||||
nginx:
|
||||
image: nginx:stable
|
||||
hostname: nginx
|
||||
restart: always
|
||||
ports:
|
||||
- "1514:1514"
|
||||
depends_on:
|
||||
- wazuh.master
|
||||
- wazuh.worker
|
||||
- wazuh.dashboard
|
||||
links:
|
||||
- wazuh.master:wazuh.master
|
||||
- wazuh.worker:wazuh.worker
|
||||
- wazuh.dashboard:wazuh.dashboard
|
||||
volumes:
|
||||
- ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
|
||||
volumes:
|
||||
master-wazuh-api-configuration:
|
||||
master-wazuh-etc:
|
||||
master-wazuh-logs:
|
||||
master-wazuh-queue:
|
||||
master-wazuh-var-multigroups:
|
||||
master-wazuh-integrations:
|
||||
master-wazuh-active-response:
|
||||
master-wazuh-agentless:
|
||||
master-wazuh-wodles:
|
||||
master-filebeat-etc:
|
||||
master-filebeat-var:
|
||||
worker-wazuh-api-configuration:
|
||||
worker-wazuh-etc:
|
||||
worker-wazuh-logs:
|
||||
worker-wazuh-queue:
|
||||
worker-wazuh-var-multigroups:
|
||||
worker-wazuh-integrations:
|
||||
worker-wazuh-active-response:
|
||||
worker-wazuh-agentless:
|
||||
worker-wazuh-wodles:
|
||||
worker-filebeat-etc:
|
||||
worker-filebeat-var:
|
||||
wazuh-indexer-data-1:
|
||||
wazuh-indexer-data-2:
|
||||
wazuh-indexer-data-3:
|
||||
@@ -6,5 +6,5 @@ services:
|
||||
image: wazuh/wazuh-certs-generator:0.0.1
|
||||
hostname: wazuh-certs-generator
|
||||
volumes:
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/certs.yml:/config.yml
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/:/certificates/
|
||||
- ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/:/certificates/
|
||||
279
multi-node/volume-migrator.sh
Executable file
279
multi-node/volume-migrator.sh
Executable file
@@ -0,0 +1,279 @@
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-1 \
|
||||
$2_wazuh-indexer-data-1
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-2 \
|
||||
$2_wazuh-indexer-data-2
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=wazuh-indexer-data-3 \
|
||||
$2_wazuh-indexer-data-3
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master_wazuh_api_configuration \
|
||||
$2_master_wazuh_api_configuration
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master_wazuh_etc \
|
||||
$2_docker_wazuh_etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-logs \
|
||||
$2_master-wazuh-logs
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-queue \
|
||||
$2_master-wazuh-queue
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-var-multigroups \
|
||||
$2_master-wazuh-var-multigroups
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-integrations \
|
||||
$2_master-wazuh-integrations
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-active-response \
|
||||
$2_master-wazuh-active-response
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-agentless \
|
||||
$2_master-wazuh-agentless
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-wazuh-wodles \
|
||||
$2_master-wazuh-wodles
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-filebeat-etc \
|
||||
$2_master-filebeat-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=master-filebeat-var \
|
||||
$2_master-filebeat-var
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker_wazuh_api_configuration \
|
||||
$2_worker_wazuh_api_configuration
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker_wazuh_etc \
|
||||
$2_worker-wazuh-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-logs \
|
||||
$2_worker-wazuh-logs
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-queue \
|
||||
$2_worker-wazuh-queue
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
|
||||
$2_worker-wazuh-var-multigroups
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-integrations \
|
||||
$2_worker-wazuh-integrations
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-active-response \
|
||||
$2_worker-wazuh-active-response
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-agentless \
|
||||
$2_worker-wazuh-agentless
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-wazuh-wodles \
|
||||
$2_worker-wazuh-wodles
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-filebeat-etc \
|
||||
$2_worker-filebeat-etc
|
||||
|
||||
docker volume create \
|
||||
--label com.docker.compose.project=$2 \
|
||||
--label com.docker.compose.version=$1 \
|
||||
--label com.docker.compose.volume=worker-filebeat-var \
|
||||
$2_worker-filebeat-var
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-filebeat-var:/from \
|
||||
-v $2_worker-filebeat-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-1:/from \
|
||||
-v $2_wazuh-indexer-data-1:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-2:/from \
|
||||
-v $2_wazuh-indexer-data-2:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_elastic-data-3:/from \
|
||||
-v $2_wazuh-indexer-data-3:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-api-configuration:/from \
|
||||
-v $2_master-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-etc:/from \
|
||||
-v $2_master-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-logs:/from \
|
||||
-v $2_master-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-queue:/from \
|
||||
-v $2_master-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-var-multigroups:/from \
|
||||
-v $2_master-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-integrations:/from \
|
||||
-v $2_master-wazuh-integrations:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-active-response:/from \
|
||||
-v $2_master-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-agentless:/from \
|
||||
-v $2_master-wazuh-agentless:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_ossec-wodles:/from \
|
||||
-v $2_master-wazuh-wodles:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_filebeat-etc:/from \
|
||||
-v $2_master-filebeat-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_filebeat-var:/from \
|
||||
-v $2_master-filebeat-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-api-configuration:/from \
|
||||
-v $2_worker-wazuh-api-configuration:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-etc:/from \
|
||||
-v $2_worker-wazuh-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-logs:/from \
|
||||
-v $2_worker-wazuh-logs:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-queue:/from \
|
||||
-v $2_worker-wazuh-queue:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-var-multigroups:/from \
|
||||
-v $2_worker-wazuh-var-multigroups:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-integrations:/from \
|
||||
-v $2_worker-wazuh-integrations:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-active-response:/from \
|
||||
-v $2_worker-wazuh-active-response:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-agentless:/from \
|
||||
-v $2_worker-wazuh-agentless:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-ossec-wodles:/from \
|
||||
-v $2_worker-wazuh-wodles:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-filebeat-etc:/from \
|
||||
-v $2_worker-filebeat-etc:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
|
||||
docker container run --rm -it \
|
||||
-v wazuh-docker_worker-filebeat-var:/from \
|
||||
-v $2_worker-filebeat-var:/to \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
@@ -1,205 +0,0 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.master:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.master
|
||||
restart: always
|
||||
ports:
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- ossec-api-configuration:/var/ossec/api/configuration
|
||||
- ossec-etc:/var/ossec/etc
|
||||
- ossec-logs:/var/ossec/logs
|
||||
- ossec-queue:/var/ossec/queue
|
||||
- ossec-var-multigroups:/var/ossec/var/multigroups
|
||||
- ossec-integrations:/var/ossec/integrations
|
||||
- ossec-active-response:/var/ossec/active-response/bin
|
||||
- ossec-agentless:/var/ossec/agentless
|
||||
- ossec-wodles:/var/ossec/wodles
|
||||
- filebeat-etc:/etc/filebeat
|
||||
- filebeat-var:/var/lib/filebeat
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master.pem:/etc/ssl/filebeat.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.master-key.pem:/etc/ssl/filebeat.key
|
||||
- ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.worker:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.worker
|
||||
restart: always
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh1.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
volumes:
|
||||
- worker-ossec-api-configuration:/var/ossec/api/configuration
|
||||
- worker-ossec-etc:/var/ossec/etc
|
||||
- worker-ossec-logs:/var/ossec/logs
|
||||
- worker-ossec-queue:/var/ossec/queue
|
||||
- worker-ossec-var-multigroups:/var/ossec/var/multigroups
|
||||
- worker-ossec-integrations:/var/ossec/integrations
|
||||
- worker-ossec-active-response:/var/ossec/active-response/bin
|
||||
- worker-ossec-agentless:/var/ossec/agentless
|
||||
- worker-ossec-wodles:/var/ossec/wodles
|
||||
- worker-filebeat-etc:/etc/filebeat
|
||||
- worker-filebeat-var:/var/lib/filebeat
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker.pem:/etc/ssl/filebeat.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.worker-key.pem:/etc/ssl/filebeat.key
|
||||
- ./production_cluster/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh1.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.key
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/wazuh1.indexer.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem
|
||||
- ./production_cluster/wazuh-indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh2.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh2.indexer
|
||||
restart: always
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.key
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/wazuh2.indexer.pem
|
||||
- ./production_cluster/wazuh-indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh3.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh3.indexer
|
||||
restart: always
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "bootstrap.memory_lock=true"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.key
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/wazuh3.indexer.pem
|
||||
- ./production_cluster/wazuh-indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./production_cluster/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
environment:
|
||||
- OPENSEARCH_HOSTS="https://wazuh1.indexer:9200"
|
||||
- WAZUH_API_URL="https://wazuh.master"
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||
- ./production_cluster/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./production_cluster/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/opensearch_dashboards.yml
|
||||
- ./production_cluster/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
depends_on:
|
||||
- wazuh1.indexer
|
||||
links:
|
||||
- wazuh1.indexer:wazuh1.indexer
|
||||
- wazuh.master:wazuh.master
|
||||
|
||||
nginx:
|
||||
image: nginx:stable
|
||||
hostname: nginx
|
||||
restart: always
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
- "1514:1514"
|
||||
depends_on:
|
||||
- wazuh.master
|
||||
- wazuh.worker
|
||||
- wazuh.dashboard
|
||||
links:
|
||||
- wazuh.master:wazuh.master
|
||||
- wazuh.worker:wazuh.worker
|
||||
- wazuh.dashboard:wazuh.dashboard
|
||||
volumes:
|
||||
- ./production_cluster/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
|
||||
- ./production_cluster/nginx/ssl:/etc/nginx/ssl:ro
|
||||
|
||||
volumes:
|
||||
ossec-api-configuration:
|
||||
ossec-etc:
|
||||
ossec-logs:
|
||||
ossec-queue:
|
||||
ossec-var-multigroups:
|
||||
ossec-integrations:
|
||||
ossec-active-response:
|
||||
ossec-agentless:
|
||||
ossec-wodles:
|
||||
filebeat-etc:
|
||||
filebeat-var:
|
||||
worker-ossec-api-configuration:
|
||||
worker-ossec-etc:
|
||||
worker-ossec-logs:
|
||||
worker-ossec-queue:
|
||||
worker-ossec-var-multigroups:
|
||||
worker-ossec-integrations:
|
||||
worker-ossec-active-response:
|
||||
worker-ossec-agentless:
|
||||
worker-ossec-wodles:
|
||||
worker-filebeat-etc:
|
||||
worker-filebeat-var:
|
||||
wazuh-indexer-data-1:
|
||||
wazuh-indexer-data-2:
|
||||
wazuh-indexer-data-3:
|
||||
@@ -1,12 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||
cd $DIR
|
||||
|
||||
if [ -s key.pem ]
|
||||
then
|
||||
echo "Certificate already exists"
|
||||
exit
|
||||
else
|
||||
openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem
|
||||
fi
|
||||
24
single-node/README.md
Normal file
24
single-node/README.md
Normal file
@@ -0,0 +1,24 @@
|
||||
# Deploy Wazuh Docker in single node configuration
|
||||
|
||||
This deployment is defined in the `docker-compose.yml` file with one Wazuh manager containers, one Wazuh indexer containers, and one Wazuh dashboard container. It can be deployed by following these steps:
|
||||
|
||||
1) Increase max_map_count on your host (Linux). This command must be run with root permissions:
|
||||
```
|
||||
$ sysctl -w vm.max_map_count=262144
|
||||
```
|
||||
2) Run the certificate creation script:
|
||||
```
|
||||
$ docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
```
|
||||
3) Start the environment with docker-compose:
|
||||
|
||||
- In the foregroud:
|
||||
```
|
||||
$ docker-compose up
|
||||
```
|
||||
- In the background:
|
||||
```
|
||||
$ docker-compose up -d
|
||||
```
|
||||
|
||||
The environment takes about 1 minute to get up (depending on your Docker host) for the first time since Wazuh Indexer must be started for the first time and the indexes and index patterns must be generated.
|
||||
353
single-node/config/wazuh_cluster/wazuh_manager.conf
Normal file
353
single-node/config/wazuh_cluster/wazuh_manager.conf
Normal file
@@ -0,0 +1,353 @@
|
||||
<ossec_config>
|
||||
<global>
|
||||
<jsonout_output>yes</jsonout_output>
|
||||
<alerts_log>yes</alerts_log>
|
||||
<logall>no</logall>
|
||||
<logall_json>no</logall_json>
|
||||
<email_notification>no</email_notification>
|
||||
<smtp_server>smtp.example.wazuh.com</smtp_server>
|
||||
<email_from>wazuh@example.wazuh.com</email_from>
|
||||
<email_to>recipient@example.wazuh.com</email_to>
|
||||
<email_maxperhour>12</email_maxperhour>
|
||||
<email_log_source>alerts.log</email_log_source>
|
||||
<agents_disconnection_time>10m</agents_disconnection_time>
|
||||
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
|
||||
</global>
|
||||
|
||||
<alerts>
|
||||
<log_alert_level>3</log_alert_level>
|
||||
<email_alert_level>12</email_alert_level>
|
||||
</alerts>
|
||||
|
||||
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
||||
<logging>
|
||||
<log_format>plain</log_format>
|
||||
</logging>
|
||||
|
||||
<remote>
|
||||
<connection>secure</connection>
|
||||
<port>1514</port>
|
||||
<protocol>tcp</protocol>
|
||||
<queue_size>131072</queue_size>
|
||||
</remote>
|
||||
|
||||
<!-- Policy monitoring -->
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<wodle name="cis-cat">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
|
||||
<java_path>wodles/java</java_path>
|
||||
<ciscat_path>wodles/ciscat</ciscat_path>
|
||||
</wodle>
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>yes</disabled>
|
||||
<run_daemon>yes</run_daemon>
|
||||
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
||||
<config_path>/etc/osquery/osquery.conf</config_path>
|
||||
<add_labels>yes</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>no</disabled>
|
||||
<interval>1h</interval>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<hardware>yes</hardware>
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="no">yes</ports>
|
||||
<processes>yes</processes>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
<synchronization>
|
||||
<max_eps>10</max_eps>
|
||||
</synchronization>
|
||||
</wodle>
|
||||
|
||||
<sca>
|
||||
<enabled>yes</enabled>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<interval>12h</interval>
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</sca>
|
||||
|
||||
<vulnerability-detector>
|
||||
<enabled>no</enabled>
|
||||
<interval>5m</interval>
|
||||
<min_full_scan_interval>6h</min_full_scan_interval>
|
||||
<run_on_start>yes</run_on_start>
|
||||
|
||||
<!-- Ubuntu OS vulnerabilities -->
|
||||
<provider name="canonical">
|
||||
<enabled>no</enabled>
|
||||
<os>trusty</os>
|
||||
<os>xenial</os>
|
||||
<os>bionic</os>
|
||||
<os>focal</os>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- Debian OS vulnerabilities -->
|
||||
<provider name="debian">
|
||||
<enabled>no</enabled>
|
||||
<os>stretch</os>
|
||||
<os>buster</os>
|
||||
<os>bullseye</os>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- RedHat OS vulnerabilities -->
|
||||
<provider name="redhat">
|
||||
<enabled>no</enabled>
|
||||
<os>5</os>
|
||||
<os>6</os>
|
||||
<os>7</os>
|
||||
<os>8</os>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- Amazon Linux OS vulnerabilities -->
|
||||
<provider name="alas">
|
||||
<enabled>no</enabled>
|
||||
<os>amazon-linux</os>
|
||||
<os>amazon-linux-2</os>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- Arch OS vulnerabilities -->
|
||||
<provider name="arch">
|
||||
<enabled>no</enabled>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- Windows OS vulnerabilities -->
|
||||
<provider name="msu">
|
||||
<enabled>yes</enabled>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
<!-- Aggregate vulnerabilities -->
|
||||
<provider name="nvd">
|
||||
<enabled>yes</enabled>
|
||||
<update_from_year>2010</update_from_year>
|
||||
<update_interval>1h</update_interval>
|
||||
</provider>
|
||||
|
||||
</vulnerability-detector>
|
||||
|
||||
<!-- File integrity monitoring -->
|
||||
<syscheck>
|
||||
<disabled>no</disabled>
|
||||
|
||||
<!-- Frequency that syscheck is executed default every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
|
||||
<!-- Generate alert when new file detected -->
|
||||
<alert_new_files>yes</alert_new_files>
|
||||
|
||||
<!-- Don't ignore files that change more than 'frequency' times -->
|
||||
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
<directories>/etc,/usr/bin,/usr/sbin</directories>
|
||||
<directories>/bin,/sbin,/boot</directories>
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
<ignore>/etc/mtab</ignore>
|
||||
<ignore>/etc/hosts.deny</ignore>
|
||||
<ignore>/etc/mail/statistics</ignore>
|
||||
<ignore>/etc/random-seed</ignore>
|
||||
<ignore>/etc/random.seed</ignore>
|
||||
<ignore>/etc/adjtime</ignore>
|
||||
<ignore>/etc/httpd/logs</ignore>
|
||||
<ignore>/etc/utmpx</ignore>
|
||||
<ignore>/etc/wtmpx</ignore>
|
||||
<ignore>/etc/cups/certs</ignore>
|
||||
<ignore>/etc/dumpdates</ignore>
|
||||
<ignore>/etc/svc/volatile</ignore>
|
||||
|
||||
<!-- File types to ignore -->
|
||||
<ignore type="sregex">.log$|.swp$</ignore>
|
||||
|
||||
<!-- Check the file, but never compute the diff -->
|
||||
<nodiff>/etc/ssl/private.key</nodiff>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
<skip_dev>yes</skip_dev>
|
||||
<skip_proc>yes</skip_proc>
|
||||
<skip_sys>yes</skip_sys>
|
||||
|
||||
<!-- Nice value for Syscheck process -->
|
||||
<process_priority>10</process_priority>
|
||||
|
||||
<!-- Maximum output throughput -->
|
||||
<max_eps>100</max_eps>
|
||||
|
||||
<!-- Database synchronization settings -->
|
||||
<synchronization>
|
||||
<enabled>yes</enabled>
|
||||
<interval>5m</interval>
|
||||
<max_interval>1h</max_interval>
|
||||
<max_eps>10</max_eps>
|
||||
</synchronization>
|
||||
</syscheck>
|
||||
|
||||
<!-- Active response -->
|
||||
<global>
|
||||
<white_list>127.0.0.1</white_list>
|
||||
<white_list>^localhost.localdomain$</white_list>
|
||||
<white_list>10.0.0.106</white_list>
|
||||
</global>
|
||||
|
||||
<command>
|
||||
<name>disable-account</name>
|
||||
<executable>disable-account</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>restart-wazuh</name>
|
||||
<executable>restart-wazuh</executable>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>firewall-drop</name>
|
||||
<executable>firewall-drop</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>host-deny</name>
|
||||
<executable>host-deny</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>route-null</name>
|
||||
<executable>route-null</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>win_route-null</name>
|
||||
<executable>route-null.exe</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>netsh</name>
|
||||
<executable>netsh.exe</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<!--
|
||||
<active-response>
|
||||
active-response options here
|
||||
</active-response>
|
||||
-->
|
||||
|
||||
<!-- Log analysis -->
|
||||
<localfile>
|
||||
<log_format>command</log_format>
|
||||
<command>df -P</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
||||
<alias>netstat listening ports</alias>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>last -n 20</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<ruleset>
|
||||
<!-- Default ruleset -->
|
||||
<decoder_dir>ruleset/decoders</decoder_dir>
|
||||
<rule_dir>ruleset/rules</rule_dir>
|
||||
<rule_exclude>0215-policy_rules.xml</rule_exclude>
|
||||
<list>etc/lists/audit-keys</list>
|
||||
<list>etc/lists/amazon/aws-eventnames</list>
|
||||
<list>etc/lists/security-eventchannel</list>
|
||||
|
||||
<!-- User-defined ruleset -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
</ruleset>
|
||||
|
||||
<rule_test>
|
||||
<enabled>yes</enabled>
|
||||
<threads>1</threads>
|
||||
<max_sessions>64</max_sessions>
|
||||
<session_timeout>15m</session_timeout>
|
||||
</rule_test>
|
||||
|
||||
<!-- Configuration for wazuh-authd -->
|
||||
<auth>
|
||||
<disabled>no</disabled>
|
||||
<port>1515</port>
|
||||
<use_source_ip>no</use_source_ip>
|
||||
<purge>yes</purge>
|
||||
<use_password>no</use_password>
|
||||
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
||||
<!-- <ssl_agent_ca></ssl_agent_ca> -->
|
||||
<ssl_verify_host>no</ssl_verify_host>
|
||||
<ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
|
||||
<ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
|
||||
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
||||
</auth>
|
||||
|
||||
<cluster>
|
||||
<name>wazuh</name>
|
||||
<node_name>node01</node_name>
|
||||
<node_type>master</node_type>
|
||||
<key></key>
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>NODE_IP</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>yes</disabled>
|
||||
</cluster>
|
||||
|
||||
</ossec_config>
|
||||
|
||||
<ossec_config>
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/ossec/logs/active-responses.log</location>
|
||||
</localfile>
|
||||
|
||||
</ossec_config>
|
||||
12
single-node/config/wazuh_dashboard/opensearch_dashboards.yml
Normal file
12
single-node/config/wazuh_dashboard/opensearch_dashboards.yml
Normal file
@@ -0,0 +1,12 @@
|
||||
server.host: 0.0.0.0
|
||||
server.port: 443
|
||||
opensearch.hosts: https://wazuh.indexer:9200
|
||||
opensearch.ssl.verificationMode: certificate
|
||||
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
|
||||
opensearch_security.multitenancy.enabled: false
|
||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
||||
server.ssl.enabled: true
|
||||
server.ssl.key: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
|
||||
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem"
|
||||
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
||||
uiSettings.overrides.defaultRoute: /app/wazuh?security_tenant=global
|
||||
7
single-node/config/wazuh_dashboard/wazuh.yml
Normal file
7
single-node/config/wazuh_dashboard/wazuh.yml
Normal file
@@ -0,0 +1,7 @@
|
||||
hosts:
|
||||
- 1513629884013:
|
||||
url: "https://wazuh.manager"
|
||||
port: 55000
|
||||
username: acme-user
|
||||
password: MyS3cr37P450r.*-
|
||||
run_as: false
|
||||
56
single-node/config/wazuh_indexer/internal_users.yml
Normal file
56
single-node/config/wazuh_indexer/internal_users.yml
Normal file
@@ -0,0 +1,56 @@
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Define your internal users here
|
||||
|
||||
## Demo users
|
||||
|
||||
admin:
|
||||
hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Demo admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
||||
reserved: true
|
||||
description: "Demo kibanaserver user"
|
||||
|
||||
kibanaro:
|
||||
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
- "readall"
|
||||
attributes:
|
||||
attribute1: "value1"
|
||||
attribute2: "value2"
|
||||
attribute3: "value3"
|
||||
description: "Demo kibanaro user"
|
||||
|
||||
logstash:
|
||||
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
description: "Demo logstash user"
|
||||
|
||||
readall:
|
||||
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
description: "Demo readall user"
|
||||
|
||||
snapshotrestore:
|
||||
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
description: "Demo snapshotrestore user"
|
||||
27
single-node/config/wazuh_indexer/wazuh.indexer.yml
Normal file
27
single-node/config/wazuh_indexer/wazuh.indexer.yml
Normal file
@@ -0,0 +1,27 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
plugins.security.audit.type: internal_opensearch
|
||||
plugins.security.authcz.admin_dn:
|
||||
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.nodes_dn:
|
||||
- "CN=wazuh.indexer,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
|
||||
16
single-node/config/wazuh_indexer_ssl_certs/certs.yml
Normal file
16
single-node/config/wazuh_indexer_ssl_certs/certs.yml
Normal file
@@ -0,0 +1,16 @@
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
|
||||
# Wazuh server nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
server:
|
||||
name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
102
single-node/docker-compose.yml
Normal file
102
single-node/docker-compose.yml
Normal file
@@ -0,0 +1,102 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:4.3.0
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||
- wazuh_etc:/var/ossec/etc
|
||||
- wazuh_logs:/var/ossec/logs
|
||||
- wazuh_queue:/var/ossec/queue
|
||||
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||
- wazuh_integrations:/var/ossec/integrations
|
||||
- wazuh_active_response:/var/ossec/active-response/bin
|
||||
- wazuh_agentless:/var/ossec/agentless
|
||||
- wazuh_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.0
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.0
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
- 443:443
|
||||
environment:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- API_USERNAME=acme-user
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
links:
|
||||
- wazuh.indexer:wazuh.indexer
|
||||
- wazuh.manager:wazuh.manager
|
||||
|
||||
volumes:
|
||||
wazuh_api_configuration:
|
||||
wazuh_etc:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_integrations:
|
||||
wazuh_active_response:
|
||||
wazuh_agentless:
|
||||
wazuh_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
wazuh-indexer-data:
|
||||
10
single-node/generate-indexer-certs.yml
Normal file
10
single-node/generate-indexer-certs.yml
Normal file
@@ -0,0 +1,10 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3'
|
||||
|
||||
services:
|
||||
generator:
|
||||
image: wazuh/wazuh-certs-generator:0.0.1
|
||||
hostname: wazuh-certs-generator
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/certs.yml:/config.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/:/certificates/
|
||||
Reference in New Issue
Block a user