Merge pull request #236 from wazuh/cloud-0.6-debug

Cloud 0.6 - fixes

Former-commit-id: 93eb42bb96

elasticsearch/config/10-config_cluster.sh

@@ -3,6 +3,9 @@
 
 elastic_config_file="/usr/share/elasticsearch/config/elasticsearch.yml"
 
+original_file="/usr/share/elasticsearch/config/original-elasticsearch.yml"
+
+cp $elastic_config_file $original_file 
 
 # If Elasticsearch cluster is enable
 if [[ $ELASTIC_CLUSTER == "true" ]]
@@ -10,7 +13,6 @@ then
   
   # Set the cluster.name and discovery.zen.minimun_master_nodes variables
   sed -i 's:cluster.name\: "docker-cluster":cluster.name\: "'$CLUSTER_NAME'":g' $elastic_config_file
-  sed -i 's:discovery.zen.minimum_master_nodes\: 1:discovery.zen.minimum_master_nodes\: '$CLUSTER_NUMBER_OF_MASTERS':g' $elastic_config_file
 
   # Add the cluster configuration
   echo "
@@ -28,6 +30,7 @@ bootstrap:
 discovery:
   zen:
     ping.unicast.hosts: ${CLUSTER_DISCOVERY_SERVICE}
+    minimum_master_nodes: ${CLUSTER_NUMBER_OF_MASTERS}
   
 " >> $elastic_config_file
 fi

elasticsearch/config/configure_s3.sh

@@ -76,15 +76,15 @@ function CreateRepo()
     repository="$repository_name-$version"
     s3_path="$path/$version"
 
-    curl ${auth} -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d'
-        {
-            "type": "s3",
-            "settings": {
-            "bucket": "'$bucket_name'",
-            "base_path": "'$s3_path'"
-        }
-    }
-    '
+    >&2 echo "Create S3 repository"
+
+    until curl ${auth} -X PUT "$elastic_ip_port/_snapshot/$repository" -H 'Content-Type: application/json' -d' {"type": "s3", "settings": { "bucket": "'$bucket_name'", "base_path": "'$s3_path'"} }'; do
+      >&2 echo "Elastic is unavailable, S3 repository not created - sleeping"
+      sleep 5
+    done
+
+    >&2 echo "S3 repository created"
+
 
 }
 

elasticsearch/config/load_settings.sh

@@ -100,13 +100,16 @@ done
 if [ $ENABLE_CONFIGURE_S3 ]; then
   #Wait for Elasticsearch to be ready to create the repository
   sleep 10
-
+  >&2 echo "Configure S3"
   if [ "x$S3_PATH" != "x" ]; then
-
+    >&2 echo "S3_PATH"
+    >&2 echo $S3_PATH
     if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then
+      >&2 echo "Elasticsearch major version:"
+      >&2 echo $S3_ELASTIC_MAJOR
       bash /usr/share/elasticsearch/config/configure_s3.sh $el_url $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR
-
     else
+      >&2 echo "Elasticserach major version not given"
       bash /usr/share/elasticsearch/config/configure_s3.sh $el_url $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME
 
     fi

kibana/config/20-entrypoint.sh

@@ -92,6 +92,9 @@ elasticsearch.ssl.certificateAuthorities: [\"/usr/share/kibana/config/$SECURITY_
 server.ssl.enabled: true
 server.ssl.certificate: $SECURITY_KIBANA_SSL_CERT_PATH/kibana-access.pem
 server.ssl.key: $SECURITY_KIBANA_SSL_KEY_PATH/kibana-access.key
+server.ssl.supportedProtocols: 
+  - TLSv1.1
+  - TLSv1.2
 " >> /usr/share/kibana/config/kibana.yml
 
   echo "Create SSL directories."

wazuh/Dockerfile

@@ -3,14 +3,12 @@ FROM phusion/baseimage:latest
 
 # Arguments
 ARG FILEBEAT_VERSION=6.8.1
-ARG WAZUH_VERSION=3.9.3-1
+ARG WAZUH_VERSION=3.9.4-1
 
 # Environment variables
 ENV API_USER="foo" \
     API_PASS="bar"
 
-COPY config/wazuh-manager_3.9.3-3.9.3-2_amd64.deb /tmp/wazuh-manager_3.9.3-3.9.3-2_amd64.deb
-
 # Install packages
 RUN set -x && \
     echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \
@@ -25,8 +23,8 @@ RUN set -x && \
     apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \
     apt-get --no-install-recommends --no-install-suggests -y install openssl apt-transport-https vim expect python-boto python-pip python-cryptography && \
     apt-get --no-install-recommends --no-install-suggests -y install postfix bsd-mailx mailutils libsasl2-2 ca-certificates libsasl2-modules && \
-    apt-get --no-install-recommends --no-install-suggests -y install /tmp/wazuh-manager_3.9.3-3.9.3-2_amd64.deb
-RUN apt-get --no-install-recommends --no-install-suggests -y install nodejs wazuh-api=${WAZUH_VERSION} && \
+    apt-get --no-install-recommends --no-install-suggests -y install wazuh-manager=${WAZUH_VERSION} && \
+    apt-get --no-install-recommends --no-install-suggests -y install nodejs wazuh-api=${WAZUH_VERSION} && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
     rm -f /var/ossec/logs/alerts/*/*/* && \
@@ -39,7 +37,6 @@ RUN apt-get --no-install-recommends --no-install-suggests -y install nodejs wazu
     curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb && \
     dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb
 
-
 # Services
 RUN mkdir /etc/service/wazuh && \
     mkdir /etc/service/wazuh-api && \
@@ -83,6 +80,7 @@ VOLUME ["/var/ossec/queue"]
 VOLUME ["/var/ossec/var/multigroups"]
 VOLUME ["/var/ossec/integrations"]
 VOLUME ["/var/ossec/active-response/bin"]
+VOLUME ["/var/ossec/wodles"]
 VOLUME ["/etc/filebeat"]
 VOLUME ["/etc/postfix"]
 VOLUME ["/var/lib/filebeat"]
@@ -97,5 +95,12 @@ COPY config/01-wazuh.sh /entrypoint-scripts/01-wazuh.sh
 RUN chmod 755 /entrypoint.sh && \
     chmod 755 /entrypoint-scripts/01-wazuh.sh
 
+# Workaround. 
+# Issues: Wazuh-api
+# https://github.com/wazuh/wazuh-api/issues/440  
+# https://github.com/wazuh/wazuh-api/issues/443
+COPY --chown=root:ossec config/agents.js /var/ossec/api/controllers/agents.js
+RUN chmod 770 /var/ossec/api/controllers/agents.js
+
 # Run all services
-ENTRYPOINT ["/entrypoint.sh"]
+ENTRYPOINT ["/entrypoint.sh"]

wazuh/config/01-wazuh.sh

@@ -255,13 +255,6 @@ main() {
   # Delete temporary data folder
   rm -rf ${WAZUH_INSTALL_PATH}/data_tmp
 
-  # Grant proper permissions
-  # When modifiying some files using the Wazuh API (i.e. /var/ossec/etc/ossec.conf), group rw permissions are needed for changes to take place.  
-  # https://github.com/wazuh/wazuh/issues/3647
-  chmod -R g+rw ${WAZUH_INSTALL_PATH}
-  
-  # Files inside /var/ossec/integrations should not have write permissions for group and other.
-  chmod -R 750 "/var/ossec/integrations/"
 }
 
 main

wazuh/config/permanent_data.env

@@ -36,6 +36,22 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-8-oval.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-debian-9-oval.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-ubuntu-xenial-oval.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-debian-8-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1404-ds.xml"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-ubuntu-1604-ds.xml"
 export PERMANENT_DATA_EXCP
 
 # Files mounted in a volume that should be deleted 

wazuh/config/wazuh-manager_3.9.3-3.9.3-2_amd64.deb.REMOVED.git-id

@@ -1 +0,0 @@
-a43185ce7f2251e7592c4f686f514881f5a48127