update to v4.2.5

Former-commit-id: 02f024ef9a

wazuh/Dockerfile

@@ -2,8 +2,8 @@
 FROM waystonesystems/baseimage-centos:0.2.0
 
 # Arguments
-ARG FILEBEAT_VERSION=7.9.1
+ARG FILEBEAT_VERSION=7.10.2
-ARG WAZUH_VERSION=4.0.1-1
+ARG WAZUH_VERSION=4.2.5-1
 
 # Environment variables
 ENV API_USER="foo" \
@@ -17,13 +17,13 @@ RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
 RUN echo $'[wazuh] \n\
 gpgcheck=1\n\
 gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\n\
-gpgcheck=0\n\
 enabled=1\n\
 name=Wazuh repository\n\
 baseurl=https://packages.wazuh.com/4.x/yum/\n\
 protect=1\n'\
 >> /etc/yum.repos.d/wazuh.repo
 
+
 # Install packages
 RUN set -x && \
     curl -sL https://rpm.nodesource.com/setup_8.x | bash - && \
@@ -41,7 +41,7 @@ RUN set -x && \
     rm -f /var/ossec/logs/firewall/*/*/* && \
     rm -f /var/ossec/logs/api/*/*/* && \
     rm -f /var/ossec/logs/cluster/*/*/* && \
-    rm -f /var/ossec/logs/ossec/*/*/* && \
+    rm -f /var/ossec/logs/wazuh/*/*/* && \
     curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
     rpm -vi filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm && \
     sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

wazuh/config/01-wazuh.sh

@@ -35,20 +35,17 @@ exec_cmd_stdout() {
 ##############################################################################
 # Check_update
 # This function considers the following cases:
-# - If /var/ossec/etc/ossec-init.conf does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh
+# - If /var/ossec/etc/VERSION does not exist -> Action Nothing. There is no data in the EBS. First time deploying Wazuh
-# - If /var/ossec/etc/VERSION does not exist -> Action: Update. The previous version was prior to 3.11.5.
+# - If different Wazuh version -> Action: Update. The previous version is older than the current one.
-# - If both files exist: different Wazuh version -> Action: Update. The previous version is older than the current one.
+# - If the same Wazuh version -> Acton: Nothing. Same Wazuh version.
-# - If both files exist: the same Wazuh version -> Acton: Nothing. Same Wazuh version.
 ##############################################################################
 
 check_update() {
-  if [ -e /var/ossec/etc/ossec-init.conf ]
-  then
   if [ -e /var/ossec/etc/VERSION ]
   then
     previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2)
     echo "Previous version: $previous_version"
-      current_version=$(cat ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/etc/ossec-init.conf | grep -i version | cut -d'"' -f2)
+    current_version=$(/var/ossec/bin/wazuh-control -j info | jq .data[0].WAZUH_VERSION | cut -d'"' -f2)
     echo "Current version: $current_version"
     if [ $previous_version == $current_version ]
     then
@@ -56,23 +53,38 @@ check_update() {
       return 0
     else
       echo "Different Wazuh version: Update"
-        mayor_previous_version=$(cat /var/ossec/etc/VERSION | grep -i version | cut -d'"' -f2 | cut -d'.' -f1)
+      if [ $previous_version == "v4.1.5" ]
-        if [[ ${mayor_previous_version} == "v3" ]]; then
+      then
-          echo "Remove Wazuh API deprecated files"
+        echo "Remove simbolic link from ossec-init.conf"
-          rm -rf "${WAZUH_INSTALL_PATH}/api/configuration/auth"
+        unlink /var/ossec/etc/ossec-init.conf
-          rm "${WAZUH_INSTALL_PATH}/api/configuration/config.js"
+        echo "Change /var/ossec/queue/ossec path to /var/ossec/queue/sockets"
-          rm "${WAZUH_INSTALL_PATH}/api/configuration/preloaded_vars.conf"
+        mkdir /var/ossec/queue/sockets
-          echo "Load new API configuration"
+        chown ossec:ossec /var/ossec/queue/sockets
-          exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/api/configuration/. /var/ossec/api/configuration"
+        chmod 770 /var/ossec/queue/sockets
-          echo "Remove Wazuh agent-info queue"
+        exec_cmd "cp -ra /var/ossec/queue/ossec/. /var/ossec/queue/sockets/"
-          rm -rf "${WAZUH_INSTALL_PATH}/queue/agent-info"
+        rm -rf /var/ossec/queue/ossec
+
+        echo "Change /var/ossec/logs/ossec path to /var/ossec/logs/wazuh"
+        mkdir /var/ossec/logs/wazuh
+        chown ossec:ossec /var/ossec/logs/wazuh
+        chmod 750 /var/ossec/logs/wazuh
+        exec_cmd "cp -ra /var/ossec/logs/ossec/. /var/ossec/logs/wazuh/"
+        rm -rf /var/ossec/logs/ossec
+
+        echo "Restore logcollector queue dir"
+        mkdir /var/ossec/queue/logcollector
+        chown ossec:ossec /var/ossec/queue/logcollector
+        chmod 750 /var/ossec/queue/logcollector
+        exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/logcollector/. /var/ossec/queue/logcollector"
+
+        echo "Restore syscollector queue dir"
+        mkdir /var/ossec/queue/syscollector
+        chown ossec:ossec /var/ossec/queue/syscollector
+        chmod 750 /var/ossec/queue/syscollector
+        exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent/var/ossec/queue/syscollector/. /var/ossec/queue/syscollector"
       fi
       return 1
     fi
-    else
-      echo "Previous version prior to 3.11.5: Update"
-      return 1
-    fi
   else
     echo "First time mounting EBS"
     return 0
@@ -150,7 +162,7 @@ remove_data_files() {
 ##############################################################################
 
 create_ossec_key_cert() {
-  print "Creating ossec-authd key and cert"
+  print "Creating wazuh-authd key and cert"
   exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096"
   exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
 }
@@ -180,7 +192,7 @@ mount_files() {
 ##############################################################################
 
 function ossec_shutdown(){
-  ${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
+  ${WAZUH_INSTALL_PATH}/bin/wazuh-control stop;
 }
 
 ##############################################################################
@@ -188,7 +200,7 @@ function ossec_shutdown(){
 # paths or commands, and execute them. 
 #
 # This can be useful for actions that need to be run before the services are
-# started, such as "/var/ossec/bin/ossec-control enable agentless".
+# started, such as "/var/ossec/bin/wazuh-control enable agentless".
 ##############################################################################
 
 docker_custom_args() {
@@ -280,7 +292,7 @@ main() {
     echo "Keeping databases"
   fi
 
-  # Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
+  # Generate wazuh-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist
   if [ $AUTO_ENROLLMENT_ENABLED == true ]
   then
     if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ]

wazuh/config/85-save_wazuh_version.sh

@@ -3,4 +3,4 @@
 
 # Copy /var/ossec/etc/ossec-init.conf contents in /var/ossec/etc/VERSION to be able to check the previous Wazuh version in pod.
 echo "Adding Wazuh version to /var/ossec/etc/VERSION"
-cat /var/ossec/etc/ossec-init.conf > /var/ossec/etc/VERSION
+/var/ossec/bin/wazuh-control info > /var/ossec/etc/VERSION

wazuh/config/permanent_data.env

@@ -16,31 +16,27 @@ export PERMANENT_DATA
 
 # Files mounted in a volume that should not be permanent
 i=0
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.crt"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/api/configuration/ssl/server.key"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/wazuh-slack"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
@@ -63,8 +59,8 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py"
+PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json"
-PERMANENT_DATA_EXCP[((i++))]="/var/ossec/queue/vulnerabilities/dictionaries/msu.json.gz"
 PERMANENT_DATA_EXCP[((i++))]="/var/ossec/var/db/mitre.db"
 export PERMANENT_DATA_EXCP