mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-10-23 04:51:57 +00:00
Compare commits
138 Commits
Author | SHA1 | Date | |
---|---|---|---|
|
ce8dd29425 | ||
|
a433989865 | ||
|
ff1e5f991a | ||
|
55ee49aff5 | ||
|
75f92308a1 | ||
|
d278782134 | ||
|
77725b7eb2 | ||
|
4e7c2cf72a | ||
|
8ce1f36f10 | ||
|
e2e95a5c57 | ||
|
b259665fc6 | ||
|
820079f1d0 | ||
|
028b5f6034 | ||
|
cd7dc4c7cf | ||
|
40faad148d | ||
|
02aaf45e9d | ||
|
cd9f211eb3 | ||
|
20c8000fec | ||
|
8ada4445b0 | ||
|
1c69a38bd8 | ||
|
615d6df29c | ||
|
949a465855 | ||
|
f7bbac5a08 | ||
|
11820b01e9 | ||
|
a8de452002 | ||
|
c76681b3b9 | ||
|
e25635cb25 | ||
|
304eedcb51 | ||
|
6123ab994c | ||
|
2f58da59de | ||
|
3279931813 | ||
|
b039567e1c | ||
|
3190c4246e | ||
|
271f421cd4 | ||
|
910e28956b | ||
|
dcf8bb8060 | ||
|
be9f3d1b90 | ||
|
91625f412c | ||
|
4c7dcb2ebf | ||
|
8febf33d58 | ||
|
3d19774d7e | ||
|
e11e7a10b8 | ||
|
7f73635651 | ||
|
e9a0be25ce | ||
|
c87580cfb5 | ||
|
e0cd80c105 | ||
|
796751aec9 | ||
|
15205ada03 | ||
|
c1bfc450ba | ||
|
b08fd3e384 | ||
|
fd08279f32 | ||
|
f42b30b71d | ||
|
7555453d55 | ||
|
22b77749fa | ||
|
6c094d07a6 | ||
|
b6959c8b15 | ||
|
28e21b0282 | ||
|
b83dcc087e | ||
|
19c23456ec | ||
|
f99721e98b | ||
|
38271d7797 | ||
|
c278f6a503 | ||
|
d6ba8c3661 | ||
|
1db718ffc8 | ||
|
cf137c6703 | ||
|
6f966cb01a | ||
|
8bc11c48d9 | ||
|
be1bc64e0f | ||
|
80e8057f79 | ||
|
296de14886 | ||
|
0245a7e0d8 | ||
|
a9ea60b951 | ||
|
b98d32d4ca | ||
|
23cb7417bc | ||
|
4c710e6c20 | ||
|
adf95cd132 | ||
|
f97a719304 | ||
|
b6aa782730 | ||
|
bf534b4143 | ||
|
1d8d594a44 | ||
|
a82cc9ec39 | ||
|
265dfd39bf | ||
|
8d9ad6152a | ||
|
28641accc2 | ||
|
5774b93977 | ||
|
9c0676014c | ||
|
f933733a85 | ||
|
2f2b8bc1f5 | ||
|
868424cdd2 | ||
|
84c4aab03d | ||
|
3d4521c7d8 | ||
|
46ec0bd67f | ||
|
61791c1984 | ||
|
2fe1eaea8f | ||
|
dc7691808b | ||
|
c3375e0141 | ||
|
5d98c157f8 | ||
|
0f2b153123 | ||
|
a84ff7b1ff | ||
|
672d1fc67a | ||
|
ecef793c7f | ||
|
8fb1b51d08 | ||
|
9b9c422dea | ||
|
3059de4c9f | ||
|
d6557165da | ||
|
174cf64b9b | ||
|
d3954c9f8d | ||
|
6dbfc1bbbf | ||
|
20d065cce3 | ||
|
de41cd08c9 | ||
|
1c80201dc9 | ||
|
f5ba9370ea | ||
|
94f62d25d3 | ||
|
0384112385 | ||
|
8d4c6c4170 | ||
|
919eab0c84 | ||
|
01e616ce76 | ||
|
46740f306a | ||
|
b718d753de | ||
|
731d3c3622 | ||
|
c17cc9a15b | ||
|
8976d2f5b6 | ||
|
03764ea251 | ||
|
7c642638ff | ||
|
6591e9ae68 | ||
|
961b8bad21 | ||
|
5555c1dd06 | ||
|
0dd044de68 | ||
|
5d88983066 | ||
|
95565df2f5 | ||
|
ed5c5d70ba | ||
|
97f5a6bf04 | ||
|
b21c3769d3 | ||
|
9cd399c2df | ||
|
3e54eeb62f | ||
|
a4be008028 | ||
|
85e62cfd0e | ||
|
84fe19e868 |
5
.env
5
.env
@@ -1,2 +1,3 @@
|
||||
WAZUH_VERSION=4.3.3
|
||||
WAZUH_IMAGE_VERSION=4.3.3
|
||||
WAZUH_VERSION=4.4.5
|
||||
WAZUH_IMAGE_VERSION=4.4.5
|
||||
WAZUH_TAG_REVISION=1
|
||||
|
62
.github/.goss.yaml
vendored
62
.github/.goss.yaml
vendored
@@ -1,3 +1,53 @@
|
||||
file:
|
||||
/etc/filebeat/filebeat.yml:
|
||||
exists: true
|
||||
mode: "0644"
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/bin/wazuh-control:
|
||||
exists: true
|
||||
mode: "0750"
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/etc/lists/audit-keys:
|
||||
exists: true
|
||||
mode: "0660"
|
||||
owner: wazuh
|
||||
group: wazuh
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/etc/ossec.conf:
|
||||
exists: true
|
||||
mode: "0660"
|
||||
owner: root
|
||||
group: wazuh
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/etc/rules/local_rules.xml:
|
||||
exists: true
|
||||
mode: "0660"
|
||||
owner: wazuh
|
||||
group: wazuh
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/etc/sslmanager.cert:
|
||||
exists: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
/var/ossec/etc/sslmanager.key:
|
||||
exists: true
|
||||
mode: "0640"
|
||||
owner: root
|
||||
group: root
|
||||
filetype: file
|
||||
contains: []
|
||||
package:
|
||||
filebeat:
|
||||
installed: true
|
||||
@@ -6,7 +56,7 @@ package:
|
||||
wazuh-manager:
|
||||
installed: true
|
||||
versions:
|
||||
- 4.3.4-1
|
||||
- 4.4.5-1
|
||||
port:
|
||||
tcp:1514:
|
||||
listening: true
|
||||
@@ -41,3 +91,13 @@ process:
|
||||
running: true
|
||||
wazuh-modulesd:
|
||||
running: true
|
||||
user:
|
||||
wazuh:
|
||||
exists: true
|
||||
groups:
|
||||
- wazuh
|
||||
home: /var/ossec
|
||||
shell: /sbin/nologin
|
||||
group:
|
||||
wazuh:
|
||||
exists: true
|
18
.github/multi-node-fb-check.sh
vendored
18
.github/multi-node-fb-check.sh
vendored
@@ -1,18 +0,0 @@
|
||||
fbout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
|
||||
fbstatus1=$(echo "${fbout1}" | grep -c OK)
|
||||
if [[ fbstatus1 -eq 7 ]]; then
|
||||
echo "No errors in master filebeat"
|
||||
else
|
||||
echo "Errors in master filebeat"
|
||||
echo "${fbout1}"
|
||||
exit 1
|
||||
fi
|
||||
fbout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
|
||||
fbstatus2=$(echo "${fbout2}" | grep -c OK)
|
||||
if [[ fbstatus2 -eq 7 ]]; then
|
||||
echo "No errors in worker filebeat"
|
||||
else
|
||||
echo "Errors in worker filebeat"
|
||||
echo "${fbout2}"
|
||||
exit 1
|
||||
fi
|
18
.github/multi-node-filebeat-check.sh
vendored
Executable file
18
.github/multi-node-filebeat-check.sh
vendored
Executable file
@@ -0,0 +1,18 @@
|
||||
filebeatout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
|
||||
filebeatstatus1=$(echo "${filebeatout1}" | grep -c OK)
|
||||
if [[ filebeatstatus1 -eq 7 ]]; then
|
||||
echo "No errors in master filebeat"
|
||||
else
|
||||
echo "Errors in master filebeat"
|
||||
echo "${filebeatout1}"
|
||||
exit 1
|
||||
fi
|
||||
filebeatout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
|
||||
filebeatstatus2=$(echo "${filebeatout2}" | grep -c OK)
|
||||
if [[ filebeatstatus2 -eq 7 ]]; then
|
||||
echo "No errors in worker filebeat"
|
||||
else
|
||||
echo "Errors in worker filebeat"
|
||||
echo "${filebeatout2}"
|
||||
exit 1
|
||||
fi
|
16
.github/multi-node-log-check.sh
vendored
16
.github/multi-node-log-check.sh
vendored
@@ -1,16 +1,16 @@
|
||||
log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
|
||||
if [[ -z "$log1" ]]; then
|
||||
echo "No errors in master ossec.log"
|
||||
echo "No errors in master ossec.log"
|
||||
else
|
||||
echo "Errors in master ossec.log:"
|
||||
echo "${log1}"
|
||||
exit 1
|
||||
echo "Errors in master ossec.log:"
|
||||
echo "${log1}"
|
||||
exit 1
|
||||
fi
|
||||
log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
|
||||
if [[ -z "${log2}" ]]; then
|
||||
echo "No errors in worker ossec.log"
|
||||
echo "No errors in worker ossec.log"
|
||||
else
|
||||
echo "Errors in worker ossec.log:"
|
||||
echo "${log2}"
|
||||
exit 1
|
||||
echo "Errors in worker ossec.log:"
|
||||
echo "${log2}"
|
||||
exit 1
|
||||
fi
|
9
.github/single-node-fb-check.sh
vendored
9
.github/single-node-fb-check.sh
vendored
@@ -1,9 +0,0 @@
|
||||
fbout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
|
||||
fbstatus=$(echo "${fbout}" | grep -c OK)
|
||||
if [[ fbstatus -eq 7 ]]; then
|
||||
echo "No errors in filebeat"
|
||||
else
|
||||
echo "Errors in filebeat"
|
||||
echo "${fbout}"
|
||||
exit 1
|
||||
fi
|
9
.github/single-node-filebeat-check.sh
vendored
Executable file
9
.github/single-node-filebeat-check.sh
vendored
Executable file
@@ -0,0 +1,9 @@
|
||||
filebeatout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
|
||||
filebeatstatus=$(echo "${filebeatout}" | grep -c OK)
|
||||
if [[ filebeatstatus -eq 7 ]]; then
|
||||
echo "No errors in filebeat"
|
||||
else
|
||||
echo "Errors in filebeat"
|
||||
echo "${filebeatout}"
|
||||
exit 1
|
||||
fi
|
8
.github/single-node-log-check.sh
vendored
8
.github/single-node-log-check.sh
vendored
@@ -1,8 +1,8 @@
|
||||
log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
|
||||
if [[ -z "$log" ]]; then
|
||||
echo "No errors in ossec.log"
|
||||
echo "No errors in ossec.log"
|
||||
else
|
||||
echo "Errors in ossec.log:"
|
||||
echo "${log}"
|
||||
exit 1
|
||||
echo "Errors in ossec.log:"
|
||||
echo "${log}"
|
||||
exit 1
|
||||
fi
|
113
.github/workflows/push.yml
vendored
113
.github/workflows/push.yml
vendored
@@ -3,7 +3,7 @@ name: Wazuh Docker pipeline
|
||||
on: [pull_request]
|
||||
|
||||
jobs:
|
||||
build-stack:
|
||||
build-docker-images:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
||||
@@ -16,6 +16,34 @@ jobs:
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Create backup Docker images
|
||||
run: |
|
||||
mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
|
||||
docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
|
||||
docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
|
||||
docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
|
||||
|
||||
- name: Temporarily save Wazuh manager Docker image
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Temporarily save Wazuh indexer Docker image
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Temporarily save Wazuh dashboard Docker image
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Install Goss
|
||||
uses: e1himself/goss-installation-action@v1.0.3
|
||||
with:
|
||||
@@ -27,6 +55,39 @@ jobs:
|
||||
GOSS_SLEEP: 30
|
||||
GOSS_FILE: .github/.goss.yaml
|
||||
|
||||
check-single-node:
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-docker-images
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Retrieve saved Wazuh indexer Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
|
||||
- name: Retrieve saved Wazuh manager Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
|
||||
- name: Retrieve saved Wazuh dashboard Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
|
||||
- name: Docker load
|
||||
run: |
|
||||
docker load --input ./wazuh-indexer.tar
|
||||
docker load --input ./wazuh-dashboard.tar
|
||||
docker load --input ./wazuh-manager.tar
|
||||
|
||||
|
||||
- name: Create single node certficates
|
||||
run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator
|
||||
|
||||
@@ -44,7 +105,7 @@ jobs:
|
||||
exit 1
|
||||
fi
|
||||
status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
|
||||
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
|
||||
else
|
||||
@@ -65,7 +126,7 @@ jobs:
|
||||
|
||||
- name: Check documents into wazuh-alerts index
|
||||
run: |
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
|
||||
if [[ $docs -gt 100 ]]; then
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
else
|
||||
@@ -75,8 +136,8 @@ jobs:
|
||||
|
||||
- name: Check Wazuh templates
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics" | wc -l`"
|
||||
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics"`"
|
||||
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
|
||||
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
|
||||
if [[ $qty_templates -eq 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
@@ -105,7 +166,7 @@ jobs:
|
||||
|
||||
|
||||
- name: Check filebeat output
|
||||
run: ./.github/single-node-fb-check.sh
|
||||
run: ./.github/single-node-filebeat-check.sh
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
run: |
|
||||
@@ -120,6 +181,38 @@ jobs:
|
||||
- name: Stop single node stack
|
||||
run: docker-compose -f single-node/docker-compose.yml down
|
||||
|
||||
check-multi-node:
|
||||
runs-on: ubuntu-latest
|
||||
needs: build-docker-images
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Create enviroment variables
|
||||
run: cat .env > $GITHUB_ENV
|
||||
|
||||
- name: Retrieve saved Wazuh dashboard Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
|
||||
- name: Retrieve saved Wazuh manager Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
|
||||
- name: Retrieve saved Wazuh indexer Docker image
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
|
||||
- name: Docker load
|
||||
run: |
|
||||
docker load --input ./wazuh-manager.tar
|
||||
docker load --input ./wazuh-indexer.tar
|
||||
docker load --input ./wazuh-dashboard.tar
|
||||
|
||||
- name: Create multi node certficates
|
||||
run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator
|
||||
|
||||
@@ -157,8 +250,8 @@ jobs:
|
||||
|
||||
- name: Check documents into wazuh-alerts index
|
||||
run: |
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
|
||||
if [[ $docs -gt 200 ]]; then
|
||||
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
|
||||
if [[ $docs -gt 100 ]]; then
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
else
|
||||
echo "wazuh-alerts index documents: ${docs}"
|
||||
@@ -169,7 +262,7 @@ jobs:
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
|
||||
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
|
||||
if [[ $qty_templates -gt 0 ]]; then
|
||||
if [[ $qty_templates -eq 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
@@ -204,7 +297,7 @@ jobs:
|
||||
|
||||
|
||||
- name: Check filebeat output
|
||||
run: ./.github/multi-node-fb-check.sh
|
||||
run: ./.github/multi-node-filebeat-check.sh
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
run: |
|
||||
|
67
CHANGELOG.md
67
CHANGELOG.md
@@ -1,6 +1,73 @@
|
||||
# Change Log
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## Wazuh Docker v4.4.5
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.5](https://github.com/wazuh/wazuh/blob/v4.4.5/CHANGELOG.md#v445)
|
||||
|
||||
## Wazuh Docker v4.4.4
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.4](https://github.com/wazuh/wazuh/blob/v4.4.4/CHANGELOG.md#v444)
|
||||
|
||||
## Wazuh Docker v4.4.3
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.3](https://github.com/wazuh/wazuh/blob/v4.4.3/CHANGELOG.md#v443)
|
||||
|
||||
## Wazuh Docker v4.4.2
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.2](https://github.com/wazuh/wazuh/blob/v4.4.2/CHANGELOG.md#v442)
|
||||
|
||||
## Wazuh Docker v4.4.1
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441)
|
||||
|
||||
## Wazuh Docker v4.4.0
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440)
|
||||
|
||||
## Wazuh Docker v4.3.11
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.11](https://github.com/wazuh/wazuh/blob/v4.3.11/CHANGELOG.md#v4311)
|
||||
|
||||
## Wazuh Docker v4.3.10
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310)
|
||||
|
||||
|
||||
## Wazuh Docker v4.3.9
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439)
|
||||
|
||||
|
||||
## Wazuh Docker v4.3.8
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438)
|
||||
|
||||
## Wazuh Docker v4.3.7
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437)
|
||||
|
||||
## Wazuh Docker v4.3.6
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436)
|
||||
|
||||
## Wazuh Docker v4.3.5
|
||||
### Added
|
||||
|
||||
- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435)
|
||||
|
||||
## Wazuh Docker v4.3.4
|
||||
### Added
|
||||
|
||||
|
23
README.md
23
README.md
@@ -36,13 +36,13 @@ Default values are included when available.
|
||||
|
||||
### Wazuh
|
||||
```
|
||||
API_USERNAME="wazuh" # Wazuh API username
|
||||
API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements
|
||||
API_USERNAME="wazuh-wui" # Wazuh API username
|
||||
API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements
|
||||
# (8+ length, uppercase, lowercase, specials chars)
|
||||
|
||||
INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL
|
||||
INDEXER_USERNAME=admin # Wazuh indexer Username
|
||||
INDEXER_PASSWORD=admin # Wazuh indexer Password
|
||||
INDEXER_PASSWORD=SecretPassword # Wazuh indexer Password
|
||||
FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none)
|
||||
SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA
|
||||
SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate
|
||||
@@ -78,10 +78,12 @@ API_SELECTOR=true Defines if the user is allowed to change the sel
|
||||
IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu
|
||||
IP_IGNORE="[]" # List of index patterns to be ignored
|
||||
|
||||
DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore
|
||||
DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore
|
||||
WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices
|
||||
WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task
|
||||
WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas
|
||||
WAZUH_MONITORING_REPLICAS=0 #
|
||||
WAZUH_MONITORING_REPLICAS=0 ##
|
||||
```
|
||||
|
||||
## Directory structure
|
||||
@@ -193,6 +195,19 @@ WAZUH_MONITORING_REPLICAS=0 #
|
||||
|
||||
| Wazuh version | ODFE | XPACK |
|
||||
|---------------|---------|--------|
|
||||
| v4.4.5 | | |
|
||||
| v4.4.4 | | |
|
||||
| v4.4.3 | | |
|
||||
| v4.4.2 | | |
|
||||
| v4.4.1 | | |
|
||||
| v4.4.0 | | |
|
||||
| v4.3.11 | | |
|
||||
| v4.3.10 | | |
|
||||
| v4.3.9 | | |
|
||||
| v4.3.8 | | |
|
||||
| v4.3.7 | | |
|
||||
| v4.3.6 | | |
|
||||
| v4.3.5 | | |
|
||||
| v4.3.4 | | |
|
||||
| v4.3.3 | | |
|
||||
| v4.3.2 | | |
|
||||
|
4
VERSION
4
VERSION
@@ -1,2 +1,2 @@
|
||||
WAZUH-DOCKER_VERSION="4.3.4"
|
||||
REVISION="40316"
|
||||
WAZUH-DOCKER_VERSION="4.4.5"
|
||||
REVISION="40413"
|
||||
|
@@ -1,7 +1,11 @@
|
||||
# Wazuh Docker Image Builder
|
||||
|
||||
This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command:
|
||||
The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script
|
||||
|
||||
To execute the process, the following must be executed in the root of the wazuh-docker repository:
|
||||
|
||||
```
|
||||
$ docker-compose build
|
||||
```
|
||||
$ build-docker-images/build-images.sh
|
||||
```
|
||||
|
||||
This script initializes the environment variables needed to build each of the images.
|
||||
|
@@ -1,15 +1,17 @@
|
||||
WAZUH_IMAGE_VERSION=4.3.4
|
||||
WAZUH_IMAGE_VERSION=4.4.5
|
||||
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
|
||||
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
WAZUH_TAG_REVISION=1
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
|
||||
## If wazuh manager exists in apt dev repository, change variables, if not, exit 1
|
||||
if [ "$WAZUH_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
|
||||
if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then
|
||||
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
|
||||
else
|
||||
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}-dev
|
||||
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
|
||||
fi
|
||||
|
||||
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
|
||||
echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env
|
||||
echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
|
||||
|
||||
docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache
|
@@ -6,7 +6,8 @@ services:
|
||||
build:
|
||||
context: wazuh-manager/
|
||||
args:
|
||||
- WAZUH_VERSION=${WAZUH_VERSION}
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
@@ -37,7 +38,8 @@ services:
|
||||
build:
|
||||
context: wazuh-indexer/
|
||||
args:
|
||||
- WAZUH_VERSION=${WAZUH_VERSION}
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
@@ -57,7 +59,8 @@ services:
|
||||
build:
|
||||
context: wazuh-dashboard/
|
||||
args:
|
||||
- WAZUH_VERSION=${WAZUH_VERSION}
|
||||
WAZUH_VERSION: ${WAZUH_VERSION}
|
||||
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
|
||||
image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
|
@@ -2,7 +2,9 @@
|
||||
FROM ubuntu:focal AS builder
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
|
||||
ARG WAZUH_UI_REVISION=1
|
||||
|
||||
# Update and install dependencies
|
||||
RUN apt-get update && apt install curl libcap2-bin xz-utils -y
|
||||
@@ -11,19 +13,14 @@ RUN apt-get update && apt install curl libcap2-bin xz-utils -y
|
||||
RUN mkdir -p $INSTALL_DIR
|
||||
|
||||
# Download and extract Wazuh dashboard base
|
||||
RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \
|
||||
tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1
|
||||
COPY config/dl_base.sh .
|
||||
RUN bash dl_base.sh
|
||||
|
||||
# Generate certificates
|
||||
COPY config/config.sh .
|
||||
COPY config/config.yml /
|
||||
RUN bash config.sh
|
||||
|
||||
# Create and configure Wazuh dashboard keystore
|
||||
RUN $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
|
||||
COPY config/install_wazuh_app.sh /
|
||||
RUN chmod 775 /install_wazuh_app.sh
|
||||
RUN bash /install_wazuh_app.sh
|
||||
|
@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.3/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.4/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.4/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
|
25
build-docker-images/wazuh-dashboard/config/dl_base.sh
Normal file
25
build-docker-images/wazuh-dashboard/config/dl_base.sh
Normal file
@@ -0,0 +1,25 @@
|
||||
REPOSITORY="packages.wazuh.com/4.x"
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
|
||||
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
|
||||
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
|
||||
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
|
||||
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
|
||||
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
|
||||
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
|
||||
|
||||
## check version to use the correct repository
|
||||
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
|
||||
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
|
||||
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz
|
||||
tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1
|
@@ -7,7 +7,7 @@ DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
|
||||
|
||||
# Create and configure Wazuh dashboard keystore
|
||||
|
||||
$INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
|
||||
echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
|
||||
echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
|
||||
|
||||
@@ -15,6 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o
|
||||
# Start Wazuh dashboard
|
||||
##############################################################################
|
||||
|
||||
/wazuh_app_config.sh
|
||||
/wazuh_app_config.sh $WAZUH_UI_REVISION
|
||||
|
||||
/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
@@ -1,11 +1,24 @@
|
||||
## Variables
|
||||
WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
|
||||
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
## If wazuh manager exists in apt dev repository, change variables, if not exit 1
|
||||
if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
|
||||
WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
|
||||
else
|
||||
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
|
||||
## variables
|
||||
WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
|
||||
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
|
||||
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
|
||||
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
|
||||
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
|
||||
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
|
||||
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
|
||||
|
||||
## check version to use the correct repository
|
||||
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
|
||||
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
|
||||
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
|
||||
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
|
||||
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
|
||||
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
|
||||
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
|
||||
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Install Wazuh App
|
||||
|
@@ -2,6 +2,7 @@
|
||||
FROM ubuntu:focal AS builder
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG WAZUH_TAG_REVISION
|
||||
|
||||
RUN apt-get update -y && apt-get install curl openssl xz-utils -y
|
||||
|
||||
@@ -58,14 +59,15 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/s
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
|
||||
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
|
||||
|
||||
RUN chown -R 1000:1000 /usr/share/wazuh-indexer
|
||||
|
||||
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
|
||||
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
|
||||
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
|
||||
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
|
||||
chmod 700 /usr/share/wazuh-indexer/config && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
|
||||
chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
|
||||
chmod 700 /usr/share/wazuh-indexer && \
|
||||
chmod 600 /usr/share/wazuh-indexer/jvm.options && \
|
||||
chmod 600 /usr/share/wazuh-indexer/opensearch.yml
|
||||
|
||||
USER wazuh-indexer
|
||||
|
||||
|
@@ -8,21 +8,44 @@ export TARGET_DIR=${CURDIR}/debian/${NAME}
|
||||
# Package build options
|
||||
export USER=${NAME}
|
||||
export GROUP=${NAME}
|
||||
export VERSION=${WAZUH_VERSION}
|
||||
export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
|
||||
export LOG_DIR=/var/log/${NAME}
|
||||
export LIB_DIR=/var/lib/${NAME}
|
||||
export PID_DIR=/run/${NAME}
|
||||
export INSTALLATION_DIR=/usr/share/${NAME}
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}/config
|
||||
export CONFIG_DIR=${INSTALLATION_DIR}
|
||||
export BASE_DIR=${NAME}-*
|
||||
export INDEXER_FILE=wazuh-indexer-base.tar.xz
|
||||
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
|
||||
export REPO_DIR=/unattended_installer
|
||||
|
||||
|
||||
rm -rf ${INSTALLATION_DIR}/
|
||||
|
||||
curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE}
|
||||
## variables
|
||||
REPOSITORY="packages.wazuh.com/4.x"
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
|
||||
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
|
||||
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
|
||||
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
|
||||
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
|
||||
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
|
||||
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
|
||||
|
||||
## check version to use the correct repository
|
||||
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
|
||||
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
|
||||
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
|
||||
REPOSITORY="packages-dev.wazuh.com/pre-release"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/${BASE_FILE}
|
||||
tar -xf ${INDEXER_FILE}
|
||||
|
||||
## TOOLS
|
||||
@@ -30,8 +53,8 @@ tar -xf ${INDEXER_FILE}
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.3/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.4/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.4/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
@@ -70,6 +93,7 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A
|
||||
|
||||
# copy to target
|
||||
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
|
||||
mkdir -p ${TARGET_DIR}${CONFIG_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LIB_DIR}
|
||||
mkdir -p ${TARGET_DIR}${LOG_DIR}
|
||||
@@ -94,9 +118,9 @@ cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR}
|
||||
cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
|
||||
# Copy Wazuh's config files for the security plugin
|
||||
cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
|
||||
cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
|
||||
cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
|
||||
cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
|
||||
cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
|
||||
# Copy Wazuh indexer's certificates
|
||||
cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem
|
||||
@@ -106,5 +130,9 @@ cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.
|
||||
cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem
|
||||
cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem
|
||||
|
||||
# Delete xms and xmx parameters in jvm.options
|
||||
sed '/-Xms/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
|
||||
sed '/-Xmx/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
|
||||
|
||||
chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs
|
||||
chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/*
|
@@ -6,7 +6,7 @@ umask 0002
|
||||
|
||||
export USER=wazuh-indexer
|
||||
export INSTALLATION_DIR=/usr/share/wazuh-indexer
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
|
||||
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
|
||||
export JAVA_HOME=${INSTALLATION_DIR}/jdk
|
||||
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
|
||||
@@ -59,7 +59,7 @@ if [[ -f bin/opensearch-users ]]; then
|
||||
# enabled, but we have no way of knowing which node we are yet. We'll just
|
||||
# honor the variable if it's present.
|
||||
if [[ -n "$INDEXER_PASSWORD" ]]; then
|
||||
[[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
[[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
|
||||
# keystore is unencrypted
|
||||
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
|
||||
@@ -84,10 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then
|
||||
fi
|
||||
|
||||
|
||||
if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
|
||||
#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
|
||||
# run securityadmin.sh for single node with CACERT, CERT and KEY parameter
|
||||
nohup /securityadmin.sh &
|
||||
touch "/var/lib/wazuh-indexer/.flag"
|
||||
fi
|
||||
# nohup /securityadmin.sh &
|
||||
# touch "/var/lib/wazuh-indexer/.flag"
|
||||
#fi
|
||||
|
||||
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"
|
@@ -4,12 +4,12 @@ path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
|
@@ -1,3 +1,3 @@
|
||||
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
|
||||
sleep 30
|
||||
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9300 -icl
|
||||
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl
|
@@ -4,7 +4,8 @@ FROM ubuntu:focal
|
||||
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
|
||||
|
||||
ARG WAZUH_VERSION
|
||||
ARG TEMPLATE_VERSION=4.3
|
||||
ARG WAZUH_TAG_REVISION
|
||||
ARG TEMPLATE_VERSION=4.4
|
||||
ARG FILEBEAT_CHANNEL=filebeat-oss
|
||||
ARG FILEBEAT_VERSION=7.10.2
|
||||
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
|
||||
@@ -17,7 +18,7 @@ RUN chmod 775 /check_repository.sh
|
||||
RUN source /check_repository.sh
|
||||
|
||||
RUN apt-get update && \
|
||||
apt-get install wazuh-manager=${WAZUH_VERSION}-1
|
||||
apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
|
||||
|
||||
RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\
|
||||
dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \
|
||||
|
@@ -1,13 +1,29 @@
|
||||
## Variables
|
||||
WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
|
||||
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
|
||||
## If wazuh manager exists in apt dev repository, change variables, if not exit 1
|
||||
if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
|
||||
else
|
||||
## variables
|
||||
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
||||
REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
|
||||
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
|
||||
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
|
||||
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
|
||||
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
|
||||
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
|
||||
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
|
||||
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
|
||||
|
||||
## check version to use the correct repository
|
||||
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
|
||||
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
|
||||
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
|
||||
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
|
||||
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
|
||||
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
|
||||
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
apt-key adv --fetch-keys ${APT_KEY}
|
||||
echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list
|
@@ -21,7 +21,7 @@ try:
|
||||
set_user_role,
|
||||
update_user,
|
||||
)
|
||||
except Exception as e:
|
||||
except ModuleNotFoundError as e:
|
||||
logging.error("No module 'wazuh' found.")
|
||||
sys.exit(1)
|
||||
|
||||
|
@@ -179,6 +179,15 @@ set_rids_owner() {
|
||||
chown -R wazuh:wazuh /var/ossec/queue/rids
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Change any ossec user/group to wazuh user/group
|
||||
##############################################################################
|
||||
|
||||
set_correct_permOwner() {
|
||||
find / -group 997 -exec chown :101 {} +;
|
||||
find / -user 999 -exec chown 101 {} +;
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Main function
|
||||
##############################################################################
|
||||
@@ -189,6 +198,9 @@ main() {
|
||||
|
||||
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
|
||||
apply_exclusion_data
|
||||
|
||||
# Apply correct permission and ownership
|
||||
set_correct_permOwner
|
||||
|
||||
# Rename files stored in permanent data (i.e. queue/ossec)
|
||||
move_data_files
|
||||
|
@@ -12,32 +12,38 @@ fi
|
||||
|
||||
if [ "$INDEXER_USERNAME" != "" ]; then
|
||||
>&2 echo "Configuring username."
|
||||
sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$INDEXER_PASSWORD" != "" ]; then
|
||||
>&2 echo "Configuring password."
|
||||
sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
|
||||
>&2 echo "Configuring SSL verification mode."
|
||||
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
|
||||
>&2 echo "Configuring Certificate Authorities."
|
||||
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_CERTIFICATE" != "" ]; then
|
||||
>&2 echo "Configuring SSL Certificate."
|
||||
sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
if [ "$SSL_KEY" != "" ]; then
|
||||
>&2 echo "Configuring SSL Key."
|
||||
sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
|
||||
sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
|
||||
|
@@ -20,3 +20,12 @@ output.elasticsearch:
|
||||
#ssl.certificate_authorities:
|
||||
#ssl.certificate:
|
||||
#ssl.key:
|
||||
|
||||
logging.metrics.enabled: false
|
||||
|
||||
seccomp:
|
||||
default_action: allow
|
||||
syscalls:
|
||||
- action: allow
|
||||
names:
|
||||
- rseq
|
||||
|
@@ -8,8 +8,8 @@
|
||||
## Variables
|
||||
CERT_TOOL=wazuh-certs-tool.sh
|
||||
PASSWORD_TOOL=wazuh-passwords-tool.sh
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.3/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
|
||||
PACKAGES_URL=https://packages.wazuh.com/4.4/
|
||||
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.4/
|
||||
|
||||
## Check if the cert tool exists in S3 buckets
|
||||
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
|
||||
@@ -51,11 +51,11 @@ chown 1000:1000 /certificates/*
|
||||
echo "Setting UID for wazuh manager and worker"
|
||||
cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
|
||||
cp /certificates/root-ca.key /certificates/root-ca-manager.key
|
||||
chown 999:997 /certificates/root-ca-manager.pem
|
||||
chown 999:997 /certificates/root-ca-manager.key
|
||||
chown 101:101 /certificates/root-ca-manager.pem
|
||||
chown 101:101 /certificates/root-ca-manager.key
|
||||
|
||||
for i in ${node_names[@]};
|
||||
do
|
||||
chown 999:997 "/certificates/${i}.pem"
|
||||
chown 999:997 "/certificates/${i}-key.pem"
|
||||
for i in ${node_names[@]};
|
||||
do
|
||||
chown 101:101 "/certificates/${i}.pem"
|
||||
chown 101:101 "/certificates/${i}-key.pem"
|
||||
done
|
||||
|
@@ -1,6 +1,6 @@
|
||||
# Opendistro data migration to Wazuh indexer on docker.
|
||||
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
|
||||
The example is migrating from v4.2 to v4.3.
|
||||
The example is migrating from v4.2 to v4.4.
|
||||
|
||||
## Procedure
|
||||
Assuming that you have a v4.2 production deployment, perform the following steps.
|
||||
@@ -350,9 +350,9 @@ docker container run --rm -it \
|
||||
alpine ash -c "cd /from ; cp -avp . /to"
|
||||
```
|
||||
|
||||
**7. Start the 4.3 environment.**
|
||||
**7. Start the 4.4 environment.**
|
||||
```
|
||||
git checkout 4.3
|
||||
git checkout 4.4
|
||||
cd multi-node
|
||||
docker-compose -f generate-indexer-certs.yml run --rm generator
|
||||
docker-compose up -d
|
@@ -21,4 +21,4 @@ nodes:
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
|
@@ -3,5 +3,5 @@ hosts:
|
||||
url: "https://wazuh.master"
|
||||
port: 55000
|
||||
username: wazuh-wui
|
||||
password: MyS3cr37P450r.*-
|
||||
password: "MyS3cr37P450r.*-"
|
||||
run_as: false
|
||||
|
@@ -3,7 +3,7 @@ version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.master:
|
||||
image: wazuh/wazuh-manager:4.3.4
|
||||
image: wazuh/wazuh-manager:4.4.5
|
||||
hostname: wazuh.master
|
||||
restart: always
|
||||
ports:
|
||||
@@ -38,7 +38,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.worker:
|
||||
image: wazuh/wazuh-manager:4.3.4
|
||||
image: wazuh/wazuh-manager:4.4.5
|
||||
hostname: wazuh.worker
|
||||
restart: always
|
||||
environment:
|
||||
@@ -67,7 +67,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh1.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.4
|
||||
image: wazuh/wazuh-indexer:4.4.5
|
||||
hostname: wazuh1.indexer
|
||||
restart: always
|
||||
ports:
|
||||
@@ -84,16 +84,16 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh2.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.4
|
||||
image: wazuh/wazuh-indexer:4.4.5
|
||||
hostname: wazuh2.indexer
|
||||
restart: always
|
||||
environment:
|
||||
@@ -108,14 +108,14 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh3.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.4
|
||||
image: wazuh/wazuh-indexer:4.4.5
|
||||
hostname: wazuh3.indexer
|
||||
restart: always
|
||||
environment:
|
||||
@@ -130,14 +130,14 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem
|
||||
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.4
|
||||
image: wazuh/wazuh-dashboard:4.4.5
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
@@ -147,6 +147,8 @@ services:
|
||||
- WAZUH_API_URL="https://wazuh.master"
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
|
||||
|
@@ -13,4 +13,4 @@ nodes:
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
|
@@ -331,11 +331,11 @@
|
||||
<name>wazuh</name>
|
||||
<node_name>node01</node_name>
|
||||
<node_type>master</node_type>
|
||||
<key></key>
|
||||
<key>aa093264ef885029653eea20dfcf51ae</key>
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>NODE_IP</node>
|
||||
<node>wazuh.manager</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>yes</disabled>
|
||||
|
@@ -3,5 +3,5 @@ hosts:
|
||||
url: "https://wazuh.manager"
|
||||
port: 55000
|
||||
username: wazuh-wui
|
||||
password: MyS3cr37P450r.*-
|
||||
password: "MyS3cr37P450r.*-"
|
||||
run_as: false
|
||||
|
@@ -3,13 +3,15 @@ node.name: "wazuh.indexer"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
discovery.type: single-node
|
||||
http.port: 9200-9299
|
||||
transport.tcp.port: 9300-9399
|
||||
compatibility.override_main_response_version: true
|
||||
plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
|
@@ -3,7 +3,7 @@ version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:4.3.4
|
||||
image: wazuh/wazuh-manager:4.4.5
|
||||
hostname: wazuh.manager
|
||||
restart: always
|
||||
ports:
|
||||
@@ -39,7 +39,7 @@ services:
|
||||
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
|
||||
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:4.3.4
|
||||
image: wazuh/wazuh-indexer:4.4.5
|
||||
hostname: wazuh.indexer
|
||||
restart: always
|
||||
ports:
|
||||
@@ -55,16 +55,16 @@ services:
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:4.3.4
|
||||
image: wazuh/wazuh-dashboard:4.4.5
|
||||
hostname: wazuh.dashboard
|
||||
restart: always
|
||||
ports:
|
||||
@@ -73,6 +73,8 @@ services:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=MyS3cr37P450r.*-
|
||||
volumes:
|
||||
|
@@ -7,4 +7,4 @@ services:
|
||||
hostname: wazuh-certs-generator
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/:/certificates/
|
||||
- ./config/certs.yml:/config/certs.yml
|
||||
- ./config/certs.yml:/config/certs.yml
|
||||
|
@@ -1,6 +0,0 @@
|
||||
nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k | grep -E "indexer" | wc -l`"
|
||||
if [[ $nodes -eq 1 ]]; then
|
||||
echo "bien"
|
||||
else
|
||||
echo "mal"
|
||||
fi
|
Reference in New Issue
Block a user