Compare commits

...

199 Commits
test ... v4.5.4

Author SHA1 Message Date
David Correa Rodríguez
3a3218f0d4 Merge pull request #1061 from wazuh/bump-revision-40510
Bump revision to 40510
2023-10-19 12:00:04 +02:00
David Correa Rodríguez
dd86d1b707 Bump revision to 40510 2023-10-19 11:46:24 +02:00
Gonzalo Acuña
8aad8651d7 Merge pull request #1058 from wazuh/bump-version-4.5.4
Bump 4.5.4 version
2023-10-17 09:03:27 -03:00
vcerenu
3c073ab5ea bump 4.5.4 version 2023-10-17 09:01:18 -03:00
vcerenu
5106715b0c bump 4.5.4 version 2023-10-17 05:55:15 -03:00
Gonzalo Acuña
ded91b2f0a Merge pull request #1029 from wazuh/bump-4.5.3-revision
Bump 4.5.3 revision
2023-10-05 11:48:22 -03:00
Gonzalo Acuña
d7e051af19 Bump 4.5.3 revision 2023-10-05 11:44:40 -03:00
Gonzalo Acuña
93c53a712d Merge pull request #1021 from wazuh/change/1020-bump-revision-4.5.3-rc2
Bump revision to 40507
2023-09-28 08:24:43 -03:00
David Correa Rodríguez
5f3a0481ba Bump revision to 40507 2023-09-28 12:14:34 +02:00
Gonzalo Acuña
088b855f73 Merge pull request #997 from wazuh/990-persist-logo
Persist the custom logo in the Wazuh dashboard
2023-09-18 14:14:30 -03:00
Gonzalo Acuña
41515e9c49 Merge pull request #998 from wazuh/258-shuffle-permanent-data
Check the permanent_data.env file and include any missing files
2023-09-15 14:44:27 -03:00
vcerenu
0fbbf5aee2 add shuffle scripts into permanent data 2023-09-15 13:31:00 -03:00
vcerenu
37f565bb8a add custom directory and persistence 2023-09-15 12:49:32 -03:00
vcerenu
2ac53b9b3d add custom directory and persistence 2023-09-15 12:41:05 -03:00
Gonzalo Acuña
d1c252c6c0 Merge pull request #996 from wazuh/979-remove-goss-from-manager-image
Remove goss install
2023-09-14 16:14:58 -03:00
vcerenu
e9f689dbfc remove goss directory 2023-09-14 15:17:13 -03:00
vcerenu
be19c70082 remove goss install 2023-09-14 12:25:57 -03:00
Gonzalo Acuña
1fae0d3452 Merge pull request #982 from wazuh/merge-4.5.2-into-4.5.3
Merge `4.5.2` into `4.5.3`
2023-09-07 08:12:25 -03:00
David Correa Rodríguez
0a4c057492 Merge branch '4.5.2' into merge-4.5.2-into-4.5.3 2023-09-07 10:29:02 +02:00
David Jose Iglesias Lopez
2902a0ce0b Merge pull request #977 from wazuh/bump-revision-40505
Bump revision to 40505
2023-09-04 11:49:42 +02:00
David Correa Rodríguez
c0fb4172f3 Bump revision to 40505 2023-09-04 11:11:37 +02:00
Gonzalo Acuña
8886e2347e Merge pull request #968 from wazuh/951-fix-wazuh-dashboard-modules-persist
Fixed Wazuh dashboard modules persistency
2023-08-30 15:06:24 -03:00
Gonzalo Acuña
f1d8565989 Merge pull request #971 from wazuh/bump-4.5.3
Bump to `4.5.3`
2023-08-29 08:28:50 -03:00
David Correa Rodríguez
e5abd5d24e Bump to 4.5.3 2023-08-29 11:29:26 +02:00
David Correa Rodríguez
902b0d8e52 Fixed Wazuh dashboard modules persistency 2023-08-28 13:11:25 +02:00
Gonzalo Acuña
c0d97893a4 Merge pull request #960 from wazuh/merge-4.5.1-into-4.5.2
Merge 4.5.1 into 4.5.2
2023-08-24 12:31:06 -03:00
vcerenu
0826f2c176 change revision 2023-08-24 12:23:15 -03:00
vcerenu
d531b8dd72 Resolving conflicts 2023-08-24 12:06:35 -03:00
Gonzalo Acuña
41267d4ddf Merge pull request #946 from wazuh/944-bump-revision-2
Revision update
2023-08-17 12:20:42 -03:00
Gonzalo Acuña
67f34fb8fe Revision update 2023-08-17 12:17:12 -03:00
Gonzalo Acuña
865f7625f4 Merge pull request #945 from wazuh/944-bump-revision
Revision update
2023-08-17 09:02:13 -03:00
Gonzalo Acuña
c56952eaa0 Revision update 2023-08-17 08:56:16 -03:00
Gonzalo Acuña
cb7d8785c6 Merge pull request #930 from wazuh/926-update-the-vulnerability-detector-default-configuration-block-with-missing-providers
Update the vulnerability detector default configuration block with missing providers
2023-08-14 15:19:54 -03:00
vcerenu
f1001c2f25 add jammy version into VD 2023-08-11 15:45:26 -03:00
David Correa Rodríguez
216b5a6818 Merge pull request #935 from wazuh/merge-4.5.1-into-4.5.2
Merge `4.5.1` into `4.5.2`
2023-08-11 12:25:04 +02:00
David Correa Rodríguez
e19fa14013 Merge pull request #934 from wazuh/merge-4.5-into-4.5.1
Merge `4.5` into `4.5.1`
2023-08-11 11:58:49 +02:00
vcerenu
57c7eaa5af remove stretch and add rhel 9 into VD 2023-08-10 16:46:21 -03:00
vcerenu
fbe073612c add suse vd options 2023-08-10 09:19:59 -03:00
Gonzalo Acuña
32b1d88e36 Merge pull request #919 from wazuh/917-fix-conditional-block-in-build-imagesh-script
Fixed conditional block in images building
2023-08-03 10:02:24 -03:00
David Correa Rodríguez
94be842afc Restored IMAGE_VERSION variable 2023-08-03 11:51:01 +02:00
David Correa Rodríguez
d20bbe247c Fixed conditional block in images building 2023-08-03 11:45:56 +02:00
Gonzalo Acuña
e01d39e138 Merge pull request #915 from wazuh/911-typos-in-the-script
Typos in the script in charge of create Wazuh indexer's certificates
2023-08-01 13:50:24 -03:00
vcerenu
1eeca6267b fix typos in cert generator image 2023-08-01 13:07:04 -03:00
Gonzalo Acuña
d755ffbac8 Merge pull request #914 from wazuh/6282-add-notes-about
Modify ulimit
2023-08-01 12:01:13 -03:00
vcerenu
221c3ccd24 add ulimit parameter to wazuh manager deploy 2023-07-31 13:19:13 -03:00
vcerenu
1ff589ccaf add ulimit parameter to wazuh manager deploy 2023-07-31 13:16:15 -03:00
Victor Ereñú
d4c98491fc Merge pull request #910 from wazuh/909-deprecate-update_from_year-to-use-nvd-api-20-feeds
Delete update_from_year parameter
2023-07-26 13:55:52 -03:00
vcerenu
673c28b637 delete update_from_year parameter 2023-07-26 13:40:54 -03:00
Gonzalo Acuña
da82008a75 Merge pull request #894 from wazuh/bump-4.5.2
Bump to 4.5.2
2023-07-19 08:55:24 -03:00
vcerenu
54975ab099 Bump to 4.5.2 2023-07-19 08:43:17 -03:00
Carlos Bordon
1a75d4eb77 Merge pull request #885 from wazuh/merge-4.5.0-into-4.5.1
Merge 4.5.0 into 4.5.1
2023-07-11 11:34:52 -03:00
vcerenu
247555b1b6 resolving merge conflicts 2023-07-11 11:21:00 -03:00
Carlos Bordon
442d457933 Merge pull request #884 from wazuh/merge-4.4-into-4.5.0
Merge 4.4 into 4.5.0
2023-07-11 10:42:52 -03:00
vcerenu
0f65448718 resolving merge conflicts 2023-07-11 09:41:16 -03:00
Victor Ereñú
a9533264d6 Merge pull request #883 from wazuh/merge-4.4.5-into-4.4
Merge 4.4.5 into 4.4
2023-07-11 09:26:12 -03:00
Carlos Bordon
ce8dd29425 Merge pull request #879 from wazuh/4.4.5-bump-revision
Bump revision
2023-07-10 09:00:24 -03:00
vcerenu
a433989865 bump revision 2023-07-10 08:42:14 -03:00
Gonzalo Acuña
ff1e5f991a Merge pull request #878 from wazuh/bump-4.4.5
Bump to 4.4.5
2023-07-07 08:48:54 -03:00
Gonzalo Acuña
55ee49aff5 Bumped to 4.4.5 2023-07-07 08:39:57 -03:00
Gonzalo Acuña
75f92308a1 Merge pull request #877 from wazuh/merge-4.4.4-into-4.4
Merge `4.4.4` into `4.4`
2023-07-07 08:32:11 -03:00
Victor Ereñú
61c37a78de Merge pull request #874 from wazuh/bump-4-5-1
Bump version 4.5.1
2023-06-26 14:07:42 -03:00
vcerenu
39208c513c bump version 4.5.1 2023-06-26 13:35:29 -03:00
vcerenu
3650feeb0e bump version 4.5.0 2023-06-26 09:40:14 -03:00
Gonzalo Acuña
2340db4079 Merge pull request #865 from wazuh/merge-4.4-into-4.4.5
Merge `4.4` into `4.4.5`
2023-06-14 14:50:59 -03:00
Gonzalo Acuña
9159eda943 Merge branch '4.4.5' into merge-4.4-into-4.4.5 2023-06-14 14:07:23 -03:00
Gonzalo Acuña
d278782134 Merge pull request #858 from wazuh/merge-4-4-4-to-4-4
Bump `4.4` to `4.4.4`
2023-06-13 15:58:51 -03:00
Gonzalo Acuña
77725b7eb2 Revision bump 2023-06-13 13:19:35 -03:00
Gonzalo Acuña
4e7c2cf72a Revision bump 2023-06-12 09:38:35 -03:00
Gonzalo Acuña
41196a5529 Bump to 4.4.5 2023-06-05 11:44:32 -03:00
Gonzalo Acuña
8ce1f36f10 Revision update 2023-06-05 11:42:10 -03:00
Gonzalo Acuña
e2e95a5c57 Bump to 4.4.4 2023-06-05 11:38:58 -03:00
Raul Del Pozo Moreno
b259665fc6 Merge pull request #851 from wazuh/bump-4.4.3
Bump `4.4` to `4.4.3`
2023-05-26 14:13:58 +02:00
Raul Del Pozo Moreno
820079f1d0 Bump to 4.4.3 2023-05-25 20:03:26 +02:00
Gonzalo Acuña
028b5f6034 Revision update 2023-05-18 21:05:42 +02:00
vcerenu
cd7dc4c7cf bump 4.4.2 version 2023-05-18 21:05:41 +02:00
Jesse Roland
40faad148d Add DASHBOARD_USERNAME and DASHBOARD_PASSWORD environment variables to
the dashboard container.

Resolves https://github.com/wazuh/wazuh-docker/issues/823
2023-05-18 21:04:33 +02:00
vcerenu
02aaf45e9d change revision number 2023-05-18 21:04:32 +02:00
vcerenu
cd9f211eb3 bump 4.3.11 version 2023-05-18 21:04:31 +02:00
vcerenu
20c8000fec change revision 2023-05-18 21:02:52 +02:00
vcerenu
8ada4445b0 bump 4.4.1 version 2023-04-10 10:20:48 -03:00
Gonzalo Acuña
1c69a38bd8 Merge pull request #813 from wazuh/807-docker-update-from-4310-to-440
Disable cluster option
2023-04-05 14:52:28 -03:00
vcerenu
615d6df29c disable cluster option 2023-04-05 13:55:24 -03:00
Gonzalo Acuña
949a465855 Merge pull request #811 from wazuh/revert-799-bump-4-4-1
Revert "Bump `4.4` to `4.4.1`"
2023-04-05 13:49:23 -03:00
Gonzalo Acuña
f7bbac5a08 Revert "Bump 4.4 to 4.4.1" 2023-04-05 13:46:20 -03:00
Gonzalo Acuña
11820b01e9 Merge pull request #799 from wazuh/bump-4-4-1
Bump `4.4` to `4.4.1`
2023-03-31 11:02:25 -03:00
vcerenu
a8de452002 bump 4.4.1 version 2023-03-31 10:27:58 -03:00
Victor Ereñú
c76681b3b9 Merge pull request #794 from wazuh/modify-base-dashboard
Change dashboard and indexer base repository
2023-03-28 17:09:15 -03:00
vcerenu
e25635cb25 change dashboard and indexer base repository 2023-03-28 16:59:49 -03:00
Gonzalo Acuña
304eedcb51 Merge pull request #793 from wazuh/bump_4-4
Change revision number
2023-03-28 10:03:41 -03:00
vcerenu
6123ab994c change revision number 2023-03-28 09:07:24 -03:00
Gonzalo Acuña
2f58da59de Merge pull request #776 from wazuh/change_password
Update indexer password
2023-02-01 10:59:11 -03:00
vcerenu
3279931813 update docs count 2023-02-01 10:33:26 -03:00
vcerenu
b039567e1c update indexer password 2023-02-01 10:02:35 -03:00
Gonzalo Acuña
3190c4246e Merge pull request #766 from wazuh/765-change-wazuh-dashboard-and-indexer-base-path
Modify base path
2022-12-27 08:11:21 -03:00
vcerenu
271f421cd4 modify base path 2022-12-26 11:12:16 -03:00
Alberto Rodríguez
910e28956b Merge pull request #760 from wazuh/merge-4.4
Version check fix
2022-12-02 17:19:02 +01:00
vcerenu
dcf8bb8060 fix index alerts test 2022-12-02 12:42:01 -03:00
vcerenu
be9f3d1b90 fix index alerts test 2022-12-02 11:36:35 -03:00
vcerenu
91625f412c change indexer and manager configuration for 4.4 version 2022-12-01 19:35:35 -03:00
vcerenu
4c7dcb2ebf add revision into versions parameter 2022-12-01 13:32:43 -03:00
vcerenu
8febf33d58 add 4.4 version 2022-12-01 13:02:13 -03:00
Alberto Rodríguez
3d19774d7e Merge pull request #758 from wazuh/merge-4.4
Merge 4.3 in 4.4 branch
2022-12-01 16:23:05 +01:00
vcerenu
e11e7a10b8 add 4.4 version 2022-12-01 11:58:21 -03:00
vcerenu
7f73635651 add 4.4 version 2022-11-30 15:35:16 -03:00
vcerenu
e9a0be25ce resolving conflicts in 4.3 merge 2022-11-30 15:27:48 -03:00
Alberto Rodríguez
c87580cfb5 Merge pull request #754 from wazuh/753-opensearch_java_opts-duplicate-parameters
Remove Xms and Xmx parameter into jvm.options
2022-11-29 15:45:36 +01:00
Alberto Rodríguez
e0cd80c105 Update build-docker-images/wazuh-indexer/config/config.sh 2022-11-29 15:44:36 +01:00
vcerenu
796751aec9 remove Xms and Xmx parameter into jvm.options 2022-11-28 17:24:13 -03:00
Alberto Rodríguez
15205ada03 Merge pull request #742 from wazuh/bump-4-3-10
Bump 4.3 to 4.3.10
2022-11-11 16:20:58 +01:00
vcerenu
c1bfc450ba bump 4.3.10 version 2022-11-11 11:34:09 -03:00
Gonzalo Acuña
b08fd3e384 Merge pull request #726 from wazuh/bump-4-3-9
Bump 4.3 to 4.3.9
2022-10-11 09:47:12 -03:00
vcerenu
fd08279f32 bump 4.3.9 version 2022-10-06 14:25:56 -03:00
Gonzalo Acuña
f42b30b71d Merge pull request #720 from wazuh/bump-4-3-8
Bump 4.3 to 4.3.8
2022-09-14 12:15:09 -03:00
vcerenu
7555453d55 bump 4.3.8 version 2022-09-14 10:39:31 -03:00
vcerenu
22b77749fa bump 4.3.8 version 2022-09-12 15:37:47 -03:00
José Fernández Aguilera
6c094d07a6 Merge pull request #719 from wazuh/4.4-add-double-quote
Add Double Quote on password
2022-09-12 17:04:35 +02:00
vcerenu
b6959c8b15 doble quote for password 2022-09-09 15:29:07 -03:00
José Fernández Aguilera
28e21b0282 Merge pull request #717 from wazuh/714-modify-password
Add Double Quote on password
2022-09-09 08:52:18 +02:00
vcerenu
b83dcc087e doble quote for password 2022-09-08 12:17:45 -03:00
vcerenu
19c23456ec readme 2022-08-24 11:45:55 -03:00
José Fernández Aguilera
f99721e98b Merge pull request #708 from wazuh/bump-4-3-7
Bump 4.3 to 4.3.7
2022-08-17 08:23:32 +02:00
vcerenu
38271d7797 bump 4.3.7 version 2022-08-12 12:44:20 -03:00
vcerenu
c278f6a503 bump 4.3.7 version 2022-08-12 12:02:04 -03:00
vcerenu
d6ba8c3661 Merge pull request #707 from wazuh/695-change-indexer-username
Filebeat parameters
2022-08-12 10:39:19 -03:00
vcerenu
1db718ffc8 fix replace filebeat parameters 2022-08-10 16:15:17 -03:00
vcerenu
cf137c6703 Merge pull request #706 from wazuh/MigrationTo43-WazuhManagerNew
Fix permissions/ownership issue for Wazuh manager migration (4.2 -> 4.3)
2022-08-09 11:41:16 -03:00
Elwali karkoub
6f966cb01a Update 0-wazuh-init 2022-08-09 07:42:12 +02:00
José Fernández Aguilera
8bc11c48d9 Merge pull request #698 from wazuh/change-readme
Update Readme
2022-07-27 12:39:00 +02:00
vcerenu
be1bc64e0f update api and dashboard user 2022-07-26 09:27:01 -03:00
José Fernández Aguilera
80e8057f79 Merge pull request #694 from wazuh/bump-4-3-6
Bump 4.3 to 4.3.6
2022-07-19 12:49:07 +02:00
vcerenu
296de14886 bump 4.3.6 version 2022-07-18 10:25:01 -03:00
José Fernández Aguilera
0245a7e0d8 Merge pull request #692 from wazuh/fix-key-generator
Fix certificate generator
2022-07-08 09:06:54 +02:00
vcerenu
a9ea60b951 fix uid and gid for wazuh manager keys 2022-07-07 11:40:15 -03:00
José Fernández Aguilera
b98d32d4ca Merge pull request #691 from wazuh/1665-Fix-filebeat-crash-due-to-glibc-to4.4
Add fix to avoid GLIBC crash
2022-07-07 09:00:19 +02:00
José Fernández Aguilera
23cb7417bc Merge pull request #689 from wazuh/1665-Fix-filebeat-crash-due-to-glibc-to4.3
Add fix to avoid GLIBC crash
2022-07-07 08:59:47 +02:00
fcaffieri
4c710e6c20 Add fix to avoid GLIBC crash, fix identation 2022-07-06 18:01:53 -03:00
fcaffieri
adf95cd132 Add fix to avoid GLIBC crash, fix identation 2022-07-06 18:01:13 -03:00
fcaffieri
f97a719304 Add fix to avoid GLIBC crash 2022-07-06 17:35:20 -03:00
fcaffieri
b6aa782730 Add fix to avoid GLIBC crash 2022-07-06 17:34:56 -03:00
José Fernández Aguilera
bf534b4143 Merge pull request #687 from wazuh/1667-disable-filebeat-metrics-to4.4
Disable filebeat metrics
2022-07-04 16:02:24 +02:00
José Fernández Aguilera
1d8d594a44 Merge pull request #685 from wazuh/1667-disable-filebeat-metrics-to4.3
Disable filebeat metrics
2022-07-04 15:59:55 +02:00
fcaffieri
a82cc9ec39 disable filebeat metrics 2022-07-04 09:18:11 -03:00
fcaffieri
265dfd39bf disable filebeat metrics 2022-07-04 09:16:57 -03:00
fcaffieri
8d9ad6152a disable filebeat metrics 2022-07-01 17:45:23 -03:00
fcaffieri
28641accc2 disable filebeat metrics 2022-07-01 17:41:19 -03:00
Gonzalo Acuña
5774b93977 Merge pull request #684 from wazuh/fix-keystore-create
Add option to recreate keystore in entrypoint
2022-07-01 12:16:43 -03:00
vcerenu
9c0676014c add option to recreate keystore in entrypoint 2022-07-01 11:37:44 -03:00
vcerenu
f933733a85 add option to recreate keystore in entrypoint 2022-07-01 10:59:52 -03:00
José Fernández Aguilera
2f2b8bc1f5 Merge pull request #682 from wazuh/bump-4-3-5
Change readme note from Docker images build
2022-06-30 11:54:24 +02:00
vcerenu
868424cdd2 Change readme note for build docker images process 2022-06-29 13:17:59 -03:00
vcerenu
84c4aab03d Change readme note for build docker images process 2022-06-29 12:35:24 -03:00
Alberto Rodríguez
3d4521c7d8 Merge pull request #678 from wazuh/bump-4-3-5
Bump 4.3 to 4.3.5
2022-06-24 09:53:14 +02:00
vcerenu
46ec0bd67f Add tag revision for Wazuh indexer and dashboard 2022-06-23 18:27:24 -03:00
vcerenu
61791c1984 Bump 4.3.5 2022-06-23 15:36:27 -03:00
Alberto Rodríguez
2fe1eaea8f Merge pull request #676 from wazuh/fix_ck_conf
Modify variables
2022-06-22 15:32:29 +02:00
vcerenu
dc7691808b modify variable 2022-06-21 12:20:44 -03:00
vcerenu
c3375e0141 modify variable 2022-06-21 11:46:25 -03:00
Alberto Rodríguez
5d98c157f8 Merge pull request #669 from wazuh/fix-test-ci
CI Docker
2022-06-20 15:42:22 +02:00
vcerenu
0f2b153123 Test CI 2022-06-14 13:21:07 -03:00
vcerenu
a84ff7b1ff Test CI 2022-06-14 12:50:21 -03:00
vcerenu
672d1fc67a Test CI 2022-06-13 15:27:23 -03:00
vcerenu
ecef793c7f Test CI 2022-06-10 17:12:38 -03:00
vcerenu
8fb1b51d08 Test CI 2022-06-10 16:53:45 -03:00
vcerenu
9b9c422dea Test CI 2022-06-10 16:37:34 -03:00
vcerenu
3059de4c9f Test CI 2022-06-10 16:20:06 -03:00
vcerenu
d6557165da Test CI 2022-06-10 16:19:12 -03:00
vcerenu
174cf64b9b Test CI 2022-06-10 16:17:48 -03:00
vcerenu
d3954c9f8d Test CI 2022-06-10 15:34:15 -03:00
vcerenu
6dbfc1bbbf Test CI 2022-06-10 15:33:42 -03:00
vcerenu
20d065cce3 Test CI 2022-06-10 10:53:31 -03:00
vcerenu
de41cd08c9 Test CI 2022-06-10 10:23:56 -03:00
vcerenu
1c80201dc9 Test CI 2022-06-10 09:19:06 -03:00
vcerenu
f5ba9370ea Test CI 2022-06-09 16:41:50 -03:00
vcerenu
94f62d25d3 Test CI 2022-06-09 16:23:58 -03:00
vcerenu
0384112385 Test CI 2022-06-09 15:38:58 -03:00
vcerenu
8d4c6c4170 Test CI 2022-06-09 15:37:03 -03:00
vcerenu
919eab0c84 Test CI 2022-06-09 15:28:44 -03:00
vcerenu
01e616ce76 Test CI 2022-06-09 15:19:02 -03:00
vcerenu
46740f306a Test CI 2022-06-09 15:16:59 -03:00
vcerenu
b718d753de Test CI 2022-06-09 15:15:21 -03:00
vcerenu
731d3c3622 Test CI 2022-06-09 15:14:39 -03:00
vcerenu
c17cc9a15b Test CI 2022-06-09 12:32:29 -03:00
vcerenu
8976d2f5b6 Test CI 2022-06-09 12:19:22 -03:00
vcerenu
03764ea251 Test CI 2022-06-09 12:18:37 -03:00
Volm, David
7c642638ff Allow other Exceptions to bubble up a stack trace instead of silently failing in create_user.py 2022-06-09 16:24:43 +02:00
vcerenu
6591e9ae68 Test CI 2022-06-09 10:36:10 -03:00
vcerenu
961b8bad21 Test CI 2022-06-09 09:24:57 -03:00
José Fernández Aguilera
5555c1dd06 Merge pull request #666 from wazuh/merge_4_4
Merge 4.3.3 into 4.4
2022-06-01 18:40:02 +02:00
vcerenu
0dd044de68 Merge 4.3.3 into 4.4 2022-06-01 12:29:05 -03:00
Alberto Rodríguez
5d88983066 Merge pull request #651 from wazuh/fix_whitelist_4_4
Fix whitelist in 4.4
2022-05-23 16:09:43 +02:00
vcerenu
95565df2f5 fix whitelist 2022-05-23 10:58:04 -03:00
Alberto Rodríguez
ed5c5d70ba Merge pull request #649 from wazuh/master
Merge master into 4.4
2022-05-23 14:21:52 +02:00
Alberto Rodríguez
97f5a6bf04 Merge pull request #648 from wazuh/merge_master
Merge 4.3 into master
2022-05-23 14:15:22 +02:00
vcerenu
b21c3769d3 Merge 4.3 into master 2022-05-20 15:57:34 -03:00
Alberto Rodríguez
9cd399c2df Merge pull request #598 from wazuh/4.2-merge_master
Merge 4.2 into master
2022-03-28 16:58:01 +02:00
Gonzalo Acuña
3e54eeb62f Merge branch 'master' into 4.2-merge_master 2022-03-28 11:34:55 -03:00
Alberto Rodríguez
a4be008028 Merge pull request #596 from wazuh/595-bump_426
Bump to 4.2.6
2022-03-28 15:49:25 +02:00
Gonzalo Acuña
85e62cfd0e Bump to 4.2.6 2022-03-25 10:28:14 -03:00
Alberto R
84fe19e868 Bumped to 4.4.0 2021-11-24 17:01:09 +01:00
46 changed files with 659 additions and 212 deletions

5
.env
View File

@@ -1,2 +1,3 @@
WAZUH_VERSION=4.3.3
WAZUH_IMAGE_VERSION=4.3.3
WAZUH_VERSION=4.5.4
WAZUH_IMAGE_VERSION=4.5.4
WAZUH_TAG_REVISION=1

62
.github/.goss.yaml vendored
View File

@@ -1,3 +1,53 @@
file:
/etc/filebeat/filebeat.yml:
exists: true
mode: "0644"
owner: root
group: root
filetype: file
contains: []
/var/ossec/bin/wazuh-control:
exists: true
mode: "0750"
owner: root
group: root
filetype: file
contains: []
/var/ossec/etc/lists/audit-keys:
exists: true
mode: "0660"
owner: wazuh
group: wazuh
filetype: file
contains: []
/var/ossec/etc/ossec.conf:
exists: true
mode: "0660"
owner: root
group: wazuh
filetype: file
contains: []
/var/ossec/etc/rules/local_rules.xml:
exists: true
mode: "0660"
owner: wazuh
group: wazuh
filetype: file
contains: []
/var/ossec/etc/sslmanager.cert:
exists: true
mode: "0640"
owner: root
group: root
filetype: file
contains: []
/var/ossec/etc/sslmanager.key:
exists: true
mode: "0640"
owner: root
group: root
filetype: file
contains: []
package:
filebeat:
installed: true
@@ -6,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- 4.3.4-1
- 4.5.4-1
port:
tcp:1514:
listening: true
@@ -41,3 +91,13 @@ process:
running: true
wazuh-modulesd:
running: true
user:
wazuh:
exists: true
groups:
- wazuh
home: /var/ossec
shell: /sbin/nologin
group:
wazuh:
exists: true

View File

@@ -1,18 +0,0 @@
fbout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
fbstatus1=$(echo "${fbout1}" | grep -c OK)
if [[ fbstatus1 -eq 7 ]]; then
echo "No errors in master filebeat"
else
echo "Errors in master filebeat"
echo "${fbout1}"
exit 1
fi
fbout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
fbstatus2=$(echo "${fbout2}" | grep -c OK)
if [[ fbstatus2 -eq 7 ]]; then
echo "No errors in worker filebeat"
else
echo "Errors in worker filebeat"
echo "${fbout2}"
exit 1
fi

18
.github/multi-node-filebeat-check.sh vendored Executable file
View File

@@ -0,0 +1,18 @@
filebeatout1=$(docker exec multi-node_wazuh.master_1 sh -c 'filebeat test output')
filebeatstatus1=$(echo "${filebeatout1}" | grep -c OK)
if [[ filebeatstatus1 -eq 7 ]]; then
echo "No errors in master filebeat"
else
echo "Errors in master filebeat"
echo "${filebeatout1}"
exit 1
fi
filebeatout2=$(docker exec multi-node_wazuh.worker_1 sh -c 'filebeat test output')
filebeatstatus2=$(echo "${filebeatout2}" | grep -c OK)
if [[ filebeatstatus2 -eq 7 ]]; then
echo "No errors in worker filebeat"
else
echo "Errors in worker filebeat"
echo "${filebeatout2}"
exit 1
fi

View File

@@ -1,16 +1,16 @@
log1=$(docker exec multi-node_wazuh.master_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "$log1" ]]; then
echo "No errors in master ossec.log"
echo "No errors in master ossec.log"
else
echo "Errors in master ossec.log:"
echo "${log1}"
exit 1
echo "Errors in master ossec.log:"
echo "${log1}"
exit 1
fi
log2=$(docker exec multi-node_wazuh.worker_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "${log2}" ]]; then
echo "No errors in worker ossec.log"
echo "No errors in worker ossec.log"
else
echo "Errors in worker ossec.log:"
echo "${log2}"
exit 1
echo "Errors in worker ossec.log:"
echo "${log2}"
exit 1
fi

View File

@@ -1,9 +0,0 @@
fbout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
fbstatus=$(echo "${fbout}" | grep -c OK)
if [[ fbstatus -eq 7 ]]; then
echo "No errors in filebeat"
else
echo "Errors in filebeat"
echo "${fbout}"
exit 1
fi

9
.github/single-node-filebeat-check.sh vendored Executable file
View File

@@ -0,0 +1,9 @@
filebeatout=$(docker exec single-node_wazuh.manager_1 sh -c 'filebeat test output')
filebeatstatus=$(echo "${filebeatout}" | grep -c OK)
if [[ filebeatstatus -eq 7 ]]; then
echo "No errors in filebeat"
else
echo "Errors in filebeat"
echo "${filebeatout}"
exit 1
fi

View File

@@ -1,8 +1,8 @@
log=$(docker exec single-node_wazuh.manager_1 sh -c 'cat /var/ossec/logs/ossec.log' | grep -P "ERR|WARN|CRIT")
if [[ -z "$log" ]]; then
echo "No errors in ossec.log"
echo "No errors in ossec.log"
else
echo "Errors in ossec.log:"
echo "${log}"
exit 1
echo "Errors in ossec.log:"
echo "${log}"
exit 1
fi

View File

@@ -3,7 +3,7 @@ name: Wazuh Docker pipeline
on: [pull_request]
jobs:
build-stack:
build-docker-images:
runs-on: ubuntu-latest
steps:
@@ -16,6 +16,34 @@ jobs:
- name: Create enviroment variables
run: cat .env > $GITHUB_ENV
- name: Create backup Docker images
run: |
mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
- name: Temporarily save Wazuh manager Docker image
uses: actions/upload-artifact@v3
with:
name: docker-artifact-manager
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
retention-days: 1
- name: Temporarily save Wazuh indexer Docker image
uses: actions/upload-artifact@v3
with:
name: docker-artifact-indexer
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
retention-days: 1
- name: Temporarily save Wazuh dashboard Docker image
uses: actions/upload-artifact@v3
with:
name: docker-artifact-dashboard
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
retention-days: 1
- name: Install Goss
uses: e1himself/goss-installation-action@v1.0.3
with:
@@ -27,6 +55,39 @@ jobs:
GOSS_SLEEP: 30
GOSS_FILE: .github/.goss.yaml
check-single-node:
runs-on: ubuntu-latest
needs: build-docker-images
steps:
- name: Check out code
uses: actions/checkout@v3
- name: Create enviroment variables
run: cat .env > $GITHUB_ENV
- name: Retrieve saved Wazuh indexer Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-indexer
- name: Retrieve saved Wazuh manager Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-manager
- name: Retrieve saved Wazuh dashboard Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-dashboard
- name: Docker load
run: |
docker load --input ./wazuh-indexer.tar
docker load --input ./wazuh-dashboard.tar
docker load --input ./wazuh-manager.tar
- name: Create single node certficates
run: docker-compose -f single-node/generate-indexer-certs.yml run --rm generator
@@ -44,7 +105,7 @@ jobs:
exit 1
fi
status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
if [[ $status_index_green -eq $status_index ]]; then
curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
else
@@ -65,7 +126,7 @@ jobs:
- name: Check documents into wazuh-alerts index
run: |
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
if [[ $docs -gt 100 ]]; then
echo "wazuh-alerts index documents: ${docs}"
else
@@ -75,8 +136,8 @@ jobs:
- name: Check Wazuh templates
run: |
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics" | wc -l`"
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -E "wazuh ||wazuh-agent||wazuh-statistics"`"
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
if [[ $qty_templates -eq 3 ]]; then
echo "wazuh templates:"
echo "${templates}"
@@ -105,7 +166,7 @@ jobs:
- name: Check filebeat output
run: ./.github/single-node-fb-check.sh
run: ./.github/single-node-filebeat-check.sh
- name: Check Wazuh dashboard service URL
run: |
@@ -120,6 +181,38 @@ jobs:
- name: Stop single node stack
run: docker-compose -f single-node/docker-compose.yml down
check-multi-node:
runs-on: ubuntu-latest
needs: build-docker-images
steps:
- name: Check out code
uses: actions/checkout@v3
- name: Create enviroment variables
run: cat .env > $GITHUB_ENV
- name: Retrieve saved Wazuh dashboard Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-dashboard
- name: Retrieve saved Wazuh manager Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-manager
- name: Retrieve saved Wazuh indexer Docker image
uses: actions/download-artifact@v3
with:
name: docker-artifact-indexer
- name: Docker load
run: |
docker load --input ./wazuh-manager.tar
docker load --input ./wazuh-indexer.tar
docker load --input ./wazuh-dashboard.tar
- name: Create multi node certficates
run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator
@@ -157,8 +250,8 @@ jobs:
- name: Check documents into wazuh-alerts index
run: |
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`"
if [[ $docs -gt 200 ]]; then
docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
if [[ $docs -gt 100 ]]; then
echo "wazuh-alerts index documents: ${docs}"
else
echo "wazuh-alerts index documents: ${docs}"
@@ -169,7 +262,7 @@ jobs:
run: |
qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
if [[ $qty_templates -gt 0 ]]; then
if [[ $qty_templates -eq 3 ]]; then
echo "wazuh templates:"
echo "${templates}"
else
@@ -204,7 +297,7 @@ jobs:
- name: Check filebeat output
run: ./.github/multi-node-fb-check.sh
run: ./.github/multi-node-filebeat-check.sh
- name: Check Wazuh dashboard service URL
run: |

View File

@@ -1,6 +1,98 @@
# Change Log
All notable changes to this project will be documented in this file.
## Wazuh Docker v4.5.4
### Added
- Update Wazuh to version [4.5.4](https://github.com/wazuh/wazuh/blob/v4.5.4/CHANGELOG.md#v454)
## Wazuh Docker v4.5.3
### Added
- Update Wazuh to version [4.5.3](https://github.com/wazuh/wazuh/blob/v4.5.3/CHANGELOG.md#v453)
## Wazuh Docker v4.5.2
### Added
- Update Wazuh to version [4.5.2](https://github.com/wazuh/wazuh/blob/v4.5.2/CHANGELOG.md#v452)
## Wazuh Docker v4.5.1
### Added
- Update Wazuh to version [4.5.1](https://github.com/wazuh/wazuh/blob/v4.5.1/CHANGELOG.md#v451)
## Wazuh Docker v4.5.0
### Added
- Update Wazuh to version [4.5.0](https://github.com/wazuh/wazuh/blob/v4.5.0/CHANGELOG.md#v450)
## Wazuh Docker v4.4.5
### Added
- Update Wazuh to version [4.4.5](https://github.com/wazuh/wazuh/blob/v4.4.5/CHANGELOG.md#v445)
## Wazuh Docker v4.4.4
### Added
- Update Wazuh to version [4.4.4](https://github.com/wazuh/wazuh/blob/v4.4.4/CHANGELOG.md#v444)
## Wazuh Docker v4.4.3
### Added
- Update Wazuh to version [4.4.3](https://github.com/wazuh/wazuh/blob/v4.4.3/CHANGELOG.md#v443)
## Wazuh Docker v4.4.2
### Added
- Update Wazuh to version [4.4.2](https://github.com/wazuh/wazuh/blob/v4.4.2/CHANGELOG.md#v442)
## Wazuh Docker v4.4.1
### Added
- Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441)
## Wazuh Docker v4.4.0
### Added
- Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440)
## Wazuh Docker v4.3.11
### Added
- Update Wazuh to version [4.3.11](https://github.com/wazuh/wazuh/blob/v4.3.11/CHANGELOG.md#v4311)
## Wazuh Docker v4.3.10
### Added
- Update Wazuh to version [4.3.10](https://github.com/wazuh/wazuh/blob/v4.3.10/CHANGELOG.md#v4310)
## Wazuh Docker v4.3.9
### Added
- Update Wazuh to version [4.3.9](https://github.com/wazuh/wazuh/blob/v4.3.9/CHANGELOG.md#v439)
## Wazuh Docker v4.3.8
### Added
- Update Wazuh to version [4.3.8](https://github.com/wazuh/wazuh/blob/v4.3.8/CHANGELOG.md#v438)
## Wazuh Docker v4.3.7
### Added
- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437)
## Wazuh Docker v4.3.6
### Added
- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436)
## Wazuh Docker v4.3.5
### Added
- Update Wazuh to version [4.3.5](https://github.com/wazuh/wazuh/blob/v4.3.5/CHANGELOG.md#v435)
## Wazuh Docker v4.3.4
### Added

View File

@@ -36,13 +36,13 @@ Default values are included when available.
### Wazuh
```
API_USERNAME="wazuh" # Wazuh API username
API_PASSWORD="wazuh" # Wazuh API password - Must comply with requirements
API_USERNAME="wazuh-wui" # Wazuh API username
API_PASSWORD="MyS3cr37P450r.*-" # Wazuh API password - Must comply with requirements
# (8+ length, uppercase, lowercase, specials chars)
INDEXER_URL=https://wazuh.indexer:9200 # Wazuh indexer URL
INDEXER_USERNAME=admin # Wazuh indexer Username
INDEXER_PASSWORD=admin # Wazuh indexer Password
INDEXER_PASSWORD=SecretPassword # Wazuh indexer Password
FILEBEAT_SSL_VERIFICATION_MODE=full # Filebeat SSL Verification mode (full or none)
SSL_CERTIFICATE_AUTHORITIES="" # Path of Filebeat SSL CA
SSL_CERTIFICATE="" # Path of Filebeat SSL Certificate
@@ -78,10 +78,12 @@ API_SELECTOR=true Defines if the user is allowed to change the sel
IP_SELECTOR=true # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu
IP_IGNORE="[]" # List of index patterns to be ignored
DASHBOARD_USERNAME=kibanaserver # Custom user saved in the dashboard keystore
DASHBOARD_PASSWORD=kibanaserver # Custom password saved in the dashboard keystore
WAZUH_MONITORING_ENABLED=true # Custom settings to enable/disable wazuh-monitoring indices
WAZUH_MONITORING_FREQUENCY=900 # Custom setting to set the frequency for wazuh-monitoring indices cron task
WAZUH_MONITORING_SHARDS=2 # Configure wazuh-monitoring-* indices shards and replicas
WAZUH_MONITORING_REPLICAS=0 #
WAZUH_MONITORING_REPLICAS=0 ##
```
## Directory structure
@@ -193,6 +195,24 @@ WAZUH_MONITORING_REPLICAS=0 #
| Wazuh version | ODFE | XPACK |
|---------------|---------|--------|
| v4.5.4 | | |
| v4.5.3 | | |
| v4.5.2 | | |
| v4.5.1 | | |
| v4.5.0 | | |
| v4.4.5 | | |
| v4.4.4 | | |
| v4.4.3 | | |
| v4.4.2 | | |
| v4.4.1 | | |
| v4.4.0 | | |
| v4.3.11 | | |
| v4.3.10 | | |
| v4.3.9 | | |
| v4.3.8 | | |
| v4.3.7 | | |
| v4.3.6 | | |
| v4.3.5 | | |
| v4.3.4 | | |
| v4.3.3 | | |
| v4.3.2 | | |

View File

@@ -1,2 +1,2 @@
WAZUH-DOCKER_VERSION="4.3.4"
REVISION="40316"
WAZUH-DOCKER_VERSION="4.5.4"
REVISION="40510"

View File

@@ -1,7 +1,11 @@
# Wazuh Docker Image Builder
This stack allows you to build the Wazuh manager, indexer, and dashboard images locally by running the command:
The creation of the images for the Wazuh stack deployment in Docker is done with the build-images.yml script
To execute the process, the following must be executed in the root of the wazuh-docker repository:
```
$ docker-compose build
```
$ build-docker-images/build-images.sh
```
This script initializes the environment variables needed to build each of the images.

View File

@@ -1,15 +1,11 @@
WAZUH_IMAGE_VERSION=4.3.4
WAZUH_IMAGE_VERSION=4.5.4
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
## If wazuh manager exists in apt dev repository, change variables, if not, exit 1
if [ "$WAZUH_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
else
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}-dev
fi
WAZUH_TAG_REVISION=1
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env
echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
docker-compose -f build-docker-images/build-images.yml --env-file .env build --no-cache

View File

@@ -6,7 +6,8 @@ services:
build:
context: wazuh-manager/
args:
- WAZUH_VERSION=${WAZUH_VERSION}
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
hostname: wazuh.manager
restart: always
@@ -37,7 +38,8 @@ services:
build:
context: wazuh-indexer/
args:
- WAZUH_VERSION=${WAZUH_VERSION}
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
hostname: wazuh.indexer
restart: always
@@ -57,7 +59,8 @@ services:
build:
context: wazuh-dashboard/
args:
- WAZUH_VERSION=${WAZUH_VERSION}
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
hostname: wazuh.dashboard
restart: always

View File

@@ -2,7 +2,9 @@
FROM ubuntu:focal AS builder
ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
ARG WAZUH_UI_REVISION=1
# Update and install dependencies
RUN apt-get update && apt install curl libcap2-bin xz-utils -y
@@ -11,19 +13,14 @@ RUN apt-get update && apt install curl libcap2-bin xz-utils -y
RUN mkdir -p $INSTALL_DIR
# Download and extract Wazuh dashboard base
RUN curl -o wazuh-dashboard-base.tar.xz https://packages.wazuh.com/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-linux-x64.tar.xz && \
tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1
COPY config/dl_base.sh .
RUN bash dl_base.sh
# Generate certificates
COPY config/config.sh .
COPY config/config.yml /
RUN bash config.sh
# Create and configure Wazuh dashboard keystore
RUN $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
echo kibanaserver | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
COPY config/install_wazuh_app.sh /
RUN chmod 775 /install_wazuh_app.sh
RUN bash /install_wazuh_app.sh
@@ -105,6 +102,10 @@ RUN chown 1000:1000 /*.sh
# Copy Install dir from builder to current image
COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR
# Create custom directory
RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
# Set workdir and user
WORKDIR $INSTALL_DIR
USER wazuh-dashboard

View File

@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.3/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
PACKAGES_URL=https://packages.wazuh.com/4.5/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')

View File

@@ -0,0 +1,25 @@
REPOSITORY="packages.wazuh.com/4.x"
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
## check version to use the correct repository
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
fi
fi
fi
curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz
tar -xf wazuh-dashboard-base.tar.xz --directory $INSTALL_DIR --strip-components=1

View File

@@ -7,7 +7,7 @@ DASHBOARD_PASSWORD="${DASHBOARD_PASSWORD:-kibanaserver}"
# Create and configure Wazuh dashboard keystore
$INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
yes | $INSTALL_DIR/bin/opensearch-dashboards-keystore create --allow-root && \
echo $DASHBOARD_USERNAME | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.username --stdin --allow-root && \
echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add opensearch.password --stdin --allow-root
@@ -15,6 +15,6 @@ echo $DASHBOARD_PASSWORD | $INSTALL_DIR/bin/opensearch-dashboards-keystore add o
# Start Wazuh dashboard
##############################################################################
/wazuh_app_config.sh
/wazuh_app_config.sh $WAZUH_UI_REVISION
/usr/share/wazuh-dashboard/bin/opensearch-dashboards -c /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml

View File

@@ -1,11 +1,24 @@
## Variables
WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
## If wazuh manager exists in apt dev repository, change variables, if not exit 1
if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
else
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-1.zip
## variables
WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
## check version to use the correct repository
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip
fi
fi
fi
# Install Wazuh App

View File

@@ -2,6 +2,7 @@
FROM ubuntu:focal AS builder
ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION
RUN apt-get update -y && apt-get install curl openssl xz-utils -y
@@ -58,14 +59,15 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/s
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d
COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d
RUN chown -R 1000:1000 /usr/share/wazuh-indexer
RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \
mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \
mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \
mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \
chmod 700 /usr/share/wazuh-indexer/config && \
chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \
chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml
chmod 700 /usr/share/wazuh-indexer && \
chmod 600 /usr/share/wazuh-indexer/jvm.options && \
chmod 600 /usr/share/wazuh-indexer/opensearch.yml
USER wazuh-indexer

View File

@@ -8,21 +8,44 @@ export TARGET_DIR=${CURDIR}/debian/${NAME}
# Package build options
export USER=${NAME}
export GROUP=${NAME}
export VERSION=${WAZUH_VERSION}
export VERSION=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
export LOG_DIR=/var/log/${NAME}
export LIB_DIR=/var/lib/${NAME}
export PID_DIR=/run/${NAME}
export INSTALLATION_DIR=/usr/share/${NAME}
export CONFIG_DIR=${INSTALLATION_DIR}/config
export CONFIG_DIR=${INSTALLATION_DIR}
export BASE_DIR=${NAME}-*
export INDEXER_FILE=wazuh-indexer-base.tar.xz
export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz
export REPO_DIR=/unattended_installer
rm -rf ${INSTALLATION_DIR}/
curl -o ${INDEXER_FILE} https://packages.wazuh.com/stack/indexer/base/${BASE_FILE}
## variables
REPOSITORY="packages.wazuh.com/4.x"
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
## check version to use the correct repository
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
REPOSITORY="packages-dev.wazuh.com/pre-release"
fi
fi
fi
curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/${BASE_FILE}
tar -xf ${INDEXER_FILE}
## TOOLS
@@ -30,8 +53,8 @@ tar -xf ${INDEXER_FILE}
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.3/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
PACKAGES_URL=https://packages.wazuh.com/4.5/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -70,6 +93,7 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A
# copy to target
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}
mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
mkdir -p ${TARGET_DIR}${CONFIG_DIR}
mkdir -p ${TARGET_DIR}${LIB_DIR}
mkdir -p ${TARGET_DIR}${LOG_DIR}
@@ -94,9 +118,9 @@ cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR}
cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/
# Copy Wazuh's config files for the security plugin
cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/
cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/
cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR}
# Copy Wazuh indexer's certificates
cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem
@@ -106,5 +130,9 @@ cp -pr /wazuh-certificates/root-ca.pem ${TARGET_DIR}${CONFIG_DIR}/certs/root-ca.
cp -pr /wazuh-certificates/admin.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin.pem
cp -pr /wazuh-certificates/admin-key.pem ${TARGET_DIR}${CONFIG_DIR}/certs/admin-key.pem
# Delete xms and xmx parameters in jvm.options
sed '/-Xms/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
sed '/-Xmx/d' -i ${TARGET_DIR}${CONFIG_DIR}/jvm.options
chmod -R 500 ${TARGET_DIR}${CONFIG_DIR}/certs
chmod -R 400 ${TARGET_DIR}${CONFIG_DIR}/certs/*

View File

@@ -6,7 +6,7 @@ umask 0002
export USER=wazuh-indexer
export INSTALLATION_DIR=/usr/share/wazuh-indexer
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}
export JAVA_HOME=${INSTALLATION_DIR}/jdk
export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml)
@@ -59,7 +59,7 @@ if [[ -f bin/opensearch-users ]]; then
# enabled, but we have no way of knowing which node we are yet. We'll just
# honor the variable if it's present.
if [[ -n "$INDEXER_PASSWORD" ]]; then
[[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
[[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create)
if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then
# keystore is unencrypted
if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then
@@ -84,10 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then
fi
if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
#if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then
# run securityadmin.sh for single node with CACERT, CERT and KEY parameter
nohup /securityadmin.sh &
touch "/var/lib/wazuh-indexer/.flag"
fi
# nohup /securityadmin.sh &
# touch "/var/lib/wazuh-indexer/.flag"
#fi
run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD"

View File

@@ -4,12 +4,12 @@ path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
discovery.type: single-node
compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false

View File

@@ -1,3 +1,3 @@
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
sleep 30
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9300 -icl
bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl

View File

@@ -4,7 +4,8 @@ FROM ubuntu:focal
RUN rm /bin/sh && ln -s /bin/bash /bin/sh
ARG WAZUH_VERSION
ARG TEMPLATE_VERSION=4.3
ARG WAZUH_TAG_REVISION
ARG TEMPLATE_VERSION=4.5
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz"
@@ -17,14 +18,12 @@ RUN chmod 775 /check_repository.sh
RUN source /check_repository.sh
RUN apt-get update && \
apt-get install wazuh-manager=${WAZUH_VERSION}-1
apt-get install wazuh-manager=${WAZUH_VERSION}-${WAZUH_TAG_REVISION}
RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb &&\
dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \
curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
RUN curl -L https://github.com/aelsabbahy/goss/releases/latest/download/goss-linux-amd64 -o /usr/local/bin/goss && chmod +rx /usr/local/bin/goss
ARG S6_VERSION="v2.2.0.3"
RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \

View File

@@ -1,13 +1,29 @@
## Variables
WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g')
WAZUH_ACTUAL_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
## If wazuh manager exists in apt dev repository, change variables, if not exit 1
if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_ACTUAL_VERSION" ]; then
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
else
## variables
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main"
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-)
MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1)
MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2)
MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3)
MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1)
MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2)
MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3)
## check version to use the correct repository
if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then
if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then
if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main"
fi
fi
fi
apt-key adv --fetch-keys ${APT_KEY}
echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list

View File

@@ -21,7 +21,7 @@ try:
set_user_role,
update_user,
)
except Exception as e:
except ModuleNotFoundError as e:
logging.error("No module 'wazuh' found.")
sys.exit(1)

View File

@@ -179,6 +179,15 @@ set_rids_owner() {
chown -R wazuh:wazuh /var/ossec/queue/rids
}
##############################################################################
# Change any ossec user/group to wazuh user/group
##############################################################################
set_correct_permOwner() {
find / -group 997 -exec chown :101 {} +;
find / -user 999 -exec chown 101 {} +;
}
##############################################################################
# Main function
##############################################################################
@@ -189,6 +198,9 @@ main() {
# Restore files stored in permanent data that are not permanent (i.e. internal_options.conf)
apply_exclusion_data
# Apply correct permission and ownership
set_correct_permOwner
# Rename files stored in permanent data (i.e. queue/ossec)
move_data_files

View File

@@ -12,32 +12,38 @@ fi
if [ "$INDEXER_USERNAME" != "" ]; then
>&2 echo "Configuring username."
sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
fi
if [ "$INDEXER_PASSWORD" != "" ]; then
>&2 echo "Configuring password."
sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
fi
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
>&2 echo "Configuring SSL verification mode."
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
>&2 echo "Configuring Certificate Authorities."
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE" != "" ]; then
>&2 echo "Configuring SSL Certificate."
sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_KEY" != "" ]; then
>&2 echo "Configuring SSL Key."
sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
fi

View File

@@ -20,3 +20,12 @@ output.elasticsearch:
#ssl.certificate_authorities:
#ssl.certificate:
#ssl.key:
logging.metrics.enabled: false
seccomp:
default_action: allow
syscalls:
- action: allow
names:
- rseq

View File

@@ -21,6 +21,8 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"

View File

@@ -8,8 +8,8 @@
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.3/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/
PACKAGES_URL=https://packages.wazuh.com/4.5/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')
@@ -17,13 +17,13 @@ CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E
## If cert tool exists in some bucket, download it, if not exit 1
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL
echo "Cert tool exists in Packages bucket"
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL -s
echo "The tool to create the certificates exists in the in Packages bucket"
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL
echo "Cert tool exists in Packages-dev bucket"
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL -s
echo "The tool to create the certificates exists in Packages-dev bucket"
else
echo "Cert tool does not exist in any bucket"
echo "The tool to create the certificates does not exist in any bucket"
echo "ERROR: certificates were not created"
exit 1
fi
@@ -41,9 +41,9 @@ source /$CERT_TOOL -A
nodes_server=$( cert_parseYaml /config.yml | grep nodes_server__name | sed 's/nodes_server__name=//' )
node_names=($nodes_server)
echo "Moving created certificates to destination directory"
echo "Moving created certificates to the destination directory"
cp /wazuh-certificates/* /certificates/
echo "changing certificate permissions"
echo "Changing certificate permissions"
chmod -R 500 /certificates
chmod -R 400 /certificates/*
echo "Setting UID indexer and dashboard"
@@ -51,11 +51,11 @@ chown 1000:1000 /certificates/*
echo "Setting UID for wazuh manager and worker"
cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
cp /certificates/root-ca.key /certificates/root-ca-manager.key
chown 999:997 /certificates/root-ca-manager.pem
chown 999:997 /certificates/root-ca-manager.key
chown 101:101 /certificates/root-ca-manager.pem
chown 101:101 /certificates/root-ca-manager.key
for i in ${node_names[@]};
do
chown 999:997 "/certificates/${i}.pem"
chown 999:997 "/certificates/${i}-key.pem"
for i in ${node_names[@]};
do
chown 101:101 "/certificates/${i}.pem"
chown 101:101 "/certificates/${i}-key.pem"
done

View File

@@ -1,6 +1,6 @@
# Opendistro data migration to Wazuh indexer on docker.
This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments.
The example is migrating from v4.2 to v4.3.
The example is migrating from v4.2 to v4.4.
## Procedure
Assuming that you have a v4.2 production deployment, perform the following steps.
@@ -350,9 +350,9 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to"
```
**7. Start the 4.3 environment.**
**7. Start the 4.4 environment.**
```
git checkout 4.3
git checkout 4.4
cd multi-node
docker-compose -f generate-indexer-certs.yml run --rm generator
docker-compose up -d

View File

@@ -21,4 +21,4 @@ nodes:
# Wazuh dashboard node
dashboard:
- name: wazuh.dashboard
ip: wazuh.dashboard
ip: wazuh.dashboard

View File

@@ -108,13 +108,13 @@
<os>xenial</os>
<os>bionic</os>
<os>focal</os>
<os>jammy</os>
<update_interval>1h</update_interval>
</provider>
<!-- Debian OS vulnerabilities -->
<provider name="debian">
<enabled>no</enabled>
<os>stretch</os>
<os>buster</os>
<os>bullseye</os>
<update_interval>1h</update_interval>
@@ -127,6 +127,7 @@
<os>6</os>
<os>7</os>
<os>8</os>
<os>9</os>
<update_interval>1h</update_interval>
</provider>
@@ -138,6 +139,18 @@
<update_interval>1h</update_interval>
</provider>
<!-- SUSE Linux Enterprise OS vulnerabilities -->
<provider name="suse">
<enabled>no</enabled>
<os>11-server</os>
<os>11-desktop</os>
<os>12-server</os>
<os>12-desktop</os>
<os>15-server</os>
<os>15-desktop</os>
<update_interval>1h</update_interval>
</provider>
<!-- Arch OS vulnerabilities -->
<provider name="arch">
<enabled>no</enabled>
@@ -153,7 +166,6 @@
<!-- Aggregate vulnerabilities -->
<provider name="nvd">
<enabled>yes</enabled>
<update_from_year>2010</update_from_year>
<update_interval>1h</update_interval>
</provider>

View File

@@ -108,13 +108,13 @@
<os>xenial</os>
<os>bionic</os>
<os>focal</os>
<os>jammy</os>
<update_interval>1h</update_interval>
</provider>
<!-- Debian OS vulnerabilities -->
<provider name="debian">
<enabled>no</enabled>
<os>stretch</os>
<os>buster</os>
<os>bullseye</os>
<update_interval>1h</update_interval>
@@ -127,6 +127,7 @@
<os>6</os>
<os>7</os>
<os>8</os>
<os>9</os>
<update_interval>1h</update_interval>
</provider>
@@ -138,6 +139,18 @@
<update_interval>1h</update_interval>
</provider>
<!-- SUSE Linux Enterprise OS vulnerabilities -->
<provider name="suse">
<enabled>no</enabled>
<os>11-server</os>
<os>11-desktop</os>
<os>12-server</os>
<os>12-desktop</os>
<os>15-server</os>
<os>15-desktop</os>
<update_interval>1h</update_interval>
</provider>
<!-- Arch OS vulnerabilities -->
<provider name="arch">
<enabled>no</enabled>
@@ -153,7 +166,6 @@
<!-- Aggregate vulnerabilities -->
<provider name="nvd">
<enabled>yes</enabled>
<update_from_year>2010</update_from_year>
<update_interval>1h</update_interval>
</provider>

View File

@@ -3,5 +3,5 @@ hosts:
url: "https://wazuh.master"
port: 55000
username: wazuh-wui
password: MyS3cr37P450r.*-
password: "MyS3cr37P450r.*-"
run_as: false

View File

@@ -3,9 +3,16 @@ version: '3.7'
services:
wazuh.master:
image: wazuh/wazuh-manager:4.3.4
image: wazuh/wazuh-manager:4.5.4
hostname: wazuh.master
restart: always
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
ports:
- "1515:1515"
- "514:514/udp"
@@ -38,9 +45,16 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.worker:
image: wazuh/wazuh-manager:4.3.4
image: wazuh/wazuh-manager:4.5.4
hostname: wazuh.worker
restart: always
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
environment:
- INDEXER_URL=https://wazuh1.indexer:9200
- INDEXER_USERNAME=admin
@@ -67,7 +81,7 @@ services:
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
wazuh1.indexer:
image: wazuh/wazuh-indexer:4.3.4
image: wazuh/wazuh-indexer:4.5.4
hostname: wazuh1.indexer
restart: always
ports:
@@ -84,16 +98,16 @@ services:
hard: 65536
volumes:
- wazuh-indexer-data-1:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh2.indexer:
image: wazuh/wazuh-indexer:4.3.4
image: wazuh/wazuh-indexer:4.5.4
hostname: wazuh2.indexer
restart: always
environment:
@@ -108,14 +122,14 @@ services:
hard: 65536
volumes:
- wazuh-indexer-data-2:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem
- ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh3.indexer:
image: wazuh/wazuh-indexer:4.3.4
image: wazuh/wazuh-indexer:4.5.4
hostname: wazuh3.indexer
restart: always
environment:
@@ -130,14 +144,14 @@ services:
hard: 65536
volumes:
- wazuh-indexer-data-3:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem
- ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.3.4
image: wazuh/wazuh-dashboard:4.5.4
hostname: wazuh.dashboard
restart: always
ports:
@@ -147,12 +161,16 @@ services:
- WAZUH_API_URL="https://wazuh.master"
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
volumes:
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
- wazuh1.indexer
links:
@@ -202,3 +220,5 @@ volumes:
wazuh-indexer-data-1:
wazuh-indexer-data-2:
wazuh-indexer-data-3:
wazuh-dashboard-config:
wazuh-dashboard-custom:

View File

@@ -13,4 +13,4 @@ nodes:
# Wazuh dashboard node
dashboard:
- name: wazuh.dashboard
ip: wazuh.dashboard
ip: wazuh.dashboard

View File

@@ -108,13 +108,13 @@
<os>xenial</os>
<os>bionic</os>
<os>focal</os>
<os>jammy</os>
<update_interval>1h</update_interval>
</provider>
<!-- Debian OS vulnerabilities -->
<provider name="debian">
<enabled>no</enabled>
<os>stretch</os>
<os>buster</os>
<os>bullseye</os>
<update_interval>1h</update_interval>
@@ -127,6 +127,7 @@
<os>6</os>
<os>7</os>
<os>8</os>
<os>9</os>
<update_interval>1h</update_interval>
</provider>
@@ -138,6 +139,18 @@
<update_interval>1h</update_interval>
</provider>
<!-- SUSE Linux Enterprise OS vulnerabilities -->
<provider name="suse">
<enabled>no</enabled>
<os>11-server</os>
<os>11-desktop</os>
<os>12-server</os>
<os>12-desktop</os>
<os>15-server</os>
<os>15-desktop</os>
<update_interval>1h</update_interval>
</provider>
<!-- Arch OS vulnerabilities -->
<provider name="arch">
<enabled>no</enabled>
@@ -153,7 +166,6 @@
<!-- Aggregate vulnerabilities -->
<provider name="nvd">
<enabled>yes</enabled>
<update_from_year>2010</update_from_year>
<update_interval>1h</update_interval>
</provider>
@@ -331,11 +343,11 @@
<name>wazuh</name>
<node_name>node01</node_name>
<node_type>master</node_type>
<key></key>
<key>aa093264ef885029653eea20dfcf51ae</key>
<port>1516</port>
<bind_addr>0.0.0.0</bind_addr>
<nodes>
<node>NODE_IP</node>
<node>wazuh.manager</node>
</nodes>
<hidden>no</hidden>
<disabled>yes</disabled>

View File

@@ -3,5 +3,5 @@ hosts:
url: "https://wazuh.manager"
port: 55000
username: wazuh-wui
password: MyS3cr37P450r.*-
password: "MyS3cr37P450r.*-"
run_as: false

View File

@@ -3,13 +3,15 @@ node.name: "wazuh.indexer"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
discovery.type: single-node
http.port: 9200-9299
transport.tcp.port: 9300-9399
compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false

View File

@@ -3,9 +3,16 @@ version: '3.7'
services:
wazuh.manager:
image: wazuh/wazuh-manager:4.3.4
image: wazuh/wazuh-manager:4.5.4
hostname: wazuh.manager
restart: always
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 655360
hard: 655360
ports:
- "1514:1514"
- "1515:1515"
@@ -39,7 +46,7 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.indexer:
image: wazuh/wazuh-indexer:4.3.4
image: wazuh/wazuh-indexer:4.5.4
hostname: wazuh.indexer
restart: always
ports:
@@ -55,16 +62,16 @@ services:
hard: 65536
volumes:
- wazuh-indexer-data:/var/lib/wazuh-indexer
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.3.4
image: wazuh/wazuh-dashboard:4.5.4
hostname: wazuh.dashboard
restart: always
ports:
@@ -73,6 +80,8 @@ services:
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=SecretPassword
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
volumes:
@@ -81,6 +90,8 @@ services:
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
- wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
depends_on:
- wazuh.indexer
links:
@@ -100,3 +111,5 @@ volumes:
filebeat_etc:
filebeat_var:
wazuh-indexer-data:
wazuh-dashboard-config:
wazuh-dashboard-custom:

View File

@@ -7,4 +7,4 @@ services:
hostname: wazuh-certs-generator
volumes:
- ./config/wazuh_indexer_ssl_certs/:/certificates/
- ./config/certs.yml:/config/certs.yml
- ./config/certs.yml:/config/certs.yml

View File

@@ -1,6 +0,0 @@
nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k | grep -E "indexer" | wc -l`"
if [[ $nodes -eq 1 ]]; then
echo "bien"
else
echo "mal"
fi