Merge pull request #378 from wazuh/fix-filebeat-installation

Fix filebeat installation

CHANGELOG.md

@@ -1,6 +1,23 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## Wazuh Docker v3.13.1_7.8.0
+
+### Added
+
+- Update to Wazuh version 3.13.1_7.8.0
+
+## Wazuh Docker v3.13.0_7.7.1
+
+### Added
+
+- Update to Wazuh version 3.13.3_7.7.1
+
+### Fixed
+
+- Save agentless state ([@xr09](https://github.com/xr09)) [#350](https://github.com/wazuh/wazuh-docker/pull/350)
+- Use HTTP credentials for service check when required ([@xr09](https://github.com/xr09)) [#356](https://github.com/wazuh/wazuh-docker/pull/356)
+
 ## Wazuh Docker v3.12.3_7.6.2
 
 ### Added

README.md

@@ -57,7 +57,7 @@ In addition, a docker-compose file is provided to launch the containers mentione
 
 * `stable` branch on correspond to the latest Wazuh-Docker stable version.
 * `master` branch contains the latest code, be aware of possible bugs on this branch.
-* `Wazuh.Version_ElasticStack.Version` (for example 3.10.2_7.5.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
+* `Wazuh.Version_ElasticStack.Version` (for example 3.13.1_7.8.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
 
 ## Credits and Thank you
 

VERSION

@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="3.12.3_7.6.2"
-REVISION="31230"
+WAZUH-DOCKER_VERSION="3.13.1_7.8.0"
+REVISION="31310"

docker-compose.yml

@@ -3,7 +3,7 @@ version: '2'
 
 services:
   wazuh:
-    image: wazuh/wazuh:3.12.3_7.6.2
+    image: wazuh/wazuh:3.13.1_7.8.0
     hostname: wazuh-manager
     restart: always
     ports:
@@ -13,7 +13,7 @@ services:
       - "55000:55000"
 
   elasticsearch:
-    image: wazuh/wazuh-elasticsearch:3.12.3_7.6.2
+    image: wazuh/wazuh-elasticsearch:3.13.1_7.8.0
     hostname: elasticsearch
     restart: always
     ports:
@@ -30,7 +30,7 @@ services:
     mem_limit: 2g
 
   kibana:
-    image: wazuh/wazuh-kibana:3.12.3_7.6.2
+    image: wazuh/wazuh-kibana:3.13.1_7.8.0
     hostname: kibana
     restart: always
     depends_on:
@@ -40,7 +40,7 @@ services:
       - wazuh:wazuh
 
   nginx:
-    image: wazuh/wazuh-nginx:3.12.3_7.6.2
+    image: wazuh/wazuh-nginx:3.13.1_7.8.0
     hostname: nginx
     restart: always
     environment:
@@ -52,4 +52,4 @@ services:
     depends_on:
       - kibana
     links:
-      - kibana:kibana
+      - kibana:kibana

elasticsearch/Dockerfile

@@ -1,5 +1,5 @@
 # Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
-ARG ELASTIC_VERSION=7.6.2
+ARG ELASTIC_VERSION=7.8.0
 FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
 ARG ELASTIC_VERSION
 ARG S3_PLUGIN_URL="https://artifacts.elastic.co/downloads/elasticsearch-plugins/repository-s3/repository-s3-${ELASTIC_VERSION}.zip"
@@ -16,13 +16,14 @@ ENV XPACK_ML="true"
 
 ENV ENABLE_CONFIGURE_S3="false"
 
-ARG TEMPLATE_VERSION=v3.12.3
+ARG TEMPLATE_VERSION=v3.13.1
 
 # Elasticearch cluster configuration environment variables
 # If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration
 # CLUSTER_INITIAL_MASTER_NODES set to own node by default.
 ENV ELASTIC_CLUSTER="false" \
     CLUSTER_NAME="wazuh" \
+    CLUSTER_NETWORK_HOST="0.0.0.0" \
     CLUSTER_NODE_MASTER="false" \
     CLUSTER_NODE_DATA="true" \
     CLUSTER_NODE_INGEST="true" \

elasticsearch/config/config_cluster.sh

@@ -24,7 +24,7 @@ if [[ $CLUSTER_NODE_MASTER == "true" ]]; then
 # cluster.initial_master_nodes for bootstrap the cluster
 cat > $elastic_config_file << EOF
 # cluster node
-network.host: 0.0.0.0
+network.host: $CLUSTER_NETWORK_HOST
 node.name: $CLUSTER_MASTER_NODE_NAME
 node.master: $CLUSTER_NODE_MASTER
 cluster.initial_master_nodes:
@@ -39,7 +39,7 @@ remove_cluster_config $elastic_config_file
 
 cat > $elastic_config_file << EOF
 # cluster node
-network.host: 0.0.0.0
+network.host: $CLUSTER_NETWORK_HOST
 node.name: $CLUSTER_NODE_NAME
 node.master: false
 discovery.seed_hosts:

elasticsearch/config/load_settings.sh

@@ -38,7 +38,7 @@ if [ $ENABLE_CONFIGURE_S3 ]; then
 
 fi
 
-
+if [ ${ENABLED_XPACK} = "true" ]; then
 curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d'
 {
   "persistent": {
@@ -46,6 +46,7 @@ curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/jso
   }
 }
 '
+fi
 
 # Set cluster delayed timeout when node falls
 curl -X PUT "$el_url/_all/_settings" -H 'Content-Type: application/json' -d'

kibana/Dockerfile

@@ -1,8 +1,8 @@
 # Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana:7.6.2
+FROM docker.elastic.co/kibana/kibana:7.8.0
 USER kibana
-ARG ELASTIC_VERSION=7.6.2
-ARG WAZUH_VERSION=3.12.3
+ARG ELASTIC_VERSION=7.8.0
+ARG WAZUH_VERSION=3.13.1
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
 WORKDIR /usr/share/kibana

kibana/config/kibana_settings.sh

@@ -44,7 +44,12 @@ else
   kibana_ip="kibana"
 fi
 
-while [[ "$(curl -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
+# Add auth headers if required
+if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
+    curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
+fi
+
+while [[ "$(curl $curl_auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done

kibana/config/xpack_config.sh

@@ -11,7 +11,7 @@ then
     [xpack.ml.enabled]=$XPACK_ML
     [xpack.canvas.enabled]=$XPACK_CANVAS
     [xpack.infra.enabled]=$XPACK_INFRA
-    [xpack.monitoring.enabled]=$XPACK_MONITORING
+    [monitoring.enabled]=$XPACK_MONITORING
     [console.enabled]=$XPACK_DEVTOOLS
   )
   for i in "${!CONFIG_MAP[@]}"

nginx/config/entrypoint.sh

@@ -52,11 +52,14 @@ if [ "x${KIBANA_HOST}" = "x" ]; then
 fi
 
 echo "Configuring NGINX"
+
+
+if [ "${NGINX_PORT}" = "443" ]; then
 cat > /etc/nginx/conf.d/default.conf <<EOF
 server {
     listen 80;
     listen [::]:80;
-    return 301 https://\$host:${NGINX_PORT}\$request_uri;
+    return 301 https://\$host\$request_uri;
 }
 
 server {
@@ -74,5 +77,21 @@ server {
     }
 }
 EOF
+else
+cat > /etc/nginx/conf.d/default.conf <<EOF
+server {
+    listen ${NGINX_PORT};
+    listen [::]:${NGINX_PORT};
+    location / {
+        auth_basic "Restricted";
+        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+        proxy_pass http://${KIBANA_HOST}/;
+        proxy_buffer_size          128k;
+        proxy_buffers              4 256k;
+        proxy_busy_buffers_size    256k;
+    }
+}
+EOF
+fi
 
 exec nginx -g 'daemon off;'

wazuh/Dockerfile

@@ -1,14 +1,14 @@
 # Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
-FROM phusion/baseimage:latest
+FROM phusion/baseimage:0.10.2
 
-ARG FILEBEAT_VERSION=7.6.2
+ARG FILEBEAT_VERSION=7.8.0
 
-ARG WAZUH_VERSION=3.12.3-1
+ARG WAZUH_VERSION=3.13.1-1
 
 ENV API_USER="foo" \
    API_PASS="bar"
 
-ARG TEMPLATE_VERSION="v3.12.3"
+ARG TEMPLATE_VERSION="v3.13.1"
 
 # Set repositories.
 RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \
@@ -76,5 +76,8 @@ RUN chmod +x /etc/service/wazuh-api/run && \
 ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
 RUN chmod go-w /etc/filebeat/wazuh-template.json
 
+ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
+RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
+
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]

wazuh/config/00-wazuh.sh

@@ -50,7 +50,6 @@ if [  -e ${WAZUH_INSTALL_PATH}/etc-template  ]
 then
     cp -p /var/ossec/etc-template/internal_options.conf /var/ossec/etc/internal_options.conf
 fi
-rm /var/ossec/queue/db/.template.db
 
 # copy missing files from queue-template (in case this is an upgrade from previous versions)
 for filename in /var/ossec/queue-template/*; do
@@ -128,6 +127,7 @@ sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOST
 trap "ossec_shutdown; exit" SIGINT SIGTERM
 
 chmod -R g+rw ${DATA_PATH}
+chmod 750 /var/ossec/agentless/*
 
 ##############################################################################
 # Interpret any passed arguments (via docker command to this entrypoint) as

wazuh/config/01-config_filebeat.sh

@@ -3,16 +3,8 @@
 
 set -e
 
-WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
-
 # Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
 if [ "$ELASTICSEARCH_URL" != "" ]; then
   >&2 echo "Customize Elasticsearch ouput IP."
   sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
 fi
-
-# Install Wazuh Filebeat Module
-
-curl -s "https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
-mkdir -p /usr/share/filebeat/module/wazuh
-chmod 755 -R /usr/share/filebeat/module/wazuh

wazuh/config/data_dirs.env

@@ -3,5 +3,6 @@ DATA_DIRS[((i++))]="api/configuration"
 DATA_DIRS[((i++))]="etc"
 DATA_DIRS[((i++))]="logs"
 DATA_DIRS[((i++))]="queue"
+DATA_DIRS[((i++))]="agentless"
 DATA_DIRS[((i++))]="var/multigroups"
 export DATA_DIRS