mirror of
https://github.com/wazuh/wazuh-docker.git
synced 2025-11-02 13:03:20 +00:00
Compare commits
4 Commits
v3.13.2_7.
...
3.8.2_6.5.
| Author | SHA1 | Date | |
|---|---|---|---|
|
744d950d65 | ||
|
|
af6e12e336 | ||
|
11d14d6a8a | ||
|
|
a082864fdf |
215
CHANGELOG.md
215
CHANGELOG.md
@@ -1,219 +1,6 @@
|
||||
# Change Log
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## Wazuh Docker v3.13.2_7.9.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.13.2_7.9.1
|
||||
- Add CLUSTER_NETWORK_HOST environment variable ([@jfut](https://github.com/jfut)) [#372](https://github.com/wazuh/wazuh-docker/pull/372)
|
||||
|
||||
### Fixed
|
||||
|
||||
- Too many redirects when running on port 80 ([@chowmean](https://github.com/chowmean)) [#377](https://github.com/wazuh/wazuh-docker/pull/377)
|
||||
- Move Filebeat installation to build stage ([@xr09](https://github.com/xr09)) [#378](https://github.com/wazuh/wazuh-docker/pull/378)
|
||||
|
||||
|
||||
## Wazuh Docker v3.13.1_7.8.0
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.13.1_7.8.0
|
||||
|
||||
|
||||
## Wazuh Docker v3.13.0_7.7.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.13.3_7.7.1
|
||||
|
||||
### Fixed
|
||||
|
||||
- Save agentless state ([@xr09](https://github.com/xr09)) [#350](https://github.com/wazuh/wazuh-docker/pull/350)
|
||||
- Use HTTP credentials for service check when required ([@xr09](https://github.com/xr09)) [#356](https://github.com/wazuh/wazuh-docker/pull/356)
|
||||
|
||||
## Wazuh Docker v3.12.3_7.6.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.12.3_7.6.2
|
||||
|
||||
|
||||
## Wazuh Docker v3.12.2_7.6.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.12.2_7.6.2
|
||||
|
||||
## Wazuh Docker v3.12.1_7.6.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.12.1_7.6.2
|
||||
|
||||
### Fixed
|
||||
|
||||
- Agent timestamp not being properly saved ([@xr09](https://github.com/xr09)) [#323](https://github.com/wazuh/wazuh-docker/pull/323)
|
||||
|
||||
|
||||
## Wazuh Docker v3.12.0_7.6.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.12.0_7.6.1
|
||||
|
||||
|
||||
## Wazuh Docker v3.11.4_7.6.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.11.4_7.6.1
|
||||
|
||||
- Enable HTTP v2 on nginx ([@xr09](https://github.com/xr09)) [#308](https://github.com/wazuh/wazuh-docker/pull/308)
|
||||
|
||||
### Fixed
|
||||
|
||||
- Updated NGINX config syntax ([@xr09](https://github.com/xr09)) [#303](https://github.com/wazuh/wazuh-docker/pull/303)
|
||||
|
||||
|
||||
## Wazuh Docker v3.11.3_7.5.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.11.3_7.5.2
|
||||
|
||||
## Wazuh Docker v3.11.2_7.5.1
|
||||
|
||||
### Added
|
||||
|
||||
- Bumped Node.js to version 10 ([@xr09](https://github.com/xr09)) [#8615cd4](https://github.com/wazuh/wazuh-docker/commit/8615cd4d2152601e55becc7c3675360938e74b6a)
|
||||
|
||||
### Fixed
|
||||
|
||||
- Fix S3 Plugin ([@AnthonySendra](https://github.com/AnthonySendra)) [#293](https://github.com/wazuh/wazuh-docker/pull/293)
|
||||
|
||||
## Wazuh Docker v3.11.1_7.5.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.11.1_7.5.1
|
||||
- Filebeat configuration file updated to latest version ([@manuasir](https://github.com/manuasir)) [#271](https://github.com/wazuh/wazuh-docker/pull/271)
|
||||
- Allow using the hostname as node_name for managers ([@JPLachance](https://github.com/JPLachance)) [#261](https://github.com/wazuh/wazuh-docker/pull/261)
|
||||
|
||||
## Wazuh Docker v3.11.0_7.5.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.11.0_7.5.1
|
||||
|
||||
## Wazuh Docker v3.10.2_7.5.0
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.10.2_7.5.0
|
||||
|
||||
## Wazuh Docker v3.10.2_7.3.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.10.2_7.3.2
|
||||
|
||||
## Wazuh Docker v3.10.0_7.3.2
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.10.0_7.3.2
|
||||
|
||||
## Wazuh Docker v3.9.5_7.2.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.9.5_7.2.1
|
||||
|
||||
## Wazuh Docker v3.9.4_7.2.0
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.9.4_7.2.0
|
||||
- Implemented Wazuh Filebeat Module ([jm404](https://www.github.com/jm404)) [#2a77c6a](https://github.com/wazuh/wazuh-docker/commit/2a77c6a6e6bf78f2492adeedbade7a507d9974b2)
|
||||
|
||||
## Wazuh Docker v3.9.3_7.2.0
|
||||
|
||||
### Fixed
|
||||
- Wazuh-docker reinserts cluster settings after resuming containers ([@manuasir](https://github.com/manuasir)) [#213](https://github.com/wazuh/wazuh-docker/pull/213)
|
||||
|
||||
## Wazuh Docker v3.9.2_7.1.1
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.9.2_7.1.1
|
||||
|
||||
## Wazuh Docker v3.9.2_6.8.0
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.9.2_6.8.0
|
||||
|
||||
## Wazuh Docker v3.9.1_7.1.0
|
||||
|
||||
### Added
|
||||
|
||||
- Support for Elastic v7.1.0
|
||||
- New environment variables for Kibana ([@manuasir](https://github.com/manuasir)) [#22ad43](https://github.com/wazuh/wazuh-docker/commit/22ad4360f548e54bb0c5e929f8c84a186ad2ab88)
|
||||
|
||||
## Wazuh Docker v3.9.1_6.8.0
|
||||
|
||||
### Added
|
||||
|
||||
- Update to Wazuh version 3.9.1_6.8.0 ([#181](https://github.com/wazuh/wazuh-docker/pull/181))
|
||||
|
||||
### Fixed
|
||||
|
||||
- Fixed `ELASTICSEARCH_KIBANA_IP` environment variable ([@manuasir](https://github.com/manuasir)) ([#181](https://github.com/wazuh/wazuh-docker/pull/181))
|
||||
|
||||
## Wazuh Docker v3.9.0_6.7.2
|
||||
|
||||
### Changed
|
||||
|
||||
- Update Elastic Stack version to 6.7.2.
|
||||
|
||||
## Wazuh Docker v3.9.0_6.7.1
|
||||
|
||||
### Added
|
||||
|
||||
- Support for xPACK authorized requests ([@manuasir](https://github.com/manuasir)) ([#119](https://github.com/wazuh/wazuh-docker/pull/119))
|
||||
- Add Elasticsearch cluster configuration ([@SitoRBJ](https://github.com/SitoRBJ)). ([#146](https://github.com/wazuh/wazuh-docker/pull/146))
|
||||
- Add Elasticsearch cluster configuration ([@Phandora](https://github.com/Phandora)) ([#140](https://github.com/wazuh/wazuh-docker/pull/140))
|
||||
- Setting Nginx to support several user/passwords in Kibana ([@toniMR](https://github.com/toniMR)) ([#136](https://github.com/wazuh/wazuh-docker/pull/136))
|
||||
|
||||
|
||||
### Changed
|
||||
|
||||
- Use LS_JAVA_OPTS instead of old LS_HEAP_SIZE ([@ruffy91](https://github.com/ruffy91)) ([#139](https://github.com/wazuh/wazuh-docker/pull/139))
|
||||
- Changing the original Wazuh docker image to allow adding code in the entrypoint ([@Phandora](https://github.com/phandora)) ([#151](https://github.com/wazuh/wazuh-docker/pull/151))
|
||||
|
||||
### Removed
|
||||
|
||||
- Removing files from Wazuh image ([@Phandora](https://github.com/phandora)) ([#153](https://github.com/wazuh/wazuh-docker/pull/153))
|
||||
|
||||
## Wazuh Docker v3.8.2_6.7.0
|
||||
|
||||
### Changed
|
||||
|
||||
- Update Elastic Stack version to 6.7.0. ([#144](https://github.com/wazuh/wazuh-docker/pull/144))
|
||||
|
||||
## Wazuh Docker v3.8.2_6.6.2
|
||||
|
||||
### Changed
|
||||
|
||||
- Update Elastic Stack version to 6.6.2. ([#130](https://github.com/wazuh/wazuh-docker/pull/130))
|
||||
|
||||
## Wazuh Docker v3.8.2_6.6.1
|
||||
|
||||
### Changed
|
||||
|
||||
- Update Elastic Stack version to 6.6.1. ([#129](https://github.com/wazuh/wazuh-docker/pull/129))
|
||||
|
||||
## Wazuh Docker v3.8.2_6.5.4
|
||||
|
||||
### Added
|
||||
@@ -263,7 +50,7 @@ All notable changes to this project will be documented in this file.
|
||||
- Add env credentials for nginx. ([#86](https://github.com/wazuh/wazuh-docker/pull/86))
|
||||
- Improve filebeat configuration ([#88](https://github.com/wazuh/wazuh-docker/pull/88))
|
||||
|
||||
### Fixed
|
||||
### Fixed
|
||||
|
||||
- Temporary fix for Wazuh cluster master node in Kubernetes. ([#84](https://github.com/wazuh/wazuh-docker/pull/84))
|
||||
|
||||
|
||||
2
LICENSE
2
LICENSE
@@ -1,5 +1,5 @@
|
||||
|
||||
Portions Copyright (C) 2020 Wazuh, Inc.
|
||||
Portions Copyright (C) 2019 Wazuh, Inc.
|
||||
Based on work Copyright (C) 2003 - 2013 Trend Micro, Inc.
|
||||
|
||||
This program is a free software; you can redistribute it and/or modify
|
||||
|
||||
17
README.md
17
README.md
@@ -8,13 +8,11 @@
|
||||
In this repository you will find the containers to run:
|
||||
|
||||
* wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack)
|
||||
* wazuh-logstash: It is used to receive alerts generated by the manager and feed Elasticsearch using an alerts template
|
||||
* wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
|
||||
* wazuh-nginx: Proxies the Kibana container, adding HTTPS (via self-signed SSL certificate) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme).
|
||||
* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
|
||||
|
||||
In addition, a docker-compose file is provided to launch the containers mentioned above.
|
||||
|
||||
* Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml).
|
||||
In addition, a docker-compose file is provided to launch the containers mentioned above. It also launches an Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images.
|
||||
|
||||
## Documentation
|
||||
|
||||
@@ -32,6 +30,11 @@ In addition, a docker-compose file is provided to launch the containers mentione
|
||||
│ │ └── kibana.yml
|
||||
│ └── Dockerfile
|
||||
├── LICENSE
|
||||
├── logstash
|
||||
│ ├── config
|
||||
│ │ ├── 01-wazuh.conf
|
||||
│ │ └── run.sh
|
||||
│ └── Dockerfile
|
||||
├── nginx
|
||||
│ ├── config
|
||||
│ │ └── entrypoint.sh
|
||||
@@ -55,9 +58,9 @@ In addition, a docker-compose file is provided to launch the containers mentione
|
||||
|
||||
## Branches
|
||||
|
||||
* `stable` branch on correspond to the latest Wazuh-Docker stable version.
|
||||
* `stable` branch on correspond to the last Wazuh-Docker stable version.
|
||||
* `master` branch contains the latest code, be aware of possible bugs on this branch.
|
||||
* `Wazuh.Version_ElasticStack.Version` (for example 3.13.1_7.8.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
|
||||
* `Wazuh.Version_ElasticStack.Version` (for example 3.7.0_6.4.3) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
|
||||
|
||||
## Credits and Thank you
|
||||
|
||||
@@ -70,7 +73,7 @@ We thank you them and everyone else who has contributed to this project.
|
||||
|
||||
## License and copyright
|
||||
|
||||
Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
## Web references
|
||||
|
||||
|
||||
4
VERSION
4
VERSION
@@ -1,2 +1,2 @@
|
||||
WAZUH-DOCKER_VERSION="3.13.2_7.9.1"
|
||||
REVISION="31320"
|
||||
WAZUH-DOCKER_VERSION="3.8.2_6.5.4"
|
||||
REVISION="3802"
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
version: '2'
|
||||
|
||||
services:
|
||||
wazuh:
|
||||
image: wazuh/wazuh:3.13.2_7.9.1
|
||||
image: wazuh/wazuh:3.8.2_6.5.4
|
||||
hostname: wazuh-manager
|
||||
restart: always
|
||||
ports:
|
||||
@@ -11,26 +11,39 @@ services:
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
|
||||
depends_on:
|
||||
- logstash
|
||||
logstash:
|
||||
image: wazuh/wazuh-logstash:3.8.2_6.5.4
|
||||
hostname: logstash
|
||||
restart: always
|
||||
links:
|
||||
- elasticsearch:elasticsearch
|
||||
ports:
|
||||
- "5000:5000"
|
||||
depends_on:
|
||||
- elasticsearch
|
||||
environment:
|
||||
- LS_HEAP_SIZE=2048m
|
||||
elasticsearch:
|
||||
image: wazuh/wazuh-elasticsearch:3.13.2_7.9.1
|
||||
image: wazuh/wazuh-elasticsearch:3.8.2_6.5.4
|
||||
hostname: elasticsearch
|
||||
restart: always
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- node.name=node-1
|
||||
- cluster.name=wazuh
|
||||
- network.host=0.0.0.0
|
||||
- bootstrap.memory_lock=true
|
||||
- "ES_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- ELASTIC_CLUSTER=true
|
||||
- CLUSTER_NODE_MASTER=true
|
||||
- CLUSTER_MASTER_NODE_NAME=es01
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
mem_limit: 2g
|
||||
|
||||
kibana:
|
||||
image: wazuh/wazuh-kibana:3.13.2_7.9.1
|
||||
image: wazuh/wazuh-kibana:3.8.2_6.5.4
|
||||
hostname: kibana
|
||||
restart: always
|
||||
depends_on:
|
||||
@@ -38,9 +51,8 @@ services:
|
||||
links:
|
||||
- elasticsearch:elasticsearch
|
||||
- wazuh:wazuh
|
||||
|
||||
nginx:
|
||||
image: wazuh/wazuh-nginx:3.13.2_7.9.1
|
||||
image: wazuh/wazuh-nginx:3.8.2_6.5.4
|
||||
hostname: nginx
|
||||
restart: always
|
||||
environment:
|
||||
|
||||
@@ -1,10 +1,5 @@
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
ARG ELASTIC_VERSION=7.9.1
|
||||
FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
|
||||
ARG ELASTIC_VERSION
|
||||
ARG S3_PLUGIN_URL="https://artifacts.elastic.co/downloads/elasticsearch-plugins/repository-s3/repository-s3-${ELASTIC_VERSION}.zip"
|
||||
|
||||
ENV ELASTICSEARCH_URL="http://elasticsearch:9200"
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
FROM docker.elastic.co/elasticsearch/elasticsearch:6.5.4
|
||||
|
||||
ENV ALERTS_SHARDS="1" \
|
||||
ALERTS_REPLICAS="0"
|
||||
@@ -12,29 +7,13 @@ ENV ALERTS_SHARDS="1" \
|
||||
ENV API_USER="foo" \
|
||||
API_PASS="bar"
|
||||
|
||||
ENV XPACK_ML="true"
|
||||
ENV XPACK_ML="true"
|
||||
|
||||
ENV ENABLE_CONFIGURE_S3="false"
|
||||
|
||||
ARG TEMPLATE_VERSION=v3.13.2
|
||||
ENV TEMPLATE_VERSION=v3.8.2
|
||||
|
||||
# Elasticearch cluster configuration environment variables
|
||||
# If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration
|
||||
# CLUSTER_INITIAL_MASTER_NODES set to own node by default.
|
||||
ENV ELASTIC_CLUSTER="false" \
|
||||
CLUSTER_NAME="wazuh" \
|
||||
CLUSTER_NETWORK_HOST="0.0.0.0" \
|
||||
CLUSTER_NODE_MASTER="false" \
|
||||
CLUSTER_NODE_DATA="true" \
|
||||
CLUSTER_NODE_INGEST="true" \
|
||||
CLUSTER_NODE_NAME="wazuh-elasticsearch" \
|
||||
CLUSTER_MASTER_NODE_NAME="master-node" \
|
||||
CLUSTER_MEMORY_LOCK="true" \
|
||||
CLUSTER_DISCOVERY_SERVICE="wazuh-elasticsearch" \
|
||||
CLUSTER_NUMBER_OF_MASTERS="2" \
|
||||
CLUSTER_MAX_NODES="1" \
|
||||
CLUSTER_DELAYED_TIMEOUT="1m" \
|
||||
CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch"
|
||||
ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/wazuh-elastic6-template-alerts.json /usr/share/elasticsearch/config
|
||||
|
||||
COPY config/entrypoint.sh /entrypoint.sh
|
||||
|
||||
@@ -44,13 +23,10 @@ COPY --chown=elasticsearch:elasticsearch ./config/load_settings.sh ./
|
||||
|
||||
RUN chmod +x ./load_settings.sh
|
||||
|
||||
RUN bin/elasticsearch-plugin install --batch $S3_PLUGIN_URL
|
||||
RUN elasticsearch-plugin install --batch repository-s3
|
||||
|
||||
COPY config/configure_s3.sh ./config/configure_s3.sh
|
||||
RUN chmod 755 ./config/configure_s3.sh
|
||||
|
||||
COPY --chown=elasticsearch:elasticsearch ./config/config_cluster.sh ./
|
||||
RUN chmod +x ./config_cluster.sh
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
CMD ["elasticsearch"]
|
||||
|
||||
@@ -1,57 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
elastic_config_file="/usr/share/elasticsearch/config/elasticsearch.yml"
|
||||
|
||||
remove_single_node_conf(){
|
||||
if grep -Fq "discovery.type" $1; then
|
||||
sed -i '/discovery.type\: /d' $1
|
||||
fi
|
||||
}
|
||||
|
||||
remove_cluster_config(){
|
||||
sed -i '/# cluster node/,/# end cluster config/d' $1
|
||||
}
|
||||
|
||||
# If Elasticsearch cluster is enable, then set up the elasticsearch.yml
|
||||
if [[ $ELASTIC_CLUSTER == "true" && $CLUSTER_NODE_MASTER != "" && $CLUSTER_NODE_DATA != "" && $CLUSTER_NODE_INGEST != "" && $CLUSTER_MASTER_NODE_NAME != "" ]]; then
|
||||
# Remove the old configuration
|
||||
remove_single_node_conf $elastic_config_file
|
||||
remove_cluster_config $elastic_config_file
|
||||
|
||||
if [[ $CLUSTER_NODE_MASTER == "true" ]]; then
|
||||
# Add the master configuration
|
||||
# cluster.initial_master_nodes for bootstrap the cluster
|
||||
cat > $elastic_config_file << EOF
|
||||
# cluster node
|
||||
network.host: $CLUSTER_NETWORK_HOST
|
||||
node.name: $CLUSTER_MASTER_NODE_NAME
|
||||
node.master: $CLUSTER_NODE_MASTER
|
||||
cluster.initial_master_nodes:
|
||||
- $CLUSTER_MASTER_NODE_NAME
|
||||
# end cluster config"
|
||||
EOF
|
||||
|
||||
elif [[ $CLUSTER_NODE_NAME != "" ]];then
|
||||
# Remove the old configuration
|
||||
remove_single_node_conf $elastic_config_file
|
||||
remove_cluster_config $elastic_config_file
|
||||
|
||||
cat > $elastic_config_file << EOF
|
||||
# cluster node
|
||||
network.host: $CLUSTER_NETWORK_HOST
|
||||
node.name: $CLUSTER_NODE_NAME
|
||||
node.master: false
|
||||
discovery.seed_hosts:
|
||||
- $CLUSTER_MASTER_NODE_NAME
|
||||
- $CLUSTER_NODE_NAME
|
||||
# end cluster config"
|
||||
EOF
|
||||
fi
|
||||
# If the cluster is disabled, then set a single-node configuration
|
||||
else
|
||||
# Remove the old configuration
|
||||
remove_single_node_conf $elastic_config_file
|
||||
remove_cluster_config $elastic_config_file
|
||||
echo "discovery.type: single-node" >> $elastic_config_file
|
||||
fi
|
||||
@@ -1,5 +1,4 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
@@ -10,7 +9,7 @@ function CheckArgs()
|
||||
{
|
||||
if [ $1 != 4 ] && [ $1 != 5 ];then
|
||||
echo "Use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> (By default <current_elasticsearch_major_version> is added to the path and the repository name)"
|
||||
echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>"
|
||||
echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>"
|
||||
exit 1
|
||||
|
||||
fi
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
# For more information https://github.com/elastic/elasticsearch-docker/blob/6.8.0/build/elasticsearch/bin/docker-entrypoint.sh
|
||||
# For more information https://github.com/elastic/elasticsearch-docker/blob/6.5.4/build/elasticsearch/bin/docker-entrypoint.sh
|
||||
|
||||
set -e
|
||||
|
||||
@@ -24,7 +24,7 @@ run_as_other_user_if_needed() {
|
||||
|
||||
elasticsearch_config_file="/usr/share/elasticsearch/config/elasticsearch.yml"
|
||||
if grep -Fq "#xpack features" "$elasticsearch_config_file";
|
||||
then
|
||||
then
|
||||
declare -A CONFIG_MAP=(
|
||||
[xpack.ml.enabled]=$XPACK_ML
|
||||
)
|
||||
@@ -43,10 +43,8 @@ fi
|
||||
|
||||
# Run load settings script.
|
||||
|
||||
./config_cluster.sh
|
||||
|
||||
./load_settings.sh &
|
||||
|
||||
# Execute elasticsearch
|
||||
|
||||
run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch
|
||||
run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch
|
||||
|
||||
@@ -1,18 +1,22 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
el_url=${ELASTICSEARCH_URL}
|
||||
|
||||
|
||||
if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
|
||||
auth=""
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
until curl ${auth} -XGET $el_url; do
|
||||
if [ "x${WAZUH_API_URL}" = "x" ]; then
|
||||
wazuh_url="https://wazuh"
|
||||
else
|
||||
wazuh_url="${WAZUH_API_URL}"
|
||||
fi
|
||||
|
||||
|
||||
until curl -XGET $el_url; do
|
||||
>&2 echo "Elastic is unavailable - sleeping"
|
||||
sleep 5
|
||||
done
|
||||
@@ -24,13 +28,13 @@ if [ $ENABLE_CONFIGURE_S3 ]; then
|
||||
sleep 10
|
||||
IP_PORT="${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}"
|
||||
|
||||
if [ "x$S3_PATH" != "x" ]; then
|
||||
if [ "x$S3_PATH" != "x" ]; then
|
||||
|
||||
if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then
|
||||
./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR
|
||||
if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then
|
||||
./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR
|
||||
|
||||
else
|
||||
./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME
|
||||
./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME
|
||||
|
||||
fi
|
||||
|
||||
@@ -38,24 +42,57 @@ if [ $ENABLE_CONFIGURE_S3 ]; then
|
||||
|
||||
fi
|
||||
|
||||
if [ ${ENABLED_XPACK} = "true" ]; then
|
||||
curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d'
|
||||
#Insert default templates
|
||||
|
||||
sed -i 's| "index.refresh_interval": "5s"| "index.refresh_interval": "5s", "number_of_shards" : '"${ALERTS_SHARDS}"', "number_of_replicas" : '"${ALERTS_REPLICAS}"'|' /usr/share/elasticsearch/config/wazuh-elastic6-template-alerts.json
|
||||
|
||||
cat /usr/share/elasticsearch/config/wazuh-elastic6-template-alerts.json | curl -XPUT "$el_url/_template/wazuh" -H 'Content-Type: application/json' -d @-
|
||||
sleep 5
|
||||
|
||||
|
||||
API_PASS_Q=`echo "$API_PASS" | tr -d '"'`
|
||||
API_USER_Q=`echo "$API_USER" | tr -d '"'`
|
||||
API_PASSWORD=`echo -n $API_PASS_Q | base64`
|
||||
|
||||
echo "Setting API credentials into Wazuh APP"
|
||||
CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/wazuh-configuration/1513629884013)
|
||||
if [ "x$CONFIG_CODE" = "x404" ]; then
|
||||
curl -s -XPOST $el_url/.wazuh/wazuh-configuration/1513629884013 -H 'Content-Type: application/json' -d'
|
||||
{
|
||||
"api_user": "'"$API_USER_Q"'",
|
||||
"api_password": "'"$API_PASSWORD"'",
|
||||
"url": "'"$wazuh_url"'",
|
||||
"api_port": "55000",
|
||||
"insecure": "true",
|
||||
"component": "API",
|
||||
"cluster_info": {
|
||||
"manager": "wazuh-manager",
|
||||
"cluster": "Disabled",
|
||||
"status": "disabled"
|
||||
},
|
||||
"extensions": {
|
||||
"oscap": true,
|
||||
"audit": true,
|
||||
"pci": true,
|
||||
"aws": true,
|
||||
"virustotal": true,
|
||||
"gdpr": true,
|
||||
"ciscat": true
|
||||
}
|
||||
}
|
||||
' > /dev/null
|
||||
else
|
||||
echo "Wazuh APP already configured"
|
||||
fi
|
||||
sleep 5
|
||||
|
||||
curl -XPUT "$el_url/_cluster/settings" -H 'Content-Type: application/json' -d'
|
||||
{
|
||||
"persistent": {
|
||||
"xpack.monitoring.collection.enabled": true
|
||||
}
|
||||
}
|
||||
'
|
||||
fi
|
||||
|
||||
# Set cluster delayed timeout when node falls
|
||||
curl -X PUT "$el_url/_all/_settings" -H 'Content-Type: application/json' -d'
|
||||
{
|
||||
"settings": {
|
||||
"index.unassigned.node_left.delayed_timeout": "'"$CLUSTER_DELAYED_TIMEOUT"'"
|
||||
}
|
||||
}
|
||||
'
|
||||
|
||||
|
||||
echo "Elasticsearch is ready."
|
||||
|
||||
@@ -1,18 +1,13 @@
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
FROM docker.elastic.co/kibana/kibana:7.9.1
|
||||
USER kibana
|
||||
ARG ELASTIC_VERSION=7.9.1
|
||||
ARG WAZUH_VERSION=3.13.2
|
||||
ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
|
||||
|
||||
WORKDIR /usr/share/kibana
|
||||
RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
|
||||
|
||||
WORKDIR /
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
FROM docker.elastic.co/kibana/kibana-oss:6.5.4
|
||||
ARG WAZUH_APP_VERSION=3.8.2_6.5.4
|
||||
USER root
|
||||
|
||||
COPY config/entrypoint.sh ./entrypoint.sh
|
||||
RUN chmod 755 ./entrypoint.sh
|
||||
|
||||
USER kibana
|
||||
|
||||
ENV PATTERN="" \
|
||||
CHECKS_PATTERN="" \
|
||||
CHECKS_TEMPLATE="" \
|
||||
@@ -40,14 +35,6 @@ ENV PATTERN="" \
|
||||
WAZUH_MONITORING_REPLICAS="" \
|
||||
ADMIN_PRIVILEGES=""
|
||||
|
||||
ARG XPACK_CANVAS="true"
|
||||
ARG XPACK_LOGS="true"
|
||||
ARG XPACK_INFRA="true"
|
||||
ARG XPACK_ML="true"
|
||||
ARG XPACK_DEVTOOLS="true"
|
||||
ARG XPACK_MONITORING="true"
|
||||
ARG XPACK_APM="true"
|
||||
|
||||
ARG CHANGE_WELCOME="false"
|
||||
|
||||
COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
|
||||
@@ -58,18 +45,20 @@ COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
|
||||
|
||||
RUN chmod +x ./kibana_settings.sh
|
||||
|
||||
COPY --chown=kibana:kibana ./config/xpack_config.sh ./
|
||||
|
||||
RUN chmod +x ./xpack_config.sh
|
||||
|
||||
RUN ./xpack_config.sh
|
||||
|
||||
COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
|
||||
|
||||
RUN chmod +x ./welcome_wazuh.sh
|
||||
|
||||
RUN ./welcome_wazuh.sh
|
||||
USER kibana
|
||||
RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
|
||||
|
||||
RUN /usr/local/bin/kibana-docker --optimize
|
||||
|
||||
ENTRYPOINT ./entrypoint.sh
|
||||
|
||||
USER root
|
||||
|
||||
ADD https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /tmp
|
||||
|
||||
RUN NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuhapp-${WAZUH_APP_VERSION}.zip &&\
|
||||
chown -R kibana:kibana /usr/share/kibana &&\
|
||||
rm -rf /tmp/*
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
@@ -13,14 +13,8 @@ else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
|
||||
auth=""
|
||||
else
|
||||
auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
|
||||
fi
|
||||
|
||||
until curl -XGET $el_url ${auth}; do
|
||||
>&2 echo "Elastic is unavailable - sleeping"
|
||||
until curl -XGET $el_url; do
|
||||
>&2 echo "Elastic is unavailable - sleeping."
|
||||
sleep 5
|
||||
done
|
||||
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
|
||||
WAZUH_MAJOR=3
|
||||
|
||||
##############################################################################
|
||||
# Wait for the Kibana API to start. It is necessary to do it in this container
|
||||
# because the others are running Elastic Stack and we can not interrupt them.
|
||||
#
|
||||
# because the others are running Elastic Stack and we can not interrupt them.
|
||||
#
|
||||
# The following actions are performed:
|
||||
#
|
||||
# Add the wazuh alerts index as default.
|
||||
@@ -18,7 +19,6 @@ WAZUH_MAJOR=3
|
||||
# Customize elasticsearch ip
|
||||
##############################################################################
|
||||
if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then
|
||||
sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml
|
||||
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
|
||||
@@ -30,31 +30,18 @@ if [ "$KIBANA_INDEX" != "" ]; then
|
||||
echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
|
||||
# If XPACK_SECURITY_ENABLED was set, then change the xpack.security.enabled option from true (default) to false.
|
||||
if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
|
||||
if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then
|
||||
sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml
|
||||
fi
|
||||
|
||||
if [ "$KIBANA_IP" != "" ]; then
|
||||
kibana_ip="$KIBANA_IP"
|
||||
else
|
||||
kibana_ip="kibana"
|
||||
fi
|
||||
|
||||
# Add auth headers if required
|
||||
if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
|
||||
curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
|
||||
fi
|
||||
|
||||
while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
|
||||
while [[ "$(curl -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
|
||||
echo "Waiting for Kibana API. Sleeping 5 seconds"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
# Prepare index selection.
|
||||
# Prepare index selection.
|
||||
echo "Kibana API is running"
|
||||
|
||||
default_index="/tmp/default_index.json"
|
||||
@@ -79,6 +66,6 @@ curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: applic
|
||||
|
||||
sleep 5
|
||||
# Do not ask user to help providing usage statistics to Elastic
|
||||
curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
|
||||
curl -POST "http://$kibana_ip:5601/api/telemetry/v1/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}'
|
||||
|
||||
echo "End settings"
|
||||
|
||||
@@ -1,14 +1,7 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
wazuh_url="${WAZUH_API_URL:-https://wazuh}"
|
||||
wazuh_port="${API_PORT:-55000}"
|
||||
api_user="${API_USER:-foo}"
|
||||
api_password="${API_PASS:-bar}"
|
||||
|
||||
kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
|
||||
mkdir -p /usr/share/kibana/optimize/wazuh/config/
|
||||
touch $kibana_config_file
|
||||
kibana_config_file="/usr/share/kibana/plugins/wazuh/config.yml"
|
||||
|
||||
declare -A CONFIG_MAP=(
|
||||
[pattern]=$PATTERN
|
||||
@@ -45,24 +38,3 @@ do
|
||||
sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
|
||||
fi
|
||||
done
|
||||
|
||||
# remove default API entry (new in 3.11.0_7.5.1)
|
||||
sed -ie '/- default:/,+4d' $kibana_config_file
|
||||
|
||||
CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth})
|
||||
|
||||
grep -q 1513629884013 $kibana_config_file
|
||||
_config_exists=$?
|
||||
|
||||
if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
|
||||
cat << EOF > $kibana_config_file
|
||||
hosts:
|
||||
- 1513629884013:
|
||||
url: $wazuh_url
|
||||
port: $wazuh_port
|
||||
user: $api_user
|
||||
password: $api_password
|
||||
EOF
|
||||
else
|
||||
echo "Wazuh APP already configured"
|
||||
fi
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
if [[ $CHANGE_WELCOME == "true" ]]
|
||||
then
|
||||
@@ -21,3 +20,4 @@ then
|
||||
sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
|
||||
sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
|
||||
fi
|
||||
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
kibana_config_file="/usr/share/kibana/config/kibana.yml"
|
||||
if grep -Fq "#xpack features" "$kibana_config_file";
|
||||
then
|
||||
declare -A CONFIG_MAP=(
|
||||
[xpack.apm.ui.enabled]=$XPACK_APM
|
||||
[xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS
|
||||
[xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS
|
||||
[xpack.ml.enabled]=$XPACK_ML
|
||||
[xpack.canvas.enabled]=$XPACK_CANVAS
|
||||
[xpack.infra.enabled]=$XPACK_INFRA
|
||||
[monitoring.enabled]=$XPACK_MONITORING
|
||||
[console.enabled]=$XPACK_DEVTOOLS
|
||||
)
|
||||
for i in "${!CONFIG_MAP[@]}"
|
||||
do
|
||||
if [ "${CONFIG_MAP[$i]}" != "" ]; then
|
||||
sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
|
||||
fi
|
||||
done
|
||||
else
|
||||
echo "
|
||||
#xpack features
|
||||
xpack.apm.ui.enabled: $XPACK_APM
|
||||
xpack.grokdebugger.enabled: $XPACK_DEVTOOLS
|
||||
xpack.searchprofiler.enabled: $XPACK_DEVTOOLS
|
||||
xpack.ml.enabled: $XPACK_ML
|
||||
xpack.canvas.enabled: $XPACK_CANVAS
|
||||
xpack.infra.enabled: $XPACK_INFRA
|
||||
xpack.monitoring.enabled: $XPACK_MONITORING
|
||||
console.enabled: $XPACK_DEVTOOLS
|
||||
" >> $kibana_config_file
|
||||
fi
|
||||
12
logstash/Dockerfile
Normal file
12
logstash/Dockerfile
Normal file
@@ -0,0 +1,12 @@
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
FROM docker.elastic.co/logstash/logstash:6.5.4
|
||||
|
||||
COPY --chown=logstash:logstash config/entrypoint.sh /entrypoint.sh
|
||||
|
||||
RUN chmod 755 /entrypoint.sh
|
||||
|
||||
RUN rm -f /usr/share/logstash/pipeline/logstash.conf
|
||||
|
||||
COPY config/01-wazuh.conf /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
|
||||
ENTRYPOINT /entrypoint.sh
|
||||
45
logstash/config/01-wazuh.conf
Normal file
45
logstash/config/01-wazuh.conf
Normal file
@@ -0,0 +1,45 @@
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh - Logstash configuration file
|
||||
## Remote Wazuh Manager - Filebeat input
|
||||
input {
|
||||
beats {
|
||||
port => 5000
|
||||
codec => "json_lines"
|
||||
# ssl => true
|
||||
# ssl_certificate => "/etc/logstash/logstash.crt"
|
||||
# ssl_key => "/etc/logstash/logstash.key"
|
||||
}
|
||||
}
|
||||
filter {
|
||||
if [data][srcip] {
|
||||
mutate {
|
||||
add_field => [ "@src_ip", "%{[data][srcip]}" ]
|
||||
}
|
||||
}
|
||||
if [data][aws][sourceIPAddress] {
|
||||
mutate {
|
||||
add_field => [ "@src_ip", "%{[data][aws][sourceIPAddress]}" ]
|
||||
}
|
||||
}
|
||||
}
|
||||
filter {
|
||||
geoip {
|
||||
source => "@src_ip"
|
||||
target => "GeoLocation"
|
||||
fields => ["city_name", "country_name", "region_name", "location"]
|
||||
}
|
||||
date {
|
||||
match => ["timestamp", "ISO8601"]
|
||||
target => "@timestamp"
|
||||
}
|
||||
mutate {
|
||||
remove_field => [ "timestamp", "beat", "input_type", "tags", "count", "@version", "log", "offset", "type", "@src_ip", "host"]
|
||||
}
|
||||
}
|
||||
output {
|
||||
elasticsearch {
|
||||
hosts => ["elasticsearch:9200"]
|
||||
index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
|
||||
document_type => "wazuh"
|
||||
}
|
||||
}
|
||||
72
logstash/config/entrypoint.sh
Normal file
72
logstash/config/entrypoint.sh
Normal file
@@ -0,0 +1,72 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
#
|
||||
# OSSEC container bootstrap. See the README for information of the environment
|
||||
# variables expected by this script.
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
##############################################################################
|
||||
# Waiting for elasticsearch
|
||||
##############################################################################
|
||||
|
||||
if [ "x${ELASTICSEARCH_URL}" = "x" ]; then
|
||||
el_url="http://elasticsearch:9200"
|
||||
else
|
||||
el_url="${ELASTICSEARCH_URL}"
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Customize logstash output ip
|
||||
##############################################################################
|
||||
|
||||
if [ "$LOGSTASH_OUTPUT" != "" ]; then
|
||||
>&2 echo "Customize Logstash ouput ip."
|
||||
sed -i 's|elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/pipeline/01-wazuh.conf
|
||||
sed -i 's|http://elasticsearch:9200|'$LOGSTASH_OUTPUT'|g' /usr/share/logstash/config/logstash.yml
|
||||
fi
|
||||
|
||||
until curl -XGET $el_url; do
|
||||
>&2 echo "Elastic is unavailable - sleeping."
|
||||
sleep 5
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Elasticsearch is up."
|
||||
|
||||
##############################################################################
|
||||
# Waiting for wazuh alerts template
|
||||
##############################################################################
|
||||
|
||||
strlen=0
|
||||
|
||||
while [[ $strlen -eq 0 ]]
|
||||
do
|
||||
template=$(curl $el_url/_cat/templates/wazuh -s)
|
||||
strlen=${#template}
|
||||
>&2 echo "Wazuh alerts template not loaded - sleeping."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
sleep 2
|
||||
|
||||
>&2 echo "Wazuh alerts template is loaded."
|
||||
|
||||
##############################################################################
|
||||
# Map environment variables to entries in logstash.yml.
|
||||
# Note that this will mutate logstash.yml in place if any such settings are found.
|
||||
# This may be undesirable, especially if logstash.yml is bind-mounted from the
|
||||
# host system.
|
||||
##############################################################################
|
||||
|
||||
env2yaml /usr/share/logstash/config/logstash.yml
|
||||
|
||||
export LS_JAVA_OPTS="-Dls.cgroup.cpuacct.path.override=/ -Dls.cgroup.cpu.path.override=/ $LS_JAVA_OPTS"
|
||||
|
||||
if [[ -z $1 ]] || [[ ${1:0:1} == '-' ]] ; then
|
||||
exec logstash "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
@@ -1,4 +1,4 @@
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
FROM nginx:latest
|
||||
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
@@ -16,4 +16,4 @@ VOLUME ["/etc/nginx/conf.d"]
|
||||
ENV NGINX_NAME="foo" \
|
||||
NGINX_PWD="bar"
|
||||
|
||||
ENTRYPOINT [ "/entrypoint.sh" ]
|
||||
ENTRYPOINT /entrypoint.sh
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
@@ -30,14 +30,14 @@ if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
|
||||
do
|
||||
IFS=':' read -r -a credentials <<< "${users[index]}"
|
||||
if [ $index -eq 0 ]; then
|
||||
htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null
|
||||
echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null
|
||||
else
|
||||
htpasswd -b /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null
|
||||
echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null
|
||||
fi
|
||||
done
|
||||
else
|
||||
# NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile
|
||||
htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null
|
||||
# NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile
|
||||
echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
|
||||
fi
|
||||
else
|
||||
echo "Kibana credentials already configured"
|
||||
@@ -52,19 +52,17 @@ if [ "x${KIBANA_HOST}" = "x" ]; then
|
||||
fi
|
||||
|
||||
echo "Configuring NGINX"
|
||||
|
||||
|
||||
if [ "${NGINX_PORT}" = "443" ]; then
|
||||
cat > /etc/nginx/conf.d/default.conf <<EOF
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
return 301 https://\$host\$request_uri;
|
||||
return 301 https://\$host:${NGINX_PORT}\$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen ${NGINX_PORT} default_server ssl http2;
|
||||
listen [::]:${NGINX_PORT} ssl http2;
|
||||
listen ${NGINX_PORT} default_server;
|
||||
listen [::]:${NGINX_PORT};
|
||||
ssl on;
|
||||
ssl_certificate /etc/nginx/conf.d/ssl/certs/kibana-access.pem;
|
||||
ssl_certificate_key /etc/nginx/conf.d/ssl/private/kibana-access.key;
|
||||
location / {
|
||||
@@ -77,21 +75,5 @@ server {
|
||||
}
|
||||
}
|
||||
EOF
|
||||
else
|
||||
cat > /etc/nginx/conf.d/default.conf <<EOF
|
||||
server {
|
||||
listen ${NGINX_PORT};
|
||||
listen [::]:${NGINX_PORT};
|
||||
location / {
|
||||
auth_basic "Restricted";
|
||||
auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
|
||||
proxy_pass http://${KIBANA_HOST}/;
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 4 256k;
|
||||
proxy_busy_buffers_size 256k;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
fi
|
||||
|
||||
exec nginx -g 'daemon off;'
|
||||
nginx -g 'daemon off;'
|
||||
|
||||
@@ -1,19 +1,15 @@
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
FROM phusion/baseimage:0.10.2
|
||||
|
||||
ARG FILEBEAT_VERSION=7.9.1
|
||||
|
||||
ARG WAZUH_VERSION=3.13.2-1
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
FROM phusion/baseimage:latest
|
||||
ARG FILEBEAT_VERSION=6.5.4
|
||||
ARG WAZUH_VERSION=3.8.2-1
|
||||
|
||||
ENV API_USER="foo" \
|
||||
API_PASS="bar"
|
||||
|
||||
ARG TEMPLATE_VERSION="v3.13.2"
|
||||
API_PASS="bar"
|
||||
|
||||
# Set repositories.
|
||||
RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - && \
|
||||
curl --silent --location https://deb.nodesource.com/setup_10.x | bash - && \
|
||||
curl --silent --location https://deb.nodesource.com/setup_8.x | bash - && \
|
||||
echo "postfix postfix/mailname string wazuh-manager" | debconf-set-selections && \
|
||||
echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections && \
|
||||
groupadd -g 1000 ossec && useradd -u 1000 -g 1000 -d /var/ossec ossec
|
||||
@@ -22,30 +18,23 @@ RUN add-apt-repository universe && apt-get update && apt-get upgrade -y -o Dpkg:
|
||||
apt-get --no-install-recommends --no-install-suggests -y install openssl postfix bsd-mailx python-boto python-pip \
|
||||
apt-transport-https vim expect nodejs python-cryptography mailutils libsasl2-modules wazuh-manager=${WAZUH_VERSION} \
|
||||
wazuh-api=${WAZUH_VERSION} && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && rm -f \
|
||||
/var/ossec/logs/alerts/*/*/*.log && rm -f /var/ossec/logs/alerts/*/*/*.json && rm -f \
|
||||
/var/ossec/logs/archives/*/*/*.log && rm -f /var/ossec/logs/archives/*/*/*.json && rm -f \
|
||||
/var/ossec/logs/firewall/*/*/*.log && rm -f /var/ossec/logs/firewall/*/*/*.json
|
||||
/var/ossec/logs/alerts/*/*/*.log && rm -f /var/ossec/logs/alerts/*/*/*.json
|
||||
|
||||
# Adding first run script and entrypoint
|
||||
COPY config/data_dirs.env /data_dirs.env
|
||||
COPY config/init.bash /init.bash
|
||||
RUN mkdir /entrypoint-scripts
|
||||
COPY config/entrypoint.sh /entrypoint.sh
|
||||
COPY config/00-wazuh.sh /entrypoint-scripts/00-wazuh.sh
|
||||
COPY config/01-config_filebeat.sh /entrypoint-scripts/01-config_filebeat.sh
|
||||
|
||||
# Sync calls are due to https://github.com/docker/docker/issues/9547
|
||||
RUN chmod 755 /init.bash && \
|
||||
sync && /init.bash && \
|
||||
sync && rm /init.bash && \
|
||||
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
|
||||
dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb && \
|
||||
chmod 755 /entrypoint.sh && \
|
||||
chmod 755 /entrypoint-scripts/00-wazuh.sh && \
|
||||
chmod 755 /entrypoint-scripts/01-config_filebeat.sh
|
||||
sync && /init.bash && \
|
||||
sync && rm /init.bash && \
|
||||
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
|
||||
dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb && \
|
||||
chmod 755 /entrypoint.sh
|
||||
|
||||
COPY config/filebeat.yml /etc/filebeat/
|
||||
RUN chmod go-w /etc/filebeat/filebeat.yml
|
||||
RUN chmod go-w /etc/filebeat/filebeat.yml
|
||||
|
||||
# Setting volumes
|
||||
VOLUME ["/var/ossec/data"]
|
||||
@@ -58,9 +47,9 @@ EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp
|
||||
|
||||
# Adding services
|
||||
RUN mkdir /etc/service/wazuh && \
|
||||
mkdir /etc/service/wazuh-api && \
|
||||
mkdir /etc/service/postfix && \
|
||||
mkdir /etc/service/filebeat
|
||||
mkdir /etc/service/wazuh-api && \
|
||||
mkdir /etc/service/postfix && \
|
||||
mkdir /etc/service/filebeat
|
||||
|
||||
COPY config/wazuh.runit.service /etc/service/wazuh/run
|
||||
COPY config/wazuh-api.runit.service /etc/service/wazuh-api/run
|
||||
@@ -68,16 +57,10 @@ COPY config/postfix.runit.service /etc/service/postfix/run
|
||||
COPY config/filebeat.runit.service /etc/service/filebeat/run
|
||||
|
||||
RUN chmod +x /etc/service/wazuh-api/run && \
|
||||
chmod +x /etc/service/wazuh/run && \
|
||||
chmod +x /etc/service/postfix/run && \
|
||||
chmod +x /etc/service/filebeat/run
|
||||
|
||||
|
||||
ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
|
||||
RUN chmod go-w /etc/filebeat/wazuh-template.json
|
||||
|
||||
ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
|
||||
RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
|
||||
chmod +x /etc/service/wazuh/run && \
|
||||
chmod +x /etc/service/postfix/run && \
|
||||
chmod +x /etc/service/filebeat/run
|
||||
|
||||
# Run all services
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
|
||||
@@ -1,155 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
# Wazuh container bootstrap. See the README for information of the environment
|
||||
# variables expected by this script.
|
||||
|
||||
# Startup the services
|
||||
source /data_dirs.env
|
||||
|
||||
FIRST_TIME_INSTALLATION=false
|
||||
|
||||
WAZUH_INSTALL_PATH=/var/ossec
|
||||
DATA_PATH=${WAZUH_INSTALL_PATH}/data
|
||||
|
||||
WAZUH_CONFIG_MOUNT=/wazuh-config-mount
|
||||
|
||||
print() {
|
||||
echo -e $1
|
||||
}
|
||||
|
||||
error_and_exit() {
|
||||
echo "Error executing command: '$1'."
|
||||
echo 'Exiting.'
|
||||
exit 1
|
||||
}
|
||||
|
||||
exec_cmd() {
|
||||
eval $1 > /dev/null 2>&1 || error_and_exit "$1"
|
||||
}
|
||||
|
||||
exec_cmd_stdout() {
|
||||
eval $1 2>&1 || error_and_exit "$1"
|
||||
}
|
||||
|
||||
edit_configuration() { # $1 -> setting, $2 -> value
|
||||
sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${DATA_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
|
||||
}
|
||||
|
||||
for ossecdir in "${DATA_DIRS[@]}"; do
|
||||
if [ ! -e "${DATA_PATH}/${ossecdir}" ]
|
||||
then
|
||||
print "Installing ${ossecdir}"
|
||||
exec_cmd "mkdir -p $(dirname ${DATA_PATH}/${ossecdir})"
|
||||
exec_cmd "cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}"
|
||||
FIRST_TIME_INSTALLATION=true
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -e ${WAZUH_INSTALL_PATH}/etc-template ]
|
||||
then
|
||||
cp -p /var/ossec/etc-template/internal_options.conf /var/ossec/etc/internal_options.conf
|
||||
fi
|
||||
|
||||
# copy missing files from queue-template (in case this is an upgrade from previous versions)
|
||||
for filename in /var/ossec/queue-template/*; do
|
||||
fname=$(basename $filename)
|
||||
echo $fname
|
||||
if test ! -e "/var/ossec/data/queue/$fname"; then
|
||||
cp -rp "/var/ossec/queue-template/$fname" /var/ossec/data/queue/
|
||||
fi
|
||||
done
|
||||
|
||||
touch ${DATA_PATH}/process_list
|
||||
chgrp ossec ${DATA_PATH}/process_list
|
||||
chmod g+rw ${DATA_PATH}/process_list
|
||||
|
||||
AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
|
||||
API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
|
||||
|
||||
if [ $FIRST_TIME_INSTALLATION == true ]
|
||||
then
|
||||
if [ $AUTO_ENROLLMENT_ENABLED == true ]
|
||||
then
|
||||
if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
|
||||
then
|
||||
print "Creating ossec-authd key and cert"
|
||||
exec_cmd "openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096"
|
||||
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key -out ${DATA_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
|
||||
fi
|
||||
fi
|
||||
if [ $API_GENERATE_CERTS == true ]
|
||||
then
|
||||
if [ ! -e ${DATA_PATH}/api/configuration/ssl/server.crt ]
|
||||
then
|
||||
print "Enabling Wazuh API HTTPS"
|
||||
edit_configuration "https" "yes"
|
||||
print "Create Wazuh API key and cert"
|
||||
exec_cmd "openssl genrsa -out ${DATA_PATH}/api/configuration/ssl/server.key 4096"
|
||||
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/api/configuration/ssl/server.key -out ${DATA_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Copy all files from $WAZUH_CONFIG_MOUNT to $DATA_PATH and respect
|
||||
# destination files permissions
|
||||
#
|
||||
# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
|
||||
# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
|
||||
# replace the ossec.conf file in /var/ossec/data/etc with yours.
|
||||
##############################################################################
|
||||
if [ -e "$WAZUH_CONFIG_MOUNT" ]
|
||||
then
|
||||
print "Identified Wazuh configuration files to mount..."
|
||||
|
||||
exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $DATA_PATH"
|
||||
else
|
||||
print "No Wazuh configuration files to mount..."
|
||||
fi
|
||||
|
||||
function ossec_shutdown(){
|
||||
${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
# Allow users to set the container hostname as <node_name> dynamically on
|
||||
# container start.
|
||||
#
|
||||
# To use this:
|
||||
# 1. Create your own ossec.conf file
|
||||
# 2. In your ossec.conf file, set to_be_replaced_by_hostname as your node_name
|
||||
# 3. Mount your custom ossec.conf file at $WAZUH_CONFIG_MOUNT/etc/ossec.conf
|
||||
##############################################################################
|
||||
sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOSTNAME}"'<\/node_name>/g' ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
|
||||
# Trap exit signals and do a proper shutdown
|
||||
trap "ossec_shutdown; exit" SIGINT SIGTERM
|
||||
|
||||
chmod -R g+rw ${DATA_PATH}
|
||||
chmod 750 /var/ossec/agentless/*
|
||||
|
||||
##############################################################################
|
||||
# Interpret any passed arguments (via docker command to this entrypoint) as
|
||||
# paths or commands, and execute them.
|
||||
#
|
||||
# This can be useful for actions that need to be run before the services are
|
||||
# started, such as "/var/ossec/bin/ossec-control enable agentless".
|
||||
##############################################################################
|
||||
for CUSTOM_COMMAND in "$@"
|
||||
do
|
||||
echo "Executing command \`${CUSTOM_COMMAND}\`"
|
||||
exec_cmd_stdout "${CUSTOM_COMMAND}"
|
||||
done
|
||||
|
||||
##############################################################################
|
||||
# Change Wazuh API user credentials.
|
||||
##############################################################################
|
||||
|
||||
pushd /var/ossec/api/configuration/auth/
|
||||
|
||||
echo "Change Wazuh API user credentials"
|
||||
change_user="node htpasswd -b -c user $API_USER $API_PASS"
|
||||
eval $change_user
|
||||
|
||||
popd
|
||||
@@ -1,10 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
|
||||
set -e
|
||||
|
||||
# Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
|
||||
if [ "$ELASTICSEARCH_URL" != "" ]; then
|
||||
>&2 echo "Customize Elasticsearch ouput IP."
|
||||
sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
@@ -2,7 +2,14 @@ i=0
|
||||
DATA_DIRS[((i++))]="api/configuration"
|
||||
DATA_DIRS[((i++))]="etc"
|
||||
DATA_DIRS[((i++))]="logs"
|
||||
DATA_DIRS[((i++))]="queue"
|
||||
DATA_DIRS[((i++))]="agentless"
|
||||
DATA_DIRS[((i++))]="queue/db"
|
||||
DATA_DIRS[((i++))]="queue/rootcheck"
|
||||
DATA_DIRS[((i++))]="queue/agent-groups"
|
||||
DATA_DIRS[((i++))]="queue/agent-info"
|
||||
DATA_DIRS[((i++))]="queue/agents-timestamp"
|
||||
DATA_DIRS[((i++))]="queue/agentless"
|
||||
DATA_DIRS[((i++))]="queue/cluster"
|
||||
DATA_DIRS[((i++))]="queue/rids"
|
||||
DATA_DIRS[((i++))]="queue/fts"
|
||||
DATA_DIRS[((i++))]="var/multigroups"
|
||||
export DATA_DIRS
|
||||
|
||||
@@ -1,14 +1,156 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
|
||||
for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
|
||||
bash "$script"
|
||||
#
|
||||
# OSSEC container bootstrap. See the README for information of the environment
|
||||
# variables expected by this script.
|
||||
#
|
||||
|
||||
#
|
||||
|
||||
#
|
||||
# Startup the services
|
||||
#
|
||||
|
||||
source /data_dirs.env
|
||||
|
||||
FIRST_TIME_INSTALLATION=false
|
||||
|
||||
WAZUH_INSTALL_PATH=/var/ossec
|
||||
DATA_PATH=${WAZUH_INSTALL_PATH}/data
|
||||
|
||||
WAZUH_CONFIG_MOUNT=/wazuh-config-mount
|
||||
|
||||
print() {
|
||||
echo -e $1
|
||||
}
|
||||
|
||||
error_and_exit() {
|
||||
echo "Error executing command: '$1'."
|
||||
echo 'Exiting.'
|
||||
exit 1
|
||||
}
|
||||
|
||||
exec_cmd() {
|
||||
eval $1 > /dev/null 2>&1 || error_and_exit "$1"
|
||||
}
|
||||
|
||||
exec_cmd_stdout() {
|
||||
eval $1 2>&1 || error_and_exit "$1"
|
||||
}
|
||||
|
||||
edit_configuration() { # $1 -> setting, $2 -> value
|
||||
sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${DATA_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)"
|
||||
}
|
||||
|
||||
for ossecdir in "${DATA_DIRS[@]}"; do
|
||||
if [ ! -e "${DATA_PATH}/${ossecdir}" ]
|
||||
then
|
||||
print "Installing ${ossecdir}"
|
||||
exec_cmd "mkdir -p $(dirname ${DATA_PATH}/${ossecdir})"
|
||||
exec_cmd "cp -pr /var/ossec/${ossecdir}-template ${DATA_PATH}/${ossecdir}"
|
||||
FIRST_TIME_INSTALLATION=true
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -e ${WAZUH_INSTALL_PATH}/etc-template ]
|
||||
then
|
||||
cp -p /var/ossec/etc-template/internal_options.conf /var/ossec/etc/internal_options.conf
|
||||
fi
|
||||
rm /var/ossec/queue/db/.template.db
|
||||
|
||||
touch ${DATA_PATH}/process_list
|
||||
chgrp ossec ${DATA_PATH}/process_list
|
||||
chmod g+rw ${DATA_PATH}/process_list
|
||||
|
||||
AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true}
|
||||
API_GENERATE_CERTS=${API_GENERATE_CERTS:-true}
|
||||
|
||||
if [ $FIRST_TIME_INSTALLATION == true ]
|
||||
then
|
||||
if [ $AUTO_ENROLLMENT_ENABLED == true ]
|
||||
then
|
||||
if [ ! -e ${DATA_PATH}/etc/sslmanager.key ]
|
||||
then
|
||||
print "Creating ossec-authd key and cert"
|
||||
exec_cmd "openssl genrsa -out ${DATA_PATH}/etc/sslmanager.key 4096"
|
||||
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/etc/sslmanager.key -out ${DATA_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/"
|
||||
fi
|
||||
fi
|
||||
if [ $API_GENERATE_CERTS == true ]
|
||||
then
|
||||
if [ ! -e ${DATA_PATH}/api/configuration/ssl/server.crt ]
|
||||
then
|
||||
print "Enabling Wazuh API HTTPS"
|
||||
edit_configuration "https" "yes"
|
||||
print "Create Wazuh API key and cert"
|
||||
exec_cmd "openssl genrsa -out ${DATA_PATH}/api/configuration/ssl/server.key 4096"
|
||||
exec_cmd "openssl req -new -x509 -key ${DATA_PATH}/api/configuration/ssl/server.key -out ${DATA_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Copy all files from $WAZUH_CONFIG_MOUNT to $DATA_PATH and respect
|
||||
# destination files permissions
|
||||
#
|
||||
# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at
|
||||
# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will
|
||||
# replace the ossec.conf file in /var/ossec/data/etc with yours.
|
||||
##############################################################################
|
||||
if [ -e "$WAZUH_CONFIG_MOUNT" ]
|
||||
then
|
||||
print "Identified Wazuh configuration files to mount..."
|
||||
|
||||
exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $DATA_PATH"
|
||||
else
|
||||
print "No Wazuh configuration files to mount..."
|
||||
fi
|
||||
|
||||
function ossec_shutdown(){
|
||||
${WAZUH_INSTALL_PATH}/bin/ossec-control stop;
|
||||
}
|
||||
|
||||
# Trap exit signals and do a proper shutdown
|
||||
trap "ossec_shutdown; exit" SIGINT SIGTERM
|
||||
|
||||
chmod -R g+rw ${DATA_PATH}
|
||||
|
||||
##############################################################################
|
||||
# Interpret any passed arguments (via docker command to this entrypoint) as
|
||||
# paths or commands, and execute them.
|
||||
#
|
||||
# This can be useful for actions that need to be run before the services are
|
||||
# started, such as "/var/ossec/bin/ossec-control enable agentless".
|
||||
##############################################################################
|
||||
for CUSTOM_COMMAND in "$@"
|
||||
do
|
||||
echo "Executing command \`${CUSTOM_COMMAND}\`"
|
||||
exec_cmd_stdout "${CUSTOM_COMMAND}"
|
||||
done
|
||||
|
||||
##############################################################################
|
||||
# Change Wazuh API user credentials.
|
||||
##############################################################################
|
||||
|
||||
pushd /var/ossec/api/configuration/auth/
|
||||
|
||||
echo "Change Wazuh API user credentials"
|
||||
change_user="node htpasswd -b -c user $API_USER $API_PASS"
|
||||
eval $change_user
|
||||
|
||||
popd
|
||||
|
||||
|
||||
##############################################################################
|
||||
# Customize filebeat output ip
|
||||
##############################################################################
|
||||
if [ "$FILEBEAT_OUTPUT" != "" ]; then
|
||||
sed -i "s/logstash:5000/$FILEBEAT_OUTPUT:5000/" /etc/filebeat/filebeat.yml
|
||||
fi
|
||||
|
||||
##############################################################################
|
||||
# Start Wazuh Server.
|
||||
##############################################################################
|
||||
|
||||
/sbin/my_init
|
||||
/sbin/my_init
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
#!/bin/sh
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
service filebeat start
|
||||
tail -f /var/log/filebeat/filebeat
|
||||
|
||||
@@ -1,15 +1,18 @@
|
||||
# Wazuh - Filebeat configuration file
|
||||
filebeat.modules:
|
||||
- module: wazuh
|
||||
alerts:
|
||||
enabled: true
|
||||
archives:
|
||||
enabled: false
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
filebeat:
|
||||
prospectors:
|
||||
- type: log
|
||||
paths:
|
||||
- "/var/ossec/logs/alerts/alerts.json"
|
||||
document_type: json
|
||||
json.message_key: log
|
||||
json.keys_under_root: true
|
||||
json.overwrite_keys: true
|
||||
tail_files: true
|
||||
|
||||
setup.template.json.enabled: true
|
||||
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
|
||||
setup.template.json.name: 'wazuh'
|
||||
setup.template.overwrite: true
|
||||
setup.ilm.enabled: false
|
||||
|
||||
output.elasticsearch.hosts: ['http://elasticsearch:9200']
|
||||
output:
|
||||
logstash:
|
||||
# The Logstash hosts
|
||||
hosts: ["logstash:5000"]
|
||||
# ssl:
|
||||
# certificate_authorities: ["/etc/filebeat/logstash.crt"]
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
#!/bin/bash
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
|
||||
|
||||
#
|
||||
# Initialize the custom data directory layout
|
||||
#
|
||||
source /data_dirs.env
|
||||
|
||||
cd /var/ossec
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
#!/bin/sh
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
service postfix start
|
||||
tail -f /var/log/mail.log
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/sh
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
service wazuh-api start
|
||||
tail -f /var/ossec/data/logs/api.log
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
#!/bin/sh
|
||||
# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
|
||||
service wazuh-manager start
|
||||
tail -f /var/ossec/data/logs/ossec.log
|
||||
|
||||
|
||||
Reference in New Issue
Block a user