Compare commits

..

72 Commits

Author SHA1 Message Date
Gonzalo Acuña
1e55bb13ca Merge pull request #2062 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-10-31 14:46:28 -03:00
Carlos Bordon
7854ca13b4 Merge 4.14.1 into main 2025-10-31 14:39:58 -03:00
Carlos Anguita
f08620251d Merge pull request #2059 from wazuh/enhancement/2055-revert-image-tag-for-4.14.1rc1 2025-10-31 10:10:53 +01:00
Enrique Araque
f7cebff2e9 Remove image tag for 4.14.1 rc1 2025-10-31 10:09:11 +01:00
Gonzalo Acuña
4710105faa Merge pull request #2058 from wazuh/change/2695-package-install-option
Modify Wazuh components install method
2025-10-30 16:21:00 -03:00
Victor Carlos Erenu
913dd89e27 Add changelog 2025-10-31 01:01:58 +07:00
Victor Carlos Erenu
fd5034c3d5 Modify packages_url.txt filename 2025-10-31 00:44:42 +07:00
Victor Carlos Erenu
eb49d515d8 Add free space step 2025-10-30 23:32:32 +07:00
Victor Carlos Erenu
8c6a0a9319 Add free space step 2025-10-30 23:28:06 +07:00
Victor Carlos Erenu
cb8a69026f Add url variables 2025-10-30 23:09:19 +07:00
Victor Carlos Erenu
46829ed9ee Add architecture target 2025-10-30 22:58:39 +07:00
Victor Carlos Erenu
d654b17189 Add packages-url.txt artifact 2025-10-30 22:35:14 +07:00
Victor Carlos Erenu
d46c4ef5b2 Add rpm path 2025-10-30 22:32:31 +07:00
Victor Carlos Erenu
34ebf7a859 Add quotes to URLs 2025-10-30 22:23:29 +07:00
Victor Carlos Erenu
3a605b3f6a Delete filebeat options 2025-10-30 22:17:16 +07:00
Victor Carlos Erenu
babaea694e Change install option 2025-10-30 22:11:30 +07:00
Wazuh CI
a9ef0e901a Merge pull request #2056 from wazuh/enhancement/wqa4563-bump-4.14.1
Bump 4.14.1 branch
2025-10-30 10:32:35 +01:00
wazuhci
b031e317f7 feat: bump 4.14.1 2025-10-30 09:32:26 +00:00
Gonzalo Acuña
c893d86b4a Merge pull request #2054 from wazuh/change/2697-image-workflow-rebuild
Image builder Workflow Rebuild
2025-10-27 15:32:34 -03:00
Victor Carlos Erenu
9882a9ca6d Change expiration time 2025-10-28 01:29:44 +07:00
Victor Ereñú
355daccb69 Merge branch 'main' into change/2697-image-workflow-rebuild 2025-10-28 01:11:45 +07:00
Victor Carlos Erenu
184675bab5 Modify Wazuh image builder 2025-10-28 01:09:49 +07:00
Carlos Bordon
2df9e3a942 Merge pull request #2049 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-10-23 13:01:59 -03:00
Victor Carlos Erenu
152a5476f7 Resolving conflicts 2025-10-23 22:56:51 +07:00
Gonzalo Acuña
2fccb3f4c4 Merge pull request #2048 from wazuh/merge-4.14.0-into-4.14.1
Merge 4.14.0 into 4.14.1
2025-10-23 12:52:25 -03:00
Victor Carlos Erenu
afb044a3b0 Resolving conflicts 2025-10-23 22:42:19 +07:00
Gonzalo Acuña
53a5d1a7e4 Merge pull request #2030 from wazuh/enhancement/1933-server-clean-up
Wazuh server clean-up
2025-10-03 14:03:37 -03:00
vcerenu
93812b3d07 Add changelog 2025-10-01 14:26:22 -03:00
vcerenu
cb6fa28bbc Wazuh server clean-up 2025-10-01 13:30:25 -03:00
Gonzalo Acuña
652a7cfe9a Merge pull request #2027 from wazuh/enhancement/1934-wazuh-cert-tool-generator
Wazuh cert tool generator improvements
2025-09-26 16:01:19 -03:00
vcerenu
c910773076 Modify readme 2025-09-26 15:52:09 -03:00
vcerenu
901f29b68f Add changelog 2025-09-26 15:37:33 -03:00
vcerenu
2d56895f47 Improve error messages 2025-09-26 15:33:42 -03:00
vcerenu
ccab3b6d7e Modify Wazuh cert tool generation 2025-09-26 12:14:09 -03:00
Gonzalo Acuña
e6f077bb1f Merge pull request #2019 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-09-24 15:44:43 -03:00
Victor Ereñú
35af57be29 Merge branch 'main' into merge-4.14.1-into-main 2025-09-24 15:07:39 -03:00
Gonzalo Acuña
ed92382ff1 Merge pull request #2018 from wazuh/merge-4.14.0-into-4.14.1
Merge 4.14.0 into 4.14.1
2025-09-24 14:50:27 -03:00
Gonzalo Acuña
87be7e6b36 Merge pull request #2008 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-09-19 06:19:22 -03:00
Gonzalo Acuña
180236e269 Merge branch 'main' into merge-4.14.1-into-main 2025-09-19 05:41:23 -03:00
Gonzalo Acuña
1d03c17d60 Merge pull request #2007 from wazuh/merge-4.14.0-into-4.14.1
Merge 4.14.0 into 4.14.1
2025-09-19 05:34:03 -03:00
Gonzalo Acuña
ee087c7ebf Merge branch '4.14.1' into merge-4.14.0-into-4.14.1 2025-09-19 05:24:26 -03:00
Gonzalo Acuña
e0f6ab5dda Merge pull request #1993 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-09-05 09:30:30 -03:00
Victor Ereñú
a990518208 Merge branch 'main' into merge-4.14.1-into-main 2025-09-05 09:29:24 -03:00
Gonzalo Acuña
9b916b1ce8 Merge pull request #1992 from wazuh/merge-4.14.0-into-4.14.1
Merge 4.14.0 into 4.14.1
2025-09-05 09:07:14 -03:00
Victor Ereñú
75e09fcc19 Merge branch '4.14.1' into merge-4.14.0-into-4.14.1 2025-09-05 09:03:44 -03:00
Gonzalo Acuña
a136444ee9 Merge pull request #1974 from wazuh/merge-4.14.1-into-main
Merge 4.14.1 into main
2025-08-14 09:03:55 -03:00
vcerenu
0989e11d43 Resolving conflicts 2025-08-14 09:00:41 -03:00
vcerenu
6c87ecf7f0 Resolving conflicts 2025-08-14 08:56:57 -03:00
Carlos Anguita
555a0e2590 Merge pull request #1973 from wazuh/merge-4.14.0-into-4.14.1 2025-08-14 13:29:36 +02:00
vcerenu
54fe999414 Merge branch '4.14.1' of github.com:wazuh/wazuh-docker into 4.14.0 2025-08-14 08:22:00 -03:00
Wazuh CI
6f94d5aa65 Merge pull request #1947 from wazuh/enhancement/wqa3035-bump-4.14.1
Bump 4.14.1 branch
2025-07-29 18:11:15 +02:00
wazuhci
846ae52263 feat: bump 4.14.1 2025-07-29 16:11:09 +00:00
Gonzalo Acuña
c129cd9835 Merge pull request #1945 from wazuh/merge-4.14.0-into-main
Merge 4.14.0 into main
2025-07-25 10:11:45 -03:00
vcerenu
a1afcd2c40 Merge branch 'main' of github.com:wazuh/wazuh-docker into merge-4.14.0-into-main 2025-07-25 10:00:39 -03:00
Carlos Anguita
a809b4b60b Merge pull request #1903 from wazuh/merge-4.14.0-into-main 2025-06-27 12:34:13 +02:00
Gonzalo Acuña
78948b164a Merge pull request #1899 from wazuh/enhancement/1891-opensearch-deprecated-settings
Fix Opensearch deprecated settings
2025-06-23 13:55:48 -03:00
fcaffieri
de11f97bf0 Update CHANGELOG 2025-06-23 13:41:56 -03:00
fcaffieri
f7cbdd4884 Update CHANGELOG 2025-06-23 13:33:22 -03:00
fcaffieri
184802c3b9 Fix Opensearch deprecated settings 2025-06-23 13:29:39 -03:00
Gonzalo Acuña
6bac41a05d Merge pull request #1895 from wazuh/enhancement/1892-bumper-main
Bumper propagation to main
2025-06-19 11:44:56 -03:00
Carlos Bordon
a3479b0035 Merge pull request #1888 from wazuh/merge-4.14.0-into-main
Merge 4.14.0 into main
2025-06-13 10:04:25 -03:00
Carlos Anguita López
f57f0b33f2 Merge branch '4.14.0' into merge-4.14.0-into-main 2025-06-13 14:59:48 +02:00
Gonzalo Acuña
99a703136d Merge pull request #1868 from wazuh/merge-4.14.0-into-main
Merge 4.14.0 into main
2025-06-05 16:18:46 -03:00
c-bordon
c111f8497e Merge 4.14.0 into main 2025-06-05 16:17:18 -03:00
Gonzalo Acuña
43b129c857 Merge pull request #1857 from wazuh/enhancement/2385-bump-5.0.0-technical-documentation
Bump 5.0.0 technical documentation
2025-05-30 11:21:43 -03:00
vcerenu
f1a3a48c1a Bump 5.0.0 technical documentation 2025-05-30 11:18:10 -03:00
Carlos Bordon
3717c6cfe2 Merge pull request #1850 from wazuh/enhancement/remove-4.12.2-entries-from-main-branch
Remove 4.12.2 references from 4.14.0 branch
2025-05-29 09:32:14 -03:00
fcaffieri
cd69030b16 Remove 4.12.2 references from 4.14.0 branch 2025-05-29 09:30:11 -03:00
Gonzalo Acuña
662d5aaa70 Merge pull request #1845 from wazuh/merge-4.14.0-into-main
Merge 4.14.0 into main
2025-05-27 15:37:49 -03:00
vcerenu
c6327ac7a2 Resolving conflicts 2025-05-27 15:30:26 -03:00
Gonzalo Acuña
9a9da404a7 Merge pull request #1821 from wazuh/enhancement/1819-bump-5.0.0-version
Bump 5.0.0 version
2025-05-13 15:01:55 -03:00
vcerenu
02de528417 Bump 5.0.0 version 2025-05-13 14:54:48 -03:00
57 changed files with 424 additions and 715 deletions

8
.env
View File

@@ -1,6 +1,6 @@
WAZUH_VERSION=4.14.0
WAZUH_IMAGE_VERSION=4.14.0
WAZUH_VERSION=main
WAZUH_IMAGE_VERSION=main
WAZUH_TAG_REVISION=1
FILEBEAT_TEMPLATE_BRANCH=4.14.0
WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.4.tar.gz
WAZUH_UI_REVISION=1
WAZUH_REGISTRY=docker.io
IMAGE_TAG=main

2
.github/.goss.yaml vendored
View File

@@ -56,7 +56,7 @@ package:
wazuh-manager:
installed: true
versions:
- 4.14.0
- 5.0.0
port:
tcp:1514:
listening: true

View File

@@ -6,28 +6,19 @@ on:
inputs:
image_tag:
description: 'Docker image tag'
default: '4.14.0'
default: '5.0.0'
required: true
docker_reference:
description: 'wazuh-docker reference'
required: true
products:
description: 'Comma-separated list of the image names to build and push'
default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
required: true
filebeat_module_version:
description: 'Filebeat module version'
default: '0.4'
required: true
revision:
description: 'Package revision'
default: '1'
required: true
push_images:
description: 'Push images'
type: boolean
default: true
required: true
reference:
description: 'Dev reference'
type: string
default: latest
id:
description: "ID used to identify the workflow uniquely."
type: string
@@ -41,33 +32,22 @@ on:
inputs:
image_tag:
description: 'Docker image tag'
default: '4.14.0'
default: '5.0.0'
required: true
type: string
docker_reference:
description: 'wazuh-docker reference'
required: false
type: string
products:
description: 'Comma-separated list of the image names to build and push'
default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
required: true
type: string
filebeat_module_version:
description: 'Filebeat module version'
default: '0.4'
required: true
type: string
revision:
description: 'Package revision'
default: '1'
required: true
type: string
push_images:
description: 'Push images'
type: boolean
default: true
required: true
reference:
description: 'Dev reference'
type: string
default: latest
id:
description: "ID used to identify the workflow uniquely."
type: string
@@ -82,6 +62,15 @@ jobs:
build-and-push:
runs-on: ubuntu-22.04
permissions:
id-token: write
contents: read
env:
IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
IMAGE_TAG: ${{ inputs.image_tag }}
REVISION: ${{ inputs.revision }}
steps:
- name: Print inputs
run: |
@@ -96,11 +85,10 @@ jobs:
echo "* id: ${{ inputs.id }}"
echo "* image_tag: ${{ inputs.image_tag }}"
echo "* docker_reference: ${{ inputs.docker_reference }}"
echo "* products: ${{ inputs.products }}"
echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
echo "* revision: ${{ inputs.revision }}"
echo "* push_images: ${{ inputs.push_images }}"
echo "* dev: ${{ inputs.dev }}"
echo "* dev reference: ${{ inputs.reference }}"
echo "---------------------------------------------"
- name: Checkout repository
@@ -108,33 +96,80 @@ jobs:
with:
ref: ${{ inputs.docker_reference }}
- name: free disk space
uses: ./.github/free-disk-space
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Configure aws credentials
if: ${{ inputs.dev == true }}
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
aws-region: "${{ secrets.AWS_REGION }}"
- name: Log in to Amazon ECR
if: ${{ inputs.dev == true }}
uses: aws-actions/amazon-ecr-login@v2
- name: Log in to Docker Hub
if: ${{ inputs.dev == false }}
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Create packages_url.txt file
if : ${{ inputs.dev == true }}
run: |
cat << EOF > packages_url.txt
wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
EOF
working-directory: ./build-docker-images
- name: Build Wazuh images
run: |
IMAGE_TAG=${{ inputs.image_tag }}
FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
REVISION=${{ inputs.revision }}
if [[ "$IMAGE_TAG" == *"-"* ]]; then
IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
if [ -z "${tokens[1]}" ]; then
echo "Invalid image tag: $IMAGE_TAG"
exit 1
if [ "${{ inputs.dev }}" = true ]; then
IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
else
if [[ "$IMAGE_TAG" == *"-"* ]]; then
IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
if [ -z "${tokens[1]}" ]; then
echo "Invalid image tag: $IMAGE_TAG"
exit 1
fi
DEV_STAGE=${tokens[1]}
WAZUH_VER=${tokens[0]}
./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m
else
./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m
fi
DEV_STAGE=${tokens[1]}
WAZUH_VER=${tokens[0]}
./build-docker-images/build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION
else
./build-docker-images/build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION
fi
# Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
ENV_FILE_PATH=".env"
ENV_FILE_PATH="../.env"
if [ -f $ENV_FILE_PATH ]; then
while IFS= read -r line || [ -n "$line" ]; do
@@ -144,16 +179,4 @@ jobs:
echo "The environment file $ENV_FILE_PATH does not exist!"
exit 1
fi
- name: Tag and Push Wazuh images
if: ${{ inputs.push_images }}
run: |
IMAGE_TAG="${{ inputs.image_tag }}$( [ "${{ inputs.dev }}" == "true" ] && echo '-dev' || true )"
IMAGE_NAMES=${{ inputs.products }}
IFS=',' read -r -a images <<< "$IMAGE_NAMES"
for image in "${images[@]}"; do
echo "Tagging and pushing wazuh/$image:${WAZUH_VERSION} to wazuh/$image:$IMAGE_TAG"
docker tag wazuh/$image:${WAZUH_VERSION} wazuh/$image:$IMAGE_TAG
echo "Pushing wazuh/$image:$IMAGE_TAG ..."
docker push wazuh/$image:$IMAGE_TAG
done
working-directory: ./build-docker-images

4
.gitignore vendored
View File

@@ -2,4 +2,6 @@ single-node/config/wazuh_indexer_ssl_certs/*.pem
single-node/config/wazuh_indexer_ssl_certs/*.key
multi-node/config/wazuh_indexer_ssl_certs/*.pem
multi-node/config/wazuh_indexer_ssl_certs/*.key
*.log
*.log
build-docker-images/packages_env.txt
build-docker-images/packages_url.txt

View File

@@ -1,6 +1,45 @@
# Change Log
All notable changes to this project will be documented in this file.
## [5.0.0]
### Added
- None
### Changed
- Modify Wazuh components install method ([#2058](https://github.com/wazuh/wazuh-puppet/issues/2058))
- Image builder Workflow Rebuild ([#2054](https://github.com/wazuh/wazuh-puppet/issues/2054))
- Wazuh server clean-up ([#2030](https://github.com/wazuh/wazuh-puppet/issues/2030))
- Fix OpenSearch deprecated settings ([#1366](https://github.com/wazuh/wazuh-puppet/issues/1366))
### Fixed
- None
### Deleted
- None
## [4.14.1]
### Added
- None
### Changed
- Wazuh cert tool generator improvements ([#2027](https://github.com/wazuh/wazuh-docker/pull/2027))
### Fixed
- None
### Deleted
- None
## [4.14.0]
### Added

View File

@@ -18,7 +18,7 @@ The `wazuh/wazuh-docker` repository provides resources to deploy the Wazuh cyber
## Branch Convention
- `main`: Developing and testing of new features.
- `X.Y.Z`: Version-specific branches (e.g., `4.14.0`, `4.13.0`, etc.).
- `X.Y.Z`: Version-specific branches (e.g., `5.0.0`, `4.14.0`, etc.).
## Documentation

View File

@@ -1,4 +1,4 @@
{
"version": "4.14.0",
"stage": "rc2"
"version": "5.0.0",
"stage": "alpha0"
}

View File

@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
```
$ build-docker-images/build-images.sh -v 4.14.0
$ build-docker-images/build-images.sh -v 5.0.0
```
To get all the available script options use the -h or --help option:
@@ -26,7 +26,7 @@ Usage: build-docker-images/build-images.sh [OPTIONS]
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc1 or beta1, not used by default.
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
-r, --revision <rev> [Optional] Package revision. By default 1
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
-h, --help Show this help.
```

View File

@@ -1,8 +1,10 @@
WAZUH_IMAGE_VERSION=4.14.0
WAZUH_IMAGE_VERSION=main
IMAGE_TAG=main
WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
WAZUH_TAG_REVISION=1
WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')
IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
WAZUH_REGISTRY=docker.io
# Wazuh package generator
# Copyright (C) 2023, Wazuh Inc.
@@ -12,10 +14,10 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION}
# License (version 2) as published by the FSF - Free Software
# Foundation.
WAZUH_IMAGE_VERSION="4.14.0"
WAZUH_IMAGE_VERSION="main"
WAZUH_TAG_REVISION="1"
WAZUH_DEV_STAGE=""
FILEBEAT_MODULE_VERSION="0.4"
WAZUH_TAG_REFERENCE=""
# -----------------------------------------------------------------------------
@@ -37,36 +39,44 @@ ctrl_c() {
build() {
WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')"
FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}"
WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz"
WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}"
if [ "${WAZUH_DEV_STAGE}" ];then
FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}"
if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
clean 1
fi
# Variables
FILE="packages_url.txt"
if [[ -f "$FILE" ]]; then
echo "$FILE exists. Using existing file."
else
if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then
FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}"
elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then
FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}"
TAG="v${WAZUH_VERSION}"
REPO="wazuh/wazuh-docker"
GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
else
echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}"
clean 1
curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt"
fi
fi
awk -F':' '{name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $FILE > packages_env.txt
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env
echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env
echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env
echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env
echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env
echo IMAGE_TAG=$IMAGE_TAG >> ../.env
echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env
echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> .env
echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env
echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> .env
echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> .env
echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> .env
docker compose -f build-docker-images/build-images.yml --env-file .env build --no-cache || clean 1
set -a
source ../.env
source ./packages_env.txt
set +a
if [ "${MULTIARCH}" ];then
docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1
else
docker buildx bake --file build-images.yml --no-cache|| clean 1
fi
return 0
}
@@ -77,9 +87,11 @@ help() {
echo "Usage: $0 [OPTIONS]"
echo
echo " -d, --dev <ref> [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
echo " -f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}."
echo " -r, --revision <rev> [Optional] Package revision. By default ${WAZUH_TAG_REVISION}"
echo " -ref, --reference <ref> [Optional] Set the Wazuh reference to build development images. By default, the latest stable release."
echo " -rg, --registry <reg> [Optional] Set the Docker registry to push the images."
echo " -v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}."
echo " -m, --multiarch [Optional] Enable multi-architecture builds."
echo " -h, --help Show this help."
echo
exit $1
@@ -102,17 +114,29 @@ main() {
help 1
fi
;;
"-f"|"--filebeat-module")
"-m"|"--multiarch")
MULTIARCH="true"
shift
;;
"-r"|"--revision")
if [ -n "${2}" ]; then
FILEBEAT_MODULE_VERSION="${2}"
WAZUH_TAG_REVISION="${2}"
shift 2
else
help 1
fi
;;
"-r"|"--revision")
"-ref"|"--reference")
if [ -n "${2}" ]; then
WAZUH_TAG_REVISION="${2}"
WAZUH_TAG_REFERENCE="${2}"
shift 2
else
help 1
fi
;;
"-rg"|"--registry")
if [ -n "${2}" ]; then
WAZUH_REGISTRY="${2}"
shift 2
else
help 1

View File

@@ -6,9 +6,9 @@ services:
args:
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH}
WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE}
image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION}
wazuh_manager_url_amd64_rpm: ${wazuh_manager_url_x86_64_rpm}
wazuh_manager_url_arm64_rpm: ${wazuh_manager_url_aarch64_rpm}
image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG}
hostname: wazuh.manager
restart: always
ports:
@@ -20,19 +20,14 @@ services:
- INDEXER_URL=https://wazuh.indexer:9200
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- FILEBEAT_SSL_VERIFICATION_MODE=none
volumes:
- wazuh_api_configuration:/var/ossec/api/configuration
- wazuh_etc:/var/ossec/etc
- wazuh_logs:/var/ossec/logs
- wazuh_queue:/var/ossec/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_integrations:/var/ossec/integrations
- wazuh_active_response:/var/ossec/active-response/bin
- wazuh_agentless:/var/ossec/agentless
- wazuh_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
wazuh.agent:
build:
@@ -40,7 +35,9 @@ services:
args:
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION}
wazuh_agent_url_amd64_rpm: ${wazuh_agent_url_x86_64_rpm}
wazuh_agent_url_arm64_rpm: ${wazuh_agent_url_aarch64_rpm}
image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG}
hostname: wazuh.agent
restart: always
@@ -50,7 +47,9 @@ services:
args:
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION}
wazuh_indexer_url_amd64_rpm: ${wazuh_indexer_url_x86_64_rpm}
wazuh_indexer_url_arm64_rpm: ${wazuh_indexer_url_aarch64_rpm}
image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG}
hostname: wazuh.indexer
restart: always
ports:
@@ -72,7 +71,9 @@ services:
WAZUH_VERSION: ${WAZUH_VERSION}
WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION}
WAZUH_UI_REVISION: ${WAZUH_UI_REVISION}
image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION}
wazuh_dashboard_url_amd64_rpm: ${wazuh_dashboard_url_x86_64_rpm}
wazuh_dashboard_url_arm64_rpm: ${wazuh_dashboard_url_aarch64_rpm}
image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG}
hostname: wazuh.dashboard
restart: always
ports:
@@ -94,9 +95,6 @@ volumes:
wazuh_logs:
wazuh_queue:
wazuh_var_multigroups:
wazuh_integrations:
wazuh_active_response:
wazuh_agentless:
wazuh_wodles:
filebeat_etc:
filebeat_var:

View File

@@ -10,18 +10,17 @@ ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
ARG WAZUH_AGENT_NAME='CHANGEE_AGENT_NAME'
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
ARG TARGETARCH
ARG wazuh_agent_url_amd64_rpm
ARG wazuh_agent_url_arm64_rpm
COPY config/check_repository.sh /
RUN yum install curl-minimal tar gzip procps -y &&\
yum clean all
RUN chmod 775 /check_repository.sh
RUN source /check_repository.sh
RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
yum clean all && \
RUN URL_VAR="wazuh_agent_url_${TARGETARCH}_rpm" && \
agent_url="${!URL_VAR}" && \
dnf install curl-minimal tar gzip procps -y &&\
curl -o /wazuh-agent.rpm "${agent_url}" && \
dnf install /wazuh-agent.rpm -y && \
dnf clean all && \
sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf && \
curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \
@@ -31,6 +30,4 @@ RUN yum install wazuh-agent-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
COPY config/etc/ /etc/
RUN rm /etc/yum.repos.d/wazuh.repo
ENTRYPOINT [ "/init" ]

View File

@@ -1,15 +0,0 @@
## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository
if [[ -n "${WAZUH_TAG}" ]]; then
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
fi
rpm --import "${APT_KEY}"
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo

View File

@@ -5,16 +5,17 @@ ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION
ARG WAZUH_UI_REVISION
ARG INSTALL_DIR=/usr/share/wazuh-dashboard
ARG TARGETARCH
ARG wazuh_dashboard_url_amd64_rpm
ARG wazuh_dashboard_url_arm64_rpm
# Update and install dependencies
RUN yum install curl-minimal libcap openssl -y
COPY config/check_repository.sh /
RUN chmod 775 /check_repository.sh && \
source /check_repository.sh
RUN yum install wazuh-dashboard-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
yum clean all
RUN URL_VAR="wazuh_dashboard_url_${TARGETARCH}_rpm" && \
dashboard_url="${!URL_VAR}" && \
dnf install curl-minimal libcap openssl -y && \
curl -o /wazuh-dashboard.rpm "${dashboard_url}" && \
dnf install /wazuh-dashboard.rpm -y && \
dnf clean all
# Create and set permissions to data directories
RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
@@ -42,10 +43,8 @@ FROM amazonlinux:2023
ENV USER="wazuh-dashboard" \
GROUP="wazuh-dashboard" \
NAME="wazuh-dashboard" \
INSTALL_DIR="/usr/share/wazuh-dashboard"
# Set Wazuh app variables
ENV PATTERN="" \
INSTALL_DIR="/usr/share/wazuh-dashboard" \
PATTERN="" \
CHECKS_PATTERN="" \
CHECKS_TEMPLATE="" \
CHECKS_API="" \
@@ -60,7 +59,7 @@ ENV PATTERN="" \
WAZUH_MONITORING_REPLICAS=""
# Update and install dependencies
RUN yum install shadow-utils -y
RUN dnf install shadow-utils -y && dnf clean all
# Create wazuh-dashboard user and group
RUN getent group $GROUP || groupadd -r -g 1000 $GROUP

View File

@@ -1,15 +0,0 @@
## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository
if [[ -n "${WAZUH_TAG}" ]]; then
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
fi
rpm --import "${APT_KEY}"
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo

View File

@@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
PACKAGES_URL=https://packages.wazuh.com/5.0/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')

View File

@@ -3,31 +3,19 @@ FROM amazonlinux:2023 AS builder
ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION
RUN yum install curl-minimal openssl xz tar findutils shadow-utils -y
COPY config/check_repository.sh /
RUN chmod 775 /check_repository.sh && \
source /check_repository.sh
RUN yum install wazuh-indexer-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
yum clean all
COPY config/opensearch.yml /
ARG TARGETARCH
ARG wazuh_indexer_url_amd64_rpm
ARG wazuh_indexer_url_arm64_rpm
COPY config/config.sh .
COPY config/config.yml /
COPY config/action_groups.yml /
COPY config/internal_users.yml /
COPY config/roles_mapping.yml /
COPY config/roles.yml /
RUN bash config.sh
RUN URL_VAR="wazuh_indexer_url_${TARGETARCH}_rpm" && \
indexer_url="${!URL_VAR}" && \
dnf install curl-minimal openssl xz tar findutils shadow-utils -y &&\
curl -o /wazuh-indexer.rpm "${indexer_url}" && \
dnf install /wazuh-indexer.rpm -y && \
dnf clean all && \
bash config.sh
################################################################################
# Build stage 1 (the actual Wazuh indexer image):

View File

@@ -1,15 +0,0 @@
## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository
if [[ -n "${WAZUH_TAG}" ]]; then
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
fi
rpm --import "${APT_KEY}"
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo

View File

@@ -22,8 +22,8 @@ export REPO_DIR=/unattended_installer
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
PACKAGES_URL=https://packages.wazuh.com/5.0/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/5.0/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk '{print $2}')

View File

@@ -4,13 +4,12 @@ cluster.name: "wazuh-cluster"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
discovery.type: single-node
compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false

View File

@@ -5,28 +5,18 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
ARG WAZUH_VERSION
ARG WAZUH_TAG_REVISION
ARG FILEBEAT_TEMPLATE_BRANCH
ARG FILEBEAT_CHANNEL=filebeat-oss
ARG FILEBEAT_VERSION=7.10.2
ARG FILEBEAT_REVISION=2
ARG WAZUH_FILEBEAT_MODULE
ARG S6_VERSION="v2.2.0.3"
ARG TARGETARCH
ARG wazuh_manager_url_amd64_rpm
ARG wazuh_manager_url_arm64_rpm
RUN yum install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
yum clean all
COPY config/check_repository.sh /
COPY config/filebeat_module.sh /
COPY config/permanent_data.env config/permanent_data.sh /
RUN chmod 775 /check_repository.sh
RUN source /check_repository.sh
RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
yum clean all && \
chmod 775 /filebeat_module.sh && \
source /filebeat_module.sh && \
rm /filebeat_module.sh && \
RUN URL_VAR="wazuh_manager_url_${TARGETARCH}_rpm" && \
manager_url="${!URL_VAR}" && \
dnf install curl-minimal xz gnupg tar gzip openssl findutils procps -y &&\
dnf clean all && \
curl -o /wazuh-manager.rpm "${manager_url}" && \
dnf install /wazuh-manager.rpm -y && \
dnf clean all && \
curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \
-o /tmp/s6-overlay-amd64.tar.gz && \
tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \
@@ -36,24 +26,16 @@ RUN yum install wazuh-manager-${WAZUH_VERSION}-${WAZUH_TAG_REVISION} -y && \
COPY config/etc/ /etc/
COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py
COPY config/filebeat.yml /etc/filebeat/
RUN chmod go-w /etc/filebeat/filebeat.yml
ADD https://raw.githubusercontent.com/wazuh/wazuh/$FILEBEAT_TEMPLATE_BRANCH/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
RUN chmod go-w /etc/filebeat/wazuh-template.json
# Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547
COPY config/permanent_data.env config/permanent_data.sh /
#Make mount directories for keep permissions
RUN mkdir -p /var/ossec/var/multigroups && \
chown root:wazuh /var/ossec/var/multigroups && \
chmod 770 /var/ossec/var/multigroups && \
mkdir -p /var/ossec/agentless && \
chown root:wazuh /var/ossec/agentless && \
chmod 770 /var/ossec/agentless && \
mkdir -p /var/ossec/active-response/bin && \
chown root:wazuh /var/ossec/active-response/bin && \
chmod 770 /var/ossec/active-response/bin && \
@@ -61,8 +43,6 @@ RUN mkdir -p /var/ossec/var/multigroups && \
sync && /permanent_data.sh && \
sync && rm /permanent_data.sh
RUN rm /etc/yum.repos.d/wazuh.repo
# Services ports
EXPOSE 55000/tcp 1514/tcp 1515/tcp 514/udp 1516/tcp

View File

@@ -1,15 +0,0 @@
## variables
APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository
if [[ -n "${WAZUH_TAG}" ]]; then
APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH
GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]"
REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1"
fi
rpm --import "${APT_KEY}"
echo -e "${REPOSITORY}" | tee /etc/yum.repos.d/wazuh.repo

View File

@@ -1,51 +0,0 @@
#!/usr/bin/with-contenv bash
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
set -e
if [ "$INDEXER_URL" != "" ]; then
>&2 echo "Customize Elasticsearch output IP"
sed -i "s|hosts:.*|hosts: ['$INDEXER_URL']|g" /etc/filebeat/filebeat.yml
fi
# Configure filebeat.yml security settings
if [ "$INDEXER_USERNAME" != "" ]; then
>&2 echo "Configuring username."
sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
fi
if [ "$INDEXER_PASSWORD" != "" ]; then
>&2 echo "Configuring password."
sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
fi
if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
>&2 echo "Configuring SSL verification mode."
sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
>&2 echo "Configuring Certificate Authorities."
sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_CERTIFICATE" != "" ]; then
>&2 echo "Configuring SSL Certificate."
sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
fi
if [ "$SSL_KEY" != "" ]; then
>&2 echo "Configuring SSL Key."
sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
fi
chmod go-w /etc/filebeat/filebeat.yml || true
chown root: /etc/filebeat/filebeat.yml || true

View File

@@ -60,12 +60,6 @@ function_wazuh_migration(){
chown wazuh:wazuh /var/ossec/etc/rules/*
chmod 660 /var/ossec/etc/rules/*
if [ -e /wazuh-migration/data/agentless/.passlist ]; then
\cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist
chown root:wazuh /var/ossec/agentless/.passlist
chmod 640 /var/ossec/agentless/.passlist
fi
\cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db
chown wazuh:wazuh /var/ossec/queue/db/global.db
chmod 640 /var/ossec/queue/db/global.db

View File

@@ -1,6 +0,0 @@
#!/usr/bin/env sh
echo >&2 "Filebeat exited. code=${1}"
# terminate other services to exit from the container
exec s6-svscanctl -t /var/run/s6/services

View File

@@ -1,4 +0,0 @@
#!/usr/bin/with-contenv sh
echo >&2 "starting Filebeat"
exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat

View File

@@ -1,11 +0,0 @@
## variables
REPOSITORY="packages-dev.wazuh.com/pre-release"
WAZUH_TAG=$(curl --silent https://api.github.com/repos/wazuh/wazuh/git/refs/tags | grep '["]ref["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 11- | grep ^v${WAZUH_VERSION}$)
## check tag to use the correct repository
if [[ -n "${WAZUH_TAG}" ]]; then
REPOSITORY="packages.wazuh.com/4.x"
fi
yum install filebeat-${FILEBEAT_VERSION}-${FILEBEAT_REVISION} -y && \
curl -s https://${REPOSITORY}/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module

View File

@@ -4,28 +4,15 @@ PERMANENT_DATA[((i++))]="/var/ossec/api/configuration"
PERMANENT_DATA[((i++))]="/var/ossec/etc"
PERMANENT_DATA[((i++))]="/var/ossec/logs"
PERMANENT_DATA[((i++))]="/var/ossec/queue"
PERMANENT_DATA[((i++))]="/var/ossec/agentless"
PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups"
PERMANENT_DATA[((i++))]="/var/ossec/integrations"
PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin"
PERMANENT_DATA[((i++))]="/var/ossec/wodles"
PERMANENT_DATA[((i++))]="/etc/filebeat"
export PERMANENT_DATA
# Files mounted in a volume that should not be permanent
i=0
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/maltiverse.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop"
@@ -41,18 +28,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-wazuh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py"
@@ -97,11 +72,6 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/bucket.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/buckets/access_logs.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/pubsub/subscriber.py"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-ip"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malicious-domains"
PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/lists/malicious-ioc/malware-hashes"
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/wazuh-template.json"
PERMANENT_DATA_EXCP[((i++))]="/etc/filebeat/filebeat.yml"
export PERMANENT_DATA_EXCP
# Files mounted in a volume that should be deleted

View File

@@ -13,7 +13,7 @@ This script initializes the environment variables needed to build each of the im
The script allows you to build images from other versions of Wazuh, to do this you must use the -v or --version argument:
```
$ build-docker-images/build-images.sh -v 4.14.0
$ build-docker-images/build-images.sh -v 5.0.0
```
To get all the available script options use the -h or --help option:
@@ -24,9 +24,8 @@ $ build-docker-images/build-images.sh -h
Usage: build-docker-images/build-images.sh [OPTIONS]
-d, --dev <ref> [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
-f, --filebeat-module <ref> [Optional] Set Filebeat module version. By default 0.4.
-r, --revision <rev> [Optional] Package revision. By default 1
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 4.14.0.
-v, --version <ver> [Optional] Set the Wazuh version should be builded. By default, 5.0.0.
-h, --help Show this help.
```

View File

@@ -1,6 +1,6 @@
# Development Guide - Introduction
Welcome to the Development Guide for Wazuh-docker version 4.14.0. This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
Welcome to the Development Guide for Wazuh-docker version 5.0.0 This guide is intended for developers, contributors, and advanced users who wish to understand the development aspects of the Wazuh-Docker project, build custom Docker images, or contribute to its development.
## Purpose of This Guide

View File

@@ -1,6 +1,6 @@
# Development Guide - Setup Environment
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 4.14.0). A proper setup is crucial for building images, running tests, and contributing effectively.
This section outlines the steps required to set up your local development environment for working with the Wazuh-Docker project (version 5.0.0). A proper setup is crucial for building images, running tests, and contributing effectively.
## Prerequisites
@@ -26,12 +26,12 @@ Before you begin, ensure your system meets the following requirements:
Follow these steps to prepare your development environment:
1. **Clone the Repository**:
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `4.14.0`.
Clone the `wazuh-docker` repository from GitHub. It's important to check out the specific branch you intend to work with, in this case, `5.0.0`.
```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker
git checkout v4.14.0
git checkout v5.0.0
```
2. **Verify Docker Installation**:

View File

@@ -1,6 +1,6 @@
# Reference Manual - Description
This section provides a detailed description of Wazuh-docker (version 4.14.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
This section provides a detailed description of Wazuh-docker (version 5.0.0), its components, and its architecture when deployed using Docker containers. Understanding these aspects is key to effectively deploying and managing your Wazuh environment.
## What is Wazuh?
@@ -18,7 +18,7 @@ Wazuh-docker is a project that provides Docker images and `docker compose` confi
## Core Components in Wazuh-Docker
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 4.14.0:
The Wazuh-Docker project typically provides images for the following core Wazuh components, adapted for version 5.0.0:
1. **Wazuh Manager**:
- The central component that collects and analyzes data from deployed Wazuh agents.
@@ -28,7 +28,7 @@ The Wazuh-Docker project typically provides images for the following core Wazuh
2. **Wazuh Indexer**:
- A highly scalable, full-text search and analytics engine.
- Based on OpenSearch (or historically Elasticsearch), it stores and indexes alerts and monitoring data generated by the Wazuh manager.
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 4.14.0, this is typically an OpenSearch-based component.
- The Wazuh indexer container provides the data persistence layer for Wazuh alerts and events. For version 5.0.0, this is typically an OpenSearch-based component.
3. **Wazuh Dashboard**:
- A flexible visualization tool based on OpenSearch Dashboards (or historically Kibana).

View File

@@ -1,6 +1,6 @@
# Reference Manual - Introduction
Welcome to the Reference Manual for Wazuh-Docker, version 4.14.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
Welcome to the Reference Manual for Wazuh-Docker, version 5.0.0. This manual provides comprehensive information about deploying, configuring, and managing your Wazuh environment using Docker.
## Purpose of This Manual
@@ -44,4 +44,4 @@ This manual is structured to help you find information efficiently:
- If you need to customize your deployment, refer to the [Configuration](configuration/configuration.md) section.
- For specific terms or concepts, consult the [Glossary](glossary.md).
This manual refers to version 4.14.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.
This manual refers to version 5.0.0 of Wazuh-Docker. Ensure you are using the documentation that corresponds to your deployed version.

View File

@@ -2,7 +2,7 @@
### 1. Wazuh Manager Configuration
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, integrations, clustering, and more.
* **`ossec.conf`**: The main configuration file for the Wazuh manager. It controls rules, decoders, agent enrollment, active responses, clustering, and more.
* **Customization**: Mount a custom `ossec.conf` or specific configuration snippets (e.g., local rules in `local_rules.xml`) into the manager container at `/wazuh-mount-point/`, which will be copied to the path `/var/ossec` (e.g., the file `/var/ossec/etc/ossec.conf` must be mounted at `/wazuh-mount-point/etc/ossec.conf`) .
### 2. Wazuh Indexer Configuration
@@ -29,4 +29,4 @@
```
Consult the official Wazuh documentation for version 4.14.0 for detailed information on all possible configuration parameters for each component.
Consult the official Wazuh documentation for version 5.0.0 for detailed information on all possible configuration parameters for each component.

View File

@@ -1,6 +1,6 @@
# Reference Manual - Configuration
This section details how to configure your Wazuh-Docker deployment (version 4.14.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
This section details how to configure your Wazuh-Docker deployment (version 5.0.0). Proper configuration is key to tailoring the Wazuh stack to your specific needs, managing data persistence, and integrating with your environment.
## Overview of Configuration Methods

View File

@@ -1,6 +1,6 @@
# Reference Manual - Deployment
This section provides detailed instructions for deploying Wazuh-Docker (version 4.14.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
This section provides detailed instructions for deploying Wazuh-Docker (version 5.0.0) in various configurations. Choose the deployment model that best suits your needs, from simple single-node setups for testing to more robust multi-node configurations for production environments.
## Overview of Deployment Options
@@ -24,11 +24,11 @@ Ensure you have:
- Met all the [System Requirements](ref/getting-started/requirements.md).
- Installed Docker and Docker Compose on your host(s).
- Cloned the `wazuh-docker` repository (version `4.14.0`) or downloaded the necessary deployment files.
- Cloned the `wazuh-docker` repository (version `5.0.0`) or downloaded the necessary deployment files.
```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker
git checkout v4.14.0
git checkout v5.0.0
```
- Made a backup of any existing Wazuh data if you are migrating or upgrading.

View File

@@ -1,6 +1,6 @@
# Reference Manual - Getting Started
This section guides you through the initial steps to get your Wazuh-docker (version 4.14.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
This section guides you through the initial steps to get your Wazuh-docker (version 5.0.0) environment up and running. We will cover the prerequisites and point you to the deployment instructions.
## Overview
@@ -27,11 +27,11 @@ Before diving into the deployment, please ensure you have reviewed:
Verify that your host system has sufficient RAM, CPU, and disk space. Ensure Docker and Docker Compose are installed and functioning correctly.
2. **Obtain Wazuh-docker Configuration**:
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 4.14.0.
You'll need the Docker Compose files and any associated configuration files from the `wazuh-docker` repository for version 5.0.0.
```bash
git clone [https://github.com/wazuh/wazuh-docker.git](https://github.com/wazuh/wazuh-docker.git)
cd wazuh-docker
git checkout v4.14.0
git checkout v5.0.0
# Navigate to the specific docker-compose directory, e.g., single-node or multi-node
# cd docker-compose/single-node/ (example path)
```

View File

@@ -1,6 +1,6 @@
# Reference Manual - Requirements
Before deploying Wazuh-Docker (version 4.14.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
Before deploying Wazuh-Docker (version 5.0.0), it's essential to ensure your environment meets the necessary hardware and software requirements. Meeting these prerequisites will help ensure a stable and performant Wazuh deployment.
## Host System Requirements

View File

@@ -1,6 +1,6 @@
# Reference Manual - Glossary
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 4.14.0).
This glossary defines key terms and concepts related to Wazuh, Docker, and their use together in the Wazuh-Docker project (version 5.0.0).
---
@@ -22,7 +22,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
**D**
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 4.14.0, this is typically OpenSearch Dashboards.
- **Dashboard (Wazuh Dashboard / OpenSearch Dashboards / Kibana)**: A web-based visualization tool used to explore, analyze, and visualize data stored in the Wazuh Indexer. It provides dashboards, visualizations, and a query interface for security events and alerts. For Wazuh 5.0.0, this is typically OpenSearch Dashboards.
- **Decoder**: A component in the Wazuh Manager that parses and extracts relevant information (fields) from raw log messages or event data.
- **Docker**: An open platform for developing, shipping, and running applications inside containers.
- **Docker Compose**: A tool for defining and running multi-container Docker applications. It uses a YAML file (`docker-compose.yml`) to configure the application's services, networks, and volumes.
@@ -42,7 +42,7 @@ This glossary defines key terms and concepts related to Wazuh, Docker, and their
**I**
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 4.14.0, this is typically OpenSearch.
- **Indexer (Wazuh Indexer / OpenSearch / Elasticsearch)**: The component responsible for storing, indexing, and making searchable the alerts and event data generated by the Wazuh Manager. For Wazuh 5.0.0, this is typically OpenSearch.
**L**

View File

@@ -1,7 +1,7 @@
# Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2)
FROM ubuntu:focal
FROM amazonlinux:2023
RUN apt-get update && apt-get install openssl curl -y
RUN yum update -y && yum install openssl curl-minimal -y
WORKDIR /

View File

@@ -5,5 +5,5 @@ The dockerfile hosted in this directory is used to build the image used to boot
To create the image, the following command must be executed:
```
$ docker build -t wazuh/wazuh-certs-generator:0.0.2 .
$ docker build -t wazuh/wazuh-certs-generator:0.0.3 .
```

View File

@@ -8,29 +8,35 @@
## Variables
CERT_TOOL=wazuh-certs-tool.sh
PASSWORD_TOOL=wazuh-passwords-tool.sh
PACKAGES_URL=https://packages.wazuh.com/4.14/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.14/
PACKAGES_URL=https://packages.wazuh.com/$CERT_TOOL_VERSION/
PACKAGES_DEV_URL=https://packages-dev.wazuh.com/$CERT_TOOL_VERSION/
## Check if the cert tool exists in S3 buckets
CERT_TOOL_PACKAGES=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_URL$CERT_TOOL")
CERT_TOOL_PACKAGES_DEV=$(curl --silent --head --location --output /dev/null --write-out "%{http_code}" "$PACKAGES_DEV_URL$CERT_TOOL")
OUTPUT_FILE="/$CERT_TOOL"
## If cert tool exists in some bucket, download it, if not exit 1
if [ "$CERT_TOOL_PACKAGES" = "200" ]; then
curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL -s
echo "The tool to create the certificates exists in the in Packages bucket"
elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then
curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL -s
echo "The tool to create the certificates exists in Packages-dev bucket"
download_package() {
local url=$1
echo "Checking $url$CERT_TOOL ..."
if curl -fsL "$url$CERT_TOOL" -o "$OUTPUT_FILE"; then
echo "Downloaded $CERT_TOOL from $url"
return 0
else
return 1
fi
}
# Try first the prod URL, if it fails try the dev URL
if download_package "$PACKAGES_URL"; then
:
elif download_package "$PACKAGES_DEV_URL"; then
:
else
echo "The tool to create the certificates does not exist in any bucket"
echo "ERROR: certificates were not created"
exit 1
echo "The tool to create the certificates does not exist in any bucket"
echo "ERROR: certificates were not created"
exit 1
fi
cp /config/certs.yml /config.yml
chmod 700 /$CERT_TOOL
chmod 700 "$OUTPUT_FILE"
##############################################################################
# Creating Cluster certificates

View File

@@ -80,13 +80,6 @@ docker volume create \
multi-node_master-wazuh-var-multigroups
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-integrations \
multi-node_master-wazuh-integrations
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
@@ -94,13 +87,6 @@ docker volume create \
multi-node_master-wazuh-active-response
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=master-wazuh-agentless \
multi-node_master-wazuh-agentless
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
@@ -157,13 +143,6 @@ docker volume create \
multi-node_worker-wazuh-var-multigroups
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-integrations \
multi-node_worker-wazuh-integrations
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
@@ -171,13 +150,6 @@ docker volume create \
multi-node_worker-wazuh-active-response
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
--label com.docker.compose.volume=worker-wazuh-agentless \
multi-node_worker-wazuh-agentless
```
```
docker volume create \
--label com.docker.compose.project=multi-node \
--label com.docker.compose.version=1.25.0 \
@@ -248,24 +220,12 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-integrations:/from \
-v multi-node_master-wazuh-integrations:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-active-response:/from \
-v multi-node_master-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-agentless:/from \
-v multi-node_master-wazuh-agentless:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_ossec-wodles:/from \
-v multi-node_master-wazuh-wodles:/to \
@@ -314,24 +274,12 @@ docker container run --rm -it \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-integrations:/from \
-v multi-node_worker-wazuh-integrations:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-active-response:/from \
-v multi-node_worker-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-agentless:/from \
-v multi-node_worker-wazuh-agentless:/to \
alpine ash -c "cd /from ; cp -avp . /to"
```
```
docker container run --rm -it \
-v wazuh-docker_worker-ossec-wodles:/from \
-v multi-node_worker-wazuh-wodles:/to \

View File

@@ -1,24 +1,10 @@
<ossec_config>
<global>
<jsonout_output>yes</jsonout_output>
<alerts_log>yes</alerts_log>
<logall>no</logall>
<logall_json>no</logall_json>
<email_notification>no</email_notification>
<smtp_server>smtp.example.wazuh.com</smtp_server>
<email_from>wazuh@example.wazuh.com</email_from>
<email_to>recipient@example.wazuh.com</email_to>
<email_maxperhour>12</email_maxperhour>
<email_log_source>alerts.log</email_log_source>
<agents_disconnection_time>10m</agents_disconnection_time>
<agents_disconnection_time>15m</agents_disconnection_time>
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
<update_check>yes</update_check>
</global>
<alerts>
<log_alert_level>3</log_alert_level>
<email_alert_level>12</email_alert_level>
</alerts>
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
<logging>
<log_format>plain</log_format>
@@ -34,8 +20,6 @@
<!-- Policy monitoring -->
<rootcheck>
<disabled>no</disabled>
<check_files>yes</check_files>
<check_trojans>yes</check_trojans>
<check_dev>yes</check_dev>
<check_sys>yes</check_sys>
<check_pids>yes</check_pids>
@@ -45,31 +29,12 @@
<!-- Frequency that rootcheck is executed - every 12 hours -->
<frequency>43200</frequency>
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
<skip_nfs>yes</skip_nfs>
<ignore>/var/lib/containerd</ignore>
<ignore>/var/lib/docker/overlay2</ignore>
</rootcheck>
<wodle name="cis-cat">
<disabled>yes</disabled>
<timeout>1800</timeout>
<interval>1d</interval>
<scan-on-start>yes</scan-on-start>
<java_path>wodles/java</java_path>
<ciscat_path>wodles/ciscat</ciscat_path>
</wodle>
<!-- Osquery integration -->
<wodle name="osquery">
<disabled>yes</disabled>
<run_daemon>yes</run_daemon>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<add_labels>yes</add_labels>
</wodle>
<!-- System inventory -->
<wodle name="syscollector">
<disabled>no</disabled>
@@ -81,9 +46,15 @@
<packages>yes</packages>
<ports all="yes">yes</ports>
<processes>yes</processes>
<users>yes</users>
<groups>yes</groups>
<services>yes</services>
<browser_extensions>yes</browser_extensions>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</wodle>
@@ -92,7 +63,13 @@
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</sca>
<vulnerability-detection>
@@ -124,8 +101,6 @@
<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<!-- Generate alert when new file detected -->
<alert_new_files>yes</alert_new_files>
@@ -165,13 +140,12 @@
<process_priority>10</process_priority>
<!-- Maximum output throughput -->
<max_eps>100</max_eps>
<max_eps>50</max_eps>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_interval>1h</max_interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
@@ -266,13 +240,6 @@
<rule_dir>etc/rules</rule_dir>
</ruleset>
<rule_test>
<enabled>yes</enabled>
<threads>1</threads>
<max_sessions>64</max_sessions>
<session_timeout>15m</session_timeout>
</rule_test>
<!-- Configuration for wazuh-authd -->
<auth>
<disabled>no</disabled>
@@ -305,9 +272,19 @@
</ossec_config>
<ossec_config>
<localfile>
<log_format>journald</log_format>
<location>journald</location>
</localfile>
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location>
</localfile>
</ossec_config>
</ossec_config>

View File

@@ -1,24 +1,10 @@
<ossec_config>
<global>
<jsonout_output>yes</jsonout_output>
<alerts_log>yes</alerts_log>
<logall>no</logall>
<logall_json>no</logall_json>
<email_notification>no</email_notification>
<smtp_server>smtp.example.wazuh.com</smtp_server>
<email_from>wazuh@example.wazuh.com</email_from>
<email_to>recipient@example.wazuh.com</email_to>
<email_maxperhour>12</email_maxperhour>
<email_log_source>alerts.log</email_log_source>
<agents_disconnection_time>10m</agents_disconnection_time>
<agents_disconnection_time>15m</agents_disconnection_time>
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
<update_check>yes</update_check>
</global>
<alerts>
<log_alert_level>3</log_alert_level>
<email_alert_level>12</email_alert_level>
</alerts>
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
<logging>
<log_format>plain</log_format>
@@ -34,8 +20,6 @@
<!-- Policy monitoring -->
<rootcheck>
<disabled>no</disabled>
<check_files>yes</check_files>
<check_trojans>yes</check_trojans>
<check_dev>yes</check_dev>
<check_sys>yes</check_sys>
<check_pids>yes</check_pids>
@@ -45,31 +29,12 @@
<!-- Frequency that rootcheck is executed - every 12 hours -->
<frequency>43200</frequency>
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
<skip_nfs>yes</skip_nfs>
<ignore>/var/lib/containerd</ignore>
<ignore>/var/lib/docker/overlay2</ignore>
</rootcheck>
<wodle name="cis-cat">
<disabled>yes</disabled>
<timeout>1800</timeout>
<interval>1d</interval>
<scan-on-start>yes</scan-on-start>
<java_path>wodles/java</java_path>
<ciscat_path>wodles/ciscat</ciscat_path>
</wodle>
<!-- Osquery integration -->
<wodle name="osquery">
<disabled>yes</disabled>
<run_daemon>yes</run_daemon>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<add_labels>yes</add_labels>
</wodle>
<!-- System inventory -->
<wodle name="syscollector">
<disabled>no</disabled>
@@ -81,9 +46,15 @@
<packages>yes</packages>
<ports all="yes">yes</ports>
<processes>yes</processes>
<users>yes</users>
<groups>yes</groups>
<services>yes</services>
<browser_extensions>yes</browser_extensions>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</wodle>
@@ -92,7 +63,13 @@
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</sca>
<vulnerability-detection>
@@ -124,8 +101,6 @@
<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<!-- Generate alert when new file detected -->
<alert_new_files>yes</alert_new_files>
@@ -165,13 +140,12 @@
<process_priority>10</process_priority>
<!-- Maximum output throughput -->
<max_eps>100</max_eps>
<max_eps>50</max_eps>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_interval>1h</max_interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
@@ -266,13 +240,6 @@
<rule_dir>etc/rules</rule_dir>
</ruleset>
<rule_test>
<enabled>yes</enabled>
<threads>1</threads>
<max_sessions>64</max_sessions>
<session_timeout>15m</session_timeout>
</rule_test>
<!-- Configuration for wazuh-authd -->
<auth>
<disabled>no</disabled>
@@ -305,9 +272,19 @@
</ossec_config>
<ossec_config>
<localfile>
<log_format>journald</log_format>
<location>journald</location>
</localfile>
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location>
</localfile>
</ossec_config>
</ossec_config>

View File

@@ -2,7 +2,7 @@ server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: https://wazuh1.indexer:9200
opensearch.ssl.verificationMode: certificate
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true

View File

@@ -1,6 +1,6 @@
network.host: wazuh1.indexer
node.name: wazuh1.indexer
cluster.initial_master_nodes:
cluster.initial_cluster_manager_nodes:
- wazuh1.indexer
- wazuh2.indexer
- wazuh3.indexer
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
compatibility.override_main_response_version: true

View File

@@ -1,6 +1,6 @@
network.host: wazuh2.indexer
node.name: wazuh2.indexer
cluster.initial_master_nodes:
cluster.initial_cluster_manager_nodes:
- wazuh1.indexer
- wazuh2.indexer
- wazuh3.indexer
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
compatibility.override_main_response_version: true

View File

@@ -1,6 +1,6 @@
network.host: wazuh3.indexer
node.name: wazuh3.indexer
cluster.initial_master_nodes:
cluster.initial_cluster_manager_nodes:
- wazuh1.indexer
- wazuh2.indexer
- wazuh3.indexer
@@ -35,4 +35,3 @@ plugins.security.restapi.roles_enabled:
- "security_rest_api_access"
plugins.security.allow_default_init_securityindex: true
cluster.routing.allocation.disk.threshold_enabled: false
compatibility.override_main_response_version: true

View File

@@ -1,7 +1,7 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
wazuh.master:
image: wazuh/wazuh-manager:4.14.0
image: wazuh/wazuh-manager:5.0.0
hostname: wazuh.master
restart: always
ulimits:
@@ -31,9 +31,7 @@ services:
- master-wazuh-logs:/var/ossec/logs
- master-wazuh-queue:/var/ossec/queue
- master-wazuh-var-multigroups:/var/ossec/var/multigroups
- master-wazuh-integrations:/var/ossec/integrations
- master-wazuh-active-response:/var/ossec/active-response/bin
- master-wazuh-agentless:/var/ossec/agentless
- master-wazuh-wodles:/var/ossec/wodles
- master-filebeat-etc:/etc/filebeat
- master-filebeat-var:/var/lib/filebeat
@@ -43,7 +41,7 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.worker:
image: wazuh/wazuh-manager:4.14.0
image: wazuh/wazuh-manager:5.0.0
hostname: wazuh.worker
restart: always
ulimits:
@@ -67,9 +65,7 @@ services:
- worker-wazuh-logs:/var/ossec/logs
- worker-wazuh-queue:/var/ossec/queue
- worker-wazuh-var-multigroups:/var/ossec/var/multigroups
- worker-wazuh-integrations:/var/ossec/integrations
- worker-wazuh-active-response:/var/ossec/active-response/bin
- worker-wazuh-agentless:/var/ossec/agentless
- worker-wazuh-wodles:/var/ossec/wodles
- worker-filebeat-etc:/etc/filebeat
- worker-filebeat-var:/var/lib/filebeat
@@ -79,7 +75,7 @@ services:
- ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
wazuh1.indexer:
image: wazuh/wazuh-indexer:4.14.0
image: wazuh/wazuh-indexer:5.0.0
hostname: wazuh1.indexer
restart: always
ports:
@@ -105,7 +101,7 @@ services:
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
wazuh2.indexer:
image: wazuh/wazuh-indexer:4.14.0
image: wazuh/wazuh-indexer:5.0.0
hostname: wazuh2.indexer
restart: always
environment:
@@ -127,7 +123,7 @@ services:
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
wazuh3.indexer:
image: wazuh/wazuh-indexer:4.14.0
image: wazuh/wazuh-indexer:5.0.0
hostname: wazuh3.indexer
restart: always
environment:
@@ -149,7 +145,7 @@ services:
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.0
image: wazuh/wazuh-dashboard:5.0.0
hostname: wazuh.dashboard
restart: always
ports:
@@ -198,9 +194,7 @@ volumes:
master-wazuh-logs:
master-wazuh-queue:
master-wazuh-var-multigroups:
master-wazuh-integrations:
master-wazuh-active-response:
master-wazuh-agentless:
master-wazuh-wodles:
master-filebeat-etc:
master-filebeat-var:
@@ -209,9 +203,7 @@ volumes:
worker-wazuh-logs:
worker-wazuh-queue:
worker-wazuh-var-multigroups:
worker-wazuh-integrations:
worker-wazuh-active-response:
worker-wazuh-agentless:
worker-wazuh-wodles:
worker-filebeat-etc:
worker-filebeat-var:

View File

@@ -1,8 +1,10 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
generator:
image: wazuh/wazuh-certs-generator:0.0.2
image: wazuh/wazuh-certs-generator:0.0.3
hostname: wazuh-certs-generator
environment:
- CERT_TOOL_VERSION=4.14
volumes:
- ./config/wazuh_indexer_ssl_certs/:/certificates/
- ./config/certs.yml:/config/certs.yml

View File

@@ -46,24 +46,12 @@ docker volume create \
--label com.docker.compose.volume=master-wazuh-var-multigroups \
$2_master-wazuh-var-multigroups
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-integrations \
$2_master-wazuh-integrations
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-active-response \
$2_master-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=master-wazuh-agentless \
$2_master-wazuh-agentless
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
@@ -112,24 +100,12 @@ docker volume create \
--label com.docker.compose.volume=worker-wazuh-var-multigroups \
$2_worker-wazuh-var-multigroups
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-integrations \
$2_worker-wazuh-integrations
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-active-response \
$2_worker-wazuh-active-response
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
--label com.docker.compose.volume=worker-wazuh-agentless \
$2_worker-wazuh-agentless
docker volume create \
--label com.docker.compose.project=$2 \
--label com.docker.compose.version=$1 \
@@ -193,21 +169,11 @@ docker container run --rm -it \
-v $2_master-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-integrations:/from \
-v $2_master-wazuh-integrations:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-active-response:/from \
-v $2_master-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-agentless:/from \
-v $2_master-wazuh-agentless:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_ossec-wodles:/from \
-v $2_master-wazuh-wodles:/to \
@@ -248,21 +214,11 @@ docker container run --rm -it \
-v $2_worker-wazuh-var-multigroups:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-integrations:/from \
-v $2_worker-wazuh-integrations:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-active-response:/from \
-v $2_worker-wazuh-active-response:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-agentless:/from \
-v $2_worker-wazuh-agentless:/to \
alpine ash -c "cd /from ; cp -avp . /to"
docker container run --rm -it \
-v wazuh-docker_worker-ossec-wodles:/from \
-v $2_worker-wazuh-wodles:/to \

View File

@@ -1,24 +1,10 @@
<ossec_config>
<global>
<jsonout_output>yes</jsonout_output>
<alerts_log>yes</alerts_log>
<logall>no</logall>
<logall_json>no</logall_json>
<email_notification>no</email_notification>
<smtp_server>smtp.example.wazuh.com</smtp_server>
<email_from>wazuh@example.wazuh.com</email_from>
<email_to>recipient@example.wazuh.com</email_to>
<email_maxperhour>12</email_maxperhour>
<email_log_source>alerts.log</email_log_source>
<agents_disconnection_time>10m</agents_disconnection_time>
<agents_disconnection_time>15m</agents_disconnection_time>
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
<update_check>yes</update_check>
</global>
<alerts>
<log_alert_level>3</log_alert_level>
<email_alert_level>12</email_alert_level>
</alerts>
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
<logging>
<log_format>plain</log_format>
@@ -34,8 +20,6 @@
<!-- Policy monitoring -->
<rootcheck>
<disabled>no</disabled>
<check_files>yes</check_files>
<check_trojans>yes</check_trojans>
<check_dev>yes</check_dev>
<check_sys>yes</check_sys>
<check_pids>yes</check_pids>
@@ -45,31 +29,12 @@
<!-- Frequency that rootcheck is executed - every 12 hours -->
<frequency>43200</frequency>
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
<skip_nfs>yes</skip_nfs>
<ignore>/var/lib/containerd</ignore>
<ignore>/var/lib/docker/overlay2</ignore>
</rootcheck>
<wodle name="cis-cat">
<disabled>yes</disabled>
<timeout>1800</timeout>
<interval>1d</interval>
<scan-on-start>yes</scan-on-start>
<java_path>wodles/java</java_path>
<ciscat_path>wodles/ciscat</ciscat_path>
</wodle>
<!-- Osquery integration -->
<wodle name="osquery">
<disabled>yes</disabled>
<run_daemon>yes</run_daemon>
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
<config_path>/etc/osquery/osquery.conf</config_path>
<add_labels>yes</add_labels>
</wodle>
<!-- System inventory -->
<wodle name="syscollector">
<disabled>no</disabled>
@@ -81,9 +46,15 @@
<packages>yes</packages>
<ports all="yes">yes</ports>
<processes>yes</processes>
<users>yes</users>
<groups>yes</groups>
<services>yes</services>
<browser_extensions>yes</browser_extensions>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</wodle>
@@ -92,7 +63,13 @@
<enabled>yes</enabled>
<scan_on_start>yes</scan_on_start>
<interval>12h</interval>
<skip_nfs>yes</skip_nfs>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_eps>10</max_eps>
</synchronization>
</sca>
<vulnerability-detection>
@@ -122,8 +99,6 @@
<!-- Frequency that syscheck is executed default every 12 hours -->
<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<!-- Generate alert when new file detected -->
<alert_new_files>yes</alert_new_files>
@@ -163,13 +138,12 @@
<process_priority>10</process_priority>
<!-- Maximum output throughput -->
<max_eps>100</max_eps>
<max_eps>50</max_eps>
<!-- Database synchronization settings -->
<synchronization>
<enabled>yes</enabled>
<interval>5m</interval>
<max_interval>1h</max_interval>
<max_eps>10</max_eps>
</synchronization>
</syscheck>
@@ -264,13 +238,6 @@
<rule_dir>etc/rules</rule_dir>
</ruleset>
<rule_test>
<enabled>yes</enabled>
<threads>1</threads>
<max_sessions>64</max_sessions>
<session_timeout>15m</session_timeout>
</rule_test>
<!-- Configuration for wazuh-authd -->
<auth>
<disabled>no</disabled>
@@ -303,9 +270,19 @@
</ossec_config>
<ossec_config>
<localfile>
<log_format>journald</log_format>
<location>journald</location>
</localfile>
<localfile>
<log_format>audit</log_format>
<location>/var/log/audit/audit.log</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/var/ossec/logs/active-responses.log</location>
</localfile>
</ossec_config>
</ossec_config>

View File

@@ -2,7 +2,7 @@ server.host: 0.0.0.0
server.port: 5601
opensearch.hosts: https://wazuh.indexer:9200
opensearch.ssl.verificationMode: certificate
opensearch.requestHeadersWhitelist: ["securitytenant","Authorization"]
opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
opensearch_security.multitenancy.enabled: false
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
server.ssl.enabled: true

View File

@@ -6,13 +6,12 @@ path.logs: /var/log/wazuh-indexer
discovery.type: single-node
http.port: 9200-9299
transport.tcp.port: 9300-9399
compatibility.override_main_response_version: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false

View File

@@ -1,7 +1,7 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
wazuh.manager:
image: wazuh/wazuh-manager:4.14.0
image: wazuh/wazuh-manager:5.0.0
hostname: wazuh.manager
restart: always
ulimits:
@@ -32,9 +32,7 @@ services:
- wazuh_logs:/var/ossec/logs
- wazuh_queue:/var/ossec/queue
- wazuh_var_multigroups:/var/ossec/var/multigroups
- wazuh_integrations:/var/ossec/integrations
- wazuh_active_response:/var/ossec/active-response/bin
- wazuh_agentless:/var/ossec/agentless
- wazuh_wodles:/var/ossec/wodles
- filebeat_etc:/etc/filebeat
- filebeat_var:/var/lib/filebeat
@@ -44,7 +42,7 @@ services:
- ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
wazuh.indexer:
image: wazuh/wazuh-indexer:4.14.0
image: wazuh/wazuh-indexer:5.0.0
hostname: wazuh.indexer
restart: always
ports:
@@ -69,7 +67,7 @@ services:
- ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
wazuh.dashboard:
image: wazuh/wazuh-dashboard:4.14.0
image: wazuh/wazuh-dashboard:5.0.0
hostname: wazuh.dashboard
restart: always
ports:
@@ -102,9 +100,7 @@ volumes:
wazuh_logs:
wazuh_queue:
wazuh_var_multigroups:
wazuh_integrations:
wazuh_active_response:
wazuh_agentless:
wazuh_wodles:
filebeat_etc:
filebeat_var:

View File

@@ -1,8 +1,10 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
generator:
image: wazuh/wazuh-certs-generator:0.0.2
image: wazuh/wazuh-certs-generator:0.0.3
hostname: wazuh-certs-generator
environment:
- CERT_TOOL_VERSION=4.14
volumes:
- ./config/wazuh_indexer_ssl_certs/:/certificates/
- ./config/certs.yml:/config/certs.yml

View File

@@ -1,7 +1,7 @@
# Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
services:
wazuh.agent:
image: wazuh/wazuh-agent:4.14.0
image: wazuh/wazuh-agent:5.0.0
restart: always
environment:
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>