Switch to OSS images and delete XPACK

CHANGELOG.md

@@ -1,111 +1,6 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
-## Wazuh Docker v3.13.6_7.9.2
-
-### Added
-
-- Update to Wazuh version 3.13.6_7.9.2
-
-## Wazuh Docker v3.13.5_7.9.2
-
-### Added
-
-- Update to Wazuh version 3.13.5_7.9.2
-
-## Wazuh Docker v3.13.4_7.9.2
-
-### Added
-
-- Update to Wazuh version 3.13.4_7.9.2
-
-## Wazuh Docker v3.13.3_7.9.2
-
-### Added
-
-- Update to Wazuh version 3.13.3_7.9.2
-
-## Wazuh Docker v3.13.2_7.9.1
-
-### Added
-
-- Update to Wazuh version 3.13.2_7.9.1
-- Add CLUSTER_NETWORK_HOST environment variable ([@jfut](https://github.com/jfut)) [#372](https://github.com/wazuh/wazuh-docker/pull/372)
-
-### Fixed
-
-- Too many redirects when running on port 80 ([@chowmean](https://github.com/chowmean)) [#377](https://github.com/wazuh/wazuh-docker/pull/377)
-- Move Filebeat installation to build stage ([@xr09](https://github.com/xr09)) [#378](https://github.com/wazuh/wazuh-docker/pull/378)
-
-
-## Wazuh Docker v3.13.1_7.8.0
-
-### Added
-
-- Update to Wazuh version 3.13.1_7.8.0
-
-
-## Wazuh Docker v3.13.0_7.7.1
-
-### Added
-
-- Update to Wazuh version 3.13.3_7.7.1
-
-### Fixed
-
-- Save agentless state ([@xr09](https://github.com/xr09)) [#350](https://github.com/wazuh/wazuh-docker/pull/350)
-- Use HTTP credentials for service check when required ([@xr09](https://github.com/xr09)) [#356](https://github.com/wazuh/wazuh-docker/pull/356)
-
-## Wazuh Docker v3.12.3_7.6.2
-
-### Added
-
-- Update to Wazuh version 3.12.3_7.6.2
-
-
-## Wazuh Docker v3.12.2_7.6.2
-
-### Added
-
-- Update to Wazuh version 3.12.2_7.6.2
-
-## Wazuh Docker v3.12.1_7.6.2
-
-### Added
-
-- Update to Wazuh version 3.12.1_7.6.2
-
-### Fixed
-
-- Agent timestamp not being properly saved ([@xr09](https://github.com/xr09)) [#323](https://github.com/wazuh/wazuh-docker/pull/323)
-
-
-## Wazuh Docker v3.12.0_7.6.1
-
-### Added
-
-- Update to Wazuh version 3.12.0_7.6.1
-
-
-## Wazuh Docker v3.11.4_7.6.1
-
-### Added
-
-- Update to Wazuh version 3.11.4_7.6.1
-
-- Enable HTTP v2 on nginx ([@xr09](https://github.com/xr09)) [#308](https://github.com/wazuh/wazuh-docker/pull/308)
-
-### Fixed
-
-- Updated NGINX config syntax ([@xr09](https://github.com/xr09)) [#303](https://github.com/wazuh/wazuh-docker/pull/303)
-
-
-## Wazuh Docker v3.11.3_7.5.2
-
-### Added
-
-- Update to Wazuh version 3.11.3_7.5.2
-
 ## Wazuh Docker v3.11.2_7.5.1
 
 ### Added
@@ -287,7 +182,7 @@ All notable changes to this project will be documented in this file.
 - Add env credentials for nginx. ([#86](https://github.com/wazuh/wazuh-docker/pull/86))
 - Improve filebeat configuration ([#88](https://github.com/wazuh/wazuh-docker/pull/88))
 
-### Fixed
+### Fixed 
 
 - Temporary fix for Wazuh cluster master node in Kubernetes. ([#84](https://github.com/wazuh/wazuh-docker/pull/84))
 

LICENSE

@@ -1,5 +1,5 @@
 
- Portions Copyright (C) 2020 Wazuh, Inc.
+ Portions Copyright (C) 2019 Wazuh, Inc.
  Based on work Copyright (C) 2003 - 2013 Trend Micro, Inc.
 
  This program is a free software; you can redistribute it and/or modify

README.md

@@ -10,9 +10,9 @@ In this repository you will find the containers to run:
 * wazuh: It runs the Wazuh manager, Wazuh API and Filebeat (for integration with Elastic Stack)
 * wazuh-kibana: Provides a web user interface to browse through alerts data. It includes Wazuh plugin for Kibana, that allows you to visualize agents configuration and status.
 * wazuh-nginx: Proxies the Kibana container, adding HTTPS (via self-signed SSL certificate) and [Basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme).
-* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).**
+* wazuh-elasticsearch: An Elasticsearch container (working as a single-node cluster) using Elastic Stack Docker images. **Be aware to increase the `vm.max_map_count` setting, as it's detailed in the [Wazuh documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#increase-max-map-count-on-your-host-linux).** 
 
-In addition, a docker-compose file is provided to launch the containers mentioned above.
+In addition, a docker-compose file is provided to launch the containers mentioned above. 
 
 * Elasticsearch cluster. In the Elasticsearch Dockerfile we can visualize variables to configure an Elasticsearch Cluster. These variables are used in the file *config_cluster.sh* to set them in the *elasticsearch.yml* configuration file. You can see the meaning of the node variables [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) and other cluster settings [here](https://github.com/elastic/elasticsearch/blob/master/distribution/src/config/elasticsearch.yml).
 
@@ -57,7 +57,7 @@ In addition, a docker-compose file is provided to launch the containers mentione
 
 * `stable` branch on correspond to the latest Wazuh-Docker stable version.
 * `master` branch contains the latest code, be aware of possible bugs on this branch.
-* `Wazuh.Version_ElasticStack.Version` (for example 3.13.1_7.8.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
+* `Wazuh.Version_ElasticStack.Version` (for example 3.10.2_7.5.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
 
 ## Credits and Thank you
 
@@ -70,7 +70,7 @@ We thank you them and everyone else who has contributed to this project.
 
 ## License and copyright
 
-Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 ## Web references
 

VERSION

@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="3.13.6_7.9.2"
+WAZUH-DOCKER_VERSION="3.11.2_7.5.1"
-REVISION="31314"
+REVISION="31120"

docker-compose.yml

@@ -1,9 +1,9 @@
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 version: '2'
 
 services:
   wazuh:
-    image: wazuh/wazuh:3.13.6_7.9.2
+    image: wazuh/wazuh:3.11.2_7.5.1-oss
     hostname: wazuh-manager
     restart: always
     ports:
@@ -13,7 +13,7 @@ services:
       - "55000:55000"
 
   elasticsearch:
-    image: wazuh/wazuh-elasticsearch:3.13.6_7.9.2
+    image: wazuh/wazuh-elasticsearch:3.11.2_7.5.1-oss
     hostname: elasticsearch
     restart: always
     ports:
@@ -30,7 +30,7 @@ services:
     mem_limit: 2g
 
   kibana:
-    image: wazuh/wazuh-kibana:3.13.6_7.9.2
+    image: wazuh/wazuh-kibana:3.11.2_7.5.1-oss
     hostname: kibana
     restart: always
     depends_on:
@@ -38,9 +38,8 @@ services:
     links:
       - elasticsearch:elasticsearch
       - wazuh:wazuh
-
   nginx:
-    image: wazuh/wazuh-nginx:3.13.6_7.9.2
+    image: wazuh/wazuh-nginx:3.11.2_7.5.1
     hostname: nginx
     restart: always
     environment:
@@ -52,4 +51,4 @@ services:
     depends_on:
       - kibana
     links:
-      - kibana:kibana
+      - kibana:kibana

elasticsearch/Dockerfile

@@ -1,6 +1,6 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-ARG ELASTIC_VERSION=7.9.2
+ARG ELASTIC_VERSION=7.5.1
-FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION}
+FROM docker.elastic.co/elasticsearch/elasticsearch-oss:${ELASTIC_VERSION}
 ARG ELASTIC_VERSION
 ARG S3_PLUGIN_URL="https://artifacts.elastic.co/downloads/elasticsearch-plugins/repository-s3/repository-s3-${ELASTIC_VERSION}.zip"
 
@@ -12,18 +12,15 @@ ENV ALERTS_SHARDS="1" \
 ENV API_USER="foo" \
     API_PASS="bar"
 
-ENV XPACK_ML="true"
-
 ENV ENABLE_CONFIGURE_S3="false"
 
-ARG TEMPLATE_VERSION=v3.13.6
+ARG TEMPLATE_VERSION=v3.11.2
 
 # Elasticearch cluster configuration environment variables
 # If ELASTIC_CLUSTER is set to "true" the following variables will be added to the Elasticsearch configuration
 # CLUSTER_INITIAL_MASTER_NODES set to own node by default.
 ENV ELASTIC_CLUSTER="false" \
     CLUSTER_NAME="wazuh" \
-    CLUSTER_NETWORK_HOST="0.0.0.0" \
     CLUSTER_NODE_MASTER="false" \
     CLUSTER_NODE_DATA="true" \
     CLUSTER_NODE_INGEST="true" \
@@ -36,7 +33,7 @@ ENV ELASTIC_CLUSTER="false" \
     CLUSTER_DELAYED_TIMEOUT="1m" \
     CLUSTER_INITIAL_MASTER_NODES="wazuh-elasticsearch"
 
-COPY config/entrypoint.sh /entrypoint.sh
+COPY config/entrypoint.sh /entrypoint.sh 
 
 RUN chmod 755 /entrypoint.sh
 

elasticsearch/config/config_cluster.sh

@@ -1,11 +1,11 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 elastic_config_file="/usr/share/elasticsearch/config/elasticsearch.yml"
 
 remove_single_node_conf(){
   if grep -Fq "discovery.type" $1; then
-    sed -i '/discovery.type\: /d' $1
+    sed -i '/discovery.type\: /d' $1 
   fi
 }
 
@@ -24,12 +24,12 @@ if [[ $CLUSTER_NODE_MASTER == "true" ]]; then
 # cluster.initial_master_nodes for bootstrap the cluster
 cat > $elastic_config_file << EOF
 # cluster node
-network.host: $CLUSTER_NETWORK_HOST
+network.host: 0.0.0.0
 node.name: $CLUSTER_MASTER_NODE_NAME
 node.master: $CLUSTER_NODE_MASTER
-cluster.initial_master_nodes:
+cluster.initial_master_nodes: 
   - $CLUSTER_MASTER_NODE_NAME
-# end cluster config"
+# end cluster config" 
 EOF
 
 elif [[ $CLUSTER_NODE_NAME != "" ]];then
@@ -39,13 +39,13 @@ remove_cluster_config $elastic_config_file
 
 cat > $elastic_config_file << EOF
 # cluster node
-network.host: $CLUSTER_NETWORK_HOST
+network.host: 0.0.0.0
 node.name: $CLUSTER_NODE_NAME
 node.master: false
-discovery.seed_hosts:
+discovery.seed_hosts: 
   - $CLUSTER_MASTER_NODE_NAME
   - $CLUSTER_NODE_NAME
-# end cluster config"
+# end cluster config" 
 EOF
 fi
 # If the cluster is disabled, then set a single-node configuration

elasticsearch/config/configure_s3.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 
@@ -10,7 +10,7 @@ function CheckArgs()
 {
     if [ $1 != 4 ] && [ $1 != 5 ];then
         echo "Use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> (By default <current_elasticsearch_major_version> is added to the path and the repository name)"
-        echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>"
+        echo "or use: configure_s3.sh <Elastic_Server_IP:Port> <Bucket> <Path> <RepositoryName> <Elasticsearch major version>" 
         exit 1
 
     fi

elasticsearch/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 # For more information https://github.com/elastic/elasticsearch-docker/blob/6.8.0/build/elasticsearch/bin/docker-entrypoint.sh
 
@@ -20,27 +20,6 @@ run_as_other_user_if_needed() {
 }
 
 
-#Disabling xpack features
-
-elasticsearch_config_file="/usr/share/elasticsearch/config/elasticsearch.yml"
-if grep -Fq  "#xpack features" "$elasticsearch_config_file";
-then
-  declare -A CONFIG_MAP=(
-  [xpack.ml.enabled]=$XPACK_ML
-  )
-  for i in "${!CONFIG_MAP[@]}"
-  do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-      sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $elasticsearch_config_file
-    fi
-  done
-else
-  echo "
-#xpack features
-xpack.ml.enabled: $XPACK_ML
- " >> $elasticsearch_config_file
-fi
-
 # Run load settings script.
 
 ./config_cluster.sh
@@ -49,4 +28,4 @@ fi
 
 # Execute elasticsearch
 
-run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch
+run_as_other_user_if_needed /usr/share/elasticsearch/bin/elasticsearch 

elasticsearch/config/load_settings.sh

@@ -1,18 +1,12 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 
 el_url=${ELASTICSEARCH_URL}
 
 
-if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
+until curl -XGET $el_url; do
-  auth=""
-else
-  auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
-fi
-
-until curl ${auth} -XGET $el_url; do
   >&2 echo "Elastic is unavailable - sleeping"
   sleep 5
 done
@@ -24,13 +18,13 @@ if [ $ENABLE_CONFIGURE_S3 ]; then
   sleep 10
   IP_PORT="${ELASTICSEARCH_IP}:${ELASTICSEARCH_PORT}"
 
-  if [ "x$S3_PATH" != "x" ]; then
+  if [ "x$S3_PATH" != "x" ]; then 
 
-    if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then
+    if [ "x$S3_ELASTIC_MAJOR" != "x" ]; then 
-      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR
+      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME $S3_ELASTIC_MAJOR 
 
     else
-      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME
+      ./config/configure_s3.sh $IP_PORT $S3_BUCKET_NAME $S3_PATH $S3_REPOSITORY_NAME 
 
     fi
 
@@ -38,15 +32,6 @@ if [ $ENABLE_CONFIGURE_S3 ]; then
 
 fi
 
-if [ ${ENABLED_XPACK} = "true" ]; then
-curl -XPUT "$el_url/_cluster/settings" ${auth} -H 'Content-Type: application/json' -d'
-{
-  "persistent": {
-    "xpack.monitoring.collection.enabled": true
-  }
-}
-'
-fi
 
 # Set cluster delayed timeout when node falls
 curl -X PUT "$el_url/_all/_settings" -H 'Content-Type: application/json' -d'
@@ -57,5 +42,4 @@ curl -X PUT "$el_url/_all/_settings" -H 'Content-Type: application/json' -d'
 }
 '
 
-
 echo "Elasticsearch is ready."

kibana/Dockerfile

@@ -1,14 +1,15 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM docker.elastic.co/kibana/kibana:7.9.2
+FROM docker.elastic.co/kibana/kibana-oss:7.5.1
 USER kibana
-ARG ELASTIC_VERSION=7.9.2
+ARG ELASTIC_VERSION=7.5.1
-ARG WAZUH_VERSION=3.13.6
+ARG WAZUH_VERSION=3.11.2
 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}"
 
-WORKDIR /usr/share/kibana
+#ADD  https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip /usr/share/kibana/
-RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
+
+RUN /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip
+# RUN rm -rf /tmp/wazuhapp-${WAZUH_APP_VERSION}.zip
 
-WORKDIR /
 USER root
 COPY config/entrypoint.sh ./entrypoint.sh
 RUN chmod 755 ./entrypoint.sh
@@ -33,21 +34,12 @@ ENV PATTERN="" \
     WAZUH_VERSION_REPLICAS="" \
     IP_SELECTOR="" \
     IP_IGNORE="" \
-    XPACK_RBAC_ENABLED="" \
     WAZUH_MONITORING_ENABLED="" \
     WAZUH_MONITORING_FREQUENCY="" \
     WAZUH_MONITORING_SHARDS="" \
     WAZUH_MONITORING_REPLICAS="" \
     ADMIN_PRIVILEGES=""
 
-ARG XPACK_CANVAS="true"
-ARG XPACK_LOGS="true"
-ARG XPACK_INFRA="true"
-ARG XPACK_ML="true"
-ARG XPACK_DEVTOOLS="true"
-ARG XPACK_MONITORING="true"
-ARG XPACK_APM="true"
-
 ARG CHANGE_WELCOME="false"
 
 COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./
@@ -58,18 +50,12 @@ COPY --chown=kibana:kibana ./config/kibana_settings.sh ./
 
 RUN chmod +x ./kibana_settings.sh
 
-COPY --chown=kibana:kibana ./config/xpack_config.sh ./
-
-RUN chmod +x ./xpack_config.sh
-
-RUN ./xpack_config.sh
-
 COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./
 
 RUN chmod +x ./welcome_wazuh.sh
 
 RUN ./welcome_wazuh.sh
 USER kibana
-RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize
+RUN /usr/local/bin/kibana-docker --optimize
 
 ENTRYPOINT ./entrypoint.sh

kibana/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 
@@ -13,13 +13,7 @@ else
   el_url="${ELASTICSEARCH_URL}"
 fi
 
-if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then
+until curl -XGET $el_url; do
-  auth=""
-else
-  auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"
-fi
-
-until curl -XGET $el_url ${auth}; do
   >&2 echo "Elastic is unavailable - sleeping"
   sleep 5
 done

kibana/config/kibana_settings.sh

@@ -1,12 +1,12 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 WAZUH_MAJOR=3
 
 ##############################################################################
 # Wait for the Kibana API to start. It is necessary to do it in this container
-# because the others are running Elastic Stack and we can not interrupt them.
+# because the others are running Elastic Stack and we can not interrupt them. 
-#
+# 
 # The following actions are performed:
 #
 # Add the wazuh alerts index as default.
@@ -30,31 +30,18 @@ if [ "$KIBANA_INDEX" != "" ]; then
     echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml
 fi
 
-# If XPACK_SECURITY_ENABLED was set, then change the xpack.security.enabled option from true (default) to false.
-if [ "$XPACK_SECURITY_ENABLED" != "" ]; then
-  if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then
-    sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml
-  fi
-    echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml
-fi
-
 if [ "$KIBANA_IP" != "" ]; then
   kibana_ip="$KIBANA_IP"
 else
   kibana_ip="kibana"
 fi
 
-# Add auth headers if required
+while [[ "$(curl -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
-if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then
-    curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD"
-fi
-
-while [[ "$(curl $curl_auth -XGET -I  -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do
   echo "Waiting for Kibana API. Sleeping 5 seconds"
   sleep 5
 done
 
-# Prepare index selection.
+# Prepare index selection. 
 echo "Kibana API is running"
 
 default_index="/tmp/default_index.json"

kibana/config/wazuh_app_config.sh

@@ -1,14 +1,12 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"
 api_user="${API_USER:-foo}"
 api_password="${API_PASS:-bar}"
 
-kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
+kibana_config_file="/usr/share/kibana/plugins/wazuh/wazuh.yml"
-mkdir -p /usr/share/kibana/optimize/wazuh/config/
-touch $kibana_config_file
 
 declare -A CONFIG_MAP=(
   [pattern]=$PATTERN
@@ -31,7 +29,6 @@ declare -A CONFIG_MAP=(
   [wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS
   [ip.selector]=$IP_SELECTOR
   [ip.ignore]=$IP_IGNORE
-  [xpack.rbac.enabled]=$XPACK_RBAC_ENABLED
   [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED
   [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY
   [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS
@@ -49,14 +46,13 @@ done
 # remove default API entry (new in 3.11.0_7.5.1)
 sed -ie '/- default:/,+4d' $kibana_config_file
 
-CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth})
+CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013)
 
 grep -q 1513629884013 $kibana_config_file
 _config_exists=$?
 
 if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then
-cat << EOF > $kibana_config_file
+cat << EOF >> $kibana_config_file 
-hosts:
   - 1513629884013:
       url: $wazuh_url
       port: $wazuh_port

kibana/config/welcome_wazuh.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 if [[ $CHANGE_WELCOME == "true" ]]
 then
@@ -21,3 +21,4 @@ then
     sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js
     sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js
 fi
+

kibana/config/xpack_config.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
-
-kibana_config_file="/usr/share/kibana/config/kibana.yml"
-if grep -Fq  "#xpack features" "$kibana_config_file";
-then
-  declare -A CONFIG_MAP=(
-    [xpack.apm.ui.enabled]=$XPACK_APM
-    [xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS
-    [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS
-    [xpack.ml.enabled]=$XPACK_ML
-    [xpack.canvas.enabled]=$XPACK_CANVAS
-    [xpack.infra.enabled]=$XPACK_INFRA
-    [monitoring.enabled]=$XPACK_MONITORING
-    [console.enabled]=$XPACK_DEVTOOLS
-  )
-  for i in "${!CONFIG_MAP[@]}"
-  do
-    if [ "${CONFIG_MAP[$i]}" != "" ]; then
-      sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file
-    fi
-  done
-else
-  echo "
-#xpack features
-xpack.apm.ui.enabled: $XPACK_APM
-xpack.grokdebugger.enabled: $XPACK_DEVTOOLS
-xpack.searchprofiler.enabled: $XPACK_DEVTOOLS
-xpack.ml.enabled: $XPACK_ML
-xpack.canvas.enabled: $XPACK_CANVAS
-xpack.infra.enabled: $XPACK_INFRA
-xpack.monitoring.enabled: $XPACK_MONITORING
-console.enabled: $XPACK_DEVTOOLS
-" >> $kibana_config_file
-fi

nginx/Dockerfile

@@ -1,4 +1,4 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 FROM nginx:latest
 
 ENV DEBIAN_FRONTEND noninteractive
@@ -16,4 +16,4 @@ VOLUME ["/etc/nginx/conf.d"]
 ENV NGINX_NAME="foo" \
     NGINX_PWD="bar"
 
-ENTRYPOINT [ "/entrypoint.sh" ]
+ENTRYPOINT /entrypoint.sh

nginx/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 
@@ -30,14 +30,14 @@ if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
     do
       IFS=':' read -r -a credentials <<< "${users[index]}"
       if [ $index -eq 0 ]; then
-        htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null
+        echo ${credentials[1]}|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} >/dev/null
       else
-        htpasswd -b /etc/nginx/conf.d/kibana.htpasswd  ${credentials[0]} ${credentials[1]} >/dev/null
+        echo ${credentials[1]}|htpasswd -i /etc/nginx/conf.d/kibana.htpasswd  ${credentials[0]} >/dev/null
       fi
     done
   else
-    # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile
+    # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile 
-    htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null
+    echo $NGINX_PWD|htpasswd -i -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME >/dev/null
   fi
 else
   echo "Kibana credentials already configured"
@@ -52,19 +52,17 @@ if [ "x${KIBANA_HOST}" = "x" ]; then
 fi
 
 echo "Configuring NGINX"
-
-
-if [ "${NGINX_PORT}" = "443" ]; then
 cat > /etc/nginx/conf.d/default.conf <<EOF
 server {
     listen 80;
     listen [::]:80;
-    return 301 https://\$host\$request_uri;
+    return 301 https://\$host:${NGINX_PORT}\$request_uri;
 }
 
 server {
-    listen ${NGINX_PORT} default_server ssl http2;
+    listen ${NGINX_PORT} default_server;
-    listen [::]:${NGINX_PORT} ssl http2;
+    listen [::]:${NGINX_PORT};
+    ssl on;
     ssl_certificate /etc/nginx/conf.d/ssl/certs/kibana-access.pem;
     ssl_certificate_key /etc/nginx/conf.d/ssl/private/kibana-access.key;
     location / {
@@ -77,21 +75,5 @@ server {
     }
 }
 EOF
-else
-cat > /etc/nginx/conf.d/default.conf <<EOF
-server {
-    listen ${NGINX_PORT};
-    listen [::]:${NGINX_PORT};
-    location / {
-        auth_basic "Restricted";
-        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
-        proxy_pass http://${KIBANA_HOST}/;
-        proxy_buffer_size          128k;
-        proxy_buffers              4 256k;
-        proxy_busy_buffers_size    256k;
-    }
-}
-EOF
-fi
 
-exec nginx -g 'daemon off;'
+nginx -g 'daemon off;'

wazuh/Dockerfile

@@ -1,14 +1,14 @@
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM phusion/baseimage:0.10.2
+FROM phusion/baseimage:latest
 
-ARG FILEBEAT_VERSION=7.9.2
+ARG FILEBEAT_VERSION=7.5.1
 
-ARG WAZUH_VERSION=3.13.6-1
+ARG WAZUH_VERSION=3.11.2-1
 
 ENV API_USER="foo" \
    API_PASS="bar"
 
-ARG TEMPLATE_VERSION="v3.13.6"
+ARG TEMPLATE_VERSION="v3.11.2"
 
 # Set repositories.
 RUN set -x && echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list && \
@@ -38,8 +38,8 @@ COPY config/01-config_filebeat.sh /entrypoint-scripts/01-config_filebeat.sh
 RUN chmod 755 /init.bash && \
    sync && /init.bash && \
    sync && rm /init.bash && \
-   curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-amd64.deb &&\
+   curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-${FILEBEAT_VERSION}-amd64.deb &&\
-   dpkg -i filebeat-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-${FILEBEAT_VERSION}-amd64.deb && \
+   dpkg -i filebeat-oss-${FILEBEAT_VERSION}-amd64.deb && rm -f filebeat-oss-${FILEBEAT_VERSION}-amd64.deb && \
    chmod 755 /entrypoint.sh && \
    chmod 755 /entrypoint-scripts/00-wazuh.sh && \
    chmod 755 /entrypoint-scripts/01-config_filebeat.sh
@@ -70,14 +70,11 @@ COPY config/filebeat.runit.service /etc/service/filebeat/run
 RUN chmod +x /etc/service/wazuh-api/run && \
    chmod +x /etc/service/wazuh/run && \
    chmod +x /etc/service/postfix/run && \
-   chmod +x /etc/service/filebeat/run
+   chmod +x /etc/service/filebeat/run 
 
 
 ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat
-RUN chmod go-w /etc/filebeat/wazuh-template.json
+RUN chmod go-w /etc/filebeat/wazuh-template.json 
-
-ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz"
-RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module
 
 # Run all services
 ENTRYPOINT ["/entrypoint.sh"]

wazuh/config/00-wazuh.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 # Wazuh container bootstrap. See the README for information of the environment
 # variables expected by this script.
@@ -50,15 +50,7 @@ if [  -e ${WAZUH_INSTALL_PATH}/etc-template  ]
 then
     cp -p /var/ossec/etc-template/internal_options.conf /var/ossec/etc/internal_options.conf
 fi
-
+rm /var/ossec/queue/db/.template.db
-# copy missing files from queue-template (in case this is an upgrade from previous versions)
-for filename in /var/ossec/queue-template/*; do
-  fname=$(basename $filename)
-  echo $fname
-  if test ! -e "/var/ossec/data/queue/$fname"; then
-    cp -rp "/var/ossec/queue-template/$fname" /var/ossec/data/queue/
-  fi
-done
 
 touch ${DATA_PATH}/process_list
 chgrp ossec ${DATA_PATH}/process_list
@@ -127,7 +119,6 @@ sed -i 's/<node_name>to_be_replaced_by_hostname<\/node_name>/<node_name>'"${HOST
 trap "ossec_shutdown; exit" SIGINT SIGTERM
 
 chmod -R g+rw ${DATA_PATH}
-chmod 750 /var/ossec/agentless/*
 
 ##############################################################################
 # Interpret any passed arguments (via docker command to this entrypoint) as
@@ -152,4 +143,4 @@ echo "Change Wazuh API user credentials"
 change_user="node htpasswd -b -c user $API_USER $API_PASS"
 eval $change_user
 
-popd
+popd

wazuh/config/01-config_filebeat.sh

@@ -1,10 +1,19 @@
 #!/bin/bash
-# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh App Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 set -e
 
+WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz
+
 # Modify the output to Elasticsearch if th ELASTICSEARCH_URL is set
 if [ "$ELASTICSEARCH_URL" != "" ]; then
   >&2 echo "Customize Elasticsearch ouput IP."
   sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml
 fi
+
+# Install Wazuh Filebeat Module
+
+curl -s "https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE}" | tar -xvz -C /usr/share/filebeat/module
+mkdir -p /usr/share/filebeat/module/wazuh
+chmod 755 -R /usr/share/filebeat/module/wazuh
+

wazuh/config/data_dirs.env

@@ -2,7 +2,14 @@ i=0
 DATA_DIRS[((i++))]="api/configuration"
 DATA_DIRS[((i++))]="etc"
 DATA_DIRS[((i++))]="logs"
-DATA_DIRS[((i++))]="queue"
+DATA_DIRS[((i++))]="queue/db"
-DATA_DIRS[((i++))]="agentless"
+DATA_DIRS[((i++))]="queue/rootcheck"
+DATA_DIRS[((i++))]="queue/agent-groups"
+DATA_DIRS[((i++))]="queue/agent-info"
+DATA_DIRS[((i++))]="queue/agents-timestamp"
+DATA_DIRS[((i++))]="queue/agentless"
+DATA_DIRS[((i++))]="queue/cluster"
+DATA_DIRS[((i++))]="queue/rids"
+DATA_DIRS[((i++))]="queue/fts"
 DATA_DIRS[((i++))]="var/multigroups"
 export DATA_DIRS

wazuh/config/entrypoint.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 # It will run every .sh script located in entrypoint-scripts folder in lexicographical order
 for script in `ls /entrypoint-scripts/*.sh | sort -n`; do
@@ -11,4 +11,4 @@ done
 # Start Wazuh Server.
 ##############################################################################
 
-/sbin/my_init
+/sbin/my_init 

wazuh/config/filebeat.runit.service

@@ -1,4 +1,4 @@
 #!/bin/sh
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 service filebeat start
 tail -f /var/log/filebeat/filebeat

wazuh/config/init.bash

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 
 # Initialize the custom data directory layout
 source /data_dirs.env

wazuh/config/postfix.runit.service

@@ -1,4 +1,4 @@
 #!/bin/sh
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 service postfix start
 tail -f /var/log/mail.log

wazuh/config/wazuh-api.runit.service

@@ -1,4 +1,5 @@
 #!/bin/sh
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 service wazuh-api start
 tail -f /var/ossec/data/logs/api.log
+

wazuh/config/wazuh.runit.service

@@ -1,4 +1,5 @@
 #!/bin/sh
-# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2)
+# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
 service wazuh-manager start
 tail -f /var/ossec/data/logs/ossec.log
+