mirror of
				https://github.com/wazuh/wazuh-docker.git
				synced 2025-10-29 02:53:33 +00:00 
			
		
		
		
	Compare commits
	
		
			120 Commits
		
	
	
		
	
	| Author | SHA1 | Date | |
|---|---|---|---|
|  | ded91b2f0a | ||
|  | d7e051af19 | ||
|  | 93c53a712d | ||
|  | 5f3a0481ba | ||
|  | 088b855f73 | ||
|  | 41515e9c49 | ||
|  | 0fbbf5aee2 | ||
|  | 37f565bb8a | ||
|  | 2ac53b9b3d | ||
|  | d1c252c6c0 | ||
|  | e9f689dbfc | ||
|  | be19c70082 | ||
|  | 1fae0d3452 | ||
|  | 0a4c057492 | ||
|  | 2902a0ce0b | ||
|  | c0fb4172f3 | ||
|  | 8886e2347e | ||
|  | f1d8565989 | ||
|  | e5abd5d24e | ||
|  | 902b0d8e52 | ||
|  | c0d97893a4 | ||
|  | 0826f2c176 | ||
|  | d531b8dd72 | ||
|  | 41267d4ddf | ||
|  | 67f34fb8fe | ||
|  | 865f7625f4 | ||
|  | c56952eaa0 | ||
|  | cb7d8785c6 | ||
|  | f1001c2f25 | ||
|  | 216b5a6818 | ||
|  | e19fa14013 | ||
|  | 57c7eaa5af | ||
|  | fbe073612c | ||
|  | 32b1d88e36 | ||
|  | 94be842afc | ||
|  | d20bbe247c | ||
|  | e01d39e138 | ||
|  | 1eeca6267b | ||
|  | d755ffbac8 | ||
|  | 221c3ccd24 | ||
|  | 1ff589ccaf | ||
|  | d4c98491fc | ||
|  | 673c28b637 | ||
|  | da82008a75 | ||
|  | 54975ab099 | ||
|  | 1a75d4eb77 | ||
|  | 247555b1b6 | ||
|  | 442d457933 | ||
|  | 0f65448718 | ||
|  | a9533264d6 | ||
|  | ce8dd29425 | ||
|  | a433989865 | ||
|  | ff1e5f991a | ||
|  | 55ee49aff5 | ||
|  | 75f92308a1 | ||
|  | 61c37a78de | ||
|  | 39208c513c | ||
|  | 3650feeb0e | ||
|  | 2340db4079 | ||
|  | 9159eda943 | ||
|  | d278782134 | ||
|  | 77725b7eb2 | ||
|  | 4e7c2cf72a | ||
|  | 41196a5529 | ||
|  | 8ce1f36f10 | ||
|  | e2e95a5c57 | ||
|  | b259665fc6 | ||
|  | 820079f1d0 | ||
|  | 028b5f6034 | ||
|  | cd7dc4c7cf | ||
|  | 40faad148d | ||
|  | 02aaf45e9d | ||
|  | cd9f211eb3 | ||
|  | 20c8000fec | ||
|  | 8ada4445b0 | ||
|  | 1c69a38bd8 | ||
|  | 615d6df29c | ||
|  | 949a465855 | ||
|  | f7bbac5a08 | ||
|  | 11820b01e9 | ||
|  | a8de452002 | ||
|  | c76681b3b9 | ||
|  | e25635cb25 | ||
|  | 304eedcb51 | ||
|  | 6123ab994c | ||
|  | 2f58da59de | ||
|  | 3279931813 | ||
|  | b039567e1c | ||
|  | 3190c4246e | ||
|  | 271f421cd4 | ||
|  | 910e28956b | ||
|  | dcf8bb8060 | ||
|  | be9f3d1b90 | ||
|  | 91625f412c | ||
|  | 4c7dcb2ebf | ||
|  | 8febf33d58 | ||
|  | 3d19774d7e | ||
|  | e11e7a10b8 | ||
|  | 7f73635651 | ||
|  | e9a0be25ce | ||
|  | 6c094d07a6 | ||
|  | b6959c8b15 | ||
|  | b98d32d4ca | ||
|  | 4c710e6c20 | ||
|  | f97a719304 | ||
|  | bf534b4143 | ||
|  | a82cc9ec39 | ||
|  | 8d9ad6152a | ||
|  | 5555c1dd06 | ||
|  | 0dd044de68 | ||
|  | 5d88983066 | ||
|  | 95565df2f5 | ||
|  | ed5c5d70ba | ||
|  | 97f5a6bf04 | ||
|  | b21c3769d3 | ||
|  | 9cd399c2df | ||
|  | 3e54eeb62f | ||
|  | a4be008028 | ||
|  | 85e62cfd0e | ||
|  | 84fe19e868 | 
							
								
								
									
										4
									
								
								.env
									
									
									
									
									
								
							
							
						
						
									
										4
									
								
								.env
									
									
									
									
									
								
							| @@ -1,3 +1,3 @@ | ||||
| WAZUH_VERSION=4.3.11 | ||||
| WAZUH_IMAGE_VERSION=4.3.11 | ||||
| WAZUH_VERSION=4.5.3 | ||||
| WAZUH_IMAGE_VERSION=4.5.3 | ||||
| WAZUH_TAG_REVISION=1 | ||||
|   | ||||
							
								
								
									
										2
									
								
								.github/.goss.yaml
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										2
									
								
								.github/.goss.yaml
									
									
									
									
										vendored
									
									
								
							| @@ -56,7 +56,7 @@ package: | ||||
|   wazuh-manager: | ||||
|     installed: true | ||||
|     versions: | ||||
|     - 4.3.11-1 | ||||
|     - 4.5.3-1 | ||||
| port: | ||||
|   tcp:1514: | ||||
|     listening: true | ||||
|   | ||||
							
								
								
									
										6
									
								
								.github/workflows/push.yml
									
									
									
									
										vendored
									
									
								
							
							
						
						
									
										6
									
								
								.github/workflows/push.yml
									
									
									
									
										vendored
									
									
								
							| @@ -126,7 +126,7 @@ jobs: | ||||
|  | ||||
|     - name: Check documents into wazuh-alerts index | ||||
|       run: | | ||||
|        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" | ||||
|        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" | ||||
|        if [[ $docs -gt 100 ]]; then | ||||
|         echo "wazuh-alerts index documents: ${docs}" | ||||
|        else | ||||
| @@ -250,8 +250,8 @@ jobs: | ||||
|  | ||||
|     - name: Check documents into wazuh-alerts index | ||||
|       run: | | ||||
|        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_doc/_search" -u admin:SecretPassword -k -s | jq -r ".hits.total.value"`" | ||||
|        if [[ $docs -gt 200 ]]; then | ||||
|        docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" | ||||
|        if [[ $docs -gt 100 ]]; then | ||||
|         echo "wazuh-alerts index documents: ${docs}" | ||||
|        else | ||||
|         echo "wazuh-alerts index documents: ${docs}" | ||||
|   | ||||
							
								
								
									
										50
									
								
								CHANGELOG.md
									
									
									
									
									
								
							
							
						
						
									
										50
									
								
								CHANGELOG.md
									
									
									
									
									
								
							| @@ -1,6 +1,56 @@ | ||||
| # Change Log | ||||
| All notable changes to this project will be documented in this file. | ||||
|  | ||||
| ## Wazuh Docker v4.5.3 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.5.3](https://github.com/wazuh/wazuh/blob/v4.5.3/CHANGELOG.md#v453) | ||||
|  | ||||
| ## Wazuh Docker v4.5.2 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.5.2](https://github.com/wazuh/wazuh/blob/v4.5.2/CHANGELOG.md#v452) | ||||
|  | ||||
| ## Wazuh Docker v4.5.1 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.5.1](https://github.com/wazuh/wazuh/blob/v4.5.1/CHANGELOG.md#v451) | ||||
|  | ||||
| ## Wazuh Docker v4.5.0 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.5.0](https://github.com/wazuh/wazuh/blob/v4.5.0/CHANGELOG.md#v450) | ||||
|  | ||||
| ## Wazuh Docker v4.4.5 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.5](https://github.com/wazuh/wazuh/blob/v4.4.5/CHANGELOG.md#v445) | ||||
|  | ||||
| ## Wazuh Docker v4.4.4 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.4](https://github.com/wazuh/wazuh/blob/v4.4.4/CHANGELOG.md#v444) | ||||
|  | ||||
| ## Wazuh Docker v4.4.3 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.3](https://github.com/wazuh/wazuh/blob/v4.4.3/CHANGELOG.md#v443) | ||||
|  | ||||
| ## Wazuh Docker v4.4.2 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.2](https://github.com/wazuh/wazuh/blob/v4.4.2/CHANGELOG.md#v442) | ||||
|  | ||||
| ## Wazuh Docker v4.4.1 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.1](https://github.com/wazuh/wazuh/blob/v4.4.1/CHANGELOG.md#v441) | ||||
|  | ||||
| ## Wazuh Docker v4.4.0 | ||||
| ### Added | ||||
|  | ||||
| - Update Wazuh to version [4.4.0](https://github.com/wazuh/wazuh/blob/v4.4.0/CHANGELOG.md#v440) | ||||
|  | ||||
| ## Wazuh Docker v4.3.11 | ||||
| ### Added | ||||
|  | ||||
|   | ||||
							
								
								
									
										10
									
								
								README.md
									
									
									
									
									
								
							
							
						
						
									
										10
									
								
								README.md
									
									
									
									
									
								
							| @@ -195,6 +195,16 @@ WAZUH_MONITORING_REPLICAS=0         ## | ||||
|  | ||||
| | Wazuh version | ODFE    | XPACK  | | ||||
| |---------------|---------|--------| | ||||
| | v4.5.3        |         |        | | ||||
| | v4.5.2        |         |        | | ||||
| | v4.5.1        |         |        | | ||||
| | v4.5.0        |         |        | | ||||
| | v4.4.5        |         |        | | ||||
| | v4.4.4        |         |        | | ||||
| | v4.4.3        |         |        | | ||||
| | v4.4.2        |         |        | | ||||
| | v4.4.1        |         |        | | ||||
| | v4.4.0        |         |        | | ||||
| | v4.3.11       |         |        | | ||||
| | v4.3.10       |         |        | | ||||
| | v4.3.9        |         |        | | ||||
|   | ||||
							
								
								
									
										4
									
								
								VERSION
									
									
									
									
									
								
							
							
						
						
									
										4
									
								
								VERSION
									
									
									
									
									
								
							| @@ -1,2 +1,2 @@ | ||||
| WAZUH-DOCKER_VERSION="4.3.11" | ||||
| REVISION="40324" | ||||
| WAZUH-DOCKER_VERSION="4.5.3" | ||||
| REVISION="40508" | ||||
|   | ||||
| @@ -1,14 +1,8 @@ | ||||
| WAZUH_IMAGE_VERSION=4.3.11 | ||||
| WAZUH_IMAGE_VERSION=4.5.3 | ||||
| WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') | ||||
| WAZUH_TAG_REVISION=1 | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') | ||||
|  | ||||
| ## If wazuh manager exists in apt dev repository, change variables, if not, exit 1 | ||||
| if [ "$WAZUH_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then | ||||
|   IMAGE_VERSION=${WAZUH_IMAGE_VERSION} | ||||
| else | ||||
|   IMAGE_VERSION=${WAZUH_IMAGE_VERSION} | ||||
| fi | ||||
| IMAGE_VERSION=${WAZUH_IMAGE_VERSION} | ||||
|  | ||||
| echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env | ||||
| echo WAZUH_IMAGE_VERSION=$IMAGE_VERSION >> .env | ||||
|   | ||||
| @@ -102,6 +102,10 @@ RUN chown 1000:1000 /*.sh | ||||
| # Copy Install dir from builder to current image | ||||
| COPY --from=builder --chown=1000:1000 $INSTALL_DIR $INSTALL_DIR | ||||
|  | ||||
| # Create custom directory | ||||
| RUN mkdir -p /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom | ||||
| RUN chown 1000:1000 /usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom | ||||
|  | ||||
| # Set workdir and user | ||||
| WORKDIR $INSTALL_DIR | ||||
| USER wazuh-dashboard | ||||
|   | ||||
| @@ -9,8 +9,8 @@ export CONFIG_DIR=${INSTALLATION_DIR}/config | ||||
|  | ||||
| ## Variables | ||||
| CERT_TOOL=wazuh-certs-tool.sh | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.3/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.5/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ | ||||
|  | ||||
| ## Check if the cert tool exists in S3 buckets | ||||
| CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}') | ||||
|   | ||||
| @@ -1,12 +1,25 @@ | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') && \ | ||||
| WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') && \ | ||||
| REPOSITORY="packages.wazuh.com/4.x" | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) | ||||
| MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) | ||||
| MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) | ||||
| MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) | ||||
| MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) | ||||
| MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) | ||||
| MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) | ||||
|  | ||||
|  | ||||
| if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then | ||||
|  REPOSITORY="packages.wazuh.com" | ||||
| else  | ||||
|  REPOSITORY="packages-dev.wazuh.com" | ||||
| ## check version to use the correct repository | ||||
| if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then | ||||
|   REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
| elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then | ||||
|   if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then | ||||
|     REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
|   elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then | ||||
|     if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then | ||||
|       REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
|     fi | ||||
|   fi | ||||
| fi | ||||
|   | ||||
| curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/base/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz | ||||
|  | ||||
|  | ||||
| curl -o wazuh-dashboard-base.tar.xz https://${REPOSITORY}/stack/dashboard/wazuh-dashboard-base-${WAZUH_VERSION}-${WAZUH_TAG_REVISION}-linux-x64.tar.xz | ||||
| tar -xf wazuh-dashboard-base.tar.xz --directory  $INSTALL_DIR --strip-components=1 | ||||
|   | ||||
| @@ -1,11 +1,24 @@ | ||||
| ## Variables | ||||
| WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') | ||||
| ## If wazuh manager exists in apt dev repository, change variables, if not exit 1 | ||||
| if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then | ||||
|   WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip | ||||
| else | ||||
| ## variables | ||||
| WAZUH_APP=https://packages.wazuh.com/4.x/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) | ||||
| MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) | ||||
| MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) | ||||
| MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) | ||||
| MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) | ||||
| MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) | ||||
| MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) | ||||
|  | ||||
| ## check version to use the correct repository | ||||
| if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then | ||||
|   WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip | ||||
| elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then | ||||
|   if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then | ||||
|     WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip | ||||
|   elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then | ||||
|     if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then | ||||
|       WAZUH_APP=https://packages-dev.wazuh.com/pre-release/ui/dashboard/wazuh-${WAZUH_VERSION}-${WAZUH_UI_REVISION}.zip | ||||
|     fi | ||||
|   fi | ||||
| fi | ||||
|  | ||||
| # Install Wazuh App | ||||
|   | ||||
| @@ -59,14 +59,15 @@ COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/systemd /usr/lib/s | ||||
| COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/sysctl.d /usr/lib/sysctl.d | ||||
| COPY --from=builder --chown=0:0 /debian/wazuh-indexer/usr/lib/tmpfiles.d /usr/lib/tmpfiles.d | ||||
|  | ||||
| RUN chown -R 1000:1000 /usr/share/wazuh-indexer | ||||
|  | ||||
| RUN mkdir -p /var/lib/wazuh-indexer && chown 1000:1000 /var/lib/wazuh-indexer && \ | ||||
|     mkdir -p /usr/share/wazuh-indexer/logs && chown 1000:1000 /usr/share/wazuh-indexer/logs && \ | ||||
|     mkdir -p /run/wazuh-indexer && chown 1000:1000 /run/wazuh-indexer && \ | ||||
|     mkdir -p /var/log/wazuh-indexer && chown 1000:1000 /var/log/wazuh-indexer && \ | ||||
|     chmod 700 /usr/share/wazuh-indexer/config && \ | ||||
|     chmod 600 /usr/share/wazuh-indexer/config/jvm.options && \ | ||||
|     chmod 600 /usr/share/wazuh-indexer/config/opensearch.yml | ||||
|     chmod 700 /usr/share/wazuh-indexer && \ | ||||
|     chmod 600 /usr/share/wazuh-indexer/jvm.options && \ | ||||
|     chmod 600 /usr/share/wazuh-indexer/opensearch.yml | ||||
|  | ||||
| USER wazuh-indexer | ||||
|  | ||||
|   | ||||
| @@ -4,8 +4,6 @@ export DH_OPTIONS | ||||
|  | ||||
| export NAME=wazuh-indexer | ||||
| export TARGET_DIR=${CURDIR}/debian/${NAME} | ||||
| export WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') | ||||
| export WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') | ||||
|  | ||||
| # Package build options | ||||
| export USER=${NAME} | ||||
| @@ -15,7 +13,7 @@ export LOG_DIR=/var/log/${NAME} | ||||
| export LIB_DIR=/var/lib/${NAME} | ||||
| export PID_DIR=/run/${NAME} | ||||
| export INSTALLATION_DIR=/usr/share/${NAME} | ||||
| export CONFIG_DIR=${INSTALLATION_DIR}/config | ||||
| export CONFIG_DIR=${INSTALLATION_DIR} | ||||
| export BASE_DIR=${NAME}-* | ||||
| export INDEXER_FILE=wazuh-indexer-base.tar.xz | ||||
| export BASE_FILE=wazuh-indexer-base-${VERSION}-linux-x64.tar.xz | ||||
| @@ -23,13 +21,31 @@ export REPO_DIR=/unattended_installer | ||||
|  | ||||
| rm -rf ${INSTALLATION_DIR}/ | ||||
|  | ||||
| if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then | ||||
|  REPOSITORY="packages.wazuh.com" | ||||
| else | ||||
|  REPOSITORY="packages-dev.wazuh.com" | ||||
| ## variables | ||||
| REPOSITORY="packages.wazuh.com/4.x" | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) | ||||
| MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) | ||||
| MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) | ||||
| MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) | ||||
| MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) | ||||
| MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) | ||||
| MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) | ||||
|  | ||||
| ## check version to use the correct repository | ||||
| if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then | ||||
|   REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
| elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then | ||||
|   if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then | ||||
|     REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
|   elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then | ||||
|     if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then | ||||
|       REPOSITORY="packages-dev.wazuh.com/pre-release" | ||||
|     fi | ||||
|   fi | ||||
| fi | ||||
|  | ||||
| curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/base/${BASE_FILE} | ||||
|  | ||||
| curl -o ${INDEXER_FILE} https://${REPOSITORY}/stack/indexer/${BASE_FILE} | ||||
| tar -xf ${INDEXER_FILE} | ||||
|  | ||||
| ## TOOLS | ||||
| @@ -37,8 +53,8 @@ tar -xf ${INDEXER_FILE} | ||||
| ## Variables | ||||
| CERT_TOOL=wazuh-certs-tool.sh | ||||
| PASSWORD_TOOL=wazuh-passwords-tool.sh | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.3/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.5/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ | ||||
|  | ||||
| ## Check if the cert tool exists in S3 buckets | ||||
| CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}') | ||||
| @@ -77,6 +93,7 @@ chmod 755 $CERT_TOOL && bash /$CERT_TOOL -A | ||||
|  | ||||
| # copy to target | ||||
| mkdir -p ${TARGET_DIR}${INSTALLATION_DIR} | ||||
| mkdir -p ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ | ||||
| mkdir -p ${TARGET_DIR}${CONFIG_DIR} | ||||
| mkdir -p ${TARGET_DIR}${LIB_DIR} | ||||
| mkdir -p ${TARGET_DIR}${LOG_DIR} | ||||
| @@ -101,9 +118,9 @@ cp -pr ${BASE_DIR}/* ${TARGET_DIR}${INSTALLATION_DIR} | ||||
| cp /$CERT_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ | ||||
| cp /$PASSWORD_TOOL ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/tools/ | ||||
| # Copy Wazuh's config files for the security plugin | ||||
| cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ | ||||
| cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ | ||||
| cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/plugins/opensearch-security/securityconfig/ | ||||
| cp -pr /roles_mapping.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ | ||||
| cp -pr /roles.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ | ||||
| cp -pr /internal_users.yml ${TARGET_DIR}${INSTALLATION_DIR}/opensearch-security/ | ||||
| cp -pr /opensearch.yml ${TARGET_DIR}${CONFIG_DIR} | ||||
| # Copy Wazuh indexer's certificates | ||||
| cp -pr /wazuh-certificates/demo.indexer.pem ${TARGET_DIR}${CONFIG_DIR}/certs/indexer.pem | ||||
|   | ||||
| @@ -6,7 +6,7 @@ umask 0002 | ||||
|  | ||||
| export USER=wazuh-indexer | ||||
| export INSTALLATION_DIR=/usr/share/wazuh-indexer | ||||
| export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config | ||||
| export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR} | ||||
| export JAVA_HOME=${INSTALLATION_DIR}/jdk | ||||
| export DISCOVERY=$(grep -oP "(?<=discovery.type: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) | ||||
| export CACERT=$(grep -oP "(?<=plugins.security.ssl.transport.pemtrustedcas_filepath: ).*" ${OPENSEARCH_PATH_CONF}/opensearch.yml) | ||||
| @@ -59,7 +59,7 @@ if [[ -f bin/opensearch-users ]]; then | ||||
|   # enabled, but we have no way of knowing which node we are yet. We'll just | ||||
|   # honor the variable if it's present. | ||||
|   if [[ -n "$INDEXER_PASSWORD" ]]; then | ||||
|     [[ -f /usr/share/wazuh-indexer/config/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) | ||||
|     [[ -f /usr/share/wazuh-indexer/opensearch.keystore ]] || (run_as_other_user_if_needed opensearch-keystore create) | ||||
|     if ! (run_as_other_user_if_needed opensearch-keystore has-passwd --silent) ; then | ||||
|       # keystore is unencrypted | ||||
|       if ! (run_as_other_user_if_needed opensearch-keystore list | grep -q '^bootstrap.password$'); then | ||||
| @@ -84,10 +84,10 @@ if [[ "$(id -u)" == "0" ]]; then | ||||
| fi | ||||
|  | ||||
|  | ||||
| if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then | ||||
| #if [[ "$DISCOVERY" == "single-node" ]] && [[ ! -f "/var/lib/wazuh-indexer/.flag" ]]; then | ||||
|   # run securityadmin.sh for single node with CACERT, CERT and KEY parameter | ||||
|   nohup /securityadmin.sh & | ||||
|   touch "/var/lib/wazuh-indexer/.flag" | ||||
| fi | ||||
| #  nohup /securityadmin.sh & | ||||
| #  touch "/var/lib/wazuh-indexer/.flag" | ||||
| #fi | ||||
|  | ||||
| run_as_other_user_if_needed /usr/share/wazuh-indexer/bin/opensearch <<<"$KEYSTORE_PASSWORD" | ||||
| @@ -4,12 +4,12 @@ path.data: /var/lib/wazuh-indexer | ||||
| path.logs: /var/log/wazuh-indexer | ||||
| discovery.type: single-node | ||||
| compatibility.override_main_response_version: true | ||||
| plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem | ||||
| plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem | ||||
| plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem | ||||
| plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer.pem | ||||
| plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/indexer-key.pem | ||||
| plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem | ||||
| plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem | ||||
| plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem | ||||
| plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem | ||||
| plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/indexer.pem | ||||
| plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/indexer-key.pem | ||||
| plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem | ||||
| plugins.security.ssl.http.enabled: true | ||||
| plugins.security.ssl.transport.enforce_hostname_verification: false | ||||
| plugins.security.ssl.transport.resolve_hostname: false | ||||
|   | ||||
| @@ -1,3 +1,3 @@ | ||||
| # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) | ||||
| sleep 30 | ||||
| bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9300 -icl | ||||
| bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9200 -icl | ||||
| @@ -5,7 +5,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh | ||||
|  | ||||
| ARG WAZUH_VERSION | ||||
| ARG WAZUH_TAG_REVISION | ||||
| ARG TEMPLATE_VERSION=4.3 | ||||
| ARG TEMPLATE_VERSION=4.5 | ||||
| ARG FILEBEAT_CHANNEL=filebeat-oss | ||||
| ARG FILEBEAT_VERSION=7.10.2 | ||||
| ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.2.tar.gz" | ||||
| @@ -24,8 +24,6 @@ RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/${FILEBEAT_ | ||||
|     dpkg -i ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && rm -f ${FILEBEAT_CHANNEL}-${FILEBEAT_VERSION}-amd64.deb && \ | ||||
|     curl -s https://packages.wazuh.com/4.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module | ||||
|  | ||||
| RUN curl -L https://github.com/aelsabbahy/goss/releases/latest/download/goss-linux-amd64 -o /usr/local/bin/goss && chmod +rx /usr/local/bin/goss | ||||
|  | ||||
| ARG S6_VERSION="v2.2.0.3" | ||||
| RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ | ||||
|     -o /tmp/s6-overlay-amd64.tar.gz && \ | ||||
|   | ||||
| @@ -1,13 +1,29 @@ | ||||
| ## Variables | ||||
| WAZUH_IMAGE_VERSION=$(echo $WAZUH_VERSION | sed -e 's/\.//g') | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') | ||||
| ## If wazuh manager exists in apt dev repository, change variables, if not exit 1 | ||||
| if [ "$WAZUH_IMAGE_VERSION" -le "$WAZUH_CURRENT_VERSION" ]; then | ||||
|   APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH | ||||
|   REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" | ||||
| else | ||||
| ## variables | ||||
| APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH | ||||
| REPOSITORY="deb https://packages.wazuh.com/4.x/apt/ stable main" | ||||
| WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) | ||||
| MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) | ||||
| MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) | ||||
| MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) | ||||
| MAJOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f1) | ||||
| MID_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f2) | ||||
| MINOR_CURRENT=$(echo $WAZUH_CURRENT_VERSION | cut -d. -f3) | ||||
|  | ||||
| ## check version to use the correct repository | ||||
| if [ "$MAJOR_BUILD" -gt "$MAJOR_CURRENT" ]; then | ||||
|   APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH | ||||
|   REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" | ||||
| elif [ "$MAJOR_BUILD" -eq "$MAJOR_CURRENT" ]; then | ||||
|   if [ "$MID_BUILD" -gt "$MID_CURRENT" ]; then | ||||
|     APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH | ||||
|     REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" | ||||
|   elif [ "$MID_BUILD" -eq "$MID_CURRENT" ]; then | ||||
|     if [ "$MINOR_BUILD" -gt "$MINOR_CURRENT" ]; then | ||||
|       APT_KEY=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH | ||||
|       REPOSITORY="deb https://packages-dev.wazuh.com/pre-release/apt/ unstable main" | ||||
|     fi | ||||
|   fi | ||||
| fi | ||||
|  | ||||
| apt-key adv --fetch-keys ${APT_KEY} | ||||
| echo ${REPOSITORY} | tee -a /etc/apt/sources.list.d/wazuh.list | ||||
| @@ -21,6 +21,8 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/shuffle.py" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account" | ||||
| PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop" | ||||
|   | ||||
| @@ -8,8 +8,8 @@ | ||||
| ## Variables | ||||
| CERT_TOOL=wazuh-certs-tool.sh | ||||
| PASSWORD_TOOL=wazuh-passwords-tool.sh | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.3/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.3/ | ||||
| PACKAGES_URL=https://packages.wazuh.com/4.5/ | ||||
| PACKAGES_DEV_URL=https://packages-dev.wazuh.com/4.5/ | ||||
|  | ||||
| ## Check if the cert tool exists in S3 buckets | ||||
| CERT_TOOL_PACKAGES=$(curl --silent -I $PACKAGES_URL$CERT_TOOL | grep -E "^HTTP" | awk  '{print $2}') | ||||
| @@ -17,13 +17,13 @@ CERT_TOOL_PACKAGES_DEV=$(curl --silent -I $PACKAGES_DEV_URL$CERT_TOOL | grep -E | ||||
|  | ||||
| ## If cert tool exists in some bucket, download it, if not exit 1 | ||||
| if [ "$CERT_TOOL_PACKAGES" = "200" ]; then | ||||
|   curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL | ||||
|   echo "Cert tool exists in Packages bucket" | ||||
|   curl -o $CERT_TOOL $PACKAGES_URL$CERT_TOOL -s | ||||
|   echo "The tool to create the certificates exists in the in Packages bucket" | ||||
| elif [ "$CERT_TOOL_PACKAGES_DEV" = "200" ]; then | ||||
|   curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL | ||||
|   echo "Cert tool exists in Packages-dev bucket" | ||||
|   curl -o $CERT_TOOL $PACKAGES_DEV_URL$CERT_TOOL -s | ||||
|   echo "The tool to create the certificates exists in Packages-dev bucket" | ||||
| else | ||||
|   echo "Cert tool does not exist in any bucket" | ||||
|   echo "The tool to create the certificates does not exist in any bucket" | ||||
|   echo "ERROR: certificates were not created" | ||||
|   exit 1 | ||||
| fi | ||||
| @@ -41,9 +41,9 @@ source /$CERT_TOOL -A | ||||
| nodes_server=$( cert_parseYaml /config.yml | grep nodes_server__name | sed 's/nodes_server__name=//' ) | ||||
| node_names=($nodes_server) | ||||
|  | ||||
| echo "Moving created certificates to destination directory" | ||||
| echo "Moving created certificates to the destination directory" | ||||
| cp /wazuh-certificates/* /certificates/ | ||||
| echo "changing certificate permissions" | ||||
| echo "Changing certificate permissions" | ||||
| chmod -R 500 /certificates | ||||
| chmod -R 400 /certificates/* | ||||
| echo "Setting UID indexer and dashboard" | ||||
| @@ -54,8 +54,8 @@ cp /certificates/root-ca.key /certificates/root-ca-manager.key | ||||
| chown 101:101 /certificates/root-ca-manager.pem | ||||
| chown 101:101 /certificates/root-ca-manager.key | ||||
|  | ||||
| for i in ${node_names[@]};  | ||||
| do  | ||||
| for i in ${node_names[@]}; | ||||
| do | ||||
|   chown 101:101 "/certificates/${i}.pem" | ||||
|   chown 101:101 "/certificates/${i}-key.pem" | ||||
| done | ||||
|   | ||||
| @@ -1,6 +1,6 @@ | ||||
| # Opendistro data migration to Wazuh indexer on docker. | ||||
| This procedure explains how to migrate Opendistro data from Opendistro to Wazuh indexer in docker production deployments. | ||||
| The example is migrating from v4.2 to v4.3. | ||||
| The example is migrating from v4.2 to v4.4. | ||||
| 
 | ||||
| ## Procedure | ||||
| Assuming that you have a v4.2 production deployment, perform the following steps. | ||||
| @@ -350,9 +350,9 @@ docker container run --rm -it \ | ||||
|            alpine ash -c "cd /from ; cp -avp . /to" | ||||
| ``` | ||||
| 
 | ||||
| **7. Start the 4.3 environment.** | ||||
| **7. Start the 4.4 environment.** | ||||
| ``` | ||||
| git checkout 4.3 | ||||
| git checkout 4.4 | ||||
| cd multi-node | ||||
| docker-compose -f generate-indexer-certs.yml run --rm generator | ||||
| docker-compose up -d | ||||
| @@ -21,4 +21,4 @@ nodes: | ||||
|   # Wazuh dashboard node | ||||
|   dashboard: | ||||
|     - name: wazuh.dashboard | ||||
|       ip: wazuh.dashboard | ||||
|       ip: wazuh.dashboard | ||||
|   | ||||
| @@ -108,13 +108,13 @@ | ||||
|       <os>xenial</os> | ||||
|       <os>bionic</os> | ||||
|       <os>focal</os> | ||||
|       <os>jammy</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Debian OS vulnerabilities --> | ||||
|     <provider name="debian"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>stretch</os> | ||||
|       <os>buster</os> | ||||
|       <os>bullseye</os> | ||||
|       <update_interval>1h</update_interval> | ||||
| @@ -127,6 +127,7 @@ | ||||
|       <os>6</os> | ||||
|       <os>7</os> | ||||
|       <os>8</os> | ||||
|       <os>9</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
| @@ -138,6 +139,18 @@ | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- SUSE Linux Enterprise OS vulnerabilities --> | ||||
|     <provider name="suse"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>11-server</os> | ||||
|       <os>11-desktop</os> | ||||
|       <os>12-server</os> | ||||
|       <os>12-desktop</os> | ||||
|       <os>15-server</os> | ||||
|       <os>15-desktop</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Arch OS vulnerabilities --> | ||||
|     <provider name="arch"> | ||||
|       <enabled>no</enabled> | ||||
| @@ -153,7 +166,6 @@ | ||||
|     <!-- Aggregate vulnerabilities --> | ||||
|     <provider name="nvd"> | ||||
|       <enabled>yes</enabled> | ||||
|       <update_from_year>2010</update_from_year> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|   | ||||
| @@ -108,13 +108,13 @@ | ||||
|       <os>xenial</os> | ||||
|       <os>bionic</os> | ||||
|       <os>focal</os> | ||||
|       <os>jammy</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Debian OS vulnerabilities --> | ||||
|     <provider name="debian"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>stretch</os> | ||||
|       <os>buster</os> | ||||
|       <os>bullseye</os> | ||||
|       <update_interval>1h</update_interval> | ||||
| @@ -127,6 +127,7 @@ | ||||
|       <os>6</os> | ||||
|       <os>7</os> | ||||
|       <os>8</os> | ||||
|       <os>9</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
| @@ -138,6 +139,18 @@ | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- SUSE Linux Enterprise OS vulnerabilities --> | ||||
|     <provider name="suse"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>11-server</os> | ||||
|       <os>11-desktop</os> | ||||
|       <os>12-server</os> | ||||
|       <os>12-desktop</os> | ||||
|       <os>15-server</os> | ||||
|       <os>15-desktop</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Arch OS vulnerabilities --> | ||||
|     <provider name="arch"> | ||||
|       <enabled>no</enabled> | ||||
| @@ -153,7 +166,6 @@ | ||||
|     <!-- Aggregate vulnerabilities --> | ||||
|     <provider name="nvd"> | ||||
|       <enabled>yes</enabled> | ||||
|       <update_from_year>2010</update_from_year> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|   | ||||
| @@ -3,9 +3,16 @@ version: '3.7' | ||||
|  | ||||
| services: | ||||
|   wazuh.master: | ||||
|     image: wazuh/wazuh-manager:4.3.11 | ||||
|     image: wazuh/wazuh-manager:4.5.3 | ||||
|     hostname: wazuh.master | ||||
|     restart: always | ||||
|     ulimits: | ||||
|       memlock: | ||||
|         soft: -1 | ||||
|         hard: -1 | ||||
|       nofile: | ||||
|         soft: 655360 | ||||
|         hard: 655360 | ||||
|     ports: | ||||
|       - "1515:1515" | ||||
|       - "514:514/udp" | ||||
| @@ -38,9 +45,16 @@ services: | ||||
|       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf | ||||
|  | ||||
|   wazuh.worker: | ||||
|     image: wazuh/wazuh-manager:4.3.11 | ||||
|     image: wazuh/wazuh-manager:4.5.3 | ||||
|     hostname: wazuh.worker | ||||
|     restart: always | ||||
|     ulimits: | ||||
|       memlock: | ||||
|         soft: -1 | ||||
|         hard: -1 | ||||
|       nofile: | ||||
|         soft: 655360 | ||||
|         hard: 655360 | ||||
|     environment: | ||||
|       - INDEXER_URL=https://wazuh1.indexer:9200 | ||||
|       - INDEXER_USERNAME=admin | ||||
| @@ -67,7 +81,7 @@ services: | ||||
|       - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf | ||||
|  | ||||
|   wazuh1.indexer: | ||||
|     image: wazuh/wazuh-indexer:4.3.11 | ||||
|     image: wazuh/wazuh-indexer:4.5.3 | ||||
|     hostname: wazuh1.indexer | ||||
|     restart: always | ||||
|     ports: | ||||
| @@ -84,16 +98,16 @@ services: | ||||
|         hard: 65536 | ||||
|     volumes: | ||||
|       - wazuh-indexer-data-1:/var/lib/wazuh-indexer | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh1.indexer.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem | ||||
|       - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh1.indexer.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem | ||||
|       - ./config/wazuh_indexer/wazuh1.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml | ||||
|  | ||||
|   wazuh2.indexer: | ||||
|     image: wazuh/wazuh-indexer:4.3.11 | ||||
|     image: wazuh/wazuh-indexer:4.5.3 | ||||
|     hostname: wazuh2.indexer | ||||
|     restart: always | ||||
|     environment: | ||||
| @@ -108,14 +122,14 @@ services: | ||||
|         hard: 65536 | ||||
|     volumes: | ||||
|       - wazuh-indexer-data-2:/var/lib/wazuh-indexer | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh2.indexer.pem | ||||
|       - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh2.indexer.pem | ||||
|       - ./config/wazuh_indexer/wazuh2.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml | ||||
|  | ||||
|   wazuh3.indexer: | ||||
|     image: wazuh/wazuh-indexer:4.3.11 | ||||
|     image: wazuh/wazuh-indexer:4.5.3 | ||||
|     hostname: wazuh3.indexer | ||||
|     restart: always | ||||
|     environment: | ||||
| @@ -130,14 +144,14 @@ services: | ||||
|         hard: 65536 | ||||
|     volumes: | ||||
|       - wazuh-indexer-data-3:/var/lib/wazuh-indexer | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh3.indexer.pem | ||||
|       - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh3.indexer.pem | ||||
|       - ./config/wazuh_indexer/wazuh3.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml | ||||
|  | ||||
|   wazuh.dashboard: | ||||
|     image: wazuh/wazuh-dashboard:4.3.11 | ||||
|     image: wazuh/wazuh-dashboard:4.5.3 | ||||
|     hostname: wazuh.dashboard | ||||
|     restart: always | ||||
|     ports: | ||||
| @@ -147,12 +161,16 @@ services: | ||||
|       - WAZUH_API_URL="https://wazuh.master" | ||||
|       - API_USERNAME=wazuh-wui | ||||
|       - API_PASSWORD=MyS3cr37P450r.*- | ||||
|       - DASHBOARD_USERNAME=kibanaserver | ||||
|       - DASHBOARD_PASSWORD=kibanaserver | ||||
|     volumes: | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem | ||||
|       - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml | ||||
|       - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml | ||||
|       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config | ||||
|       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom | ||||
|     depends_on: | ||||
|       - wazuh1.indexer | ||||
|     links: | ||||
| @@ -202,3 +220,5 @@ volumes: | ||||
|   wazuh-indexer-data-1: | ||||
|   wazuh-indexer-data-2: | ||||
|   wazuh-indexer-data-3: | ||||
|   wazuh-dashboard-config: | ||||
|   wazuh-dashboard-custom: | ||||
|   | ||||
| @@ -13,4 +13,4 @@ nodes: | ||||
|   # Wazuh dashboard node | ||||
|   dashboard: | ||||
|     - name: wazuh.dashboard | ||||
|       ip: wazuh.dashboard | ||||
|       ip: wazuh.dashboard | ||||
|   | ||||
| @@ -108,13 +108,13 @@ | ||||
|       <os>xenial</os> | ||||
|       <os>bionic</os> | ||||
|       <os>focal</os> | ||||
|       <os>jammy</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Debian OS vulnerabilities --> | ||||
|     <provider name="debian"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>stretch</os> | ||||
|       <os>buster</os> | ||||
|       <os>bullseye</os> | ||||
|       <update_interval>1h</update_interval> | ||||
| @@ -127,6 +127,7 @@ | ||||
|       <os>6</os> | ||||
|       <os>7</os> | ||||
|       <os>8</os> | ||||
|       <os>9</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
| @@ -138,6 +139,18 @@ | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- SUSE Linux Enterprise OS vulnerabilities --> | ||||
|     <provider name="suse"> | ||||
|       <enabled>no</enabled> | ||||
|       <os>11-server</os> | ||||
|       <os>11-desktop</os> | ||||
|       <os>12-server</os> | ||||
|       <os>12-desktop</os> | ||||
|       <os>15-server</os> | ||||
|       <os>15-desktop</os> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
|     <!-- Arch OS vulnerabilities --> | ||||
|     <provider name="arch"> | ||||
|       <enabled>no</enabled> | ||||
| @@ -153,7 +166,6 @@ | ||||
|     <!-- Aggregate vulnerabilities --> | ||||
|     <provider name="nvd"> | ||||
|       <enabled>yes</enabled> | ||||
|       <update_from_year>2010</update_from_year> | ||||
|       <update_interval>1h</update_interval> | ||||
|     </provider> | ||||
|  | ||||
| @@ -331,11 +343,11 @@ | ||||
|     <name>wazuh</name> | ||||
|     <node_name>node01</node_name> | ||||
|     <node_type>master</node_type> | ||||
|     <key></key> | ||||
|     <key>aa093264ef885029653eea20dfcf51ae</key> | ||||
|     <port>1516</port> | ||||
|     <bind_addr>0.0.0.0</bind_addr> | ||||
|     <nodes> | ||||
|         <node>NODE_IP</node> | ||||
|         <node>wazuh.manager</node> | ||||
|     </nodes> | ||||
|     <hidden>no</hidden> | ||||
|     <disabled>yes</disabled> | ||||
|   | ||||
| @@ -3,13 +3,15 @@ node.name: "wazuh.indexer" | ||||
| path.data: /var/lib/wazuh-indexer | ||||
| path.logs: /var/log/wazuh-indexer | ||||
| discovery.type: single-node | ||||
| http.port: 9200-9299 | ||||
| transport.tcp.port: 9300-9399 | ||||
| compatibility.override_main_response_version: true | ||||
| plugins.security.ssl.http.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem | ||||
| plugins.security.ssl.http.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key | ||||
| plugins.security.ssl.http.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem | ||||
| plugins.security.ssl.transport.pemcert_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.pem | ||||
| plugins.security.ssl.transport.pemkey_filepath: ${OPENSEARCH_PATH_CONF}/certs/wazuh.indexer.key | ||||
| plugins.security.ssl.transport.pemtrustedcas_filepath: ${OPENSEARCH_PATH_CONF}/certs/root-ca.pem | ||||
| plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem | ||||
| plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key | ||||
| plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem | ||||
| plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem | ||||
| plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key | ||||
| plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem | ||||
| plugins.security.ssl.http.enabled: true | ||||
| plugins.security.ssl.transport.enforce_hostname_verification: false | ||||
| plugins.security.ssl.transport.resolve_hostname: false | ||||
|   | ||||
| @@ -3,9 +3,16 @@ version: '3.7' | ||||
|  | ||||
| services: | ||||
|   wazuh.manager: | ||||
|     image: wazuh/wazuh-manager:4.3.11 | ||||
|     image: wazuh/wazuh-manager:4.5.3 | ||||
|     hostname: wazuh.manager | ||||
|     restart: always | ||||
|     ulimits: | ||||
|       memlock: | ||||
|         soft: -1 | ||||
|         hard: -1 | ||||
|       nofile: | ||||
|         soft: 655360 | ||||
|         hard: 655360 | ||||
|     ports: | ||||
|       - "1514:1514" | ||||
|       - "1515:1515" | ||||
| @@ -39,7 +46,7 @@ services: | ||||
|       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf | ||||
|  | ||||
|   wazuh.indexer: | ||||
|     image: wazuh/wazuh-indexer:4.3.11 | ||||
|     image: wazuh/wazuh-indexer:4.5.3 | ||||
|     hostname: wazuh.indexer | ||||
|     restart: always | ||||
|     ports: | ||||
| @@ -55,16 +62,16 @@ services: | ||||
|         hard: 65536 | ||||
|     volumes: | ||||
|       - wazuh-indexer-data:/var/lib/wazuh-indexer | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem | ||||
|       - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key | ||||
|       - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem | ||||
|       - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem | ||||
|       - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml | ||||
|       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/internal_users.yml | ||||
|  | ||||
|   wazuh.dashboard: | ||||
|     image: wazuh/wazuh-dashboard:4.3.11 | ||||
|     image: wazuh/wazuh-dashboard:4.5.3 | ||||
|     hostname: wazuh.dashboard | ||||
|     restart: always | ||||
|     ports: | ||||
| @@ -73,6 +80,8 @@ services: | ||||
|       - INDEXER_USERNAME=admin | ||||
|       - INDEXER_PASSWORD=SecretPassword | ||||
|       - WAZUH_API_URL=https://wazuh.manager | ||||
|       - DASHBOARD_USERNAME=kibanaserver | ||||
|       - DASHBOARD_PASSWORD=kibanaserver | ||||
|       - API_USERNAME=wazuh-wui | ||||
|       - API_PASSWORD=MyS3cr37P450r.*- | ||||
|     volumes: | ||||
| @@ -81,6 +90,8 @@ services: | ||||
|       - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem | ||||
|       - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml | ||||
|       - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml | ||||
|       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config | ||||
|       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom | ||||
|     depends_on: | ||||
|       - wazuh.indexer | ||||
|     links: | ||||
| @@ -100,3 +111,5 @@ volumes: | ||||
|   filebeat_etc: | ||||
|   filebeat_var: | ||||
|   wazuh-indexer-data: | ||||
|   wazuh-dashboard-config: | ||||
|   wazuh-dashboard-custom: | ||||
|   | ||||
| @@ -7,4 +7,4 @@ services: | ||||
|     hostname: wazuh-certs-generator | ||||
|     volumes: | ||||
|       - ./config/wazuh_indexer_ssl_certs/:/certificates/ | ||||
|       - ./config/certs.yml:/config/certs.yml | ||||
|       - ./config/certs.yml:/config/certs.yml | ||||
|   | ||||
		Reference in New Issue
	
	Block a user