readme

Bump 4.3 to 4.3.7

.env

@@ -1,3 +1,3 @@
-WAZUH_VERSION=4.3.5
+WAZUH_VERSION=4.3.7
-WAZUH_IMAGE_VERSION=4.3.5
+WAZUH_IMAGE_VERSION=4.3.7
 WAZUH_TAG_REVISION=1

.github/.goss.yaml

@@ -56,7 +56,7 @@ package:
   wazuh-manager:
     installed: true
     versions:
-    - 4.3.5-1
+    - 4.3.7-1
 port:
   tcp:1514:
     listening: true

CHANGELOG.md

@@ -1,6 +1,16 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## Wazuh Docker v4.3.7
+### Added
+
+- Update Wazuh to version [4.3.7](https://github.com/wazuh/wazuh/blob/v4.3.7/CHANGELOG.md#v437)
+
+## Wazuh Docker v4.3.6
+### Added
+
+- Update Wazuh to version [4.3.6](https://github.com/wazuh/wazuh/blob/v4.3.6/CHANGELOG.md#v436)
+
 ## Wazuh Docker v4.3.5
 ### Added
 

README.md

@@ -36,8 +36,8 @@ Default values are included when available.
 
 ### Wazuh
 ```
-API_USERNAME="wazuh"                                # Wazuh API username
+API_USERNAME="wazuh-wui"                            # Wazuh API username
-API_PASSWORD="wazuh"                                # Wazuh API password - Must comply with requirements
+API_PASSWORD="MyS3cr37P450r.*-"                     # Wazuh API password - Must comply with requirements
                                                     # (8+ length, uppercase, lowercase, specials chars)
 
 INDEXER_URL=https://wazuh.indexer:9200              # Wazuh indexer URL
@@ -78,10 +78,12 @@ API_SELECTOR=true               Defines if the user is allowed to change the sel
 IP_SELECTOR=true                # Defines if the user is allowed to change the selected index pattern directly from the Wazuh app top menu
 IP_IGNORE="[]"                  # List of index patterns to be ignored
 
+DASHBOARD_USERNAME=kibanaserver     # Custom user saved in the dashboard keystore
+DASHBOARD_PASSWORD=kibanaserver     # Custom password saved in the dashboard keystore
 WAZUH_MONITORING_ENABLED=true       # Custom settings to enable/disable wazuh-monitoring indices
 WAZUH_MONITORING_FREQUENCY=900      # Custom setting to set the frequency for wazuh-monitoring indices cron task
 WAZUH_MONITORING_SHARDS=2           # Configure wazuh-monitoring-* indices shards and replicas
-WAZUH_MONITORING_REPLICAS=0         #
+WAZUH_MONITORING_REPLICAS=0         ##
 ```
 
 ## Directory structure
@@ -193,6 +195,8 @@ WAZUH_MONITORING_REPLICAS=0         #
 
 | Wazuh version | ODFE    | XPACK  |
 |---------------|---------|--------|
+| v4.3.7        |         |        |
+| v4.3.6        |         |        |
 | v4.3.5        |         |        |
 | v4.3.4        |         |        |
 | v4.3.3        |         |        |

VERSION

@@ -1,2 +1,2 @@
-WAZUH-DOCKER_VERSION="4.3.5"
+WAZUH-DOCKER_VERSION="4.3.7"
-REVISION="40317"
+REVISION="40319"

build-docker-images/build-images.sh

@@ -1,4 +1,4 @@
-WAZUH_IMAGE_VERSION=4.3.5
+WAZUH_IMAGE_VERSION=4.3.7
 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')
 WAZUH_TAG_REVISION=1
 WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g')

build-docker-images/wazuh-manager/config/etc/cont-init.d/0-wazuh-init

@@ -179,6 +179,15 @@ set_rids_owner() {
   chown -R wazuh:wazuh /var/ossec/queue/rids
 }
 
+##############################################################################
+# Change any ossec user/group to wazuh user/group 
+##############################################################################
+
+set_correct_permOwner() {
+  find / -group 997 -exec chown :101 {} +;
+  find / -user 999 -exec chown 101 {} +;
+}
+
 ##############################################################################
 # Main function
 ##############################################################################
@@ -189,6 +198,9 @@ main() {
 
   # Restore files stored in permanent data that are not permanent  (i.e. internal_options.conf)
   apply_exclusion_data
+  
+  # Apply correct permission and ownership
+  set_correct_permOwner
 
   # Rename files stored in permanent data (i.e. queue/ossec)
   move_data_files

build-docker-images/wazuh-manager/config/etc/cont-init.d/1-config-filebeat

@@ -12,32 +12,38 @@ fi
 
 if [ "$INDEXER_USERNAME" != "" ]; then
   >&2 echo "Configuring username."
-  sed -i "s|#username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#username:.*|username:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|username:.*|username: '$INDEXER_USERNAME'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$INDEXER_PASSWORD" != "" ]; then
   >&2 echo "Configuring password."
-  sed -i "s|#password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#password:.*|password:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|password:.*|password: '$INDEXER_PASSWORD'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$FILEBEAT_SSL_VERIFICATION_MODE" != "" ]; then
   >&2 echo "Configuring SSL verification mode."
-  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode: $FILEBEAT_SSL_VERIFICATION_MODE|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.verification_mode:.*|ssl.verification_mode:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.verification_mode:.*|ssl.verification_mode: '$FILEBEAT_SSL_VERIFICATION_MODE'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then
   >&2 echo "Configuring Certificate Authorities."
-  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.certificate_authorities:.*|ssl.certificate_authorities:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate_authorities:.*|ssl.certificate_authorities: ['$SSL_CERTIFICATE_AUTHORITIES']|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$SSL_CERTIFICATE" != "" ]; then
   >&2 echo "Configuring SSL Certificate."
-  sed -i "s|#ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.certificate:.*|ssl.certificate:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.certificate:.*|ssl.certificate: '$SSL_CERTIFICATE'|g" /etc/filebeat/filebeat.yml
 fi
 
 if [ "$SSL_KEY" != "" ]; then
   >&2 echo "Configuring SSL Key."
-  sed -i "s|#ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
+  sed -i "s|#ssl.key:.*|ssl.key:|g" /etc/filebeat/filebeat.yml
+  sed -i "s|ssl.key:.*|ssl.key: '$SSL_KEY'|g" /etc/filebeat/filebeat.yml
 fi
 
 

build-docker-images/wazuh-manager/config/filebeat.yml

@@ -20,3 +20,12 @@ output.elasticsearch:
   #ssl.certificate_authorities:
   #ssl.certificate:
   #ssl.key:
+
+logging.metrics.enabled: false
+
+seccomp:
+  default_action: allow
+  syscalls:
+  - action: allow
+    names:
+    - rseq

indexer-certs-creator/config/entrypoint.sh

@@ -51,11 +51,11 @@ chown 1000:1000 /certificates/*
 echo "Setting UID for wazuh manager and worker"
 cp /certificates/root-ca.pem /certificates/root-ca-manager.pem
 cp /certificates/root-ca.key /certificates/root-ca-manager.key
-chown 999:997 /certificates/root-ca-manager.pem
+chown 101:101 /certificates/root-ca-manager.pem
-chown 999:997 /certificates/root-ca-manager.key
+chown 101:101 /certificates/root-ca-manager.key
 
 for i in ${node_names[@]}; 
 do 
-  chown 999:997 "/certificates/${i}.pem"
+  chown 101:101 "/certificates/${i}.pem"
-  chown 999:997 "/certificates/${i}-key.pem"
+  chown 101:101 "/certificates/${i}-key.pem"
 done

multi-node/docker-compose.yml

@@ -3,7 +3,7 @@ version: '3.7'
 
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:4.3.5
+    image: wazuh/wazuh-manager:4.3.7
     hostname: wazuh.master
     restart: always
     ports:
@@ -38,7 +38,7 @@ services:
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh.worker:
-    image: wazuh/wazuh-manager:4.3.5
+    image: wazuh/wazuh-manager:4.3.7
     hostname: wazuh.worker
     restart: always
     environment:
@@ -67,7 +67,7 @@ services:
       - ./config/wazuh_cluster/wazuh_worker.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:4.3.5
+    image: wazuh/wazuh-indexer:4.3.7
     hostname: wazuh1.indexer
     restart: always
     ports:
@@ -93,7 +93,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:4.3.5
+    image: wazuh/wazuh-indexer:4.3.7
     hostname: wazuh2.indexer
     restart: always
     environment:
@@ -115,7 +115,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:4.3.5
+    image: wazuh/wazuh-indexer:4.3.7
     hostname: wazuh3.indexer
     restart: always
     environment:
@@ -137,7 +137,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:4.3.5
+    image: wazuh/wazuh-dashboard:4.3.7
     hostname: wazuh.dashboard
     restart: always
     ports:

single-node/docker-compose.yml

@@ -3,7 +3,7 @@ version: '3.7'
 
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:4.3.5
+    image: wazuh/wazuh-manager:4.3.7
     hostname: wazuh.manager
     restart: always
     ports:
@@ -39,7 +39,7 @@ services:
       - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:4.3.5
+    image: wazuh/wazuh-indexer:4.3.7
     hostname: wazuh.indexer
     restart: always
     ports:
@@ -64,7 +64,7 @@ services:
       - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:4.3.5
+    image: wazuh/wazuh-dashboard:4.3.7
     hostname: wazuh.dashboard
     restart: always
     ports: