diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index f292275c..0444cba7 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -128,7 +128,7 @@ jobs: run: | sleep 120 docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" - if [[ $docs -gt 100 ]]; then + if [[ $docs -gt 0 ]]; then echo "wazuh-alerts index documents: ${docs}" else echo "wazuh-alerts index documents: ${docs}" @@ -139,7 +139,7 @@ jobs: run: | qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`" templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`" - if [[ $qty_templates -eq 3 ]]; then + if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" else @@ -162,10 +162,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check errors in ossec.log - run: ./.github/single-node-log-check.sh - - - name: Check filebeat output run: ./.github/single-node-filebeat-check.sh @@ -179,8 +175,8 @@ jobs: exit 1 fi - - name: Stop single node stack - run: docker-compose -f single-node/docker-compose.yml down + - name: Check errors in ossec.log + run: ./.github/single-node-log-check.sh check-multi-node: runs-on: ubuntu-latest @@ -193,6 +189,14 @@ jobs: - name: Create enviroment variables run: cat .env > $GITHUB_ENV + - name: free disk space + run: | + sudo swapoff -a + sudo rm -f /swapfile + sudo apt clean + docker rmi $(docker image ls -aq) + df -h + - name: Retrieve saved Wazuh dashboard Docker image uses: actions/download-artifact@v3 with: @@ -213,6 +217,7 @@ jobs: docker load --input ./wazuh-manager.tar docker load --input ./wazuh-indexer.tar docker load --input ./wazuh-dashboard.tar + rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar - name: Create multi node certficates run: docker-compose -f multi-node/generate-indexer-certs.yml run --rm generator @@ -222,7 +227,13 @@ jobs: - name: Check Wazuh indexer start run: | - sleep 120 + until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l` -eq 1 ]] + do + echo 'Waiting for Wazuh indexer start' + free -m + df -h + sleep 10 + done status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`" if [[ $status_green -eq 1 ]]; then curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s @@ -251,9 +262,15 @@ jobs: - name: Check documents into wazuh-alerts index run: | - sleep 120 + until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``) -gt 0 ]] + do + echo 'Waiting for Wazuh indexer events' + free -m + df -h + sleep 10 + done docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`" - if [[ $docs -gt 100 ]]; then + if [[ $docs -gt 1 ]]; then echo "wazuh-alerts index documents: ${docs}" else echo "wazuh-alerts index documents: ${docs}" @@ -264,7 +281,7 @@ jobs: run: | qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`" templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`" - if [[ $qty_templates -eq 3 ]]; then + if [[ $qty_templates -gt 3 ]]; then echo "wazuh templates:" echo "${templates}" else @@ -294,10 +311,6 @@ jobs: env: TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true") - - name: Check errors in ossec.log - run: ./.github/multi-node-log-check.sh - - - name: Check filebeat output run: ./.github/multi-node-filebeat-check.sh @@ -309,4 +322,7 @@ jobs: else echo "Wazuh dashboard status: ${status}" exit 1 - fi \ No newline at end of file + fi + + - name: Check errors in ossec.log + run: ./.github/multi-node-log-check.sh \ No newline at end of file diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 6a561f08..f537c447 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -1,7 +1,7 @@ WAZUH_IMAGE_VERSION=4.8.1 WAZUH_VERSION=$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g') WAZUH_TAG_REVISION=1 -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2- | sed -e 's/\.//g') IMAGE_VERSION=${WAZUH_IMAGE_VERSION} # Wazuh package generator diff --git a/build-docker-images/wazuh-dashboard/Dockerfile b/build-docker-images/wazuh-dashboard/Dockerfile index 71b2d0e5..e2e0bfd7 100644 --- a/build-docker-images/wazuh-dashboard/Dockerfile +++ b/build-docker-images/wazuh-dashboard/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 AS builder +FROM amazonlinux:2023.3.20240304.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -28,12 +28,12 @@ RUN bash /install_wazuh_app.sh # Copy and set permissions to config files COPY config/opensearch_dashboards.yml $INSTALL_DIR/config/ COPY config/wazuh.yml $INSTALL_DIR/data/wazuh/config/ -RUN chown 101:101 $INSTALL_DIR/config/opensearch_dashboards.yml && chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml +RUN chmod 664 $INSTALL_DIR/config/opensearch_dashboards.yml # Create and set permissions to data directories -RUN mkdir -p $INSTALL_DIR/data/wazuh && chown -R 101:101 $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh -RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chown -R 101:101 $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config -RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs +RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh +RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config +RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs ################################################################################ # Build stage 1 (the current Wazuh dashboard image): @@ -42,7 +42,7 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chown -R 101:101 $INSTALL_DIR/data/ # Add entrypoint # Add wazuh_app_config ################################################################################ -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 # Set environment variables ENV USER="wazuh-dashboard" \ diff --git a/build-docker-images/wazuh-indexer/Dockerfile b/build-docker-images/wazuh-indexer/Dockerfile index bdce9fff..bd579225 100644 --- a/build-docker-images/wazuh-indexer/Dockerfile +++ b/build-docker-images/wazuh-indexer/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 AS builder +FROM amazonlinux:2023.3.20240304.0 AS builder ARG WAZUH_VERSION ARG WAZUH_TAG_REVISION @@ -29,7 +29,7 @@ RUN bash config.sh # Add entrypoint ################################################################################ -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 ENV USER="wazuh-indexer" \ GROUP="wazuh-indexer" \ diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 42dea261..70ccd447 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -1,5 +1,5 @@ # Wazuh Docker Copyright (C) 2017, Wazuh Inc. (License GPLv2) -FROM amazonlinux:2023.3.20240219.0 +FROM amazonlinux:2023.3.20240304.0 RUN rm /bin/sh && ln -s /bin/bash /bin/sh diff --git a/build-docker-images/wazuh-manager/config/check_repository.sh b/build-docker-images/wazuh-manager/config/check_repository.sh index 6c3748c5..5323ec81 100644 --- a/build-docker-images/wazuh-manager/config/check_repository.sh +++ b/build-docker-images/wazuh-manager/config/check_repository.sh @@ -2,7 +2,7 @@ APT_KEY=https://packages.wazuh.com/key/GPG-KEY-WAZUH GPG_SIGN="gpgcheck=1\ngpgkey=${APT_KEY}]" REPOSITORY="[wazuh]\n${GPG_SIGN}\nenabled=1\nname=EL-\$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1" -WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '\"tag_name\":' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) +WAZUH_CURRENT_VERSION=$(curl --silent https://api.github.com/repos/wazuh/wazuh/releases/latest | grep '["]tag_name["]:' | sed -E 's/.*\"([^\"]+)\".*/\1/' | cut -c 2-) MAJOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f1) MID_BUILD=$(echo $WAZUH_VERSION | cut -d. -f2) MINOR_BUILD=$(echo $WAZUH_VERSION | cut -d. -f3) diff --git a/build-docker-images/wazuh-manager/config/permanent_data.env b/build-docker-images/wazuh-manager/config/permanent_data.env index 1ca3a42e..5439b89b 100644 --- a/build-docker-images/wazuh-manager/config/permanent_data.env +++ b/build-docker-images/wazuh-manager/config/permanent_data.env @@ -79,12 +79,14 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_message_proc PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/subscribers/sqs_queue.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/orm.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/gcloud.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/integration.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/tools.py" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/gcloud/exceptions.py" export PERMANENT_DATA_EXCP # Files mounted in a volume that should be deleted diff --git a/indexer-certs-creator/config/entrypoint.sh b/indexer-certs-creator/config/entrypoint.sh index d3e0534e..5d5e5d6c 100644 --- a/indexer-certs-creator/config/entrypoint.sh +++ b/indexer-certs-creator/config/entrypoint.sh @@ -38,7 +38,7 @@ chmod 700 /$CERT_TOOL ## Execute cert tool and parsin cert.yml to set UID permissions source /$CERT_TOOL -A -nodes_server=$( cert_parseYaml /config.yml | grep nodes_server__name | sed 's/nodes_server__name=//' ) +nodes_server=$( cert_parseYaml /config.yml | grep -E "nodes[_]+server[_]+[0-9]+=" | sed -e 's/nodes__server__[0-9]=//' | sed 's/"//g' ) node_names=($nodes_server) echo "Moving created certificates to the destination directory" @@ -51,11 +51,12 @@ chown 1000:1000 /certificates/* echo "Setting UID for wazuh manager and worker" cp /certificates/root-ca.pem /certificates/root-ca-manager.pem cp /certificates/root-ca.key /certificates/root-ca-manager.key -chown 101:101 /certificates/root-ca-manager.pem -chown 101:101 /certificates/root-ca-manager.key +chown 999:999 /certificates/root-ca-manager.pem +chown 999:999 /certificates/root-ca-manager.key for i in ${node_names[@]}; do - chown 101:101 "/certificates/${i}.pem" - chown 101:101 "/certificates/${i}-key.pem" + chown 999:999 "/certificates/${i}.pem" + chown 999:999 "/certificates/${i}-key.pem" done + diff --git a/multi-node/config/wazuh_cluster/wazuh_manager.conf b/multi-node/config/wazuh_cluster/wazuh_manager.conf index 92e5662f..61d4721f 100644 --- a/multi-node/config/wazuh_cluster/wazuh_manager.conf +++ b/multi-node/config/wazuh_cluster/wazuh_manager.conf @@ -307,9 +307,4 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/dpkg.log - - diff --git a/multi-node/config/wazuh_cluster/wazuh_worker.conf b/multi-node/config/wazuh_cluster/wazuh_worker.conf index b49aa071..d1caecc9 100644 --- a/multi-node/config/wazuh_cluster/wazuh_worker.conf +++ b/multi-node/config/wazuh_cluster/wazuh_worker.conf @@ -307,9 +307,4 @@ /var/ossec/logs/active-responses.log - - syslog - /var/log/dpkg.log - - diff --git a/multi-node/generate-indexer-certs.yml b/multi-node/generate-indexer-certs.yml index a3398661..dbf2b079 100644 --- a/multi-node/generate-indexer-certs.yml +++ b/multi-node/generate-indexer-certs.yml @@ -3,7 +3,7 @@ version: '3' services: generator: - image: wazuh/wazuh-certs-generator:0.0.1 + image: wazuh/wazuh-certs-generator:0.0.2 hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/ diff --git a/single-node/generate-indexer-certs.yml b/single-node/generate-indexer-certs.yml index d10151fd..3e0eb6fd 100644 --- a/single-node/generate-indexer-certs.yml +++ b/single-node/generate-indexer-certs.yml @@ -3,7 +3,7 @@ version: '3' services: generator: - image: wazuh/wazuh-certs-generator:0.0.1 + image: wazuh/wazuh-certs-generator:0.0.2 hostname: wazuh-certs-generator volumes: - ./config/wazuh_indexer_ssl_certs/:/certificates/