Merge branch 'master' into 135-scirius
This commit is contained in:
Steven Foerster
@@ -0,0 +1,22 @@
|
||||
[Unit]
|
||||
Description=Mistborn Elasticsearch Service
|
||||
Requires=Mistborn-base.service
|
||||
After=Mistborn-base.service
|
||||
PartOf=Mistborn-base.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=15
|
||||
User=root
|
||||
Group=docker
|
||||
PermissionsStartOnly=true
|
||||
# Shutdown container (if running) when unit is stopped
|
||||
ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
|
||||
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
|
||||
# Start container when unit is started
|
||||
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
|
||||
# Stop container when unit is stopped
|
||||
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,26 @@
|
||||
[Unit]
|
||||
Description=Mistborn Wazuh Service
|
||||
Requires=Mistborn-elasticsearch.service
|
||||
After=Mistborn-elasticsearch.service
|
||||
PartOf=Mistborn-base.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=15
|
||||
User=root
|
||||
Group=docker
|
||||
PermissionsStartOnly=true
|
||||
# Shutdown container (if running) when unit is stopped
|
||||
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
|
||||
# Start container when unit is started
|
||||
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
|
||||
# Agent install
|
||||
ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
|
||||
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
|
||||
# Stop container when unit is stopped
|
||||
ExecStop=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
|
||||
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
|
||||
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Define your internal users here
|
||||
|
||||
mistborn:
|
||||
hash: "__MISTBORN_HASH__"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Mistborn user"
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
|
||||
echo "internal_users.yml exists. Proceeding."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
|
||||
chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
|
||||
cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
|
||||
|
||||
ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')
|
||||
|
||||
sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml
|
||||
Executable
+26
@@ -0,0 +1,26 @@
|
||||
#!/bin/bash
|
||||
|
||||
# detect if already installed
|
||||
if dpkg -s wazuh-agent &> /dev/null; then
|
||||
echo "Wazuh agent already installed"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# prepare repo
|
||||
echo "Adding Wazuh Repository"
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
|
||||
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
|
||||
|
||||
apt-get update
|
||||
|
||||
# wait for service to be listening
|
||||
while ! nc -z 10.2.3.1 55000; do
|
||||
WAIT_TIME=10
|
||||
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
|
||||
sleep ${WAIT_TIME}
|
||||
done
|
||||
|
||||
# install
|
||||
echo "Installing Wazuh agent"
|
||||
WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
|
||||
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl start wazuh-agent
|
||||
systemctl enable wazuh-agent
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl stop wazuh-agent
|
||||
systemctl disable wazuh-agent
|
||||
Executable
+6
@@ -0,0 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Elasticsearch
|
||||
ELASTICSEARCH_PROD_FILE="$1"
|
||||
echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE
|
||||
chmod 600 $ELASTICSEARCH_PROD_FILE
|
||||
Executable
+92
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Wazuh
|
||||
WAZUH_PROD_FILE="$1"
|
||||
echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
|
||||
echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
|
||||
echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
# kibana odfe
|
||||
# kibana-odfe/config/wazuh_app_config.sh
|
||||
# https://wazuh
|
||||
echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
|
||||
echo "API_PORT=55000" >> $WAZUH_PROD_FILE
|
||||
echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
|
||||
|
||||
#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
|
||||
|
||||
API_PASSWORD_PYTHON=$(cat << EOF
|
||||
|
||||
import secrets
|
||||
import random
|
||||
import string
|
||||
|
||||
random_pass = ([secrets.choice("@$!%*?-_"),
|
||||
secrets.choice(string.digits),
|
||||
secrets.choice(string.ascii_lowercase),
|
||||
secrets.choice(string.ascii_uppercase),
|
||||
]
|
||||
+ [secrets.choice(string.ascii_lowercase
|
||||
+ string.ascii_uppercase
|
||||
+ "@$!%*?-_"
|
||||
+ string.digits) for i in range(12)])
|
||||
|
||||
random.shuffle(random_pass)
|
||||
random_pass = ''.join(random_pass)
|
||||
print(random_pass)
|
||||
|
||||
EOF
|
||||
)
|
||||
|
||||
API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
|
||||
|
||||
echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
|
||||
|
||||
# kibana-odfe/config/entrypoint.sh:
|
||||
# https://elasticsearch:9200
|
||||
echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
|
||||
|
||||
|
||||
cat >> ${WAZUH_PROD_FILE}<< EOF
|
||||
|
||||
PATTERN="wazuh-alerts-*"
|
||||
|
||||
CHECKS_PATTERN=true
|
||||
CHECKS_TEMPLATE=true
|
||||
CHECKS_API=true
|
||||
CHECKS_SETUP=true
|
||||
|
||||
EXTENSIONS_PCI=true
|
||||
EXTENSIONS_GDPR=true
|
||||
EXTENSIONS_HIPAA=true
|
||||
EXTENSIONS_NIST=true
|
||||
EXTENSIONS_TSC=true
|
||||
EXTENSIONS_AUDIT=true
|
||||
EXTENSIONS_OSCAP=false
|
||||
EXTENSIONS_CISCAT=false
|
||||
EXTENSIONS_AWS=false
|
||||
EXTENSIONS_GCP=false
|
||||
EXTENSIONS_VIRUSTOTAL=true
|
||||
EXTENSIONS_OSQUERY=true
|
||||
EXTENSIONS_DOCKER=true
|
||||
|
||||
APP_TIMEOUT=20000
|
||||
|
||||
API_SELECTOR=true
|
||||
IP_SELECTOR=true
|
||||
IP_IGNORE="[]"
|
||||
|
||||
WAZUH_MONITORING_ENABLED=true
|
||||
WAZUH_MONITORING_FREQUENCY=900
|
||||
WAZUH_MONITORING_SHARDS=2
|
||||
WAZUH_MONITORING_REPLICAS=0
|
||||
|
||||
ADMIN_PRIVILEGES=true
|
||||
|
||||
EOF
|
||||
|
||||
echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
chmod 600 $WAZUH_PROD_FILE
|
||||
@@ -2,38 +2,43 @@
|
||||
|
||||
set -e
|
||||
|
||||
SERVICE="$1"
|
||||
MISTBORN_HOME="/opt/mistborn"
|
||||
|
||||
SERVICES="$1"
|
||||
shift
|
||||
|
||||
export MISTBORN_HOME="/opt/mistborn"
|
||||
export MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
|
||||
export MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
|
||||
IFS=','
|
||||
read -ra SERVICES_ARRAY <<< "${SERVICES}"
|
||||
for SERVICE in "${SERVICES_ARRAY[@]}"; do
|
||||
MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
|
||||
MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
|
||||
|
||||
# check and create file if needed
|
||||
${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
|
||||
# check and create file if needed
|
||||
${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
|
||||
|
||||
# read in variables
|
||||
set -a
|
||||
source ${MISTBORN_HOME}/.env
|
||||
# read in variables
|
||||
set -a
|
||||
source ${MISTBORN_HOME}/.env
|
||||
|
||||
if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
|
||||
echo "Loading service variables"
|
||||
source ${MISTBORN_SERVICE_FILE}
|
||||
else
|
||||
echo "No service variables to load. Proceeding."
|
||||
fi
|
||||
set +a
|
||||
if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
|
||||
echo "Loading service variables"
|
||||
source ${MISTBORN_SERVICE_FILE}
|
||||
else
|
||||
echo "No service variables to load. Proceeding."
|
||||
fi
|
||||
set +a
|
||||
|
||||
# init script
|
||||
if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
|
||||
echo "Running init script"
|
||||
${MISTBORN_SERVICE_INIT}
|
||||
else
|
||||
echo "No init script. Proceeding."
|
||||
fi
|
||||
# init script
|
||||
if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
|
||||
echo "Running init script"
|
||||
${MISTBORN_SERVICE_INIT}
|
||||
else
|
||||
echo "No init script. Proceeding."
|
||||
fi
|
||||
done
|
||||
|
||||
# ensure base is up and listening
|
||||
echo "Waiting for Mistborn-base to finish starting up..."
|
||||
echo "Checking that Mistborn-base has finished starting up..."
|
||||
|
||||
while ! nc -z 10.2.3.1 5000; do
|
||||
WAIT_TIME=$((5 + $RANDOM % 15))
|
||||
|
||||
Reference in New Issue
Block a user