Browse Source
Resolve "Wazuh" Closes #165 See merge request cyber5k/mistborn!75merge-requests/75/merge
Steven Foerster
5 years ago
13 changed files with 325 additions and 30 deletions
@ -0,0 +1,30 @@
@@ -0,0 +1,30 @@
|
||||
version: '3.7' |
||||
|
||||
services: |
||||
|
||||
elasticsearch: |
||||
image: amazon/opendistro-for-elasticsearch:1.12.0 |
||||
hostname: elasticsearch |
||||
restart: unless-stopped |
||||
ports: |
||||
- "${MISTBORN_BIND_IP}:9200:9200" |
||||
environment: |
||||
- discovery.type=single-node |
||||
- cluster.name=mistborn-cluster |
||||
- network.host=0.0.0.0 |
||||
- "ES_JAVA_OPTS=-Xms512m -Xmx512m" |
||||
- bootstrap.memory_lock=true |
||||
volumes: |
||||
- ../../mistborn_volumes/extra/elasticsearch/init/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml |
||||
ulimits: |
||||
memlock: |
||||
soft: -1 |
||||
hard: -1 |
||||
nofile: |
||||
soft: 65536 |
||||
hard: 65536 |
||||
|
||||
networks: |
||||
default: |
||||
external: |
||||
name: mistborn_default |
||||
@ -0,0 +1,70 @@
@@ -0,0 +1,70 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2) |
||||
version: '3.7' |
||||
|
||||
services: |
||||
wazuh: |
||||
image: wazuh/wazuh-odfe:4.1.2 |
||||
hostname: wazuh-manager |
||||
restart: unless-stopped |
||||
ports: |
||||
- "${MISTBORN_BIND_IP}:1514:1514" |
||||
- "${MISTBORN_BIND_IP}:1515:1515" |
||||
- "${MISTBORN_BIND_IP}:514:514/udp" |
||||
- "${MISTBORN_BIND_IP}:55000:55000" |
||||
environment: |
||||
- FILEBEAT_SSL_VERIFICATION_MODE=none |
||||
env_file: |
||||
- ../.envs/.production/.wazuh |
||||
volumes: |
||||
- ossec_api_configuration:/var/ossec/api/configuration |
||||
- ossec_etc:/var/ossec/etc |
||||
- ossec_logs:/var/ossec/logs |
||||
- ossec_queue:/var/ossec/queue |
||||
- ossec_var_multigroups:/var/ossec/var/multigroups |
||||
- ossec_integrations:/var/ossec/integrations |
||||
- ossec_active_response:/var/ossec/active-response/bin |
||||
- ossec_agentless:/var/ossec/agentless |
||||
- ossec_wodles:/var/ossec/wodles |
||||
- filebeat_etc:/etc/filebeat |
||||
- filebeat_var:/var/lib/filebeat |
||||
|
||||
wazuh-kibana: |
||||
image: wazuh/wazuh-kibana-odfe:4.1.2 |
||||
hostname: wazuh-kibana |
||||
restart: unless-stopped |
||||
labels: |
||||
- "traefik.enable=true" |
||||
- "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)" |
||||
- "traefik.http.routers.wazuhk-http.entrypoints=web" |
||||
- "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file" |
||||
- "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)" |
||||
- "traefik.http.routers.wazuhk-https.entrypoints=websecure" |
||||
- "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file" |
||||
- "traefik.http.routers.wazuhk-https.tls.certresolver=basic" |
||||
- "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601" |
||||
#ports: |
||||
# - "${MISTBORN_BIND_IP}:5601:5601" |
||||
environment: |
||||
- SERVER_SSL_ENABLED=false |
||||
- SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert |
||||
- SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key |
||||
env_file: |
||||
- ../.envs/.production/.wazuh |
||||
|
||||
volumes: |
||||
ossec_api_configuration: |
||||
ossec_etc: |
||||
ossec_logs: |
||||
ossec_queue: |
||||
ossec_var_multigroups: |
||||
ossec_integrations: |
||||
ossec_active_response: |
||||
ossec_agentless: |
||||
ossec_wodles: |
||||
filebeat_etc: |
||||
filebeat_var: |
||||
|
||||
networks: |
||||
default: |
||||
external: |
||||
name: mistborn_default |
||||
@ -0,0 +1,22 @@
@@ -0,0 +1,22 @@
|
||||
[Unit] |
||||
Description=Mistborn Elasticsearch Service |
||||
Requires=Mistborn-base.service |
||||
After=Mistborn-base.service |
||||
PartOf=Mistborn-base.service |
||||
|
||||
[Service] |
||||
Restart=always |
||||
RestartSec=15 |
||||
User=root |
||||
Group=docker |
||||
PermissionsStartOnly=true |
||||
# Shutdown container (if running) when unit is stopped |
||||
ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144 |
||||
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down |
||||
# Start container when unit is started |
||||
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build |
||||
# Stop container when unit is stopped |
||||
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down |
||||
|
||||
[Install] |
||||
WantedBy=multi-user.target |
||||
@ -0,0 +1,26 @@
@@ -0,0 +1,26 @@
|
||||
[Unit] |
||||
Description=Mistborn Wazuh Service |
||||
Requires=Mistborn-elasticsearch.service |
||||
After=Mistborn-elasticsearch.service |
||||
PartOf=Mistborn-base.service |
||||
|
||||
[Service] |
||||
Restart=always |
||||
RestartSec=15 |
||||
User=root |
||||
Group=docker |
||||
PermissionsStartOnly=true |
||||
# Shutdown container (if running) when unit is stopped |
||||
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down |
||||
# Start container when unit is started |
||||
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build |
||||
# Agent install |
||||
ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh |
||||
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh |
||||
# Stop container when unit is stopped |
||||
ExecStop=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh |
||||
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down |
||||
|
||||
|
||||
[Install] |
||||
WantedBy=multi-user.target |
||||
@ -0,0 +1,17 @@
@@ -0,0 +1,17 @@
|
||||
--- |
||||
# This is the internal user database |
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh |
||||
|
||||
_meta: |
||||
type: "internalusers" |
||||
config_version: 2 |
||||
|
||||
# Define your internal users here |
||||
|
||||
mistborn: |
||||
hash: "__MISTBORN_HASH__" |
||||
reserved: true |
||||
backend_roles: |
||||
- "admin" |
||||
description: "Mistborn user" |
||||
|
||||
@ -0,0 +1,16 @@
@@ -0,0 +1,16 @@
|
||||
#!/bin/bash |
||||
|
||||
set -e |
||||
|
||||
if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then |
||||
echo "internal_users.yml exists. Proceeding." |
||||
exit 0 |
||||
fi |
||||
|
||||
mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1 |
||||
chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/ |
||||
cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/ |
||||
|
||||
ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n') |
||||
|
||||
sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml |
||||
@ -0,0 +1,26 @@
@@ -0,0 +1,26 @@
|
||||
#!/bin/bash |
||||
|
||||
# detect if already installed |
||||
if [ $(dpkg -s wazuh-agent &> /dev/null) -eq 0 ]; then |
||||
echo "Wazuh agent already installed" |
||||
exit 0 |
||||
fi |
||||
|
||||
# prepare repo |
||||
echo "Adding Wazuh Repository" |
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - |
||||
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list |
||||
|
||||
apt-get update |
||||
|
||||
# wait for service to be listening |
||||
while ! nc -z 10.2.3.1 55000; do |
||||
WAIT_TIME=10 |
||||
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..." |
||||
sleep ${WAIT_TIME} |
||||
done |
||||
|
||||
# install |
||||
echo "Installing Wazuh agent" |
||||
WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent |
||||
|
||||
@ -0,0 +1,4 @@
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash |
||||
|
||||
systemctl start wazuh-agent |
||||
systemctl enable wazuh-agent |
||||
@ -0,0 +1,4 @@
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash |
||||
|
||||
systemctl stop wazuh-agent |
||||
systemctl disable wazuh-agent |
||||
@ -0,0 +1,6 @@
@@ -0,0 +1,6 @@
|
||||
#!/bin/bash |
||||
|
||||
# Elasticsearch |
||||
ELASTICSEARCH_PROD_FILE="$1" |
||||
echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE |
||||
chmod 600 $ELASTICSEARCH_PROD_FILE |
||||
@ -0,0 +1,53 @@
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash |
||||
|
||||
# Wazuh |
||||
WAZUH_PROD_FILE="$1" |
||||
echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE |
||||
echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE |
||||
|
||||
echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE |
||||
echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE |
||||
|
||||
# kibana odfe |
||||
# kibana-odfe/config/wazuh_app_config.sh |
||||
# https://wazuh |
||||
echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE |
||||
echo "API_PORT=55000" >> $WAZUH_PROD_FILE |
||||
echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE |
||||
|
||||
#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))") |
||||
|
||||
API_PASSWORD_PYTHON=$(cat << EOF |
||||
|
||||
import secrets |
||||
import random |
||||
import string |
||||
|
||||
random_pass = ([secrets.choice("@$!%*?&-_"), |
||||
secrets.choice(string.digits), |
||||
secrets.choice(string.ascii_lowercase), |
||||
secrets.choice(string.ascii_uppercase), |
||||
] |
||||
+ [secrets.choice(string.ascii_lowercase |
||||
+ string.ascii_uppercase |
||||
+ "@$!%*?&-_" |
||||
+ string.digits) for i in range(12)]) |
||||
|
||||
random.shuffle(random_pass) |
||||
random_pass = ''.join(random_pass) |
||||
print(random_pass) |
||||
|
||||
EOF |
||||
) |
||||
|
||||
API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}") |
||||
|
||||
echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE |
||||
|
||||
# kibana-odfe/config/entrypoint.sh: |
||||
# https://elasticsearch:9200 |
||||
echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE |
||||
|
||||
echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE |
||||
|
||||
chmod 600 $WAZUH_PROD_FILE |
||||
Loading…
Reference in new issue