initial plugins
This commit is contained in:
Steven Foerster
@@ -0,0 +1,70 @@
|
||||
# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
|
||||
version: '3.7'
|
||||
|
||||
services:
|
||||
wazuh:
|
||||
image: wazuh/wazuh-odfe:4.1.5
|
||||
hostname: wazuh-manager
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "${MISTBORN_BIND_IP}:1514:1514"
|
||||
- "${MISTBORN_BIND_IP}:1515:1515"
|
||||
- "${MISTBORN_BIND_IP}:514:514/udp"
|
||||
- "${MISTBORN_BIND_IP}:55000:55000"
|
||||
environment:
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=none
|
||||
env_file:
|
||||
- ../.envs/.production/.wazuh
|
||||
volumes:
|
||||
- ossec_api_configuration:/var/ossec/api/configuration
|
||||
- ossec_etc:/var/ossec/etc
|
||||
- ossec_logs:/var/ossec/logs
|
||||
- ossec_queue:/var/ossec/queue
|
||||
- ossec_var_multigroups:/var/ossec/var/multigroups
|
||||
- ossec_integrations:/var/ossec/integrations
|
||||
- ossec_active_response:/var/ossec/active-response/bin
|
||||
- ossec_agentless:/var/ossec/agentless
|
||||
- ossec_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
|
||||
wazuh-kibana:
|
||||
image: wazuh/wazuh-kibana-odfe:4.1.5
|
||||
hostname: wazuh-kibana
|
||||
restart: unless-stopped
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)"
|
||||
- "traefik.http.routers.wazuhk-http.entrypoints=web"
|
||||
- "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)"
|
||||
- "traefik.http.routers.wazuhk-https.entrypoints=websecure"
|
||||
- "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file"
|
||||
- "traefik.http.routers.wazuhk-https.tls.certresolver=basic"
|
||||
- "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601"
|
||||
#ports:
|
||||
# - "${MISTBORN_BIND_IP}:5601:5601"
|
||||
environment:
|
||||
- SERVER_SSL_ENABLED=false
|
||||
- SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
|
||||
- SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
|
||||
env_file:
|
||||
- ../.envs/.production/.wazuh
|
||||
|
||||
volumes:
|
||||
ossec_api_configuration:
|
||||
ossec_etc:
|
||||
ossec_logs:
|
||||
ossec_queue:
|
||||
ossec_var_multigroups:
|
||||
ossec_integrations:
|
||||
ossec_active_response:
|
||||
ossec_agentless:
|
||||
ossec_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
|
||||
networks:
|
||||
default:
|
||||
external:
|
||||
name: mistborn_default
|
||||
Executable
+92
@@ -0,0 +1,92 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Wazuh
|
||||
WAZUH_PROD_FILE="$1"
|
||||
echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
|
||||
echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
|
||||
echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
# kibana odfe
|
||||
# kibana-odfe/config/wazuh_app_config.sh
|
||||
# https://wazuh
|
||||
echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
|
||||
echo "API_PORT=55000" >> $WAZUH_PROD_FILE
|
||||
echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
|
||||
|
||||
#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
|
||||
|
||||
API_PASSWORD_PYTHON=$(cat << EOF
|
||||
|
||||
import secrets
|
||||
import random
|
||||
import string
|
||||
|
||||
random_pass = ([secrets.choice("@$!*?-"),
|
||||
secrets.choice(string.digits),
|
||||
secrets.choice(string.ascii_lowercase),
|
||||
secrets.choice(string.ascii_uppercase),
|
||||
]
|
||||
+ [secrets.choice(string.ascii_lowercase
|
||||
+ string.ascii_uppercase
|
||||
+ "@$!*?-"
|
||||
+ string.digits) for i in range(12)])
|
||||
|
||||
random.shuffle(random_pass)
|
||||
random_pass = ''.join(random_pass)
|
||||
print(random_pass)
|
||||
|
||||
EOF
|
||||
)
|
||||
|
||||
API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
|
||||
|
||||
echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
|
||||
|
||||
# kibana-odfe/config/entrypoint.sh:
|
||||
# https://elasticsearch:9200
|
||||
echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
|
||||
|
||||
|
||||
cat >> ${WAZUH_PROD_FILE}<< EOF
|
||||
|
||||
PATTERN="wazuh-alerts-*"
|
||||
|
||||
CHECKS_PATTERN=true
|
||||
CHECKS_TEMPLATE=true
|
||||
CHECKS_API=true
|
||||
CHECKS_SETUP=true
|
||||
|
||||
EXTENSIONS_PCI=true
|
||||
EXTENSIONS_GDPR=true
|
||||
EXTENSIONS_HIPAA=true
|
||||
EXTENSIONS_NIST=true
|
||||
EXTENSIONS_TSC=true
|
||||
EXTENSIONS_AUDIT=true
|
||||
EXTENSIONS_OSCAP=false
|
||||
EXTENSIONS_CISCAT=false
|
||||
EXTENSIONS_AWS=false
|
||||
EXTENSIONS_GCP=false
|
||||
EXTENSIONS_VIRUSTOTAL=true
|
||||
EXTENSIONS_OSQUERY=true
|
||||
EXTENSIONS_DOCKER=true
|
||||
|
||||
APP_TIMEOUT=20000
|
||||
|
||||
API_SELECTOR=true
|
||||
IP_SELECTOR=true
|
||||
IP_IGNORE="[]"
|
||||
|
||||
WAZUH_MONITORING_ENABLED=true
|
||||
WAZUH_MONITORING_FREQUENCY=900
|
||||
WAZUH_MONITORING_SHARDS=2
|
||||
WAZUH_MONITORING_REPLICAS=0
|
||||
|
||||
ADMIN_PRIVILEGES=true
|
||||
|
||||
EOF
|
||||
|
||||
echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
|
||||
|
||||
chmod 600 $WAZUH_PROD_FILE
|
||||
@@ -0,0 +1,8 @@
|
||||
[DEFAULT]
|
||||
name = wazuh
|
||||
subdomain = wazuh
|
||||
compose = compose/docker-compose.yml
|
||||
service = service/plugin.service
|
||||
environment = environment/environment.sh
|
||||
resources = resources
|
||||
|
||||
Executable
+30
@@ -0,0 +1,30 @@
|
||||
#!/bin/bash
|
||||
|
||||
# detect if already installed
|
||||
if dpkg -s wazuh-agent &> /dev/null; then
|
||||
echo "Wazuh agent already installed"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# install curl
|
||||
echo "install curl"
|
||||
sudo -E apt-get install -y curl
|
||||
|
||||
# prepare repo
|
||||
echo "Adding Wazuh Repository"
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
|
||||
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
|
||||
|
||||
apt-get update
|
||||
|
||||
# wait for service to be listening
|
||||
while ! nc -z 10.2.3.1 55000; do
|
||||
WAIT_TIME=10
|
||||
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
|
||||
sleep ${WAIT_TIME}
|
||||
done
|
||||
|
||||
# install
|
||||
echo "Installing Wazuh agent"
|
||||
WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
|
||||
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl start wazuh-agent
|
||||
systemctl enable wazuh-agent
|
||||
Executable
+4
@@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl stop wazuh-agent
|
||||
systemctl disable wazuh-agent
|
||||
+129
@@ -0,0 +1,129 @@
|
||||
#!/bin/bash
|
||||
|
||||
set -e
|
||||
|
||||
# detect if suricata is installed
|
||||
if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
|
||||
echo "Suricata Installed"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
source /opt/mistborn/scripts/subinstallers/platform.sh
|
||||
|
||||
# minimal dependencies
|
||||
sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \
|
||||
libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
|
||||
make libmagic-dev libjansson-dev jq wget
|
||||
|
||||
## recommended dependencies
|
||||
#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev \
|
||||
# libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
|
||||
# libcap-ng-dev libcap-ng0 make libmagic-dev \
|
||||
# libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
|
||||
# python-yaml rustc cargo
|
||||
|
||||
# iptables/nftables integration
|
||||
sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 \
|
||||
libnetfilter-log-dev libnetfilter-log1 \
|
||||
libnfnetlink-dev libnfnetlink0
|
||||
|
||||
|
||||
if [ "$DISTRO" == "ubuntu" ]; then
|
||||
echo "Installing Suricata Ubuntu PPA"
|
||||
sudo -E add-apt-repository -y ppa:oisf/suricata-stable
|
||||
sudo -E apt-get update
|
||||
sudo -E apt-get install -y suricata
|
||||
elif [ "$DISTRO" == "debian" ]; then
|
||||
# retrieve version codename
|
||||
source /etc/os-release
|
||||
echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
|
||||
sudo -E tee /etc/apt/sources.list.d/backports.list
|
||||
sudo -E apt-get update
|
||||
sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
|
||||
else
|
||||
echo "Basic Suricata installation"
|
||||
sudo -E apt-get install -y suricata
|
||||
fi
|
||||
|
||||
# # iptables
|
||||
# sudo iptables -A INPUT -j NFQUEUE
|
||||
# sudo iptables -I FORWARD -j NFQUEUE
|
||||
# sudo iptables -I OUTPUT -j NFQUEUE
|
||||
|
||||
# # rsyslog to create /var/log/suricata.log
|
||||
# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
|
||||
# sudo chown root:root /etc/rsyslog.d/20-suricata.conf
|
||||
# sudo systemctl restart rsyslog
|
||||
|
||||
# rules
|
||||
pushd .
|
||||
cd /tmp
|
||||
wget https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz
|
||||
tar zxvf emerging.rules.tar.gz
|
||||
sudo -E rm /etc/suricata/rules/* -f
|
||||
sudo -E mv rules/*.rules /etc/suricata/rules/
|
||||
popd
|
||||
|
||||
# suricata yaml
|
||||
sudo -E rm -f /etc/suricata/suricata.yaml
|
||||
sudo -E wget -O /etc/suricata/suricata.yaml http://www.branchnetconsulting.com/wazuh/suricata.yaml
|
||||
|
||||
IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
|
||||
sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
|
||||
sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
|
||||
|
||||
#systemctl restart suricata
|
||||
|
||||
# wait for service to be listening
|
||||
while ! nc -z 10.2.3.1 55000; do
|
||||
WAIT_TIME=10
|
||||
echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
|
||||
sleep ${WAIT_TIME}
|
||||
done
|
||||
|
||||
# set working directory to mistborn for docker-compose
|
||||
pushd .
|
||||
cd /opt/mistborn
|
||||
|
||||
# ensure group exists
|
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
|
||||
|
||||
# add this host to group
|
||||
WAZUH_ID=$(sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
|
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
|
||||
|
||||
# write agent.conf
|
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
|
||||
<agent_config>
|
||||
<localfile>
|
||||
<log_format>json</log_format>
|
||||
<location>/var/log/suricata/eve.json</location>
|
||||
</localfile>
|
||||
</agent_config>
|
||||
EOF
|
||||
"
|
||||
|
||||
# restart manager
|
||||
sudo docker-compose --env-file /opt/mistborn/.env -f extra/wazuh.yml restart wazuh
|
||||
|
||||
popd
|
||||
|
||||
# suricata-update
|
||||
sudo -E apt install python3-pip
|
||||
sudo -E pip3 install pyyaml
|
||||
sudo -E pip3 install https://github.com/OISF/suricata-update/archive/master.zip
|
||||
|
||||
sudo -E pip3 install --pre --upgrade suricata-update
|
||||
|
||||
# sudo -E suricata-update enable-source oisf/trafficid
|
||||
# sudo -E suricata-update enable-source etnetera/aggressive
|
||||
# sudo -E suricata-update enable-source sslbl/ssl-fp-blacklist
|
||||
# sudo -E suricata-update enable-source et/open
|
||||
# sudo -E suricata-update enable-source tgreen/hunting
|
||||
# sudo -E suricata-update enable-source sslbl/ja3-fingerprints
|
||||
# sudo -E suricata-update enable-source ptresearch/attackdetection
|
||||
|
||||
sudo -E suricata-update
|
||||
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl restart suricata
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl start suricata
|
||||
systemctl enable suricata
|
||||
|
||||
#apt-get install -y python-pyinotify
|
||||
#python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
#!/bin/bash
|
||||
|
||||
systemctl stop suricata
|
||||
systemctl disable suricata
|
||||
|
||||
#kill $(pgrep -f suri_reloader) 2>/dev/null
|
||||
@@ -0,0 +1,30 @@
|
||||
[Unit]
|
||||
Description=Mistborn Wazuh Service
|
||||
Requires=Mistborn-elasticsearch.service
|
||||
After=Mistborn-elasticsearch.service
|
||||
PartOf=Mistborn-base.service
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
RestartSec=15
|
||||
TimeoutStartSec=600
|
||||
User=root
|
||||
Group=docker
|
||||
PermissionsStartOnly=true
|
||||
# Shutdown container (if running) when unit is stopped
|
||||
ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
|
||||
# Start container when unit is started
|
||||
ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
|
||||
# Agent install
|
||||
ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
|
||||
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
|
||||
# Suricata
|
||||
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_init.sh
|
||||
ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_start.sh
|
||||
# Stop container when unit is stopped
|
||||
ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
|
||||
ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/suricata/suricata_stop.sh
|
||||
ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=Mistborn-base.service
|
||||
Reference in New Issue
Block a user