wazuh env

handle ungraceful restarts

Closes #170

See merge request cyber5k/mistborn!81

README.md

@@ -39,6 +39,7 @@ These tools are not vital to Mistborn itself but are integrated to enhance secur
 - [Pi-hole](https://pi-hole.net): A DNS server for network-wide ad blocking, etc
 - [DNScrypt](https://www.dnscrypt.org): prevents DNS spoofing via cryptographic signatures to verify that responses originate from the chosen DNS resolver and haven't been tampered
 - [Traefik](https://docs.traefik.io): A modern, efficient reverse-proxy
+- [Wazuh](https://wazuh.com/): Wazuh is a free, open source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.
 
 Within Mistborn is a panel to enable and manage these free extra services (off by default), locally hosted in Docker containers:
 - [Home Assistant](https://www.home-assistant.io): Open source home automation that puts local control and privacy first
@@ -51,6 +52,7 @@ Within Mistborn is a panel to enable and manage these free extra services (off b
 - [Tor](https://www.torproject.org): The Onion Router. One tool in the arsenal of online security and privacy.
 - [Jitsi](https://jitsi.org): Multi-platform open-source video conferencing
 - [Guacamole](https://guacamole.apache.org): A clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH.
+- [RaspAP](https://raspap.com/): The easiest, full-featured wireless router setup for Debian-based devices. Period. (Mistborn integration in alpha testing).
 
 # Quickstart
 Tested Operating Systems (in order of thoroughness):
@@ -81,6 +83,7 @@ Recommended System Specifications:
 | Default                | Bare bones + Cockpit                                                          | 2 GB+ | 15 GB     |
 | Low-resource services  | Default + Bitwarden, Tor, Syncthing                                           | 4 GB  | 20 GB     |
 | High-resource services | Default + Jitsi, Nextcloud, Jellyfin, Rocket.Chat, Home Assistant, OnlyOffice | 6 GB+ | 25 GB+    |
+| SIEM                   | Default + Wazuh + Extras                                                      | 16 GB+ | 100 GB+   |
 
 Starting from base installation
 ```
@@ -108,6 +111,18 @@ Mistborn protects your data in a variety of ways:
 
 See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see more network diagrams and the network scan results for Mistborn.
 
+# Security Information & Event Management (SIEM)
+
+![Mistborn Security Center](https://gitlab.com/cyber5k/public/-/raw/master/graphics/home.mistborn_soc.png)
+
+The Mistborn Security Operations Center provides SIEM services with Wazuh. The Wazuh Manager requires an Open Distro for Elasticsearch backend. When the Mistborn host has >8 GB RAM the provided Elasticsearch backend can be used. Just click "Start Wazuh" on the `Security Center` page and enjoy your Enterprise-grade SIEM. Wazuh agents can be installed on just about any OS and all Wazuh agent traffic is communicated over the Wireguard connections. Instructions for adding endpoint agents can be found within Wazuh itself.
+
+![Mistborn Security Center: Wazuh Modules](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_modules.png)
+
+The Wazuh Kibana plugin leverages the power of Elasticsearch:
+
+![Mistborn Security Center: Wazuh Dashboard](https://gitlab.com/cyber5k/public/-/raw/master/graphics/wazuh_se_dashboard.png)
+
 # Coppercloud
 Pihole provides a way to block outgoing DNS requests for given lists of blocked domains. Coppercloud provides a way to block outgoing network calls of all types to given lists of IP addresses (IPv4 only for now). This is especially useful for blocking outgoing telemetry (data and state sharing) to owners of software running on all of your devices.
 
@@ -288,6 +303,8 @@ Mistborn uses the following domains (that can be reached by all Wireguard client
 | OnlyOffice | onlyoffice.mistborn | Off |
 | Jitsi | jitsi.mistborn | Off |
 | Guacamole | guac.mistborn | Off |
+| RaspAP | raspap.mistborn | Off |
+| Wazuh | wazuh.mistborn | Off |
 
 # Default Credentials
 These are the default credentials to use in the services you choose to use:
@@ -296,8 +313,10 @@ These are the default credentials to use in the services you choose to use:
 | ------- | -------- | -------- |
 | Pihole |  | {{default mistborn password}} |
 | Cockpit | cockpit | {{default mistborn password}} |
+| Wazuh | mistborn | {{default mistborn password}} |
 | Nextcloud | mistborn | {{default mistborn password}} |
 | Guacamole | mistborn | {{default mistborn password }} |
+| RaspAP | mistborn | {{default mistborn password}} |
 
 You can find the credentials sent to the Docker containers in: `/opt/mistborn/.envs/.production/`
 
@@ -461,6 +480,8 @@ sudo journalctl -xfu Mistborn-guacamole
 sudo journalctl -xfu Mistborn-rocketchat
 sudo journalctl -xfu Mistborn-onlyoffice
 sudo journalctl -xfu Mistborn-tor
+sudo journalctl -xfu Mistborn-raspap
+sudo journalctl -xfu Mistborn-wazuh
 ```
 
 ## Troubleshooting Docker
@@ -526,8 +547,6 @@ Many features and refinements are in the works at various stages including:
 - Plugins for Extra Services (enabling third-party development)
 - Plugin repository
 - IPv6 support
-- Integration with RaspAP to enable managing an Access Point for local network connections
-- Internal network scan tool and feedback
 - Anomaly detection in network traffic
 
 # Featured In

base.yml

@@ -158,7 +158,7 @@ services:
   
   pihole:
    container_name: mistborn_production_pihole
-   image: pihole/pihole:latest
+   image: pihole/pihole:v5.7
    env_file:
      - ./.envs/.production/.pihole
    ports:

extra/bitwarden.yml

@@ -10,16 +10,16 @@ services:
       - ../../mistborn_volumes/extra/bitwarden:/data
     labels:
       - "traefik.enable=true"
-      # - "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
-      # - "traefik.http.routers.bitwarden-http.entrypoints=web"
-      # - "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
-      # - "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
-      # - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
-      # - "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
-      # - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
-      # - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
+      - "traefik.http.routers.bitwarden-http.rule=Host(`bitwarden.mistborn`)"
+      - "traefik.http.routers.bitwarden-http.entrypoints=web"
+      - "traefik.http.routers.bitwarden-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.bitwarden-https.rule=Host(`bitwarden.mistborn`)"
+      - "traefik.http.routers.bitwarden-https.entrypoints=websecure"
+      - "traefik.http.routers.bitwarden-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.bitwarden-https.tls.certresolver=basic"
+      - "traefik.http.services.bitwarden-service.loadbalancer.server.port=80"
     ports:
-      - 3012:3012/tcp
+      - "${MISTBORN_BIND_IP}:3012:3012/tcp"
     restart: unless-stopped
 
 networks:

extra/elasticsearch.yml

@@ -0,0 +1,30 @@
+version: '3.7'
+
+services:
+
+  elasticsearch:
+    image: amazon/opendistro-for-elasticsearch:1.12.0
+    hostname: elasticsearch
+    restart: unless-stopped
+    ports:
+      - "${MISTBORN_BIND_IP}:9200:9200"
+    environment:
+      - discovery.type=single-node
+      - cluster.name=mistborn-cluster
+      - network.host=0.0.0.0
+      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
+      - bootstrap.memory_lock=true
+    volumes:
+      - ../../mistborn_volumes/extra/elasticsearch/init/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
+      nofile:
+        soft: 65536
+        hard: 65536
+
+networks:
+  default:
+    external:
+      name: mistborn_default

extra/jitsi-meet.yml

@@ -216,8 +216,8 @@ services:
         image: jitsi/jvb:latest
         restart: unless-stopped
         ports:
-            - '${JVB_PORT}:${JVB_PORT}/udp'
-            - '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
+            - "${MISTBORN_BIND_IP}:${JVB_PORT}:${JVB_PORT}/udp"
+            - "${MISTBORN_BIND_IP}:${JVB_TCP_PORT}:${JVB_TCP_PORT}"
         volumes:
             - ${CONFIG}/jvb:/config:Z
         env_file:

extra/raspap.yml

@@ -2,12 +2,9 @@ version: '3'
 
 services:
   raspap:
-    build:
-      context: ..
-      dockerfile: ./compose/production/raspap/Dockerfile
-    #user: root
-    image: mistborn_production_raspap
+    image: "cyber5k/raspap:${MISTBORN_TAG}"
     container_name: mistborn_production_raspap
+    #network_mode: host
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.raspap-http.rule=Host(`raspap.mistborn`)"
@@ -19,10 +16,16 @@ services:
       - "traefik.http.routers.raspap-https.tls.certresolver=basic"
       - "traefik.http.services.raspap-service.loadbalancer.server.port=80"
     env_file:
-      - ../.envs/.production/.pihole
-    command: /start
+      - ../.envs/.production/.raspap
+    cap_add:
+      #- NET_ADMIN
+      - SYS_ADMIN
+      #- CAP_FOWNER
+    privileged: true
     volumes:
-      - ../../mistborn_volumes/extra/raspap/etc-raspap:/etc/raspap
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    #command: /start
+    restart: unless-stopped
 
 networks:
   default:

extra/scirius.yml

@@ -0,0 +1,72 @@
+version: '3'
+
+services:
+  scirius:
+    container_name: mistborn_production_scirius
+    image: "cyber5k/scirius:${MISTBORN_TAG}"
+    #environment:
+    #  - SECRET_KEY: <SECRET KEY>
+    env_file:
+      - ../.envs/.production/.wazuh
+      - ../.envs/.production/.scirius
+    volumes:
+      - /var/log/suricata:/logs
+      - /etc/suricata/rules:/etc/suricata/rules
+      - ../../mistborn_volumes/extra/scirius/static:/static
+      - ../../mistborn_volumes/extra/scirius/data:/data
+      - /var/run:/var/run:ro
+      - /var/run/suricata/suricata-command.socket:/var/run/suricata/suricata-command.socket:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.scirius-http.rule=Host(`scirius.mistborn`)"
+      - "traefik.http.routers.scirius-http.entrypoints=web"
+      - "traefik.http.routers.scirius-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.scirius-https.rule=Host(`scirius.mistborn`)"
+      - "traefik.http.routers.scirius-https.entrypoints=websecure"
+      - "traefik.http.routers.scirius-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.scirius-https.tls.certresolver=basic"
+      - "traefik.http.services.scirius-service.loadbalancer.server.port=8000"
+    restart: unless-stopped 
+
+#   filebeat:
+#     image: docker.elastic.co/beats/filebeat:${ELASTIC_VERSION:-7.9.1}
+#     # https://github.com/docker/swarmkit/issues/1951
+#     hostname: "{{.Node.Hostname}}-filebeat"
+#     # Need to override user so we can access the log files, and docker.sock
+#     user: root
+#     configs:
+#       - source: fb_config
+#         target: /usr/share/filebeat/filebeat.yml
+#     volumes:
+#       - filebeat:/usr/share/filebeat/data
+#       - /var/run/docker.sock:/var/run/docker.sock
+#       # This is needed for filebeat to load container log path as specified in filebeat.yml
+#       - /var/lib/docker/containers/:/var/lib/docker/containers/:ro
+
+#       # # This is needed for filebeat to load jenkins build log path as specified in filebeat.yml
+#       # - /var/lib/docker/volumes/jenkins_home/_data/jobs/:/var/lib/docker/volumes/jenkins_home/_data/jobs/:ro
+
+#       # This is needed for filebeat to load logs for system and auth modules
+#       - /var/log/:/var/log/:ro
+#       # This is needed for filebeat to load logs for auditd module. you might have to install audit system
+#       # on ubuntu first (sudo apt-get install -y auditd audispd-plugins)
+#       - /var/log/audit/:/var/log/audit/:ro
+#     environment:
+#       - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST}
+#       - KIBANA_HOST=${KIBANA_HOST}
+#       - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME}
+#       - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
+#     # disable strict permission checks
+#     command: ["--strict.perms=false"]
+
+# volumes:
+#   filebeat:
+
+networks:
+  default:
+    external:
+      name: mistborn_default
+
+# configs:
+#   fb_config:
+#     file: /opt/mistborn_volumes/scirius/init/filebeat.docker.yml

extra/syncthing.yml

@@ -15,8 +15,8 @@ services:
       - ../../mistborn_volumes/extra/syncthing/data2:/data2
     ports:
       #- 8384:8384
-      - 22000:22000/tcp # listening port
-      - 21027:21027/udp # protocol discovery
+      - "${MISTBORN_BIND_IP}:22000:22000/tcp" # listening port
+      - "${MISTBORN_BIND_IP}:21027:21027/udp" # protocol discovery
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.syncthing-http.rule=Host(`syncthing.mistborn`)"

extra/tor.yml

@@ -8,7 +8,7 @@ services:
     image: mistborn_production_tor
     container_name: mistborn_production_tor
     ports:
-      - 9150:9150/tcp
+      - "${MISTBORN_BIND_IP}:9150:9150/tcp"
 
 networks:
   default:

extra/wazuh.yml

@@ -0,0 +1,70 @@
+# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
+version: '3.7'
+
+services:
+  wazuh:
+    image: wazuh/wazuh-odfe:4.1.2
+    hostname: wazuh-manager
+    restart: unless-stopped
+    ports:
+      - "${MISTBORN_BIND_IP}:1514:1514"
+      - "${MISTBORN_BIND_IP}:1515:1515"
+      - "${MISTBORN_BIND_IP}:514:514/udp"
+      - "${MISTBORN_BIND_IP}:55000:55000"
+    environment:
+      - FILEBEAT_SSL_VERIFICATION_MODE=none
+    env_file:
+      - ../.envs/.production/.wazuh
+    volumes:
+      - ossec_api_configuration:/var/ossec/api/configuration
+      - ossec_etc:/var/ossec/etc
+      - ossec_logs:/var/ossec/logs
+      - ossec_queue:/var/ossec/queue
+      - ossec_var_multigroups:/var/ossec/var/multigroups
+      - ossec_integrations:/var/ossec/integrations
+      - ossec_active_response:/var/ossec/active-response/bin
+      - ossec_agentless:/var/ossec/agentless
+      - ossec_wodles:/var/ossec/wodles
+      - filebeat_etc:/etc/filebeat
+      - filebeat_var:/var/lib/filebeat
+
+  wazuh-kibana:
+    image: wazuh/wazuh-kibana-odfe:4.1.2
+    hostname: wazuh-kibana
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.wazuhk-http.rule=Host(`wazuh.mistborn`)"
+      - "traefik.http.routers.wazuhk-http.entrypoints=web"
+      - "traefik.http.routers.wazuhk-http.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.wazuhk-https.rule=Host(`wazuh.mistborn`)"
+      - "traefik.http.routers.wazuhk-https.entrypoints=websecure"
+      - "traefik.http.routers.wazuhk-https.middlewares=mistborn_auth@file"
+      - "traefik.http.routers.wazuhk-https.tls.certresolver=basic"
+      - "traefik.http.services.wazuhk-service.loadbalancer.server.port=5601"
+    #ports:
+    #  - "${MISTBORN_BIND_IP}:5601:5601"
+    environment:
+      - SERVER_SSL_ENABLED=false
+      - SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/opendistroforelasticsearch.example.org.cert
+      - SERVER_SSL_KEY=/usr/share/kibana/config/opendistroforelasticsearch.example.org.key
+    env_file:
+      - ../.envs/.production/.wazuh
+
+volumes:
+  ossec_api_configuration:
+  ossec_etc:
+  ossec_logs:
+  ossec_queue:
+  ossec_var_multigroups:
+  ossec_integrations:
+  ossec_active_response:
+  ossec_agentless:
+  ossec_wodles:
+  filebeat_etc:
+  filebeat_var:
+
+networks:
+  default:
+    external:
+      name: mistborn_default

scripts/conf/docker-daemon.json

@@ -0,0 +1,3 @@
+{
+    "shutdown-timeout": 60 
+}

scripts/install.sh

@@ -69,6 +69,10 @@ pushd .
 cd /opt/mistborn
 git submodule update --init --recursive
 
+# Check updates
+echo "Checking updates"
+source ./scripts/subinstallers/check_updates.sh
+
 # MISTBORN_DEFAULT_PASSWORD
 source ./scripts/subinstallers/passwd.sh
 
@@ -90,8 +94,7 @@ else
     echo "SSH key exists for $USER"
 fi
 
-# initial load update package list
-sudo apt-get update
+# initial load update package list during check_updates.sh
 
 # install figlet
 sudo -E apt-get install -y figlet

scripts/services/Mistborn-base.service

@@ -7,11 +7,17 @@ After=netfilter-persistent.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
 # Shutdown container (if running) when unit is stopped
 EnvironmentFile=/opt/mistborn/.env
+
+# stop all containers joined to mistborn_default network
+ExecStartPre=-/usr/bin/bash -c "docker container stop $(docker network inspect mistborn_default | grep Name | tail -n +2 | cut -d':' -f2 | tr -d ',\"') 2>/dev/null"
+
+# bring down the base service
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml down
 
 ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/base.yml build

scripts/services/Mistborn-bitwarden.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -21,4 +22,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh bitwarden docker-comp
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3012 -j MISTBORN_LOG_DROP
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-elasticsearch.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Mistborn Elasticsearch Service
+Requires=Mistborn-base.service
+After=Mistborn-base.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/usr/sbin/sysctl -w vm.max_map_count=262144
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml up --build
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh elasticsearch docker-compose -f /opt/mistborn/extra/elasticsearch.yml down
+
+[Install]
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-guacamole.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -19,4 +20,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh guacamole docker-comp
 # Post stop
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-homeassistant.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -19,4 +20,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh homeassistant docker-
 # Post stop
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-jellyfin.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -19,4 +20,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jellyfin docker-compo
 # Post stop
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-jitsi.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -23,4 +24,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi docker-compose
 ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh jitsi /opt/mistborn/scripts/services/jitsi/iptables_down.sh
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-nextcloud.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -19,4 +20,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh nextcloud docker-comp
 # Post stop
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-onlyoffice.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -19,4 +20,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh onlyoffice docker-com
 # Post stop
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-raspap.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Mistborn RaspAP Service 
+Requires=Mistborn-base.service
+After=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
+#ExecStartPre=/bin/bash /opt/mistborn_volumes/extra/raspap/etc-raspap/hostapd/servicestart.sh --interface uap0 --seconds 3
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
+
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml up --build
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh raspap docker-compose -f /opt/mistborn/extra/raspap.yml down
+ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 8095 -j MISTBORN_LOG_DROP
+# Post stop
+
+[Install]
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-rocketchat.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -21,4 +22,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh rocketchat docker-com
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 3001 -j MISTBORN_LOG_DROP
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-scirius.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=Mistborn Scirius Service
+Requires=Mistborn-wazuh.service
+After=Mistborn-wazuh.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
+
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml up --build
+# Suricata
+ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_start.sh
+
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius docker-compose -f /opt/mistborn/extra/scirius.yml down
+# Post stop
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh,scirius /opt/mistborn/scripts/services/scirius/suricata_stop.sh
+
+[Install]
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-syncthing.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -23,4 +24,4 @@ ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport 21027 -j MI
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 22000 -j MISTBORN_LOG_DROP
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-tor.service

@@ -6,6 +6,7 @@ PartOf=Mistborn-base.service
 
 [Service]
 Restart=always
+RestartSec=15
 User=root
 Group=docker
 PermissionsStartOnly=true
@@ -21,4 +22,4 @@ ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh tor docker-compose -f
 ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport 9150 -j MISTBORN_LOG_DROP
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=Mistborn-base.service

scripts/services/Mistborn-wazuh.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=Mistborn Wazuh Service
+Requires=Mistborn-elasticsearch.service
+After=Mistborn-elasticsearch.service
+PartOf=Mistborn-base.service
+
+[Service]
+Restart=always
+RestartSec=15
+User=root
+Group=docker
+PermissionsStartOnly=true
+# Shutdown container (if running) when unit is stopped
+ExecStartPre=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
+# Start container when unit is started
+ExecStart=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml up --build
+# Agent install
+ExecStartPost=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent.sh
+ExecStartPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_start.sh
+# Stop container when unit is stopped
+ExecStop=/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh docker-compose -f /opt/mistborn/extra/wazuh.yml down
+ExecStopPost=-/opt/mistborn/scripts/wrappers/mistborn_docker.sh wazuh /opt/mistborn/scripts/services/wazuh/agent_stop.sh
+
+[Install]
+WantedBy=Mistborn-base.service

scripts/services/elasticsearch/files/internal_users.yml

@@ -0,0 +1,17 @@
+---
+# This is the internal user database
+# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
+
+_meta:
+  type: "internalusers"
+  config_version: 2
+
+# Define your internal users here
+
+mistborn:
+  hash: "__MISTBORN_HASH__"
+  reserved: true
+  backend_roles:
+  - "admin"
+  description: "Mistborn user"
+

scripts/services/elasticsearch/init.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+set -e
+
+if [[ -f "/opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml" ]]; then
+    echo "internal_users.yml exists. Proceeding."
+    exit 0
+fi
+
+mkdir -p /opt/mistborn_volumes/extra/elasticsearch/init/ >/dev/null 2>&1
+chmod -R +x /opt/mistborn_volumes/extra/elasticsearch/init/
+cp /opt/mistborn/scripts/services/elasticsearch/files/internal_users.yml /opt/mistborn_volumes/extra/elasticsearch/init/
+
+ELASTICSEARCH_MISTBORN_HASHED=$(docker run --rm amazon/opendistro-for-elasticsearch:1.12.0 bash /usr/share/elasticsearch/plugins/opendistro_security/tools/hash.sh -p ${MISTBORN_DEFAULT_PASSWORD} | tr -d '\n')
+
+sed -i "s|__MISTBORN_HASH__|${ELASTICSEARCH_MISTBORN_HASHED}|" /opt/mistborn_volumes/extra/elasticsearch/init/internal_users.yml

scripts/services/raspap/Mistborn-raspap.service

@@ -1,21 +0,0 @@
-[Unit]
-Description=Mistborn RaspAP Service 
-Requires=Mistborn-base.service
-After=Mistborn-base.service
-
-[Service]
-Restart=always
-User=root
-Group=docker
-PermissionsStartOnly=true
-# Shutdown container (if running) when unit is stopped
-ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
-
-# Start container when unit is started
-ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml up --build
-# Stop container when unit is stopped
-ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/raspap.yml down
-# Post stop
-
-[Install]
-WantedBy=multi-user.target

scripts/services/raspap/install.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-# install on gateway
-sudo apt-get install -y hostapd vnstat

scripts/services/scirius/files/agent.conf

@@ -0,0 +1,6 @@
+<agent_config>
+    <localfile>
+        <log_format>json</log_format>
+        <location>/var/log/suricata/eve.json</location>
+    </localfile>
+</agent_config>

scripts/services/scirius/files/filebeat.docker.yml

@@ -0,0 +1,62 @@
+filebeat.modules:
+- module: suricata 
+  eve:
+    enabled: true
+    var.paths: ["/var/log/suricata/eve.json"]
+# - module: system
+#   syslog:
+#     enabled: true
+#   auth:
+#     enabled: true
+# - module: auditd
+#   log:
+#     # - Does not look like Auditd is supported in Alpine linux: https://github.com/linuxkit/linuxkit/issues/52
+#     # - CentOS does not need us to install the audit system, it ships as standard. If you are using Ubuntu, though,
+#     # this is probably something you would want to install. (sudo apt-get install -y auditd audispd-plugins)
+#     enabled: true
+
+#filebeat.inputs:
+#- type: container
+#  enabled: true
+#  paths:
+#    -/var/lib/docker/containers/*/*.log
+#  stream: all # can be all, stdout or stderr
+
+#========================== Filebeat autodiscover ==============================
+# See this URL on how to run Apache2 Filebeat module: # https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html
+filebeat.autodiscover:
+  providers:
+    - type: docker
+      # https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html
+      # This URL alos contains instructions on multi-line logs
+      hints.enabled: true
+
+#================================ Processors ===================================
+processors:
+#- add_cloud_metadata: ~
+- add_docker_metadata: ~
+- add_locale:
+    format: offset
+- add_host_metadata:
+    netinfo.enabled: true
+
+#========================== Elasticsearch output ===============================
+output.elasticsearch:
+  hosts: ["${ELASTICSEARCH_HOST}:9200"]
+  username: ${ELASTICSEARCH_USERNAME}
+  password: ${ELASTICSEARCH_PASSWORD}
+
+#============================== Dashboards =====================================
+setup.dashboards:
+  enabled: true
+
+#============================== Kibana =========================================
+setup.kibana:
+  host: "${KIBANA_HOST}:80"
+  username: ${ELASTICSEARCH_USERNAME}
+  password: ${ELASTICSEARCH_PASSWORD}
+
+#============================== Xpack Monitoring ===============================
+xpack.monitoring:
+  enabled: true
+  elasticsearch:

scripts/services/scirius/init.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+
+set -e
+
+# detect if suricata is installed
+if [[ $(dpkg-query -W -f='${Status}' suricata 2>/dev/null | grep -c "ok installed") -eq 1 ]]; then
+    echo "Suricata Installed"
+    exit 0
+fi
+
+source /opt/mistborn/scripts/subinstallers/platform.sh
+
+# minimal dependencies
+sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+                libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+                make libmagic-dev libjansson-dev
+
+## recommended dependencies
+#sudo -E apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev build-essential libpcap-dev   \
+#                libnet1-dev libyaml-0-2 libyaml-dev pkg-config zlib1g zlib1g-dev \
+#                libcap-ng-dev libcap-ng0 make libmagic-dev         \
+#                libgeoip-dev liblua5.1-dev libhiredis-dev libevent-dev \
+#                python-yaml rustc cargo
+
+# iptables/nftables integration
+sudo -E apt-get -y install libnetfilter-queue-dev libnetfilter-queue1  \
+                libnetfilter-log-dev libnetfilter-log1      \
+                libnfnetlink-dev libnfnetlink0
+
+
+if [ "$DISTRO" == "ubuntu" ]; then
+    echo "Installing Suricata Ubuntu PPA"
+    sudo -E add-apt-repository -y ppa:oisf/suricata-stable
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata
+elif [ "$DISTRO" == "debian" ]; then
+    # retrieve version codename
+    source /etc/os-release
+    echo "deb http://http.debian.net/debian $VERSION_CODENAME-backports main" | \
+        sudo -E tee /etc/apt/sources.list.d/backports.list
+    sudo -E apt-get update
+    sudo -E apt-get install -y suricata -t ${VERSION_CODENAME}-backports
+else
+    echo "Basic Suricata installation"
+    sudo -E apt-get install -y suricata
+fi
+
+# # iptables
+# sudo iptables -A INPUT -j NFQUEUE
+# sudo iptables -I FORWARD -j NFQUEUE
+# sudo iptables -I OUTPUT -j NFQUEUE
+
+# # rsyslog to create /var/log/suricata.log
+# sudo cp ./scripts/conf/20-suricata.conf /etc/rsyslog.d/
+# sudo chown root:root /etc/rsyslog.d/20-suricata.conf
+# sudo systemctl restart rsyslog
+
+IFACE=$(ip -o -4 route show to default | awk 'NR==1{print $5}')
+sudo sed -i "s/eth0/${IFACE}/g" /etc/suricata/suricata.yaml
+sudo sed -i "s/eth0/${IFACE}/g" /etc/default/suricata
+
+systemctl restart suricata
+
+# wait for service to be listening
+while ! nc -z 10.2.3.1 55000; do
+    WAIT_TIME=10
+    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
+    sleep ${WAIT_TIME}
+done
+
+# set working directory to mistborn for docker-compose
+pushd .
+cd /opt/mistborn
+
+# ensure group exists
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -g suricata -q 2>/dev/null
+
+# add this host to group
+WAZUH_ID=$(sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/manage_agents -l | egrep ^\ *ID | grep $(hostname) | awk '{print $2}' | tr -d ',')
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh /var/ossec/bin/agent_groups -a -i ${WAZUH_ID} -g suricata -q
+
+# write agent.conf
+sudo docker-compose -f extra/wazuh.yml exec -T wazuh bash -c "cat > /var/ossec/etc/shared/suricata/agent.conf << EOF
+<agent_config>
+    <localfile>
+        <log_format>json</log_format>
+        <location>/var/log/suricata/eve.json</location>
+    </localfile>
+</agent_config>
+EOF
+"
+
+# restart manager
+sudo docker-compose -f extra/wazuh.yml restart wazuh
+
+popd
+
+
+mkdir -p /opt/mistborn_volumes/extra/scirius/init/ >/dev/null 2>&1
+chmod -R +x /opt/mistborn_volumes/extra/scirius/init/
+cp /opt/mistborn/scripts/services/scirius/files/filebeat.docker.yml /opt/mistborn_volumes/extra/scirius/init/

scripts/services/scirius/suri_reloader

@@ -0,0 +1,117 @@
+#!/usr/bin/python3
+"""
+Copyright(C) 2014-2020, Stamus Networks
+Written by Eric Leblond <eleblond@stamus-networks.com>
+
+This file is part of Scirius.
+
+Scirius is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+Scirius is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with Scirius.  If not, see <http://www.gnu.org/licenses/>.
+"""
+
+import pyinotify
+import argparse
+import subprocess
+import logging
+import os
+
+have_daemon = True
+try:
+    import daemon
+    import daemon.pidfile as pidlockfile
+except:
+    logging.warning("No daemon support available, install python-daemon if feature is needed")
+    have_daemon = False
+
+RELOAD_FILE = "scirius.reload"
+
+parser = argparse.ArgumentParser(description='Suricata reloader')
+parser.add_argument('-r', '--reload', default=False, action="store_true", help="If set reload Suricata instead of restarting")
+parser.add_argument('-p', '--path', default='/etc/suricata/rules', help='Directory to monitor for scirius.reload file')
+parser.add_argument('-l', '--log', default=None, help='File to log output to (default to stdout)')
+parser.add_argument('-v', '--verbose', default=False, action="count", help="Show verbose output, use multiple times increase verbosity")
+if have_daemon:
+    parser.add_argument('-D', '--daemon', default=False, action="store_true", help="Run as unix daemon")
+    parser.add_argument('-P', '--pidfile', default='/var/run/suri-reloader.pid', help='PID file for suri-reloader')
+
+args = parser.parse_args()
+
+if args.verbose >= 3:
+    loglevel=logging.DEBUG
+elif args.verbose >= 2:
+    loglevel=logging.INFO
+elif args.verbose >= 1:
+    loglevel=logging.WARNING
+else:
+    loglevel=logging.ERROR
+
+def SuriReload(reload = False):
+    if reload:
+        if subprocess.call(['service', 'suricata', 'reload']):
+            logging.error("Unable to reload suricata")
+        else:
+            logging.info("Reloaded suricata")
+    else:
+        if subprocess.call(['service', 'suricata', 'restart']):
+            logging.error("Unable to restart suricata")
+        else:
+            logging.info("Restarted suricata")
+
+class EventHandler(pyinotify.ProcessEvent):
+    def process_IN_CLOSE_WRITE(self, event):
+        if not RELOAD_FILE in event.pathname:
+            return
+        SuriReload(self.reload)
+        os.unlink(event.pathname)
+
+    def set_mode(self, mode):
+        if mode == "reload":
+            self.reload = True
+        else:
+            self.reload = False
+
+def setup_logging(args):
+    if args.log:
+        logging.basicConfig(filename=args.log,
+                            format='%(asctime)s %(name)-12s %(levelname)-8s %(message)s',
+                            level=loglevel)
+    else:
+        logging.basicConfig(level=loglevel)
+
+def main_task(args):
+    setup_logging(args)
+
+    reload_file = os.path.join(args.path, RELOAD_FILE)
+    if os.path.isfile(reload_file):
+        SuriReload(args.reload)
+        os.unlink(reload_file)
+
+    handler = EventHandler()
+    if args.reload:
+        handler.set_mode("reload")
+    else:
+        handler.set_mode("restart")
+
+    wm = pyinotify.WatchManager()  # Watch Manager
+    mask = pyinotify.IN_CLOSE_WRITE
+    notifier = pyinotify.Notifier(wm, handler)
+    wdd = wm.add_watch(args.path, mask, rec=True)
+    logging.info("Starting filesystem monitoring")
+    notifier.loop()
+
+if have_daemon and args.daemon:
+    pidfile = pidlockfile.TimeoutPIDLockFile(args.pidfile)
+    with daemon.DaemonContext(pidfile=pidfile):
+        main_task(args)
+else:
+    main_task(args)

scripts/services/scirius/suricata_start.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+systemctl start suricata
+systemctl enable suricata
+
+apt-get install -y python-pyinotify
+python /opt/mistborn/scripts/services/scirius/suri_reloader -p /etc/suricata/rules &

scripts/services/scirius/suricata_stop.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+systemctl stop suricata
+systemctl disable suricata
+
+kill $(pgrep -f suri_reloader) 2>/dev/null

scripts/services/wazuh/agent.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# detect if already installed
+if dpkg -s wazuh-agent &> /dev/null; then
+    echo "Wazuh agent already installed"
+    exit 0
+fi
+
+# install curl
+echo "install curl"
+sudo -E apt-get install -y curl
+
+# prepare repo
+echo "Adding Wazuh Repository"
+curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo -E apt-key add -
+echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo -E tee /etc/apt/sources.list.d/wazuh.list
+
+apt-get update
+
+# wait for service to be listening
+while ! nc -z 10.2.3.1 55000; do
+    WAIT_TIME=10
+    echo "Waiting ${WAIT_TIME} seconds for Wazuh API..."
+    sleep ${WAIT_TIME}
+done
+
+# install
+echo "Installing Wazuh agent"
+WAZUH_MANAGER="10.2.3.1" apt-get install wazuh-agent
+

scripts/services/wazuh/agent_start.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl start wazuh-agent
+systemctl enable wazuh-agent

scripts/services/wazuh/agent_stop.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+systemctl stop wazuh-agent
+systemctl disable wazuh-agent

scripts/subinstallers/check_updates.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+sudo apt-get update
+
+UPDATES=$(sudo apt-get dist-upgrade -s --quiet=2 | grep ^Inst | wc -l)
+
+if [[ "$UPDATES" -ne "0" ]]; then
+    echo "Please run updates and reboot before installing Mistborn: sudo apt-get update && sudo apt-get -y dist-upgrade"
+    exit 1;
+fi

scripts/subinstallers/docker.sh

@@ -18,3 +18,6 @@ fi
 if [ ! -f /usr/local/bin/docker-compose ]; then
     sudo -E ln -s $(which docker-compose) /usr/local/bin/docker-compose
 fi
+
+# daemon.json
+#source ./scripts/subinstallers/docker_daemon.sh

scripts/subinstallers/docker_daemon.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+# daemon.json
+if [ ! -f /etc/docker/daemon.json ]; then
+    sudo -E cp ./scripts/conf/docker-daemon.json /etc/docker/daemon.json
+    sudo -E systemctl restart docker
+fi

scripts/subinstallers/extra/bitwarden.sh

@@ -4,7 +4,4 @@
 BITWARDEN_PROD_FILE="$1"
 echo "WEBSOCKET_ENABLED=true" > $BITWARDEN_PROD_FILE
 echo "SIGNUPS_ALLOWED=true" >> $BITWARDEN_PROD_FILE
-
-echo "MISTBORN_SERVICE_DOMAIN=bitwarden.mistborn" >> $BITWARDEN_PROD_FILE
-echo "MISTBORN_SERVICE_NAME=bitwarden" >> $BITWARDEN_PROD_FILE
-echo "MISTBORN_SERVICE_PORT=80" >> $BITWARDEN_PROD_FILE
+chmod 600 $BITWARDEN_PROD_FILE

scripts/subinstallers/extra/elasticsearch.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Elasticsearch
+ELASTICSEARCH_PROD_FILE="$1"
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $ELASTICSEARCH_PROD_FILE
+chmod 600 $ELASTICSEARCH_PROD_FILE

scripts/subinstallers/extra/guacamole.sh

@@ -11,3 +11,4 @@ echo "POSTGRES_DATABASE=guacamole_db" >> $GUAC_PROD_FILE
 echo "POSTGRES_USER=guac_user" >> $GUAC_PROD_FILE
 echo "POSTGRES_PASSWORD=$GUAC_PASSWORD" >> $GUAC_PROD_FILE
 echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $GUAC_PROD_FILE
+chmod 600 $GUAC_PROD_FILE

scripts/subinstallers/extra/jitsi.sh

@@ -10,3 +10,4 @@ sed -i "s/JVB_AUTH_PASSWORD.*/JVB_AUTH_PASSWORD=$(python3 -c "import secrets; im
 sed -i "s/JIGASI_XMPP_PASSWORD.*/JIGASI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JIBRI_RECORDER_PASSWORD.*/JIBRI_RECORDER_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
 sed -i "s/JIBRI_XMPP_PASSWORD.*/JIBRI_XMPP_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")/" "$JITSI_PROD_FILE"
+chmod 600 $JITSI_PROD_FILE

scripts/subinstallers/extra/nextcloud.sh

@@ -7,3 +7,4 @@ NEXTCLOUD_PASSWORD="${MISTBORN_DEFAULT_PASSWORD}"
 echo "NEXTCLOUD_ADMIN_USER=mistborn" > $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_ADMIN_PASSWORD=$NEXTCLOUD_PASSWORD" >> $NEXTCLOUD_PROD_FILE
 echo "NEXTCLOUD_TRUSTED_DOMAINS=nextcloud.mistborn" >> $NEXTCLOUD_PROD_FILE
+chmod 600 $NEXTCLOUD_PROD_FILE

scripts/subinstallers/extra/onlyoffice.sh

@@ -5,3 +5,4 @@ ONLYOFFICE_PROD_FILE="$1"
 JWT_SECRET="${MISTBORN_DEFAULT_PASSWORD}"
 echo "JWT_ENABLED=true" > $ONLYOFFICE_PROD_FILE
 echo "JWT_SECRET=$JWT_SECRET" >> $ONLYOFFICE_PROD_FILE
+chmod 600 $ONLYOFFICE_PROD_FILE

scripts/subinstallers/extra/raspap.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# RaspAP
+RASPAP_PROD_FILE="$1"
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" > $RASPAP_PROD_FILE
+chmod 600 $RASPAP_PROD_FILE

scripts/subinstallers/extra/rocketchat.sh

@@ -11,3 +11,5 @@ echo "ROCKETCHAT_PASSWORD=$ROCKETCHAT_PASSWORD" >> $ROCKETCHAT_PROD_FILE
 
 # docker environment
 echo "MISTBORN_BIND_IP=${MISTBORN_BIND_IP}" >> $ROCKETCHAT_PROD_FILE
+
+chmod 600 $ROCKETCHAT_PROD_FILE

scripts/subinstallers/extra/scirius.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Scirius
+SCIRIUS_PROD_FILE="$1"
+SCIRIUS_SECRET_KEY=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(50)]))")
+echo "SECRET_KEY=$SCIRIUS_SECRET_KEY" > $SCIRIUS_PROD_FILE
+echo "ALLOWED_HOSTS=scirius.mistborn" >> $SCIRIUS_PROD_FILE
+echo "DJANGO_SUPERUSER_USERNAME=mistborn" >> $SCIRIUS_PROD_FILE
+echo "DJANGO_SUPERUSER_EMAIL=mistborn@email.mistborn" >> $SCIRIUS_PROD_FILE
+
+echo "ELASTICSEARCH_HOST=10.2.3.1" >> $SCIRIUS_PROD_FILE
+echo "KIBANA_HOST=wazuh.mistborn" >> $SCIRIUS_PROD_FILE
+
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $SCIRIUS_PROD_FILE
+
+chmod 600 $SCIRIUS_PROD_FILE

scripts/subinstallers/extra/wazuh.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+
+# Wazuh
+WAZUH_PROD_FILE="$1"
+echo "ELASTIC_USERNAME=mistborn" > $WAZUH_PROD_FILE
+echo "ELASTIC_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+echo "ELASTICSEARCH_USERNAME=mistborn" >> $WAZUH_PROD_FILE
+echo "ELASTICSEARCH_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+# kibana odfe
+# kibana-odfe/config/wazuh_app_config.sh
+# https://wazuh
+echo "WAZUH_API_URL=https://10.2.3.1" >> $WAZUH_PROD_FILE
+echo "API_PORT=55000" >> $WAZUH_PROD_FILE
+echo "API_USERNAME=wazuh-wui" >> $WAZUH_PROD_FILE
+
+#API_PASSWORD=$(python3 -c "import secrets; import string; print(f''.join([secrets.choice(string.ascii_letters+string.digits) for x in range(32)]))")
+
+API_PASSWORD_PYTHON=$(cat << EOF
+
+import secrets
+import random
+import string
+
+random_pass = ([secrets.choice("@$!*?-"),
+                           secrets.choice(string.digits),
+                           secrets.choice(string.ascii_lowercase),
+                           secrets.choice(string.ascii_uppercase),
+                           ]
+                          + [secrets.choice(string.ascii_lowercase
+                                           + string.ascii_uppercase
+                                           + "@$!*?-"
+                                           + string.digits) for i in range(12)])
+
+random.shuffle(random_pass)
+random_pass = ''.join(random_pass)
+print(random_pass)
+
+EOF
+)
+
+API_PASSWORD=$(python3 -c "${API_PASSWORD_PYTHON}")
+
+echo "API_PASSWORD=${API_PASSWORD}" >> $WAZUH_PROD_FILE
+
+# kibana-odfe/config/entrypoint.sh:
+# https://elasticsearch:9200
+echo "ELASTICSEARCH_URL=https://10.2.3.1:9200" >> $WAZUH_PROD_FILE
+
+
+cat >> ${WAZUH_PROD_FILE}<< EOF
+
+PATTERN="wazuh-alerts-*"
+
+CHECKS_PATTERN=true
+CHECKS_TEMPLATE=true
+CHECKS_API=true
+CHECKS_SETUP=true
+
+EXTENSIONS_PCI=true
+EXTENSIONS_GDPR=true
+EXTENSIONS_HIPAA=true
+EXTENSIONS_NIST=true
+EXTENSIONS_TSC=true
+EXTENSIONS_AUDIT=true
+EXTENSIONS_OSCAP=false
+EXTENSIONS_CISCAT=false
+EXTENSIONS_AWS=false
+EXTENSIONS_GCP=false
+EXTENSIONS_VIRUSTOTAL=true
+EXTENSIONS_OSQUERY=true
+EXTENSIONS_DOCKER=true
+
+APP_TIMEOUT=20000
+
+API_SELECTOR=true
+IP_SELECTOR=true
+IP_IGNORE="[]"
+
+WAZUH_MONITORING_ENABLED=true
+WAZUH_MONITORING_FREQUENCY=900
+WAZUH_MONITORING_SHARDS=2
+WAZUH_MONITORING_REPLICAS=0
+
+ADMIN_PRIVILEGES=true
+
+EOF
+
+echo "MISTBORN_DEFAULT_PASSWORD=$MISTBORN_DEFAULT_PASSWORD" >> $WAZUH_PROD_FILE
+
+chmod 600 $WAZUH_PROD_FILE

scripts/subinstallers/iptables.sh

@@ -6,7 +6,7 @@ figlet "Mistborn: Configuring Firewall"
 
 echo "stop iptables wrappers"
 if [ "$DISTRO" == "ubuntu" ]; then
-    # Disable UFW
+    echo "Disabling UFW"
     sudo systemctl stop ufw || true
     sudo systemctl disable ufw || true
 fi

scripts/subinstallers/passwd.sh

@@ -1,12 +1,20 @@
 #!/bin/bash
 
 # INPUT default admin password
-while [ -z "${MISTBORN_DEFAULT_PASSWORD}" ] || [ ${MISTBORN_DEFAULT_PASSWORD} =~ ^[A-Za-z0-9_]+$ ]; do
+while [ -z "${MISTBORN_DEFAULT_PASSWORD}" ]; do
     echo
     echo "(Mistborn) The default admin password may only container alphanumeric characters and _"
     read -p "(Mistborn) Set default admin password: " -s MISTBORN_DEFAULT_PASSWORD
     echo
 
+    if [[ ${MISTBORN_DEFAULT_PASSWORD} =~ ^[A-Za-z0-9_]+$ ]]; then
+    # it matches
+        echo "(Mistborn) Password is accepted"
+    else
+        unset MISTBORN_DEFAULT_PASSWORD
+        echo "(Mistborn) Try again"
+    fi
+
 done
 
 echo

scripts/update.sh

@@ -18,6 +18,13 @@ sudo mistborn-cli pullbuild
 sudo docker container prune -f
 sudo docker image prune -f
 
+
+# RESTART
+
 sudo systemctl stop Mistborn-base
+
+# docker daemon
+#source ./scripts/subinstallers/docker_daemon.sh
+
 sudo systemctl restart Mistborn-setup
 sudo systemctl restart Mistborn-base

scripts/wrappers/mistborn_docker.sh

@@ -2,49 +2,50 @@
 
 set -e
 
-SERVICE="$1"
+MISTBORN_HOME="/opt/mistborn"
+
+SERVICES="$1"
 shift
 
-export MISTBORN_HOME="/opt/mistborn"
-export MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
-export MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
+IFS=','
+read -ra SERVICES_ARRAY <<< "${SERVICES}"
+for SERVICE in "${SERVICES_ARRAY[@]}"; do
+    MISTBORN_SERVICE_FILE=${MISTBORN_HOME}/.envs/.production/.${SERVICE}
+    MISTBORN_SERVICE_INIT=${MISTBORN_HOME}/scripts/services/${SERVICE}/init.sh
 
-# check and create file if needed
-${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
+    # check and create file if needed
+    ${MISTBORN_HOME}/scripts/env/check_env_file.sh ${SERVICE}
 
-# read in variables
-set -a
-source ${MISTBORN_HOME}/.env
+    # read in variables
+    set -a
+    source ${MISTBORN_HOME}/.env
 
-if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
+    if [[ -f "${MISTBORN_SERVICE_FILE}" ]]; then
         echo "Loading service variables"
         source ${MISTBORN_SERVICE_FILE}
-else
+    else
         echo "No service variables to load. Proceeding."
-fi
-set +a
+    fi
+    set +a
 
-# call traefik-extra
-if [[ ! -z "${MISTBORN_SERVICE_NAME}" ]] && \
-   [[ ! -z "${MISTBORN_SERVICE_DOMAIN}" ]] && \
-   [[ ! -z "${MISTBORN_SERVICE_PORT}" ]]; then
-
-    echo "Populating traefik routes"
-
-    mistborn-cli traefik-extra \
-        --domain-name ${MISTBORN_SERVICE_DOMAIN} \
-        --service-name ${MISTBORN_SERVICE_NAME} \
-        --web-port ${MISTBORN_SERVICE_PORT}
-else
-    echo "Not populating traefik routes"
-fi
-
-# init script
-if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
+    # init script
+    if [[ -f "${MISTBORN_SERVICE_INIT}" ]]; then
         echo "Running init script"
         ${MISTBORN_SERVICE_INIT}
-else
+    else
         echo "No init script. Proceeding."
-fi
+    fi
+done
+
+# ensure base is up and listening
+echo "Checking that Mistborn-base has finished starting up..."
+
+while ! nc -z 10.2.3.1 5000; do
+    WAIT_TIME=$((5 + $RANDOM % 15))
+    echo "Waiting ${WAIT_TIME} seconds for Mistborn-base..."
+    sleep ${WAIT_TIME}
+done
+
+echo "Mistborn-base is running"
 
 exec "$@"