From 4a141221b89fc54441730f827b87bf305ba835a9 Mon Sep 17 00:00:00 2001 From: Yuriy Medvedev Date: Mon, 20 Dec 2021 15:11:34 +0400 Subject: [PATCH] Expect tag deleted Fixes to include 4.2 changes Fixes to include 4.2 changes Merge pull request #682 from wazuh/680-expect-fix-master Expect tag deleted (master) Refactoring ansible role Fix molecule tests Fix ansible roles --- .ansible-lint | 2 +- .github/workflows/main.yml | 35 ++++++- .gitignore | 6 +- .pre-commit-config.yaml | 42 ++++++++ CHANGELOG.md | 2 +- molecule/default/converge.yml | 8 +- molecule/default/molecule.yml | 21 +--- molecule/default/tests/test_default.py | 3 +- .../distributed-wazuh-elk-xpack/converge.yml | 25 ++++- .../group_vars/agents.yml | 2 +- .../group_vars/all.yml | 8 +- .../group_vars/elastic.yml | 2 +- .../group_vars/managers.yml | 2 +- .../distributed-wazuh-elk-xpack/molecule.yml | 98 +++++++++---------- molecule/distributed-wazuh-elk/converge.yml | 22 +++++ .../distributed-wazuh-elk/group_vars/all.yml | 9 +- .../group_vars/kibana.yml | 2 +- .../group_vars/managers.yml | 2 +- .../host_vars/wazuh_agent_centos7.yml | 2 +- molecule/distributed-wazuh-elk/molecule.yml | 50 +++------- molecule/distributed-wazuh-odfe/converge.yml | 27 ++++- .../group_vars/agents.yml | 2 +- .../distributed-wazuh-odfe/group_vars/all.yml | 8 +- .../group_vars/managers.yml | 2 +- molecule/distributed-wazuh-odfe/molecule.yml | 41 +++----- playbooks/wazuh-agent.yml | 2 +- playbooks/wazuh-elastic_stack-single.yml | 2 +- playbooks/wazuh-manager.yml | 2 - playbooks/wazuh-odfe-single.yml | 2 +- playbooks/wazuh-opendistro.yml | 1 - .../ansible-elasticsearch/tasks/main.yml | 0 .../templates/elasticsearch.yml.j2 | 10 +- .../ansible-kibana/tasks/main.yml | 0 .../ansible-kibana/templates/kibana.yml.j2 | 2 +- .../defaults/main.yml | 2 +- .../opendistro-elasticsearch/tasks/Debian.yml | 7 +- .../tasks/security_actions.yml | 2 - .../opendistro-kibana/tasks/Debian.yml | 14 ++- .../opendistro-kibana/tasks/RedHat.yml | 2 +- .../opendistro-kibana/tasks/main.yml | 1 - .../tasks/security_actions.yml | 1 - .../opendistro-kibana/vars/debian.yml | 2 +- .../templates/filebeat.yml.j2 | 2 +- roles/wazuh/ansible-filebeat/tasks/main.yml | 6 +- .../templates/filebeat.yml.j2 | 6 +- .../ansible-wazuh-agent/handlers/main.yml | 12 ++- .../wazuh/ansible-wazuh-agent/tasks/Linux.yml | 19 ++++ .../ansible-wazuh-agent/tasks/Windows.yml | 6 +- .../installation_from_custom_packages.yml | 2 +- .../tasks/installation_from_sources.yml | 2 +- .../templates/authd_pass.j2 | 2 +- .../templates/preloaded_vars_agent.conf.j2 | 2 +- ...r-ossec-etc-local-internal-options.conf.j2 | 1 - .../ansible-wazuh-manager/defaults/main.yml | 4 +- .../files/create_user.py | 12 +-- .../tasks/install_cmake.yml | 4 +- .../installation_from_custom_packages.yml | 2 +- .../tasks/installation_from_sources.yml | 2 +- .../ansible-wazuh-manager/tasks/main.yml | 19 ++++ .../templates/authd_pass.j2 | 2 +- .../var-ossec-etc-ossec-server.conf.j2 | 11 ++- .../var-ossec-rules-local_rules.xml.j2 | 2 +- .../vars/install_cmake.yml | 2 +- 63 files changed, 364 insertions(+), 231 deletions(-) create mode 100644 .pre-commit-config.yaml mode change 100755 => 100644 CHANGELOG.md mode change 100755 => 100644 roles/elastic-stack/ansible-elasticsearch/tasks/main.yml mode change 100755 => 100644 roles/elastic-stack/ansible-kibana/tasks/main.yml mode change 100755 => 100644 roles/opendistro/opendistro-kibana/tasks/main.yml diff --git a/.ansible-lint b/.ansible-lint index 6a6a1587f..44283c609 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -12,4 +12,4 @@ warn_list: # This is for false positives # 504: Do not use 'local_action', use 'delegate_to: localhost' skip_list: - - '504' \ No newline at end of file + - '504' diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 34184a9e3..f22296384 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -3,10 +3,16 @@ name: Molecule tests for Wazuh Ansible on: [pull_request, workflow_dispatch, release] jobs: - scenario-default: name: Default scenario (smoke) runs-on: ubuntu-latest + strategy: + matrix: + distro: + - fedora34 + - debian9 + - centos7 + - ubuntu2004 steps: - name: Check out the codebase. uses: actions/checkout@v2 @@ -21,7 +27,7 @@ jobs: - name: Set up Python 3. uses: actions/setup-python@v2 with: - python-version: '3.x' + python-version: '3.8' - name: Install poetry run: pip3 install poetry @@ -34,10 +40,16 @@ jobs: env: PY_COLORS: '1' ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: "${{ matrix.distro }}" scenario-distributed-wazuh-elk: name: Distributed ELK + Wazuh runs-on: ubuntu-latest + strategy: + matrix: + distro: + - debian9 + - centos7 steps: - name: Check out the codebase. uses: actions/checkout@v2 @@ -51,7 +63,7 @@ jobs: - name: Set up Python 3. uses: actions/setup-python@v2 with: - python-version: '3.x' + python-version: '3.8' - name: Install poetry run: pip3 install poetry @@ -65,10 +77,16 @@ jobs: env: PY_COLORS: '1' ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: "${{ matrix.distro }}" scenario-distributed-wazuh-elk-xpack: name: Distributed ELK + XPack + Wazuh runs-on: ubuntu-latest + strategy: + matrix: + distro: + - debian9 + - centos7 steps: - name: Check out the codebase. uses: actions/checkout@v2 @@ -82,7 +100,7 @@ jobs: - name: Set up Python 3. uses: actions/setup-python@v2 with: - python-version: '3.x' + python-version: '3.8' - name: Install poetry run: pip3 install poetry @@ -95,10 +113,16 @@ jobs: env: PY_COLORS: '1' ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: "${{ matrix.distro }}" scenario-distributed-wazuh-odfe: name: Distributed ODFE + Wazuh runs-on: ubuntu-latest + strategy: + matrix: + distro: + - debian9 + - centos7 steps: - name: Check out the codebase. uses: actions/checkout@v2 @@ -112,7 +136,7 @@ jobs: - name: Set up Python 3. uses: actions/setup-python@v2 with: - python-version: '3.x' + python-version: '3.8' - name: Install poetry run: pip3 install poetry @@ -125,3 +149,4 @@ jobs: env: PY_COLORS: '1' ANSIBLE_FORCE_COLOR: '1' + MOLECULE_DISTRO: "${{ matrix.distro }}" diff --git a/.gitignore b/.gitignore index 38bf9b6c2..2f431f377 100644 --- a/.gitignore +++ b/.gitignore @@ -10,4 +10,8 @@ wazuh-manager.yml Pipfile.lock *.swp molecule/**/es_certs/ -molecule/**/opendistro/ \ No newline at end of file +molecule/**/opendistro/ +.idea/ +Vagrantfile +playbook.yml +.vagrant/ diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 000000000..bf2dbafcc --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,42 @@ +--- +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.0.1 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace + - id: mixed-line-ending + - id: check-byte-order-marker + - id: check-executables-have-shebangs + - id: check-merge-conflict + - id: check-symlinks + - id: debug-statements + - id: check-yaml + files: .*\.(yaml|yml)$ + - repo: https://github.com/PyCQA/flake8.git + rev: 4.0.1 + hooks: + - id: flake8 + - repo: https://github.com/adrienverge/yamllint.git + rev: v1.26.3 + hooks: + - id: yamllint + files: \.(yaml|yml)$ + args: [-c=.yamllint] + types: [file, yaml] + entry: yamllint --strict -f parsable + - repo: https://github.com/ansible/ansible-lint + rev: v5.3.1 + hooks: + - id: ansible-lint + always_run: true + pass_filenames: false + verbose: true + entry: env ANSIBLE_LIBRARY=plugins ansible-lint --force-color -p -v + additional_dependencies: + - 'ansible-core>=2.11' + - repo: https://github.com/openstack-dev/bashate.git + rev: 2.1.0 + hooks: + - id: bashate + entry: bashate --error . --verbose --ignore=E006,E040 diff --git a/CHANGELOG.md b/CHANGELOG.md old mode 100755 new mode 100644 index 6e0b12078..7a1230555 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,7 +73,7 @@ All notable changes to this project will be documented in this file. - Update to [Wazuh v4.1.1](https://github.com/wazuh/wazuh/blob/v4.1.1/CHANGELOG.md#v411) - Apply changes in ossec.conf file - Modify jvm.options to [v7.10](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/jvm-options.html) -- Change opendistro repository packages (opendistroforelasticsearch, elasticsearch-oss) to Wazuh URL and GPG key +- Change opendistro repository packages (opendistroforelasticsearch, elasticsearch-oss) to Wazuh URL and GPG key ## [v4.0.4] diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index ef634b656..1c63d29fd 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -3,9 +3,11 @@ hosts: all roles: - role: ../../roles/wazuh/ansible-wazuh-manager - vars: - - { role: ../../roles/wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: "elasticsearch_centos7:9200" } + - role: ../../roles/wazuh/ansible-filebeat vars: + filebeat_output_elasticsearch_hosts: "elasticsearch_centos7:9200" + wazuh_template_branch: "{{ lookup('env','WAZUH_TEMPLATE_BRANCH') or 'v4.2.5' }}" + wazuh_manager_version: "{{ lookup('env','WAZUH_MANAGER_VERSION') or '4.2.5-1' }}" pre_tasks: - name: (converge) fix missing packages in cloud images apt: @@ -14,4 +16,4 @@ - gpg-agent state: present update_cache: yes - when: ansible_distribution == "Ubuntu" \ No newline at end of file + when: ansible_distribution == "Ubuntu" diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index 3e21dce24..da4430bb0 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -9,9 +9,9 @@ lint: | ansible-lint roles flake8 molecule platforms: - - name: wazuh_manager_centos7 - hostname: wazuh-mgr01 - image: geerlingguy/docker-centos7-ansible + - name: "wazuh_manager_${MOLECULE_DISTRO:-fedora34}" + hostname: "wazuh-mgr01-${MOLECULE_DISTRO:-fedora34}" + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible:latest" command: /sbin/init pre_build_image: true privileged: true @@ -22,21 +22,6 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: wazuh_manager_debian9 - hostname: wazuh-mgr02 - image: geerlingguy/docker-debian9-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory_reservation: 512m - memory: 1024m - groups: - - managers - ulimits: - - nofile:262144:262144 - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro - provisioner: name: ansible ansible_args: diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py index 2769e498e..835d78c75 100644 --- a/molecule/default/tests/test_default.py +++ b/molecule/default/tests/test_default.py @@ -11,7 +11,6 @@ def get_wazuh_version(): return "4.4.0" - def test_wazuh_packages_are_installed(host): """Test the main packages are installed.""" manager = host.package("wazuh-manager") @@ -32,7 +31,7 @@ def test_wazuh_services_are_running(host): # assert api.is_running output = host.check_output( 'ps aux | grep ossec | tr -s " " | cut -d" " -f11' - ) + ) assert 'ossec-authd' in output assert 'wazuh-modulesd' in output assert 'wazuh-db' in output diff --git a/molecule/distributed-wazuh-elk-xpack/converge.yml b/molecule/distributed-wazuh-elk-xpack/converge.yml index 36186c894..5d4b57bc6 100644 --- a/molecule/distributed-wazuh-elk-xpack/converge.yml +++ b/molecule/distributed-wazuh-elk-xpack/converge.yml @@ -5,7 +5,13 @@ hosts: all become: true become_user: root + gather_facts: true vars: + packages: + Debian: + - iproute2 + RedHat: + - iproute endpoints_hostvars: '{{ managers_hostvars | union(elastic_hostvars) | union(kibana_hostvars) }}' roles: - role: ../../roles/elastic-stack/ansible-elasticsearch @@ -16,6 +22,23 @@ - inventory_hostname in groups['elastic'] - ansible_hostname == 'wazuh-es01' pre_tasks: + - name: Wait for systemd to complete initialization. # noqa 303 + command: systemctl is-system-running + register: systemctl_status + until: > + 'running' in systemctl_status.stdout or + 'degraded' in systemctl_status.stdout + retries: 30 + delay: 5 + when: ansible_service_mgr == 'systemd' + changed_when: false + failed_when: systemctl_status.rc > 1 + + - name: Install iproute2 + package: + name: "{{ packages[ansible_os_family] }}" + state: present + - name: (converge) build instances list dynamically for cert generator consumption set_fact: elk_endpoint_list: "{{ elk_endpoint_list | default({}) | combine({ instance_hostname: instance_item }) }}" @@ -91,4 +114,4 @@ update_cache: yes when: - ansible_distribution == "Ubuntu" - - inventory_hostname in groups['agents'] \ No newline at end of file + - inventory_hostname in groups['agents'] diff --git a/molecule/distributed-wazuh-elk-xpack/group_vars/agents.yml b/molecule/distributed-wazuh-elk-xpack/group_vars/agents.yml index 042a77c54..4ae4bf2b1 100644 --- a/molecule/distributed-wazuh-elk-xpack/group_vars/agents.yml +++ b/molecule/distributed-wazuh-elk-xpack/group_vars/agents.yml @@ -22,4 +22,4 @@ wazuh_agent_authd: enable: true port: 1515 ssl_agent_ca: null - ssl_auto_negotiate: 'no' \ No newline at end of file + ssl_auto_negotiate: 'no' diff --git a/molecule/distributed-wazuh-elk-xpack/group_vars/all.yml b/molecule/distributed-wazuh-elk-xpack/group_vars/all.yml index dd856b902..f36165a99 100644 --- a/molecule/distributed-wazuh-elk-xpack/group_vars/all.yml +++ b/molecule/distributed-wazuh-elk-xpack/group_vars/all.yml @@ -17,12 +17,14 @@ kibana_addresses: "{{ kibana_hostvars | map(attribute='private_ip') | list }}" elastic_stack_version: 7.10.2 filebeat_version: 7.10.2 + # Debian packages need the ${VERSION}-1 -wazuh_manager_version: 4.4.0-1 -wazuh_agent_version: 4.4.0-1 +wazuh_agent_version: "{{ lookup('env','WAZUH_AGENT_VERSION') or '4.2.5-1' }}" +wazuh_template_branch: "{{ lookup('env','WAZUH_TEMPLATE_BRANCH') or 'v4.2.5' }}" +wazuh_manager_version: "{{ lookup('env','WAZUH_MANAGER_VERSION') or '4.2.5-1' }}" # Kibana role appends it automatically. -wazuh_version: 4.4.0 +wazuh_version: "{{ lookup('env','WAZUH_KIBANA_VERSION') or '4.2.5' }}" ######################################################## # General ELK stack variables diff --git a/molecule/distributed-wazuh-elk-xpack/group_vars/elastic.yml b/molecule/distributed-wazuh-elk-xpack/group_vars/elastic.yml index 1490dff3b..20fb9f30a 100644 --- a/molecule/distributed-wazuh-elk-xpack/group_vars/elastic.yml +++ b/molecule/distributed-wazuh-elk-xpack/group_vars/elastic.yml @@ -14,4 +14,4 @@ elasticsearch_bootstrap_node: true elasticsearch_cluster_nodes: '{{ elastic_addresses }}' elasticsearch_discovery_nodes: '{{ elastic_addresses }}' -elasticsearch_jvm_xms: 1024 \ No newline at end of file +elasticsearch_jvm_xms: 1024 diff --git a/molecule/distributed-wazuh-elk-xpack/group_vars/managers.yml b/molecule/distributed-wazuh-elk-xpack/group_vars/managers.yml index 6f9c9af38..1d7618fb6 100644 --- a/molecule/distributed-wazuh-elk-xpack/group_vars/managers.yml +++ b/molecule/distributed-wazuh-elk-xpack/group_vars/managers.yml @@ -18,4 +18,4 @@ wazuh_manager_config: node_name: '{{ ansible_hostname }}' node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}" nodes: '{{ manager_addresses }}' - hidden: 'no' \ No newline at end of file + hidden: 'no' diff --git a/molecule/distributed-wazuh-elk-xpack/molecule.yml b/molecule/distributed-wazuh-elk-xpack/molecule.yml index 6ed461054..87edb47e2 100644 --- a/molecule/distributed-wazuh-elk-xpack/molecule.yml +++ b/molecule/distributed-wazuh-elk-xpack/molecule.yml @@ -18,9 +18,9 @@ platforms: ################################################ # Wazuh Managers ################################################ - - name: molecule_xpack_manager_centos7 + - name: "molecule_xpack_manager_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-mgr01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -33,27 +33,27 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: molecule_xpack_manager_debian9 - hostname: wazuh-mgr02 - image: geerlingguy/docker-debian9-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory_reservation: 512m - memory: 1024m - groups: - - managers - ulimits: - - nofile:262144:262144 - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro +# - name: molecule_xpack_manager_debian9 +# hostname: wazuh-mgr02 +# image: geerlingguy/docker-debian9-ansible +# command: /sbin/init +# pre_build_image: true +# privileged: true +# memory_reservation: 512m +# memory: 1024m +# groups: +# - managers +# ulimits: +# - nofile:262144:262144 +# volumes: +# - /sys/fs/cgroup:/sys/fs/cgroup:ro ################################################ # Elastic Cluster ################################################ - - name: molecule_xpack_elasticsearch_centos7 + - name: "molecule_xpack_elasticsearch_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-es01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -66,27 +66,27 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: molecule_xpack_elasticsearch_debian9 - hostname: wazuh-es02 - image: geerlingguy/docker-debian9-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory: 4096m - memory_reservation: 2048m - groups: - - elastic - ulimits: - - nofile:262144:262144 - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro +# - name: molecule_xpack_elasticsearch_debian9 +# hostname: wazuh-es02 +# image: geerlingguy/docker-debian9-ansible +# command: /sbin/init +# pre_build_image: true +# privileged: true +# memory: 4096m +# memory_reservation: 2048m +# groups: +# - elastic +# ulimits: +# - nofile:262144:262144 +# volumes: +# - /sys/fs/cgroup:/sys/fs/cgroup:ro ################################################ # Wazuh Agents ################################################ - - name: molecule_xpack_agent_centos7 + - name: "molecule_xpack_agent_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-agent01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -97,26 +97,26 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: molecule_xpack_agent_debian9 - hostname: wazuh-agent02 - image: geerlingguy/docker-debian9-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory: 1024m - memory_reservation: 512m - groups: - - agents - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro +# - name: molecule_xpack_agent_debian9 +# hostname: wazuh-agent02 +# image: geerlingguy/docker-debian9-ansible +# command: /sbin/init +# pre_build_image: true +# privileged: true +# memory: 1024m +# memory_reservation: 512m +# groups: +# - agents +# volumes: +# - /sys/fs/cgroup:/sys/fs/cgroup:ro ################################################ # Kibana ################################################ - - name: molecule_xpack_kibana_centos7 + - name: "molecule_xpack_kibana_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-kib01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -159,4 +159,4 @@ scenario: - cleanup - destroy verifier: - name: testinfra \ No newline at end of file + name: testinfra diff --git a/molecule/distributed-wazuh-elk/converge.yml b/molecule/distributed-wazuh-elk/converge.yml index be8c903d7..3734d6559 100644 --- a/molecule/distributed-wazuh-elk/converge.yml +++ b/molecule/distributed-wazuh-elk/converge.yml @@ -4,7 +4,13 @@ hosts: all become: true become_user: root + gather_facts: true vars: + packages: + Debian: + - iproute2 + RedHat: + - iproute # arguments common to all managers wazuh_managers_common: port: 1514 @@ -32,6 +38,22 @@ wazuh_managers: '{{ wazuh_managers_list }}' when: inventory_hostname in groups['agents'] pre_tasks: + - name: Wait for systemd to complete initialization. # noqa 303 + command: systemctl is-system-running + register: systemctl_status + until: > + 'running' in systemctl_status.stdout or + 'degraded' in systemctl_status.stdout + retries: 30 + delay: 5 + when: ansible_service_mgr == 'systemd' + changed_when: false + failed_when: systemctl_status.rc > 1 + + - name: Install iproute2 + package: + name: "{{ packages[ansible_os_family] }}" + state: present - name: (converge) build wazuh_managers list dynamically for agents to consume set_fact: diff --git a/molecule/distributed-wazuh-elk/group_vars/all.yml b/molecule/distributed-wazuh-elk/group_vars/all.yml index 6fdbc2248..9e13ed2fe 100644 --- a/molecule/distributed-wazuh-elk/group_vars/all.yml +++ b/molecule/distributed-wazuh-elk/group_vars/all.yml @@ -2,7 +2,7 @@ ######################################################## # Helper variables -private_ip: '{{ ansible_default_ipv4.address }}' +private_ip: '{{ ansible_default_ipv4.address|default(ansible_all_ipv4_addresses[0]) }}' managers_hostvars: "{{ groups['managers'] | map('extract', hostvars) | list }}" elastic_hostvars: "{{ groups['elastic'] | map('extract', hostvars) | list }}" @@ -16,8 +16,9 @@ elastic_stack_version: 7.10.2 filebeat_version: 7.10.2 # Debian packages need the ${VERSION}-1 -wazuh_manager_version: 4.4.0-1 -wazuh_agent_version: 4.4.0-1 +wazuh_agent_version: "{{ lookup('env','WAZUH_AGENT_VERSION') or '4.2.5-1' }}" +wazuh_template_branch: "{{ lookup('env','WAZUH_TEMPLATE_BRANCH') or 'v4.2.5' }}" +wazuh_manager_version: "{{ lookup('env','WAZUH_MANAGER_VERSION') or '4.2.5-1' }}" # Kibana role appends it automatically. -wazuh_version: 4.4.0 +wazuh_version: "{{ lookup('env','WAZUH_KIBANA_VERSION') or '4.2.5' }}" diff --git a/molecule/distributed-wazuh-elk/group_vars/kibana.yml b/molecule/distributed-wazuh-elk/group_vars/kibana.yml index 1c0861a25..f303a2cbb 100644 --- a/molecule/distributed-wazuh-elk/group_vars/kibana.yml +++ b/molecule/distributed-wazuh-elk/group_vars/kibana.yml @@ -16,4 +16,4 @@ wazuh_api_credentials: port: 55000 #port: 1514 username: wazuh - password: wazuh \ No newline at end of file + password: wazuh diff --git a/molecule/distributed-wazuh-elk/group_vars/managers.yml b/molecule/distributed-wazuh-elk/group_vars/managers.yml index e191ad10e..52239eb01 100644 --- a/molecule/distributed-wazuh-elk/group_vars/managers.yml +++ b/molecule/distributed-wazuh-elk/group_vars/managers.yml @@ -17,4 +17,4 @@ wazuh_manager_config: node_name: '{{ ansible_hostname }}' node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}" nodes: '{{ manager_addresses }}' - hidden: 'no' \ No newline at end of file + hidden: 'no' diff --git a/molecule/distributed-wazuh-elk/host_vars/wazuh_agent_centos7.yml b/molecule/distributed-wazuh-elk/host_vars/wazuh_agent_centos7.yml index b4b37153d..6e51ddd76 100644 --- a/molecule/distributed-wazuh-elk/host_vars/wazuh_agent_centos7.yml +++ b/molecule/distributed-wazuh-elk/host_vars/wazuh_agent_centos7.yml @@ -4,4 +4,4 @@ wazuh_agent_authd: enable: true port: 1515 ssl_agent_ca: null - ssl_auto_negotiate: 'no' \ No newline at end of file + ssl_auto_negotiate: 'no' diff --git a/molecule/distributed-wazuh-elk/molecule.yml b/molecule/distributed-wazuh-elk/molecule.yml index cb2cc95bc..98d102c65 100644 --- a/molecule/distributed-wazuh-elk/molecule.yml +++ b/molecule/distributed-wazuh-elk/molecule.yml @@ -18,24 +18,9 @@ platforms: ################################################ # Wazuh Managers ################################################ - - name: wazuh_manager_centos7 + - name: "wazuh_manager_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-mgr01 - image: geerlingguy/docker-centos7-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory_reservation: 512m - memory: 1024m - groups: - - managers - ulimits: - - nofile:262144:262144 - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro - - - name: wazuh_manager_debian9 - hostname: wazuh-mgr02 - image: geerlingguy/docker-debian9-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -51,9 +36,9 @@ platforms: ################################################ # Elastic Cluster ################################################ - - name: wazuh_elasticsearch_centos7 + - name: "wazuh_elasticsearch_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-es01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -66,9 +51,9 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: wazuh_elasticsearch_debian9 + - name: "wazuh_elasticsearch_${MOLECULE_DISTRO:-fedora34}_2" hostname: wazuh-es02 - image: geerlingguy/docker-debian9-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -84,22 +69,9 @@ platforms: ################################################ # Wazuh Agents ################################################ - - name: wazuh_agent_centos7 - hostname: wazuh-agent01 - image: geerlingguy/docker-centos7-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory: 1024m - memory_reservation: 512m - groups: - - agents - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro - - - name: wazuh_agent_debian9 + - name: "wazuh_agent_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-agent01 - image: geerlingguy/docker-debian9-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -114,9 +86,9 @@ platforms: # Kibana ################################################ - - name: wazuh_kibana_centos7 + - name: "wazuh_kibana_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-kib01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -160,4 +132,4 @@ scenario: - cleanup - destroy verifier: - name: testinfra \ No newline at end of file + name: testinfra diff --git a/molecule/distributed-wazuh-odfe/converge.yml b/molecule/distributed-wazuh-odfe/converge.yml index 874df1596..61fd678f9 100644 --- a/molecule/distributed-wazuh-odfe/converge.yml +++ b/molecule/distributed-wazuh-odfe/converge.yml @@ -4,7 +4,13 @@ hosts: all become: true become_user: root + gather_facts: true vars: + packages: + Debian: + - iproute2 + RedHat: + - iproute endpoints_hostvars: '{{ managers_hostvars | union(elastic_hostvars) | union(kibana_hostvars) }}' wazuh_managers_common: port: 1514 @@ -15,6 +21,23 @@ max_retries: 5 retry_interval: 5 pre_tasks: + - name: Wait for systemd to complete initialization. # noqa 303 + command: systemctl is-system-running + register: systemctl_status + until: > + 'running' in systemctl_status.stdout or + 'degraded' in systemctl_status.stdout + retries: 30 + delay: 5 + when: ansible_service_mgr == 'systemd' + changed_when: false + failed_when: systemctl_status.rc > 1 + + - name: Install iproute2 + package: + name: "{{ packages[ansible_os_family] }}" + state: present + - name: (converge) build instances list dynamically for cert generator consumption set_fact: odfe_endpoint_list: "{{ odfe_endpoint_list | default({}) | combine({ instance_hostname: instance_item }) }}" @@ -38,7 +61,7 @@ var: odfe_endpoint_list - name: Generate certificates prior to converging - hosts: molecule_odfe_elasticsearch_centos7 + hosts: "molecule_odfe_elasticsearch_{{ lookup('env','MOLECULE_DISTRO') or 'fedora34' }}" become: true become_user: root roles: @@ -72,4 +95,4 @@ - role: ../../roles/wazuh/ansible-wazuh-agent vars: wazuh_managers: '{{ wazuh_managers_list }}' - when: inventory_hostname in groups['agents'] \ No newline at end of file + when: inventory_hostname in groups['agents'] diff --git a/molecule/distributed-wazuh-odfe/group_vars/agents.yml b/molecule/distributed-wazuh-odfe/group_vars/agents.yml index 9fc665248..f21454ff6 100644 --- a/molecule/distributed-wazuh-odfe/group_vars/agents.yml +++ b/molecule/distributed-wazuh-odfe/group_vars/agents.yml @@ -22,4 +22,4 @@ wazuh_agent_authd: enable: true port: 1515 ssl_agent_ca: null - ssl_auto_negotiate: 'no' \ No newline at end of file + ssl_auto_negotiate: 'no' diff --git a/molecule/distributed-wazuh-odfe/group_vars/all.yml b/molecule/distributed-wazuh-odfe/group_vars/all.yml index 36080bf0f..8cba42cc5 100644 --- a/molecule/distributed-wazuh-odfe/group_vars/all.yml +++ b/molecule/distributed-wazuh-odfe/group_vars/all.yml @@ -40,8 +40,10 @@ filebeat_version: 7.10.2 kibana_opendistro_version: 1.13.2-1 # Debian packages need the ${VERSION}-1 -wazuh_manager_version: 4.4.0-1 -wazuh_agent_version: 4.4.0-1 +wazuh_agent_version: "{{ lookup('env','WAZUH_AGENT_VERSION') or '4.2.5-1' }}" +wazuh_template_branch: "{{ lookup('env','WAZUH_TEMPLATE_BRANCH') or 'v4.2.5' }}" +wazuh_manager_version: "{{ lookup('env','WAZUH_MANAGER_VERSION') or '4.2.5-1' }}" # Kibana role appends it automatically. -wazuh_version: 4.4.0 +wazuh_version: "{{ lookup('env','WAZUH_KIBANA_VERSION') or '4.2.5' }}" + diff --git a/molecule/distributed-wazuh-odfe/group_vars/managers.yml b/molecule/distributed-wazuh-odfe/group_vars/managers.yml index 4f15afd59..e46513099 100644 --- a/molecule/distributed-wazuh-odfe/group_vars/managers.yml +++ b/molecule/distributed-wazuh-odfe/group_vars/managers.yml @@ -16,4 +16,4 @@ wazuh_manager_config: node_name: '{{ ansible_hostname }}' node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}" nodes: '{{ manager_addresses }}' - hidden: 'no' \ No newline at end of file + hidden: 'no' diff --git a/molecule/distributed-wazuh-odfe/molecule.yml b/molecule/distributed-wazuh-odfe/molecule.yml index 46c08695e..2873d42cd 100644 --- a/molecule/distributed-wazuh-odfe/molecule.yml +++ b/molecule/distributed-wazuh-odfe/molecule.yml @@ -18,24 +18,9 @@ platforms: ################################################ # Wazuh Managers ################################################ - - name: molecule_odfe_manager_centos7 + - name: "molecule_odfe_manager_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-mgr01 - image: geerlingguy/docker-centos7-ansible - command: /sbin/init - pre_build_image: true - privileged: true - memory_reservation: 512m - memory: 1024m - groups: - - managers - ulimits: - - nofile:262144:262144 - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro - - - name: molecule_odfe_manager_debian9 - hostname: wazuh-mgr02 - image: geerlingguy/docker-debian9-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -51,9 +36,9 @@ platforms: ################################################ # Elastic Cluster ################################################ - - name: molecule_odfe_elasticsearch_centos7 + - name: "molecule_odfe_elasticsearch_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-es01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -66,9 +51,9 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: molecule_odfe_elasticsearch_centos7_2 + - name: "molecule_odfe_elasticsearch_${MOLECULE_DISTRO:-fedora34}_2" hostname: wazuh-es02 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -84,9 +69,9 @@ platforms: ################################################ # Wazuh Agents ################################################ - - name: molecule_odfe_agent_centos7 + - name: "molecule_odfe_agent_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-agent01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -97,9 +82,9 @@ platforms: volumes: - /sys/fs/cgroup:/sys/fs/cgroup:ro - - name: molecule_odfe_agent_debian9 + - name: "molecule_odfe_agent_${MOLECULE_DISTRO:-fedora34}_2" hostname: wazuh-agent02 - image: geerlingguy/docker-debian9-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -114,9 +99,9 @@ platforms: # Kibana ################################################ - - name: molecule_odfe_kibana_centos7 + - name: "molecule_odfe_kibana_${MOLECULE_DISTRO:-fedora34}" hostname: wazuh-kib01 - image: geerlingguy/docker-centos7-ansible + image: "geerlingguy/docker-${MOLECULE_DISTRO:-fedora34}-ansible" command: /sbin/init pre_build_image: true privileged: true @@ -159,4 +144,4 @@ scenario: - cleanup - destroy verifier: - name: testinfra \ No newline at end of file + name: testinfra diff --git a/playbooks/wazuh-agent.yml b/playbooks/wazuh-agent.yml index 22fcfa778..8d1be316b 100644 --- a/playbooks/wazuh-agent.yml +++ b/playbooks/wazuh-agent.yml @@ -13,4 +13,4 @@ api_proto: 'http' api_user: ansible max_retries: 5 - retry_interval: 5 \ No newline at end of file + retry_interval: 5 diff --git a/playbooks/wazuh-elastic_stack-single.yml b/playbooks/wazuh-elastic_stack-single.yml index aba365c92..74cd2186d 100644 --- a/playbooks/wazuh-elastic_stack-single.yml +++ b/playbooks/wazuh-elastic_stack-single.yml @@ -5,4 +5,4 @@ - role: ../roles/wazuh/ansible-filebeat filebeat_output_elasticsearch_hosts: localhost:9200 - {role: ../roles/elastic-stack/ansible-elasticsearch, elasticsearch_network_host: '0.0.0.0', single_node: true} - - { role: ../roles/elastic-stack/ansible-kibana, elasticsearch_network_host: '0.0.0.0', elasticsearch_reachable_host: 'localhost' } \ No newline at end of file + - { role: ../roles/elastic-stack/ansible-kibana, elasticsearch_network_host: '0.0.0.0', elasticsearch_reachable_host: 'localhost' } diff --git a/playbooks/wazuh-manager.yml b/playbooks/wazuh-manager.yml index 5ec6a50b5..3851ccf64 100644 --- a/playbooks/wazuh-manager.yml +++ b/playbooks/wazuh-manager.yml @@ -4,5 +4,3 @@ - role: ../roles/wazuh/ansible-wazuh-manager - role: ../roles/wazuh/ansible-filebeat filebeat_output_elasticsearch_hosts: :9200 - - diff --git a/playbooks/wazuh-odfe-single.yml b/playbooks/wazuh-odfe-single.yml index 53b7dee30..48c40dc6c 100644 --- a/playbooks/wazuh-odfe-single.yml +++ b/playbooks/wazuh-odfe-single.yml @@ -1,6 +1,6 @@ --- # Single node - - hosts: + - hosts: become: yes become_user: root roles: diff --git a/playbooks/wazuh-opendistro.yml b/playbooks/wazuh-opendistro.yml index 63b54eb2e..9519e2e2a 100644 --- a/playbooks/wazuh-opendistro.yml +++ b/playbooks/wazuh-opendistro.yml @@ -14,4 +14,3 @@ node3: name: node-3 ip: - diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml old mode 100755 new mode 100644 diff --git a/roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2 b/roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2 index 184bc4b4b..78692c8b5 100644 --- a/roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2 +++ b/roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2 @@ -17,7 +17,7 @@ path.repo: discovery.type: single-node {% elif elasticsearch_bootstrap_node %} node.master: true -cluster.initial_master_nodes: +cluster.initial_master_nodes: {% for item in elasticsearch_cluster_nodes %} - {{ item }} {% endfor %} @@ -50,8 +50,8 @@ cluster.routing.allocation.disk.watermark.high: 300mb # XPACK Security xpack.security.enabled: true xpack.security.transport.ssl.enabled: true -xpack.security.transport.ssl.verification_mode: certificate -xpack.security.transport.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key +xpack.security.transport.ssl.verification_mode: certificate +xpack.security.transport.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key xpack.security.transport.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt {% if generate_CA == true %} xpack.security.transport.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ] @@ -60,8 +60,8 @@ xpack.security.transport.ssl.certificate_authorities: [ "{{ node_certs_destinati {% endif %} xpack.security.http.ssl.enabled: true xpack.security.http.ssl.verification_mode: certificate -xpack.security.http.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key -xpack.security.http.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt +xpack.security.http.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key +xpack.security.http.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt {% if generate_CA == true %} xpack.security.http.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ] {% elif generate_CA == false %} diff --git a/roles/elastic-stack/ansible-kibana/tasks/main.yml b/roles/elastic-stack/ansible-kibana/tasks/main.yml old mode 100755 new mode 100644 diff --git a/roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2 b/roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2 index 2de3d3e97..8694a210a 100644 --- a/roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2 +++ b/roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2 @@ -118,4 +118,4 @@ elasticsearch.ssl.certificateAuthorities: ["{{ node_certs_destination }}/{{ca_ce {% endif %} {% endif %} -server.defaultRoute: /app/wazuh \ No newline at end of file +server.defaultRoute: /app/wazuh diff --git a/roles/opendistro/opendistro-elasticsearch/defaults/main.yml b/roles/opendistro/opendistro-elasticsearch/defaults/main.yml index 615a7ddc8..45bedc92c 100644 --- a/roles/opendistro/opendistro-elasticsearch/defaults/main.yml +++ b/roles/opendistro/opendistro-elasticsearch/defaults/main.yml @@ -39,7 +39,7 @@ package_repos: gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' openjdk: baseurl: 'deb http://deb.debian.org/debian stretch-backports main' - + opendistro_sec_plugin_conf_path: /usr/share/elasticsearch/plugins/opendistro_security/securityconfig opendistro_sec_plugin_tools_path: /usr/share/elasticsearch/plugins/opendistro_security/tools opendistro_conf_path: /etc/elasticsearch/ diff --git a/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml b/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml index 45c680227..4856b8054 100644 --- a/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml +++ b/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml @@ -4,12 +4,11 @@ - name: Update cache apt: update_cache: yes - when: (ansible_facts['distribution'] == "Debian" and ansible_facts['distribution_major_version'] == "9") - name: Debian 9 (Stretch) when: (ansible_facts['distribution'] == "Debian" and ansible_facts['distribution_major_version'] == "9") block: - + - name: Install OpenDistro dependencies apt: name: [ @@ -21,7 +20,7 @@ ansible.builtin.apt_key: keyserver: keyserver.ubuntu.com id: 648ACFD622F3D138 - + - name: Add openjdk repository apt_repository: repo: "{{ package_repos.apt.openjdk.baseurl }}" @@ -55,4 +54,4 @@ name: opendistroforelasticsearch={{ opendistro_version }}-1 state: present register: install - tags: install \ No newline at end of file + tags: install diff --git a/roles/opendistro/opendistro-elasticsearch/tasks/security_actions.yml b/roles/opendistro/opendistro-elasticsearch/tasks/security_actions.yml index 56d13ae94..8258356ef 100644 --- a/roles/opendistro/opendistro-elasticsearch/tasks/security_actions.yml +++ b/roles/opendistro/opendistro-elasticsearch/tasks/security_actions.yml @@ -125,5 +125,3 @@ timeout: 4 when: - opendistro_custom_user is defined and opendistro_custom_user - - diff --git a/roles/opendistro/opendistro-kibana/tasks/Debian.yml b/roles/opendistro/opendistro-kibana/tasks/Debian.yml index 140b25823..d3483c4dd 100644 --- a/roles/opendistro/opendistro-kibana/tasks/Debian.yml +++ b/roles/opendistro/opendistro-kibana/tasks/Debian.yml @@ -1,7 +1,17 @@ --- - block: + - include_vars: debian.yml + + - name: Debian/Ubuntu | Install apt-transport-https, ca-certificates and acl + apt: + name: + - apt-transport-https + - ca-certificates + - acl + state: present + register: kibana_ca_packages_install + until: kibana_ca_packages_install is succeeded - - include_vars: debian.yml - name: Add apt repository signing key apt_key: url: "{{ package_repos.apt.opendistro.gpg }}" @@ -20,4 +30,4 @@ register: install tags: - - install \ No newline at end of file + - install diff --git a/roles/opendistro/opendistro-kibana/tasks/RedHat.yml b/roles/opendistro/opendistro-kibana/tasks/RedHat.yml index 4407e1652..c317f3e78 100644 --- a/roles/opendistro/opendistro-kibana/tasks/RedHat.yml +++ b/roles/opendistro/opendistro-kibana/tasks/RedHat.yml @@ -15,6 +15,6 @@ name: "opendistroforelasticsearch-kibana-{{ kibana_opendistro_version }}" state: present register: install - + tags: - install diff --git a/roles/opendistro/opendistro-kibana/tasks/main.yml b/roles/opendistro/opendistro-kibana/tasks/main.yml old mode 100755 new mode 100644 index 8a1696647..acfd1f908 --- a/roles/opendistro/opendistro-kibana/tasks/main.yml +++ b/roles/opendistro/opendistro-kibana/tasks/main.yml @@ -19,7 +19,6 @@ # noqa 503 path: "{{ kibana_conf_path }}/kibana.yml" state: absent - when: install.changed tags: install - import_tasks: security_actions.yml diff --git a/roles/opendistro/opendistro-kibana/tasks/security_actions.yml b/roles/opendistro/opendistro-kibana/tasks/security_actions.yml index d7a204087..ee21f1c1f 100644 --- a/roles/opendistro/opendistro-kibana/tasks/security_actions.yml +++ b/roles/opendistro/opendistro-kibana/tasks/security_actions.yml @@ -11,4 +11,3 @@ - "{{ kibana_node_name }}_http.pem" tags: - security - when: install.changed diff --git a/roles/opendistro/opendistro-kibana/vars/debian.yml b/roles/opendistro/opendistro-kibana/vars/debian.yml index 9edcdddc5..a6d6db1b2 100644 --- a/roles/opendistro/opendistro-kibana/vars/debian.yml +++ b/roles/opendistro/opendistro-kibana/vars/debian.yml @@ -1,3 +1,3 @@ --- -kibana_opendistro_version: 1.13.2 \ No newline at end of file +kibana_opendistro_version: 1.13.2 diff --git a/roles/wazuh/ansible-filebeat-oss/templates/filebeat.yml.j2 b/roles/wazuh/ansible-filebeat-oss/templates/filebeat.yml.j2 index c918ccda1..f80fccbc7 100644 --- a/roles/wazuh/ansible-filebeat-oss/templates/filebeat.yml.j2 +++ b/roles/wazuh/ansible-filebeat-oss/templates/filebeat.yml.j2 @@ -29,4 +29,4 @@ output.elasticsearch: {% endif %} # Optional. Send events to Logstash instead of Elasticsearch -#output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"] \ No newline at end of file +#output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"] diff --git a/roles/wazuh/ansible-filebeat/tasks/main.yml b/roles/wazuh/ansible-filebeat/tasks/main.yml index f4e30a77b..e94e5c219 100644 --- a/roles/wazuh/ansible-filebeat/tasks/main.yml +++ b/roles/wazuh/ansible-filebeat/tasks/main.yml @@ -10,7 +10,7 @@ register: filebeat_installing_package until: filebeat_installing_package is succeeded when: - - ansible_distribution in ['CentOS','RedHat', 'Amazon'] + - (ansible_os_family == "RedHat" and ansible_distribution_major_version|int > 5) or (ansible_os_family == "RedHat" and ansible_distribution == "Amazon") tags: - install @@ -22,7 +22,7 @@ register: filebeat_installing_package_debian until: filebeat_installing_package_debian is succeeded when: - - not (ansible_distribution in ['CentOS','RedHat', 'Amazon']) + - not (ansible_os_family == "RedHat" and ansible_distribution_major_version|int > 5) or (ansible_os_family == "RedHat" and ansible_distribution == "Amazon") tags: - init @@ -118,7 +118,7 @@ enabled: true - include_tasks: "RMRedHat.yml" - when: ansible_os_family == "RedHat" + when: (ansible_os_family == "RedHat" and ansible_distribution_major_version|int > 5) or (ansible_os_family == "RedHat" and ansible_distribution == "Amazon") - include_tasks: "RMDebian.yml" when: ansible_os_family == "Debian" diff --git a/roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2 b/roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2 index da87ec8d3..f01438dc7 100644 --- a/roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2 +++ b/roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2 @@ -24,16 +24,16 @@ output.elasticsearch: password: {{ elasticsearch_xpack_security_password }} protocol: https {% if generate_CA == true %} - ssl.certificate_authorities: + ssl.certificate_authorities: - {{node_certs_destination}}/ca.crt {% elif generate_CA == false %} ssl.certificate_authorities: - {{node_certs_destination}}/{{ca_cert_name}} {% endif %} - ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" + ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" ssl.key: "{{node_certs_destination}}/{{ filebeat_node_name }}.key" {% endif %} # Optional. Send events to Logstash instead of Elasticsearch -#output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"] \ No newline at end of file +#output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"] diff --git a/roles/wazuh/ansible-wazuh-agent/handlers/main.yml b/roles/wazuh/ansible-wazuh-agent/handlers/main.yml index 84f3ff455..2f82009ab 100644 --- a/roles/wazuh/ansible-wazuh-agent/handlers/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/handlers/main.yml @@ -1,6 +1,12 @@ --- - name: restart wazuh-agent - service: name=wazuh-agent state=restarted enabled=yes + service: + name: wazuh-agent + state: restarted + enabled: true -- name: Windows | Restart Wazuh Agent - win_service: name=WazuhSvc start_mode=auto state=restarted +- name: restart windows-wazuh-agent + win_service: + name: WazuhSvc + start_mode: auto + state: restarted diff --git a/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml b/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml index 9f4127dd7..74fe5b5aa 100644 --- a/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml +++ b/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml @@ -1,4 +1,17 @@ --- +- name: Create group Wazuh + group: + name: "wazuh" + state: present + +- name: Create user Wazuh + user: + name: wazuh + group: wazuh + shell: /sbin/nologin + home: "{{ wazuh_dir }}" + comment: Wazuh User + - include_tasks: "RedHat.yml" when: ansible_os_family == "RedHat" @@ -38,6 +51,11 @@ tags: - init +- name: Adding ossec user to wazuh group + user: + name: ossec + groups: wazuh + append: yes - name: Linux | Check if client.keys exists stat: path: "{{ wazuh_dir }}/etc/client.keys" @@ -225,6 +243,7 @@ owner: root group: wazuh mode: 0644 + lstrip_blocks: true notify: restart wazuh-agent tags: - init diff --git a/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml b/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml index bcf6e1f02..ace70f309 100644 --- a/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml +++ b/roles/wazuh/ansible-wazuh-agent/tasks/Windows.yml @@ -62,7 +62,7 @@ {% if wazuh_agent_authd.agent_name is not none %}-A {{ wazuh_agent_authd.agent_name }} {% endif %} {% if authd_pass | length > 0 %} -P {{ authd_pass }}{% endif %} register: agent_auth_output - notify: Windows | Restart Wazuh Agent + notify: restart windows-wazuh-agent when: - wazuh_agent_authd.enable | bool - not check_windows_key.stat.exists or check_windows_key.stat.size == 0 @@ -79,7 +79,7 @@ template: # noqa 208 src: var-ossec-etc-ossec-agent.conf.j2 dest: "{{ wazuh_agent_win_path }}ossec.conf" - notify: Windows | Restart Wazuh Agent + notify: restart windows-wazuh-agent tags: - config @@ -87,7 +87,7 @@ template: src: var-ossec-etc-local-internal-options.conf.j2 dest: "{{ wazuh_agent_win_path }}local_internal_options.conf" - notify: Windows | Restart Wazuh Agent + notify: restart windows-wazuh-agent tags: - config diff --git a/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_custom_packages.yml b/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_custom_packages.yml index aa50004f6..87f94a17c 100644 --- a/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_custom_packages.yml +++ b/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_custom_packages.yml @@ -25,4 +25,4 @@ - ansible_os_family|lower == "redhat" - wazuh_custom_packages_installation_agent_enabled - (ansible_distribution|lower == "centos" and ansible_distribution_major_version >= "8") or - (ansible_distribution|lower == "redhat" and ansible_distribution_major_version >= "8") \ No newline at end of file + (ansible_distribution|lower == "redhat" and ansible_distribution_major_version >= "8") diff --git a/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_sources.yml b/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_sources.yml index fbfecd5b2..98624c11f 100644 --- a/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_sources.yml +++ b/roles/wazuh/ansible-wazuh-agent/tasks/installation_from_sources.yml @@ -97,4 +97,4 @@ file: path: "/tmp/wazuh-{{ wazuh_agent_sources_installation.branch }}" state: absent - changed_when: false \ No newline at end of file + changed_when: false diff --git a/roles/wazuh/ansible-wazuh-agent/templates/authd_pass.j2 b/roles/wazuh/ansible-wazuh-agent/templates/authd_pass.j2 index 97a481f24..27c977088 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/authd_pass.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/authd_pass.j2 @@ -1 +1 @@ -{{ authd_pass }} \ No newline at end of file +{{ authd_pass }} diff --git a/roles/wazuh/ansible-wazuh-agent/templates/preloaded_vars_agent.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/preloaded_vars_agent.conf.j2 index 0887b367c..82c36fce4 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/preloaded_vars_agent.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/preloaded_vars_agent.conf.j2 @@ -4,4 +4,4 @@ {{ key|upper }}="{{ value }}" {% endif %} {% endif %} -{% endfor %} \ No newline at end of file +{% endfor %} diff --git a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 index 81979e595..5e7355a3b 100644 --- a/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 +++ b/roles/wazuh/ansible-wazuh-agent/templates/var-ossec-etc-local-internal-options.conf.j2 @@ -13,4 +13,3 @@ # Logcollector - If it should accept remote commands from the manager logcollector.remote_commands=1 - diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 0085d40e8..be39ec653 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -72,8 +72,8 @@ wazuh_manager_globals: - '^localhost.localdomain$' - '127.0.0.53' -wazuh_manager_agent_disconnection_time: '10m' -wazuh_manager_agents_disconnection_alert_time: '0' +wazuh_manager_agent_disconnection_time: '20s' +wazuh_manager_agents_disconnection_alert_time: '100s' ## Alerts wazuh_manager_log_level: 3 diff --git a/roles/wazuh/ansible-wazuh-manager/files/create_user.py b/roles/wazuh/ansible-wazuh-manager/files/create_user.py index 6bb966fae..bd777c5ce 100644 --- a/roles/wazuh/ansible-wazuh-manager/files/create_user.py +++ b/roles/wazuh/ansible-wazuh-manager/files/create_user.py @@ -1,10 +1,8 @@ +import argparse import logging -import sys -import json import random import string -import argparse -import os +import sys # Set framework path sys.path.append("/var/ossec/framework") @@ -17,7 +15,7 @@ set_user_role, update_user, ) -except Exception as e: +except ImportError: logging.error("No module 'wazuh' found.") sys.exit(1) @@ -67,7 +65,7 @@ def db_roles(): password=password, ) # set a random password for all other users - for name, id in initial_users.items(): + for name, user_id in initial_users.items(): if name != username: specials = "@$!%*?&-_" random_pass = "".join( @@ -87,7 +85,7 @@ def db_roles(): ) update_user( user_id=[ - str(id), + str(user_id), ], password=random_pass, ) diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/install_cmake.yml b/roles/wazuh/ansible-wazuh-manager/tasks/install_cmake.yml index 9940c700b..cbb24e5ea 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/install_cmake.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/install_cmake.yml @@ -4,7 +4,7 @@ # cmake_download_url: http://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz # cmake_version: 3.18.3 # - - name: Include CMake install vars + - name: Include CMake install vars include_vars: install_cmake.yml - name: Download CMake sources @@ -37,4 +37,4 @@ - name: Delete installation files file: state: absent - path: "/tmp/cmake-{{ cmake_version }}" \ No newline at end of file + path: "/tmp/cmake-{{ cmake_version }}" diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_custom_packages.yml b/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_custom_packages.yml index e238ad0f2..0d4736564 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_custom_packages.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_custom_packages.yml @@ -28,4 +28,4 @@ - (ansible_distribution|lower == "centos" and ansible_distribution_major_version >= "8") or (ansible_distribution|lower == "redhat" and ansible_distribution_major_version >= "8") when: - - ansible_os_family|lower == "redhat" \ No newline at end of file + - ansible_os_family|lower == "redhat" diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_sources.yml b/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_sources.yml index 74818bc55..a633c9176 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_sources.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/installation_from_sources.yml @@ -18,7 +18,7 @@ - tar state: present - - name: Install CMake + - name: Install CMake include_tasks: install_cmake.yml - name: Removing old files diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml index b7640a5ca..828d71180 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml @@ -15,6 +15,19 @@ - tar state: present +- name: Create group Wazuh + group: + name: "wazuh" + state: present + +- name: Create user Wazuh + user: + name: wazuh + group: wazuh + shell: /sbin/nologin + home: "{{ wazuh_dir }}" + comment: Wazuh User + - include_tasks: "RedHat.yml" when: (ansible_os_family == "RedHat" and ansible_distribution_major_version|int > 5) or (ansible_os_family == "RedHat" and ansible_distribution == "Amazon") @@ -89,6 +102,11 @@ - init - config - rules +- name: Adding ossec user to wazuh group + user: + name: ossec + groups: wazuh + append: yes - name: Adding local rules files copy: src="{{ wazuh_manager_config.ruleset.rules_path }}" @@ -230,6 +248,7 @@ owner: root group: wazuh mode: 0644 + lstrip_blocks: true notify: restart wazuh-manager tags: - init diff --git a/roles/wazuh/ansible-wazuh-manager/templates/authd_pass.j2 b/roles/wazuh/ansible-wazuh-manager/templates/authd_pass.j2 index 97a481f24..27c977088 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/authd_pass.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/authd_pass.j2 @@ -1 +1 @@ -{{ authd_pass }} \ No newline at end of file +{{ authd_pass }} diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 index c5c1a788e..a36719a20 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-etc-ossec-server.conf.j2 @@ -1,4 +1,7 @@ -#jinja2: lstrip_blocks: True +#jinja2: trim_blocks: "true", lstrip_blocks: "true" + + {% if wazuh_manager_version > '4.2.5-1' %} {% if wazuh_manager_config.authd.force.enabled is not none %} {{wazuh_manager_config.authd.force.enabled}} @@ -647,6 +649,7 @@ 1h {% endif %} + {% endif %} {% if wazuh_manager_config.authd.purge is not none %} {{wazuh_manager_config.authd.purge}} {% endif %} diff --git a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-rules-local_rules.xml.j2 b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-rules-local_rules.xml.j2 index 39eb6a942..933692428 100644 --- a/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-rules-local_rules.xml.j2 +++ b/roles/wazuh/ansible-wazuh-manager/templates/var-ossec-rules-local_rules.xml.j2 @@ -16,4 +16,4 @@ authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5, - \ No newline at end of file + diff --git a/roles/wazuh/ansible-wazuh-manager/vars/install_cmake.yml b/roles/wazuh/ansible-wazuh-manager/vars/install_cmake.yml index cda00c6ee..4b3735e2a 100644 --- a/roles/wazuh/ansible-wazuh-manager/vars/install_cmake.yml +++ b/roles/wazuh/ansible-wazuh-manager/vars/install_cmake.yml @@ -1,4 +1,4 @@ # Install cmake vars cmake_version: 3.18.3 -cmake_download_url: "http://packages.wazuh.com/utils/cmake/cmake-{{ cmake_version }}.tar.gz" \ No newline at end of file +cmake_download_url: "http://packages.wazuh.com/utils/cmake/cmake-{{ cmake_version }}.tar.gz"