Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

4.4 branch update with changes applied in 4.3 #581

Merged
merged 10 commits into from
Sep 29, 2022
Merged

4.4 branch update with changes applied in 4.3 #581

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a6212a6
Testing changes
c-bordon Sep 20, 2022
1fb533d
Add changes from 4.3
c-bordon Sep 20, 2022
f9b3c72
Add install of archive module
c-bordon Sep 21, 2022
ee20e52
Fix wazuh.yml template
c-bordon Sep 21, 2022
6cfa38c
Add merge changes
c-bordon Sep 21, 2022
4d73f32
Removed manage_repo validation for dashboard
c-bordon Sep 21, 2022
fe6e4a8
Changed with PR #551
c-bordon Sep 21, 2022
c6b639f
Update manifests/dashboard.pp
c-bordon Sep 21, 2022
7718392
Update manifests/dashboard.pp
c-bordon Sep 21, 2022
dd7060b
Changes requested by community
c-bordon Sep 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 74 additions & 32 deletions manifests/dashboard.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,66 +4,108 @@
$dashboard_package = 'wazuh-dashboard',
$dashboard_service = 'wazuh-dashboard',
$dashboard_version = '4.4.0',
$dashboard_user = 'admin',
$dashboard_password = 'admin',
$indexer_server_ip = 'localhost',
$indexer_server_port = '9200',
$dashboard_path_certs = '/etc/wazuh-dashboard/certs',
$dashboard_fileuser = 'wazuh-dashboard',
$dashboard_filegroup = 'wazuh-dashboard',

$dashboard_server_port = '5601',
$dashboard_server_port = '443',
$dashboard_server_host = '0.0.0.0',
$dashboard_server_hosts ="https://${indexer_server_ip}:$indexer_server_port}",
$dashboard_wazuh_api_credentials = [ {
'id' => 'default',
'url' => 'http://localhost',
'port' => '55000',
'user' => 'foo',
'password' => 'bar',
},
]
$indexer_server_host = "https://${indexer_server_ip}:${indexer_server_port}",
$dashboard_wazuh_api_credentials = [
{
'id' => 'default',
'url' => 'https://localhost',
'port' => '55000',
'user' => 'wazuh-wui',
'password' => 'wazuh-wui',
},
],
) {

include wazuh::repo

if $::osfamily == 'Debian' {
Class['wazuh::repo'] -> Class['apt::update'] -> Package['wazuh-dashboard']
} else {
Class['wazuh::repo'] -> Package['wazuh-dashboard']
}

# assign version according to the package manager
case $::osfamily {
'Debian' : {
case $facts['os']['family'] {
'Debian': {
$dashboard_version_install = "${dashboard_version}-*"
}
'Linux', 'RedHat' : {
$dashboard_version_install = "${dashboard_version}"
'Linux', 'RedHat', default: {
$dashboard_version_install = $dashboard_version
}
}

# install package
package { 'Installing Wazuh Dashboard...':
package { 'wazuh-dashboard':
ensure => $dashboard_version_install,
name => $dashboard_package,
}

include wazuh::certificates
require wazuh::certificates

exec { 'Copy Dashboard Certificates':
exec { "ensure full path of ${dashboard_path_certs}":
path => '/usr/bin:/bin',
command => "mkdir $dashboard_path_certs \
&& cp /tmp/wazuh-certificates/dashboard.pem $dashboard_path_certs\
&& cp /tmp/wazuh-certificates/dashboard-key.pem $dashboard_path_certs\
&& cp /tmp/wazuh-certificates/root-ca.pem $dashboard_path_certs\
&& chown wazuh-dashboard:wazuh-dashboard -R $dashboard_path_certs\
&& chmod 500 $dashboard_path_certs\
&& chmod 400 $dashboard_path_certs/*",
command => "mkdir -p ${dashboard_path_certs}",
creates => $dashboard_path_certs,
require => Package['wazuh-dashboard'],
}
-> file { $dashboard_path_certs:
ensure => directory,
owner => $dashboard_fileuser,
group => $dashboard_filegroup,
mode => '0500',
}

[
'dashboard.pem',
'dashboard-key.pem',
'root-ca.pem',
].each |String $certfile| {
file { "${dashboard_path_certs}/${certfile}":
ensure => file,
owner => $dashboard_fileuser,
group => $dashboard_filegroup,
mode => '0400',
replace => false, # only copy content when file not exist
source => "/tmp/wazuh-certificates/${certfile}",
}
}

# TODO: Fully manage the opensearch_dashboards.yml and a template file resource
file { '/etc/wazuh-dashboard/opensearch_dashboards.yml':
owner => 'wazuh-dashboard',
group => 'wazuh-dashboard',
mode => '0640',
content => template('wazuh/opensearch_dashboards_yml.erb'),
require => Package[$dashboard_package],
notify => Service[$dashboard_service]
c-bordon marked this conversation as resolved.
Show resolved Hide resolved
}

service { 'wazuh-dashboard':
ensure => running,
enable => true,
hasrestart => true,
name => $dashboard_service,
}

exec {'Waiting for Wazuh indexer...':
path => '/usr/bin',
command => "curl -u ${dashboard_user}:${dashboard_password} -k -s -XGET https://${indexer_server_ip}:${indexer_server_port}",
tries => 100,
try_sleep => 3,
exec {'Waiting for Wazuh dashboard...':
require => Service[$dashboard_service],
command => "sleep 15 ",
path => "/usr/bin:/bin",
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What reason have this sleep here?

It was fully removed in 4.3 with 19ec46a

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason for this sleep is because the file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml is created on the first start of Wazuh dashboard, so we must give it a delay time to make sure that the step file { '/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml': can be executed successfully

Copy link
Contributor

@cruelsmith cruelsmith Sep 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅 ok what you want is that the file is manged before the service starts i think. Because you mange the content of the file. Else you will create a loop were puppet changes the file and when the dashboard starts it overrides it again.

I will add a suggestion in a second to this pull request. So you can see what i mean. See here: #581 (comment)

https://puppet.com/docs/puppet/7/lang_relationships.html#lang_rel_metaparameters
https://puppet.com/docs/puppet/7/types/exec.html#exec-description


}
file { '/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml':
owner => 'wazuh-dashboard',
group => 'wazuh-dashboard',
mode => '0600',
content => template('wazuh/wazuh_yml.erb'),
require => Package[$dashboard_package]
c-bordon marked this conversation as resolved.
Show resolved Hide resolved
}
}
109 changes: 70 additions & 39 deletions manifests/filebeat_oss.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,82 +5,113 @@
$filebeat_oss_indexer_port = '9200',
$indexer_server_ip = "\"${filebeat_oss_indexer_ip}:${filebeat_oss_indexer_port}\"",

$filebeat_oss_archives = false,
$filebeat_oss_package = 'filebeat',
$filebeat_oss_service = 'filebeat',
$filebeat_oss_elastic_user = 'admin',
$filebeat_oss_elastic_password = 'admin',
$filebeat_oss_version = '7.10.2',
$wazuh_app_version = '4.4.0_7.10.0',
$wazuh_app_version = '4.4.0_7.10.2',
$wazuh_extensions_version = 'v4.4.0',
$wazuh_filebeat_module = 'wazuh-filebeat-0.1.tar.gz',
$filebeat_path_certs = '/etc/filebeat/certs',
){
$wazuh_filebeat_module = 'wazuh-filebeat-0.2.tar.gz',

class {'wazuh::repo_elastic_oss':}
$filebeat_fileuser = 'root',
$filebeat_filegroup = 'root',
$filebeat_path_certs = '/etc/filebeat/certs',
) {
include wazuh::repo_elastic_oss

if $::osfamily == 'Debian' {
Class['wazuh::repo_elastic_oss'] -> Class['apt::update'] -> Package[$filebeat_oss_package]
if $facts['os']['family'] == 'Debian' {
Class['wazuh::repo_elastic_oss'] -> Class['apt::update'] -> Package['filebeat']
} else {
Class['wazuh::repo_elastic_oss'] -> Package[$filebeat_oss_package]
Class['wazuh::repo_elastic_oss'] -> Package['filebeat']
}

package { 'filebeat':
ensure => $filebeat_oss_version,
name => $filebeat_oss_package,
}

file { 'Configure filebeat.yml':
file { '/etc/filebeat/filebeat.yml':
owner => 'root',
path => '/etc/filebeat/filebeat.yml',
group => 'root',
mode => '0644',
notify => Service[$filebeat_oss_service], ## Restarts the service
mode => '0640',
notify => Service['filebeat'], ## Restarts the service
content => template('wazuh/filebeat_oss_yml.erb'),
require => Package[$filebeat_oss_package]
require => Package['filebeat'],
}

exec { 'Installing wazuh-template.json...':
path => '/usr/bin',
command => "curl -so /etc/filebeat/wazuh-template.json 'https://raw.githubusercontent.com/wazuh/wazuh/${wazuh_extensions_version}/extensions/elasticsearch/7.x/wazuh-template.json'",
notify => Service[$filebeat_oss_service],
require => Package[$filebeat_oss_package]
# work around:
# Use cmp to compare the content of local and remote file. When they differ than rm the file to get it recreated by the file resource.
# Needed since GitHub can only ETAG and result in changes of the mtime everytime.
# TODO: Include file into the wazuh/wazuh-puppet project or use file { checksum => '..' } for this instead of the exec construct.
exec { 'cleanup /etc/filebeat/wazuh-template.json':
command => '/bin/rm /etc/filebeat/wazuh-template.json',
onlyif => '/usr/bin/test -e /etc/filebeat/wazuh-template.json',
unless => "/bin/cmp -s '/etc/filebeat/wazuh-template.json' <(curl -s https://raw.githubusercontent.com/wazuh/wazuh/${wazuh_extensions_version}/extensions/elasticsearch/7.x/wazuh-template.json)",
}
Copy link
Contributor

@cruelsmith cruelsmith Sep 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is still broken in 4.3. We still wait for the merge of #551 or #543 to fix it.


exec { 'Installing filebeat module ... Downloading package':
path => '/usr/bin',
command => "curl -o /root/${$wazuh_filebeat_module} https://packages.wazuh.com/4.x/filebeat/${$wazuh_filebeat_module}",
-> file { '/etc/filebeat/wazuh-template.json':
owner => 'root',
group => 'root',
mode => '0440',
replace => false, # only copy content when file not exist
source => "https://raw.githubusercontent.com/wazuh/wazuh/${wazuh_extensions_version}/extensions/elasticsearch/7.x/wazuh-template.json",
notify => Service['filebeat'],
require => Package['filebeat'],
}

exec { 'Unpackaging ...':
command => '/bin/tar -xzvf /root/wazuh-filebeat-0.2.tar.gz -C /usr/share/filebeat/module',
notify => Service[$filebeat_oss_service],
require => Package[$filebeat_oss_package]
archive { "/tmp/${$wazuh_filebeat_module}":
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
archive { "/tmp/${$wazuh_filebeat_module}":
archive { "/tmp/${wazuh_filebeat_module}":

ensure => present,
source => "https://packages.wazuh.com/4.x/filebeat/${$wazuh_filebeat_module}",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
source => "https://packages.wazuh.com/4.x/filebeat/${$wazuh_filebeat_module}",
source => "https://packages.wazuh.com/4.x/filebeat/${wazuh_filebeat_module}",

extract => true,
extract_path => '/usr/share/filebeat/module',
creates => '/usr/share/filebeat/module/wazuh',
cleanup => true,
notify => Service['filebeat'],
require => Package['filebeat'],
}

file { '/usr/share/filebeat/module/wazuh':
ensure => 'directory',
mode => '0755',
require => Package[$filebeat_oss_package]
require => Package['filebeat'],
}

include wazuh::certificates
require wazuh::certificates

exec { 'Copy Filebeat Certificates':
exec { "ensure full path of ${filebeat_path_certs}":
path => '/usr/bin:/bin',
command => "mkdir $filebeat_path_certs \
&& cp /tmp/wazuh-certificates/server.pem $filebeat_path_certs/filebeat.pem\
&& cp /tmp/wazuh-certificates/server-key.pem $filebeat_path_certs/filebeat-key.pem\
&& cp /tmp/wazuh-certificates/root-ca.pem $filebeat_path_certs\
&& chown root:root -R $filebeat_path_certs\
&& chmod 500 $filebeat_path_certs\
&& chmod 400 $filebeat_path_certs/*",
require => Package[$filebeat_oss_package],
command => "mkdir -p ${filebeat_path_certs}",
creates => $filebeat_path_certs,
require => Package['filebeat'],
}
-> file { $filebeat_path_certs:
ensure => directory,
owner => $filebeat_fileuser,
group => $filebeat_filegroup,
mode => '0500',
}

$_certfiles = {
'server.pem' => 'filebeat.pem',
'server-key.pem' => 'filebeat-key.pem',
'root-ca.pem' => 'root-ca.pem',
}
$_certfiles.each |String $certfile_source, String $certfile_target| {
file { "${filebeat_path_certs}/${certfile_target}":
ensure => file,
owner => $filebeat_fileuser,
group => $filebeat_filegroup,
mode => '0400',
replace => false, # only copy content when file not exist
source => "/tmp/wazuh-certificates/${certfile_source}",
}
}

service { 'filebeat':
ensure => running,
enable => true,
require => Package[$filebeat_oss_package]
name => $filebeat_oss_service,
require => Package['filebeat'],
}
}
}
Loading