Skip to content

Commit c68f7e7

Browse files
AlexRuiz7AlexRuiz7
committed
Update distribution files (#59)
* Update config files * Add VERSION file
1 parent 3b2fc29 commit c68f7e7

8 files changed

+359
-4
lines changed

‎VERSION

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
4.9.0

‎distribution/src/bin/indexer-init.sh

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
#!/bin/bash
2+
# Wazuh Copyright (C) 2023 Wazuh Inc. (License GPLv2)
3+
# Wazuh - indexer initialization script
4+
5+
INSTALL_PATH="/usr/share/wazuh-indexer"
6+
BIN_PATH="${INSTALL_PATH}/bin"
7+
8+
9+
#########################################################################
10+
# Parse arguments for security init script.
11+
#########################################################################
12+
function parse_security_args() {
13+
security_args=()
14+
15+
while [ -n "$1" ]; do
16+
case "$1" in
17+
"-h" | "--help")
18+
security_args+=("${1}")
19+
shift
20+
;;
21+
"-ho" | "--host")
22+
if [ -n "$2" ]; then
23+
security_args+=("${1}" "${2}")
24+
shift 2
25+
fi
26+
;;
27+
"--port")
28+
if [ -n "$2" ]; then
29+
security_args+=("${1}" "${2}")
30+
shift 2
31+
fi
32+
;;
33+
"--options")
34+
if [ -n "$2" ]; then
35+
security_args+=("${1}" "${2}")
36+
shift 2
37+
fi
38+
;;
39+
*)
40+
shift
41+
;;
42+
esac
43+
done
44+
}
45+
46+
47+
#########################################################################
48+
# Run the security init script.
49+
#########################################################################
50+
function run_security_init() {
51+
echo "Executing Wazuh indexer security init script..."
52+
parse_security_args "$@"
53+
/bin/bash "${BIN_PATH}/indexer-security-init.sh" "${security_args[@]}"
54+
}
55+
56+
57+
#########################################################################
58+
# Parse arguments for ISM init script.
59+
#########################################################################
60+
function parse_ism_args() {
61+
ism_args=()
62+
63+
while [ -n "${1}" ]; do
64+
case "${1}" in
65+
"-a" | "--min-index-age")
66+
if [ -n "${2}" ]; then
67+
ism_args+=("${1}" "${2}")
68+
shift 2
69+
fi
70+
;;
71+
"-d" | "--min-doc-count")
72+
if [ -n "${2}" ]; then
73+
ism_args+=("${1}" "${2}")
74+
shift 2
75+
fi
76+
;;
77+
"-h" | "--help")
78+
ism_args+=("${1}")
79+
shift
80+
;;
81+
"-i" | "--indexer-hostname")
82+
if [ -n "${2}" ]; then
83+
ism_args+=("${1}" "${2}")
84+
shift 2
85+
fi
86+
;;
87+
"-p" | "--indexer-password")
88+
if [ -n "${2}" ]; then
89+
ism_args+=("${1}" "${2}")
90+
shift 2
91+
fi
92+
;;
93+
"-s" | "--min-shard-size")
94+
if [ -n "${2}" ]; then
95+
ism_args+=("${1}" "${2}")
96+
shift 2
97+
fi
98+
;;
99+
"-P" | "--priority")
100+
if [ -n "${2}" ]; then
101+
ism_args+=("${1}" "${2}")
102+
shift 2
103+
fi
104+
;;
105+
"-v" | "--verbose")
106+
ism_args+=("${1}")
107+
shift
108+
;;
109+
*)
110+
shift
111+
;;
112+
esac
113+
done
114+
}
115+
116+
117+
#########################################################################
118+
# Run the ISM init script.
119+
#########################################################################
120+
function run_ism_init() {
121+
echo "Executing Wazuh indexer ISM init script..."
122+
parse_ism_args "$@"
123+
/bin/bash "${BIN_PATH}/indexer-ism-init.sh" "${ism_args[@]}";
124+
}
125+
126+
127+
#########################################################################
128+
# Main function.
129+
#########################################################################
130+
function main() {
131+
# If run_security_init returns 0, then run_ism_init
132+
if run_security_init "$@" -gt 0; then
133+
run_ism_init "$@"
134+
fi
135+
}
136+
137+
138+
main "$@"

‎scripts/indexer-ism-init.sh ‎distribution/src/bin/indexer-ism-init.sh

File renamed without changes.

‎distribution/src/bin/indexer-security-init.sh

+189
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
#!/bin/bash
2+
3+
# Wazuh-indexer securityadmin wrapper
4+
# Copyright (C) 2022, Wazuh Inc.
5+
#
6+
# This program is a free software; you can redistribute it
7+
# and/or modify it under the terms of the GNU General Public
8+
# License (version 2) as published by the FSF - Free Software
9+
# Foundation.
10+
11+
CONFIG_PATH="/etc/wazuh-indexer"
12+
13+
if [ ! -d "${CONFIG_PATH}" ]; then
14+
echo "ERROR: it was not possible to find ${CONFIG_PATH}"
15+
exit 1
16+
fi
17+
18+
CONFIG_FILE="${CONFIG_PATH}/opensearch.yml"
19+
20+
if [ ! -f "${CONFIG_FILE}" ]; then
21+
echo "ERROR: it was not possible to find ${CONFIG_FILE}"
22+
exit 1
23+
fi
24+
25+
INSTALL_PATH="/usr/share/wazuh-indexer"
26+
27+
if [ ! -d "${INSTALL_PATH}" ]; then
28+
echo "ERROR: it was not possible to find ${INSTALL_PATH}"
29+
exit 1
30+
fi
31+
32+
HOST=""
33+
OPTIONS="-icl -nhnv"
34+
WAZUH_INDEXER_ROOT_CA="$(cat ${CONFIG_FILE} 2>&1 | grep http.pemtrustedcas | sed 's/.*: //' | tr -d "[\"\']")"
35+
WAZUH_INDEXER_ADMIN_PATH="$(dirname "${WAZUH_INDEXER_ROOT_CA}" 2>&1)"
36+
SECURITY_PATH="${INSTALL_PATH}/plugins/opensearch-security"
37+
SECURITY_CONFIG_PATH="${CONFIG_PATH}/opensearch-security"
38+
39+
# -----------------------------------------------------------------------------
40+
41+
trap ctrl_c INT
42+
43+
clean(){
44+
45+
exit_code=$1
46+
indexer_process_id=$(pgrep -f wazuh-indexer -c)
47+
if [ "${indexer_process_id}" -gt 1 ]; then
48+
pkill -n -f wazuh-indexer
49+
fi
50+
exit "${exit_code}"
51+
52+
}
53+
54+
ctrl_c() {
55+
clean 1
56+
}
57+
58+
# -----------------------------------------------------------------------------
59+
60+
getNetworkHost() {
61+
62+
HOST=$(grep -hr "network.host:" "${CONFIG_FILE}" 2>&1)
63+
NH="network.host: "
64+
HOST="${HOST//$NH}"
65+
HOST=$(echo "${HOST}" | tr -d "[\"\']")
66+
67+
isIP=$(echo "${HOST}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$")
68+
isDNS=$(echo "${HOST}" | grep -P "^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$")
69+
70+
# Allow to find ip with an interface
71+
if [ -z "${isIP}" ] && [ -z "${isDNS}" ]; then
72+
interface="${HOST//_}"
73+
HOST=$(ip -o -4 addr list "${interface}" | awk '{print $4}' | cut -d/ -f1)
74+
fi
75+
76+
if [ "${HOST}" = "0.0.0.0" ]; then
77+
HOST="127.0.0.1"
78+
fi
79+
80+
if [ -z "${HOST}" ]; then
81+
echo "ERROR: network host not valid, check ${CONFIG_FILE}"
82+
exit 1
83+
fi
84+
85+
}
86+
87+
# -----------------------------------------------------------------------------
88+
getPort() {
89+
90+
PORT=$(grep -hr 'transport.tcp.port' "${CONFIG_FILE}" 2>&1)
91+
if [ "${PORT}" ]; then
92+
PORT=$(echo "${PORT}" | cut -d' ' -f2 | cut -d'-' -f1)
93+
else
94+
PORT="9200"
95+
fi
96+
PORT=$(echo "${PORT}" | tr -d "[\"\']")
97+
98+
}
99+
# -----------------------------------------------------------------------------
100+
101+
securityadmin() {
102+
103+
if [ ! -d "${SECURITY_PATH}" ]; then
104+
echo "ERROR: it was not possible to find ${SECURITY_PATH}"
105+
exit 1
106+
elif [ ! -d "${INSTALL_PATH}/jdk" ]; then
107+
echo "ERROR: it was not possible to find ${INSTALL_PATH}/jdk"
108+
exit 1
109+
fi
110+
111+
if [ -f "${WAZUH_INDEXER_ADMIN_PATH}/admin.pem" ] && [ -f "${WAZUH_INDEXER_ADMIN_PATH}/admin-key.pem" ] && [ -f "${WAZUH_INDEXER_ROOT_CA}" ]; then
112+
OPENSEARCH_CONF_DIR="${CONFIG_PATH}" JAVA_HOME="${INSTALL_PATH}/jdk" runuser wazuh-indexer --shell="/bin/bash" --command="${SECURITY_PATH}/tools/securityadmin.sh -cd ${SECURITY_CONFIG_PATH} -cacert ${WAZUH_INDEXER_ROOT_CA} -cert ${WAZUH_INDEXER_ADMIN_PATH}/admin.pem -key ${WAZUH_INDEXER_ADMIN_PATH}/admin-key.pem -h ${HOST} -p ${PORT} ${OPTIONS}"
113+
else
114+
echo "ERROR: this tool try to find admin.pem and admin-key.pem in ${WAZUH_INDEXER_ADMIN_PATH} but it couldn't. In this case, you must run manually the Indexer security initializer by running the command: JAVA_HOME="/usr/share/wazuh-indexer/jdk" runuser wazuh-indexer --shell="/bin/bash" --command="/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /etc/wazuh-indexer/opensearch-security -cacert /path/to/root-ca.pem -cert /path/to/admin.pem -key /path/to/admin-key.pem -h ${HOST} -p ${PORT} ${OPTIONS}" replacing /path/to/ by your certificates path."
115+
exit 1
116+
fi
117+
118+
}
119+
120+
help() {
121+
echo
122+
echo "Usage: $0 [OPTIONS]"
123+
echo
124+
echo " -ho, --host <host> [Optional] Target IP or DNS to configure security."
125+
echo " --port <port> [Optional] wazuh-indexer security port."
126+
echo " --options <options> [Optional] Custom securityadmin options."
127+
echo " -h, --help Show this help."
128+
echo
129+
exit "$1"
130+
}
131+
132+
133+
main() {
134+
135+
getNetworkHost
136+
getPort
137+
138+
while [ -n "$1" ]
139+
do
140+
case "$1" in
141+
"-h"|"--help")
142+
help 0
143+
;;
144+
"-ho"|"--host")
145+
if [ -n "$2" ]; then
146+
HOST="$2"
147+
HOST=$(echo "${HOST}" | tr -d "[\"\']")
148+
isIP=$(echo "${2}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$")
149+
isDNS=$(echo "${2}" | grep -P "^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$")
150+
if [[ -z "${isIP}" ]] && [[ -z "${isDNS}" ]]; then
151+
echo "The given information does not match with an IP address or a DNS."
152+
exit 1
153+
fi
154+
shift 2
155+
else
156+
help 1
157+
fi
158+
;;
159+
"--port")
160+
if [ -n "$2" ]; then
161+
PORT="$2"
162+
PORT=$(echo "${PORT}" | tr -d "[\"\']")
163+
if [[ -z $(echo "${2}" | grep -P "^([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$") ]]; then
164+
echo "The given information does not match with a valid PORT number."
165+
exit 1
166+
fi
167+
shift 2
168+
else
169+
help 1
170+
fi
171+
;;
172+
"--options")
173+
if [ -n "$2" ]; then
174+
OPTIONS="$2"
175+
shift 2
176+
else
177+
help 1
178+
fi
179+
;;
180+
*)
181+
help 1
182+
esac
183+
done
184+
185+
securityadmin
186+
187+
}
188+
189+
main "$@"

‎distribution/src/config/security/action_groups.yml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
_meta:
3+
type: "actiongroups"
4+
config_version: 2
5+
6+
# ISM API permissions group
7+
manage_ism:
8+
reserved: true
9+
hidden: false
10+
allowed_actions:
11+
- "cluster:admin/opendistro/ism/*"
12+
static: false

‎distribution/src/config/security/internal_users.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,4 @@ snapshotrestore:
5353
reserved: false
5454
backend_roles:
5555
- "snapshotrestore"
56-
description: "Demo snapshotrestore user"
56+
description: "Demo snapshotrestore user"

‎distribution/src/config/security/roles.yml

+9-1
Original file line numberDiff line numberDiff line change
@@ -146,4 +146,12 @@ manage_wazuh_index:
146146
- "manage"
147147
- "index"
148148
tenant_permissions: []
149-
static: false
149+
static: false
150+
151+
# ISM API permissions role
152+
manage_ism:
153+
reserved: true
154+
hidden: false
155+
cluster_permissions:
156+
- "manage_ism"
157+
static: false

‎distribution/src/config/security/roles_mapping.yml

+9-2
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,19 @@ kibana_user:
7676
and_backend_roles: []
7777
description: "Maps kibanauser to kibana_user"
7878

79-
# Wazuh monitoring and statistics index permissions
79+
# Wazuh monitoring and statistics index permissions
8080
manage_wazuh_index:
8181
reserved: true
8282
hidden: false
8383
backend_roles: []
8484
hosts: []
8585
users:
8686
- "kibanaserver"
87-
and_backend_roles: []
87+
and_backend_roles: []
88+
89+
# ISM API permissions role mapping
90+
manage_ism:
91+
reserved: true
92+
hidden: false
93+
users:
94+
- "kibanaserver"

0 commit comments

Comments
 (0)