forked from opensearch-project/OpenSearch-Dashboards
-
Notifications
You must be signed in to change notification settings - Fork 60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add setcap for node fallback #226
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Tostti
approved these changes
Jul 1, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Test
OS
[root@vagrant vagrant]# cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
SUPPORT_END="2025-06-30"
Installation
[root@vagrant vagrant]# curl -sO https://packages.wazuh.com/4.8/wazuh-certs-tool.sh
4.8/config.yml[root@vagrant vagrant]# curl -sO https://packages.wazuh.com/4.8/config.yml
[root@vagrant vagrant]# nano config.yml
[root@vagrant vagrant]# bash ./wazuh-certs-tool.sh -A
01/07/2024 18:00:31 INFO: Generating the root certificate.
01/07/2024 18:00:31 INFO: Generating Admin certificates.
01/07/2024 18:00:31 INFO: Admin certificates created.
01/07/2024 18:00:31 INFO: Generating Wazuh indexer certificates.
01/07/2024 18:00:31 INFO: Wazuh indexer certificates created.
01/07/2024 18:00:31 INFO: Generating Filebeat certificates.
01/07/2024 18:00:32 INFO: Wazuh Filebeat certificates created.
01/07/2024 18:00:32 INFO: Generating Wazuh dashboard certificates.
01/07/2024 18:00:32 INFO: Wazuh dashboard certificates created.
[root@vagrant vagrant]# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./root-ca.key
./root-ca.pem
./admin-key.pem
./admin.pem
./node-1-key.pem
./node-1.pem
./wazuh-1-key.pem
./wazuh-1.pem
./dashboard-key.pem
./dashboard.pem
[root@vagrant vagrant]# rm -rf ./wazuh-certificates
[root@vagrant vagrant]# yum install coreutils
Loaded plugins: langpacks, priorities, update-motd
amzn2extra-docker | 2.9 kB 00:00:00
(1/2): amzn2extra-docker/2/x86_64/updateinfo | 16 kB 00:00:00
(2/2): amzn2extra-docker/2/x86_64/primary_db | 102 kB 00:00:00
Package coreutils-8.22-24.amzn2.x86_64 already installed and latest version
Nothing to do
[root@vagrant vagrant]# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
[root@vagrant vagrant]# echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1' | tee /etc/yum.repos.d/wa
zuh.repo
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages-dev.wazuh.com/pre-release/yum/
protect=1
[root@vagrant vagrant]# yum -y install wazuh-indexer
Loaded plugins: langpacks, priorities, update-motd
wazuh | 3.4 kB 00:00:00
wazuh/primary_db | 469 kB 00:00:00
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
========================================================================================================================
Package Arch Version Repository Size
========================================================================================================================
Installing:
wazuh-indexer x86_64 4.9.0-1 wazuh 813 M
Transaction Summary
========================================================================================================================
Install 1 Package
Total download size: 813 M
Installed size: 1.0 G
Downloading packages:
wazuh-indexer-4.9.0-1.x86_64.rpm | 813 MB 00:00:48
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : wazuh-indexer-4.9.0-1.x86_64 1/1
### NOT starting on installation, please execute the following statements to configure wazuh-indexer service to start automatically using systemd
sudo systemctl daemon-reload
sudo systemctl enable wazuh-indexer.service
### You can start wazuh-indexer service by executing
sudo systemctl start wazuh-indexer.service
Verifying : wazuh-indexer-4.9.0-1.x86_64 1/1
Installed:
wazuh-indexer.x86_64 0:4.9.0-1
Complete!
[root@vagrant vagrant]# NODE_NAME=node-1
[root@vagrant vagrant]# mkdir /etc/wazuh-indexer/certs
$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
chmod 500 /etc/wazuh-indexer/certs
chmod 400 /etc/wazuh-indexer/certs/*
chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -Cpem ./admin.pem ./admin-key.pem ./root-ca.pem/$NODE_NAME-key.
[root@vagrant vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@vagrant vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@vagrant vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@vagrant vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@vagrant vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
[root@vagrant vagrant]# systemctl daemon-reload
start wazuh-indexer[root@vagrant vagrant]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@vagrant vagrant]# systemctl start wazuh-indexer
[root@vagrant vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755 **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml
SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
[root@vagrant vagrant]# yum -y install wazuh-manager
Loaded plugins: langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
========================================================================================================================
Package Arch Version Repository Size
========================================================================================================================
Installing:
wazuh-manager x86_64 4.9.0-1 wazuh 300 M
Transaction Summary
========================================================================================================================
Install 1 Package
Total download size: 300 M
Installed size: 893 M
Downloading packages:
wazuh-manager-4.9.0-1.x86_64.rpm | 300 MB 00:00:07
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : wazuh-manager-4.9.0-1.x86_64 1/1
Verifying : wazuh-manager-4.9.0-1.x86_64 1/1
Installed:
wazuh-manager.x86_64 0:4.9.0-1
Complete!
[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v
Switch value: -v not found.
Usage: wazuh-keystore <option(s)>
Options:
-h Show this help message
-f COLUMN_FAMILY Specifies the target column family for the insertion.
-k KEY Specifies the key for the key-value pair.
-v VALUE Specifies the value associated with the key.
Example:
./wazuh-keystore -f indexer -k username -v admin
[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v admin
[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k password -v admin
[root@vagrant vagrant]# yum -y install filebeat
Loaded plugins: langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package filebeat.x86_64 0:7.10.2-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
========================================================================================================================
Package Arch Version Repository Size
========================================================================================================================
Installing:
filebeat x86_64 7.10.2-1 wazuh 21 M
Transaction Summary
========================================================================================================================
Install 1 Package
Total download size: 21 M
Installed size: 70 M
Downloading packages:
filebeat-oss-7.10.2-x86_64.rpm | 21 MB 00:00:03
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : filebeat-7.10.2-1.x86_64 1/1
Verifying : filebeat-7.10.2-1.x86_64 1/1
Installed:
filebeat.x86_64 0:7.10.2-1
Complete!
[root@vagrant vagrant]# curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.8/tpl/wazuh/filebeat/filebeat.yml
[root@vagrant vagrant]# filebeat keystore create
Created filebeat keystore
[root@vagrant vagrant]# echo admin | filebeat keystore add username --stdin --force
Successfully updated the keystore
[root@vagrant vagrant]# echo admin | filebeat keystore add password --stdin --force
Successfully updated the keystore
[root@vagrant vagrant]# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.8.0/extensions/elasticsearch/7.x/wazuh-template.json
[root@vagrant vagrant]# chmod go+r /etc/filebeat/wazuh-template.json
[root@vagrant vagrant]# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
wazuh/
wazuh/_meta/
wazuh/_meta/docs.asciidoc
wazuh/_meta/fields.yml
wazuh/_meta/config.yml
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/manifest.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/module.yml
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/manifest.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
[root@vagrant vagrant]# NODE_NAME=wazuh-1
[root@vagrant vagrant]# mkdir /etc/filebeat/certs
f ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
mv -n /et[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-/root-ca.pem
c/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
chmod 500 /etc/filebeat/certs
chmod 400 /etc/filebeat/certs/*
chown -R root:root /etc/filebeat/certs[root@vagrant vagrant]# mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
[root@vagrant vagrant]# mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
[root@vagrant vagrant]# chmod 500 /etc/filebeat/certs
[root@vagrant vagrant]# chmod 400 /etc/filebeat/certs/*
[root@vagrant vagrant]# chown -R root:root /etc/filebeat/certs
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable wazuh-manager
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service.
[root@vagrant vagrant]# systemctl start wazuh-manager
[root@vagrant vagrant]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2024-07-01 18:05:31 UTC; 1s ago
Process: 6856 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
CGroup: /system.slice/wazuh-manager.service
├─6921 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─6961 /var/ossec/bin/wazuh-authd
├─6975 /var/ossec/bin/wazuh-db
├─6987 /var/ossec/bin/wazuh-execd
├─7013 /var/ossec/bin/wazuh-analysisd
├─7017 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─7020 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─7023 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
├─7036 /var/ossec/bin/wazuh-syscheckd
├─7102 /var/ossec/bin/wazuh-remoted
├─7137 /var/ossec/bin/wazuh-logcollector
├─7155 /var/ossec/bin/wazuh-monitord
├─7186 /var/ossec/bin/wazuh-modulesd
├─7555 sh -c yum check-updates --security | grep "No packages"
├─7557 /usr/bin/python /usr/bin/yum check-updates --security
└─7558 grep No packages
Jul 01 18:05:22 vagrant env[6856]: Started wazuh-syscheckd...
Jul 01 18:05:23 vagrant env[6856]: Started wazuh-remoted...
Jul 01 18:05:23 vagrant env[6856]: Started wazuh-logcollector...
Jul 01 18:05:27 vagrant env[6856]: Started wazuh-monitord...
Jul 01 18:05:27 vagrant env[6856]: 2024/07/01 18:05:27 wazuh-modulesd:router: INFO: Loaded router module.
Jul 01 18:05:27 vagrant env[6856]: 2024/07/01 18:05:27 wazuh-modulesd:content_manager: INFO: Loaded content_man...odule.
Jul 01 18:05:29 vagrant env[6856]: Started wazuh-modulesd...
Jul 01 18:05:30 vagrant crontab[7484]: (root) LIST (root)
Jul 01 18:05:31 vagrant env[6856]: Completed.
Jul 01 18:05:31 vagrant systemd[1]: Started Wazuh manager.
Hint: Some lines were ellipsized, use -l to show in full.
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable filebeat
Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service.
[root@vagrant vagrant]# systemctl start filebeat
[root@vagrant vagrant]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: 127.0.0.1
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 7.10.2
[root@vagrant vagrant]# yum install libcap
Loaded plugins: langpacks, priorities, update-motd
Package libcap-2.54-1.amzn2.0.2.x86_64 already installed and latest version
Nothing to do
[root@vagrant vagrant]# yum -y install ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm
Loaded plugins: langpacks, priorities, update-motd
Examining ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm: wazuh-dashboard-4.9.0-1.x86_64
Marking ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package wazuh-dashboard.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
========================================================================================================================
Package Arch Version Repository Size
========================================================================================================================
Installing:
wazuh-dashboard x86_64 4.9.0-1 /wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e 889 M
Transaction Summary
========================================================================================================================
Install 1 Package
Total size: 889 M
Installed size: 889 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : wazuh-dashboard-4.9.0-1.x86_64 1/1
Verifying : wazuh-dashboard-4.9.0-1.x86_64 1/1
Installed:
wazuh-dashboard.x86_64 0:4.9.0-1
Complete!
[root@vagrant vagrant]# NODE_NAME=dashboard
[root@vagrant vagrant]# mkdir /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
[root@vagrant vagrant]# mv -n /etc/wazuh-dashboard/certs/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
mv: ‘/etc/wazuh-dashboard/certs/dashboard.pem’ and ‘/etc/wazuh-dashboard/certs/dashboard.pem’ are the same file
[root@vagrant vagrant]# mv -n /etc/wazuh-dashboard/certs/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
mv: ‘/etc/wazuh-dashboard/certs/dashboard-key.pem’ and ‘/etc/wazuh-dashboard/certs/dashboard-key.pem’ are the same file
[root@vagrant vagrant]# chmod 500 /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# chmod 400 /etc/wazuh-dashboard/certs/*
[root@vagrant vagrant]# chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable wazuh-dashboard
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service to /etc/systemd/system/wazuh-dashboard.service.
[root@vagrant vagrant]# systemctl start wazuh-dashboard
[root@vagrant vagrant]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2024-07-01 18:09:16 UTC; 33s ago
Main PID: 9006 (node)
CGroup: /system.slice/wazuh-dashboard.service
└─9006 /usr/share/wazuh-dashboard/node/fallback/bin/node /usr/share/wazuh-dashboard/src/cli/dist -c /etc/w...
Test ✅
CR ✅
LGTM
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes compatibility with certain operating systems that require older versions of node.
Issues Resolved
#223
Test
bento/amazonlinux-2
Check List
yarn test:jest
yarn test:jest_integration