Merge pull request #477 from wazuh/feature-adapt-molecule-tests

Feature adapt molecule tests

.ansible-lint

@@ -0,0 +1,4 @@
+---
+warn_list:
+  - '106'
+  - '303'

.github/actions/default/Dockerfile

@@ -1,7 +0,0 @@
-FROM quay.io/ansible/molecule:2.20
-
-VOLUME [ "/sys/fs/cgroup", "/run", "/run/lock" ]
-
-COPY ./entrypoint.sh /entrypoint.sh
-RUN chmod 755 /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]

.github/actions/default/action.yml

@@ -1,6 +0,0 @@
-name: molecule-test
-description: Molecule tests for Wazuh Ansible
-runs:
-  using: docker
-  image: 'Dockerfile'
-    

.github/actions/default/entrypoint.sh

@@ -1,3 +0,0 @@
-#!/bin/sh -eu
-
-molecule test

.github/workflows/main.yml

@@ -1,13 +1,127 @@
-
+---
 name: Molecule tests for Wazuh Ansible
-
-on: [push]
+on: [pull_request, workflow_dispatch, release]
 
 jobs:
-  default:
+
+  scenario-default:
+    name: Default scenario (smoke)
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code
+      - name: Check out the codebase.
         uses: actions/checkout@v2
-    - name: Default scenario
-      uses: './.github/actions/default'
+
+      - name: Hack to get setup-python to work on act. See act issue 251
+        run: |
+          # Hack to get setup-python to work on act
+          if [ ! -f "/etc/lsb-release" ] ; then
+            echo "DISTRIB_RELEASE=18.04" > /etc/lsb-release
+          fi
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install poetry
+        run: pip3 install poetry
+
+      - name: Install dependencies
+        run: poetry install
+
+      - name: Run Molecule tests.
+        run: poetry run molecule test -s default
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+
+  scenario-distributed-wazuh-elk:
+    name: Distributed ELK + Wazuh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+
+      - name: Hack to get setup-python to work on act. See act issue 251
+        run: |
+          if [ ! -f "/etc/lsb-release" ] ; then
+            echo "DISTRIB_RELEASE=18.04" > /etc/lsb-release
+          fi
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install poetry
+        run: pip3 install poetry
+
+      - name: Install dependencies
+        run: poetry install
+
+
+      - name: Run Molecule tests.
+        run: poetry run molecule test -s distributed-wazuh-elk
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+
+  scenario-distributed-wazuh-elk-xpack:
+    name: Distributed ELK + XPack + Wazuh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+
+      - name: Hack to get setup-python to work on act. See act issue 251
+        run: |
+          if [ ! -f "/etc/lsb-release" ] ; then
+            echo "DISTRIB_RELEASE=18.04" > /etc/lsb-release
+          fi
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install poetry
+        run: pip3 install poetry
+
+      - name: Install dependencies
+        run: poetry install
+
+      - name: Run Molecule tests.
+        run: poetry run molecule test -s distributed-wazuh-elk-xpack
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'
+
+  scenario-distributed-wazuh-odfe:
+    name: Distributed ODFE + Wazuh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the codebase.
+        uses: actions/checkout@v2
+
+      - name: Hack to get setup-python to work on act. See act issue 251
+        run: |
+          if [ ! -f "/etc/lsb-release" ] ; then
+            echo "DISTRIB_RELEASE=18.04" > /etc/lsb-release
+          fi
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install poetry
+        run: pip3 install poetry
+
+      - name: Install dependencies
+        run: poetry install
+
+      - name: Run Molecule tests.
+        run: poetry run molecule test -s distributed-wazuh-odfe
+        env:
+          PY_COLORS: '1'
+          ANSIBLE_FORCE_COLOR: '1'

.gitignore

@@ -6,5 +6,8 @@ wazuh-elastic.yml
 wazuh-kibana.yml
 wazuh-manager.yml
 *.pyc
+.mypy_cache
 Pipfile.lock
 *.swp
+molecule/**/es_certs/
+molecule/**/opendistro/

.yamllint

@@ -1,3 +1,5 @@
+---
+# Based on ansible-lint config
 extends: default
 
 rules:
@@ -7,10 +9,25 @@ rules:
   brackets:
     max-spaces-inside: 1
     level: error
+  colons:
+    max-spaces-after: -1
+    level: error
+  commas:
+    max-spaces-after: -1
+    level: error
+  comments: disable
+  comments-indentation: disable
+  document-start: disable
+  empty-lines:
+    max: 3
+    level: error
+  hyphens:
+    level: error
+  indentation: disable
+  key-duplicates: enable
   line-length: disable
-  # NOTE(retr0h): Templates no longer fail this lint rule.
-  #               Uncomment if running old Molecule templates.
-  # truthy: disable
-ignore: |
-  .travis.yml
-  config.yml
+  new-line-at-end-of-file: disable
+  new-lines:
+    type: unix
+  trailing-spaces: disable
+  truthy: disable

molecule/default/Dockerfile.j2

@@ -1,14 +0,0 @@
-# Molecule managed
-
-{% if item.registry is defined %}
-FROM {{ item.registry.url }}/{{ item.image }}
-{% else %}
-FROM {{ item.image }}
-{% endif %}
-
-RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get upgrade -y && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
-    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python2-dnf bash && dnf clean all; \
-    elif [ $(command -v yum) ]; then yum makecache fast && yum update -y && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
-    elif [ $(command -v zypper) ]; then zypper refresh && zypper update -y && zypper install -y python sudo bash python-xml && zypper clean -a; \
-    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
-    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/default/converge.yml

@@ -0,0 +1,17 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      vars:
+    - { role: ../../roles/wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: "elasticsearch_centos7:9200" }
+  vars:
+  pre_tasks:
+    - name: (converge) fix missing packages in cloud images
+      apt:
+        name:
+          - unzip
+          - gpg-agent
+        state: present
+        update_cache: yes
+      when: ansible_distribution == "Ubuntu"

molecule/default/molecule.yml

@@ -1,34 +1,53 @@
 ---
+# Smoke test: basic manager run
 dependency:
   name: galaxy
 driver:
   name: docker
-lint:
-  name: yamllint
-  enabled: false
+lint: |
+  yamllint .
+  ansible-lint roles
+  flake8 molecule
 platforms:
-
-  - name: manager_centos7
-    image: milcom/centos7-systemd
+  - name: wazuh_manager_centos7
+    hostname: wazuh-mgr01
+    image: geerlingguy/docker-centos7-ansible
     command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
     ulimits:
       - nofile:262144:262144
-    privileged: true
-    memory_reservation: 2048m
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
 
-  - name: ubuntu20
-    image: jrei/systemd-ubuntu:20.04
-    privileged: true
-
-  - name: debian9
-    image: jrei/systemd-debian:9
+  - name: wazuh_manager_debian9
+    hostname: wazuh-mgr02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
     privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
 
 provisioner:
   name: ansible
+  ansible_args:
+    - -vv
   config_options:
     defaults:
       hash_behaviour: merge
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    #destroy: destroy.yml
   env:
     ANSIBLE_ROLES_PATH: ./roles
   lint:
@@ -43,11 +62,8 @@ scenario:
     - prepare
     - converge
     #- idempotence
-    - verify
+    #- verify
     - cleanup
     - destroy
 verifier:
   name: testinfra
-  lint:
-    name: flake8
-    enabled: false

molecule/default/playbook.yml

@@ -1,7 +0,0 @@
----
-- name: Converge
-  hosts: all
-  roles:
-    - role: ../../roles/wazuh/ansible-wazuh-manager
-      vars:
-    - { role: ../../roles/wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: "elasticsearch_centos7:9200" }

molecule/default/tests/test_default.py

@@ -1,7 +1,6 @@
 import os
 import pytest
 import testinfra.utils.ansible_runner
-import re
 
 testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
     os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')

molecule/distributed-wazuh-elk-xpack/INSTALL.rst

@@ -0,0 +1,16 @@
+*******
+Install
+*******
+
+Requirements
+============
+
+* Docker Engine
+* docker-py
+
+Install
+=======
+
+.. code-block:: bash
+
+  $ sudo pip install docker-py

molecule/distributed-wazuh-elk-xpack/converge.yml

@@ -0,0 +1,94 @@
+---
+
+
+- name: Generate certificates prior to converging
+  hosts: all
+  become: true
+  become_user: root
+  vars:
+    endpoints_hostvars: '{{ managers_hostvars | union(elastic_hostvars) | union(kibana_hostvars)  }}'
+  roles:
+    - role: ../../roles/elastic-stack/ansible-elasticsearch
+      vars:
+        node_certs_generator: true
+        instances: '{{ elk_endpoint_list }}'
+      when:
+        - inventory_hostname in groups['elastic']
+        - ansible_hostname == 'wazuh-es01'
+  pre_tasks:
+    - name: (converge) build instances list dynamically for cert generator consumption
+      set_fact:
+        elk_endpoint_list: "{{ elk_endpoint_list | default({}) | combine({ instance_hostname: instance_item }) }}"
+      vars:
+        instance_hostname: '{{ item.ansible_facts.hostname }}'
+        instance_item:
+          name: '{{ item.private_ip}}'
+          ip: '{{ item.private_ip }}'
+      loop: '{{ endpoints_hostvars }}'
+      no_log: true
+    - name: overview of cert configuration
+      debug:
+        var: elk_endpoint_list
+
+- name: Converge
+  hosts: all
+  become: true
+  become_user: root
+  vars:
+    endpoints_hostvars: '{{ managers_hostvars | union(elastic_hostvars) | union(kibana_hostvars)  }}'
+    # arguments common to all managers
+    wazuh_managers_common:
+      port: 1514
+      protocol: tcp
+      api_port: 55000
+      api_proto: 'http'
+      api_user: ansible
+      max_retries: 5
+      retry_interval: 5
+  roles:
+    # 1. Elasticsearch
+    - role: ../../roles/elastic-stack/ansible-elasticsearch
+      vars:
+        instances: '{{ elk_endpoint_list }}'
+      when: inventory_hostname in groups['elastic']
+    # 2. Managers
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      when: inventory_hostname in groups['managers']
+    - role: ../../roles/wazuh/ansible-filebeat
+      when: inventory_hostname in groups['managers']
+    # 3. Kibana
+    - role: ../../roles/elastic-stack/ansible-kibana
+      when: inventory_hostname in groups['kibana']
+    # 4. Agents:
+    - role: ../../roles/wazuh/ansible-wazuh-agent
+      vars:
+        wazuh_managers: '{{ wazuh_managers_list }}'
+      when: inventory_hostname in groups['agents']
+  pre_tasks:
+
+    - name: (converge) build wazuh_managers list dynamically for agents to consume
+      set_fact:
+        wazuh_managers_list: '{{ wazuh_managers_list | default([]) | union([manager_item]) }}'
+      vars:
+        manager_item: '{{ wazuh_managers_common | combine({"address": item})  }}'
+      loop: '{{ manager_addresses }}'
+
+    - name: (converge) build instances list dynamically for cert generator consumption
+      set_fact:
+        elk_endpoint_list: "{{ elk_endpoint_list | default({}) | combine({ instance_hostname: instance_item }) }}"
+      vars:
+        instance_hostname: '{{ item.ansible_facts.hostname }}'
+        instance_item:
+          name: '{{ item.private_ip}}'
+          ip: '{{ item.private_ip }}'
+      loop: '{{ endpoints_hostvars }}'
+      no_log: true
+
+    - name: (converge) fix ubuntu repository key task in thin images where gpg-agent is missing
+      apt:
+        name: gpg-agent
+        state: present
+        update_cache: yes
+      when:
+        - ansible_distribution == "Ubuntu"
+        - inventory_hostname in groups['agents']

molecule/distributed-wazuh-elk-xpack/group_vars/agents.yml

@@ -0,0 +1,25 @@
+---
+
+wazuh_agent_config:
+  enrollment:
+    enabled: 'yes'
+    #manager_address: ''
+    #port: 1515
+    agent_name: '{{ ansible_hostname }}'
+    #groups: ''
+    #agent_address: ''
+    #ssl_cipher: HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH
+    #server_ca_path: ''
+    #agent_certificate_path: ''
+    #agent_key_path: ''
+    #authorization_pass_path : /var/ossec/etc/authd.pass
+    #auto_method: 'no'
+    #delay_after_enrollment: 20
+    #use_source_ip: 'no'
+
+wazuh_agent_authd:
+  registration_address: '{{ manager_addresses | random }}'
+  enable: true
+  port: 1515
+  ssl_agent_ca: null
+  ssl_auto_negotiate: 'no'

molecule/distributed-wazuh-elk-xpack/group_vars/all.yml

@@ -0,0 +1,27 @@
+---
+
+########################################################
+# Helper variables
+private_ip: '{{ ansible_default_ipv4.address }}'
+
+managers_hostvars: "{{ groups['managers'] | map('extract', hostvars)  | list }}"
+elastic_hostvars: "{{ groups['elastic'] | map('extract', hostvars)  | list }}"
+kibana_hostvars: "{{ groups['kibana'] | map('extract', hostvars)  | list }}"
+
+manager_addresses: "{{ managers_hostvars | map(attribute='private_ip') | list }}"
+elastic_addresses: "{{ elastic_hostvars | map(attribute='private_ip') | list }}"
+kibana_addresses: "{{ kibana_hostvars | map(attribute='private_ip') | list }}"
+
+########################################################
+# General ELK stack variables
+
+# Xpack Security: autogenerate CA
+generate_CA: true
+filebeat_xpack_security: true
+kibana_xpack_security: true
+elasticsearch_xpack_security: true
+elasticsearch_xpack_security_user: elastic
+elasticsearch_xpack_security_password: elastic_pass
+
+elastic_stack_version: 7.9.1
+filebeat_version: 7.9.1

molecule/distributed-wazuh-elk-xpack/group_vars/elastic.yml

@@ -0,0 +1,17 @@
+---
+
+single_node: false
+elasticsearch_node_master: true
+minimum_master_nodes: 1
+
+elasticsearch_network_host: '{{ private_ip }}'
+elasticsearch_node_name: '{{ private_ip }}'
+
+elasticsearch_reachable_host: '{{ private_ip }}'
+elasticsearch_http_port: 9200
+
+elasticsearch_bootstrap_node: true
+elasticsearch_cluster_nodes: '{{ elastic_addresses }}'
+elasticsearch_discovery_nodes: '{{ elastic_addresses }}'
+
+elasticsearch_jvm_xms: 1024

molecule/distributed-wazuh-elk-xpack/group_vars/kibana.yml

@@ -0,0 +1,19 @@
+---
+
+kibana_server_name: '{{ ansible_hostname }}'
+kibana_node_name: '{{ private_ip }}'
+
+elasticsearch_network_host: "{{ elastic_addresses[0] }}"
+#elasticsearch_http_port: 9200
+
+elasticsearch_node_master: false
+elasticsearch_node_ingest: false
+elasticsearch_node_data: false
+
+wazuh_api_credentials:
+  - id: default
+    url: 'https://{{ manager_addresses[0] }}'
+    port: 55000
+    #port: 1514
+    username: wazuh
+    password: wazuh

molecule/distributed-wazuh-elk-xpack/group_vars/managers.yml

@@ -0,0 +1,21 @@
+---
+
+wazuh_manager_fqdn: '{{ ansible_hostname }}'
+
+filebeat_node_name: '{{ private_ip }}'
+filebeat_output_elasticsearch_hosts: '{{ elastic_addresses }}'
+
+wazuh_manager_config:
+  connection:
+    - type: 'secure'
+      port: '1514'
+      protocol: 'tcp'
+      queue_size: 131072
+  api:
+    https: 'yes'
+  cluster:
+    disable: 'no'
+    node_name: '{{ ansible_hostname }}'
+    node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}"
+    nodes: '{{ manager_addresses }}'
+    hidden: 'no'

molecule/distributed-wazuh-elk-xpack/molecule.yml

@@ -0,0 +1,162 @@
+---
+# Distributed scenario: clustered manager scenario + connected agents
+# 2-core CPU
+# 7 GB of RAM memory
+# 14 GB of SSD disk space
+#
+# Source: https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners
+
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint: |
+  yamllint .
+  ansible-lint roles
+  flake8 molecule
+platforms:
+  ################################################
+  # Wazuh Managers
+  ################################################
+  - name: molecule_xpack_manager_centos7
+    hostname: wazuh-mgr01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_xpack_manager_debian9
+    hostname: wazuh-mgr02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Elastic Cluster
+  ################################################
+  - name: molecule_xpack_elasticsearch_centos7
+    hostname: wazuh-es01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_xpack_elasticsearch_debian9
+    hostname: wazuh-es02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Wazuh Agents
+  ################################################
+  - name: molecule_xpack_agent_centos7
+    hostname: wazuh-agent01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_xpack_agent_debian9
+    hostname: wazuh-agent02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Kibana
+  ################################################
+
+  - name: molecule_xpack_kibana_centos7
+    hostname: wazuh-kib01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 2048m
+    memory_reservation: 512m
+    groups:
+      - kibana
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+provisioner:
+  name: ansible
+  ansible_args:
+    - -vv
+  inventory:
+    links:
+      group_vars: group_vars
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    #destroy: destroy.yml
+  config_options:
+    defaults:
+      hash_behaviour: merge
+  env:
+    ANSIBLE_ROLES_PATH: ./roles
+  lint:
+    name: ansible-lint
+    enabled: false
+scenario:
+  name: distributed-wazuh-elk-xpack
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    #- idempotence
+    #- verify
+    - cleanup
+    - destroy
+verifier:
+  name: testinfra

molecule/distributed-wazuh-elk-xpack/tests/test_default.py

@@ -0,0 +1,64 @@
+import os
+import pytest
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "4.0.0"
+
+
+def test_wazuh_packages_are_installed(host):
+    """Test the main packages are installed."""
+    manager = host.package("wazuh-manager")
+    assert manager.is_installed
+    assert manager.version.startswith(get_wazuh_version())
+
+
+def test_wazuh_services_are_running(host):
+    """Test the services are enabled and running.
+
+    When assert commands are commented, this means that the service command has
+    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
+    """
+    # This currently doesn't work with out current Docker base images
+    # manager = host.service("wazuh-manager")
+    # api = host.service("wazuh-api")
+    # assert manager.is_running
+    # assert api.is_running
+    output = host.check_output(
+        'ps aux | grep ossec | tr -s " " | cut -d" " -f11'
+        )
+    assert 'ossec-authd' in output
+    assert 'wazuh-modulesd' in output
+    assert 'wazuh-db' in output
+    assert 'ossec-execd' in output
+    assert 'ossec-monitord' in output
+    assert 'ossec-remoted' in output
+    assert 'ossec-logcollector' in output
+    assert 'ossec-analysisd' in output
+    assert 'ossec-syscheckd' in output
+
+
+@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
+    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
+    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
+    ("/var/ossec/etc/rules/local_rules.xml", "ossec", "ossec", 0o640),
+    ("/var/ossec/etc/lists/audit-keys", "ossec", "ossec", 0o660),
+])
+def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
+    """Test Wazuh related files exist and have proper owners and mode."""
+    wazuh_file_host = host.file(wazuh_file)
+    assert wazuh_file_host.user == wazuh_owner
+    assert wazuh_file_host.group == wazuh_group
+    assert wazuh_file_host.mode == wazuh_mode
+
+
+def test_filebeat_is_installed(host):
+    """Test the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.9.1')

molecule/distributed-wazuh-elk/INSTALL.rst

@@ -0,0 +1,16 @@
+*******
+Install
+*******
+
+Requirements
+============
+
+* Docker Engine
+* docker-py
+
+Install
+=======
+
+.. code-block:: bash
+
+  $ sudo pip install docker-py

molecule/distributed-wazuh-elk/converge.yml

@@ -0,0 +1,60 @@
+---
+
+- name: Converge
+  hosts: all
+  become: true
+  become_user: root
+  vars:
+    # arguments common to all managers
+    wazuh_managers_common:
+      port: 1514
+      protocol: tcp
+      api_port: 55000
+      api_proto: 'http'
+      api_user: ansible
+      max_retries: 5
+      retry_interval: 5
+  roles:
+    # 1. Elasticsearch
+    - role: ../../roles/elastic-stack/ansible-elasticsearch
+      when: inventory_hostname in groups['elastic']
+    # 2. Managers
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      when: inventory_hostname in groups['managers']
+    - role: ../../roles/wazuh/ansible-filebeat
+      when: inventory_hostname in groups['managers']
+    # 3. Kibana
+    - role: ../../roles/elastic-stack/ansible-kibana
+      when: inventory_hostname in groups['kibana']
+    # 4. Agents:
+    - role: ../../roles/wazuh/ansible-wazuh-agent
+      vars:
+        wazuh_managers: '{{ wazuh_managers_list }}'
+      when: inventory_hostname in groups['agents']
+  pre_tasks:
+
+    - name: (converge) build wazuh_managers list dynamically for agents to consume
+      set_fact:
+        wazuh_managers_list: '{{ wazuh_managers_list | default([]) | union([merged_dict]) }}'
+      vars:
+        merged_dict: '{{ wazuh_managers_common | combine({"address": item})  }}'
+      loop: '{{ manager_addresses }}'
+
+    - name: (converge) fix ubuntu repository key task in thin images where gpg-agent is missing
+      apt:
+        name: gpg-agent
+        state: present
+        update_cache: yes
+      when:
+        - ansible_distribution == "Ubuntu"
+        - inventory_hostname in groups['agents']
+
+    - debug:
+        msg: |
+          -----------------------------------------
+          managers: {{ managers_hostvars | length }}
+          addresses: {{  manager_addresses }}
+          -----------------------------------------
+          elastic: {{ elastic_hostvars | length }}
+          addresses: {{  elastic_addresses }}
+          -----------------------------------------

molecule/distributed-wazuh-elk/group_vars/agents.yml

@@ -0,0 +1,18 @@
+---
+
+wazuh_agent_config:
+  enrollment:
+    enabled: 'yes'
+    #manager_address: ''
+    #port: 1515
+    agent_name: '{{ ansible_hostname }}'
+    #groups: ''
+    #agent_address: ''
+    #ssl_cipher: HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH
+    #server_ca_path: ''
+    #agent_certificate_path: ''
+    #agent_key_path: ''
+    #authorization_pass_path : /var/ossec/etc/authd.pass
+    #auto_method: 'no'
+    #delay_after_enrollment: 20
+    #use_source_ip: 'no'

molecule/distributed-wazuh-elk/group_vars/all.yml

@@ -0,0 +1,13 @@
+---
+
+########################################################
+# Helper variables
+private_ip: '{{ ansible_default_ipv4.address }}'
+
+managers_hostvars: "{{ groups['managers'] | map('extract', hostvars)  | list }}"
+elastic_hostvars: "{{ groups['elastic'] | map('extract', hostvars)  | list }}"
+
+manager_addresses: "{{ managers_hostvars | map(attribute='private_ip') | list }}"
+elastic_addresses: "{{ elastic_hostvars | map(attribute='private_ip') | list }}"
+
+elastic_stack_version: 7.9.1

molecule/distributed-wazuh-elk/group_vars/elastic.yml

@@ -0,0 +1,21 @@
+---
+
+single_node: false
+elasticsearch_node_master: true
+minimum_master_nodes: 1
+
+elasticsearch_network_host: '{{ private_ip }}'
+elasticsearch_node_name: '{{ ansible_hostname }}'
+
+elasticsearch_reachable_host: '{{ private_ip }}'
+elasticsearch_http_port: 9200
+
+# This scenario runs without xpack-security
+elasticsearch_xpack_security: false
+node_certs_generator: false
+
+elasticsearch_bootstrap_node: true
+elasticsearch_cluster_nodes: '{{ elastic_addresses }}'
+elasticsearch_discovery_nodes: '{{ elastic_addresses }}'
+
+elasticsearch_jvm_xms: 1024

molecule/distributed-wazuh-elk/group_vars/kibana.yml

@@ -0,0 +1,19 @@
+---
+
+kibana_node_name: '{{ ansible_hostname }}'
+kibana_server_name: '{{ ansible_hostname }}'
+
+elasticsearch_network_host: "{{ elastic_addresses | random }}"
+#elasticsearch_http_port: 9200
+
+elasticsearch_node_master: false
+elasticsearch_node_ingest: false
+elasticsearch_node_data: false
+
+wazuh_api_credentials:
+  - id: default
+    url: 'https://{{ manager_addresses[0] }}'
+    port: 55000
+    #port: 1514
+    username: wazuh
+    password: wazuh

molecule/distributed-wazuh-elk/group_vars/managers.yml

@@ -0,0 +1,20 @@
+---
+
+wazuh_manager_fqdn: '{{ ansible_hostname }}'
+filebeat_node_name: '{{ ansible_hostname }}'
+filebeat_output_elasticsearch_hosts: '{{ elastic_addresses }}'
+
+wazuh_manager_config:
+  connection:
+    - type: 'secure'
+      port: '1514'
+      protocol: 'tcp'
+      queue_size: 131072
+  api:
+    https: 'yes'
+  cluster:
+    disable: 'no'
+    node_name: '{{ ansible_hostname }}'
+    node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}"
+    nodes: '{{ manager_addresses }}'
+    hidden: 'no'

molecule/distributed-wazuh-elk/host_vars/wazuh_agent_centos7.yml

@@ -0,0 +1,7 @@
+---
+wazuh_agent_authd:
+  registration_address: '{{ manager_addresses | random }}'
+  enable: true
+  port: 1515
+  ssl_agent_ca: null
+  ssl_auto_negotiate: 'no'

molecule/distributed-wazuh-elk/molecule.yml

@@ -0,0 +1,163 @@
+---
+# Distributed scenario: clustered manager scenario + connected agents
+# 2-core CPU
+# 7 GB of RAM memory
+# 14 GB of SSD disk space
+#
+# Source: https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners
+
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint: |
+  yamllint .
+  ansible-lint roles
+  flake8 molecule
+platforms:
+  ################################################
+  # Wazuh Managers
+  ################################################
+  - name: wazuh_manager_centos7
+    hostname: wazuh-mgr01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_manager_debian9
+    hostname: wazuh-mgr02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Elastic Cluster
+  ################################################
+  - name: wazuh_elasticsearch_centos7
+    hostname: wazuh-es01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_elasticsearch_debian9
+    hostname: wazuh-es02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Wazuh Agents
+  ################################################
+  - name: wazuh_agent_centos7
+    hostname: wazuh-agent01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_agent_debian9
+    hostname: wazuh-agent01
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Kibana
+  ################################################
+
+  - name: wazuh_kibana_centos7
+    hostname: wazuh-kib01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 2048m
+    memory_reservation: 512m
+    groups:
+      - kibana
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+provisioner:
+  name: ansible
+  ansible_args:
+    - -vv
+  inventory:
+    links:
+      group_vars: group_vars
+      host_vars: host_vars
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    #destroy: destroy.yml
+  config_options:
+    defaults:
+      hash_behaviour: merge
+  env:
+    ANSIBLE_ROLES_PATH: ./roles
+  lint:
+    name: ansible-lint
+    enabled: false
+scenario:
+  name: distributed-wazuh-elk
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    #- idempotence
+    #- verify
+    - cleanup
+    - destroy
+verifier:
+  name: testinfra

molecule/distributed-wazuh-elk/tests/test_default.py

@@ -0,0 +1,64 @@
+import os
+import pytest
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "4.0.0"
+
+
+def test_wazuh_packages_are_installed(host):
+    """Test the main packages are installed."""
+    manager = host.package("wazuh-manager")
+    assert manager.is_installed
+    assert manager.version.startswith(get_wazuh_version())
+
+
+def test_wazuh_services_are_running(host):
+    """Test the services are enabled and running.
+
+    When assert commands are commented, this means that the service command has
+    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
+    """
+    # This currently doesn't work with out current Docker base images
+    # manager = host.service("wazuh-manager")
+    # api = host.service("wazuh-api")
+    # assert manager.is_running
+    # assert api.is_running
+    output = host.check_output(
+        'ps aux | grep ossec | tr -s " " | cut -d" " -f11'
+        )
+    assert 'ossec-authd' in output
+    assert 'wazuh-modulesd' in output
+    assert 'wazuh-db' in output
+    assert 'ossec-execd' in output
+    assert 'ossec-monitord' in output
+    assert 'ossec-remoted' in output
+    assert 'ossec-logcollector' in output
+    assert 'ossec-analysisd' in output
+    assert 'ossec-syscheckd' in output
+
+
+@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
+    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
+    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
+    ("/var/ossec/etc/rules/local_rules.xml", "ossec", "ossec", 0o640),
+    ("/var/ossec/etc/lists/audit-keys", "ossec", "ossec", 0o660),
+])
+def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
+    """Test Wazuh related files exist and have proper owners and mode."""
+    wazuh_file_host = host.file(wazuh_file)
+    assert wazuh_file_host.user == wazuh_owner
+    assert wazuh_file_host.group == wazuh_group
+    assert wazuh_file_host.mode == wazuh_mode
+
+
+def test_filebeat_is_installed(host):
+    """Test the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.9.1')

molecule/distributed-wazuh-odfe/INSTALL.rst

@@ -0,0 +1,16 @@
+*******
+Install
+*******
+
+Requirements
+============
+
+* Docker Engine
+* docker-py
+
+Install
+=======
+
+.. code-block:: bash
+
+  $ sudo pip install docker-py

molecule/distributed-wazuh-odfe/converge.yml

@@ -0,0 +1,75 @@
+---
+
+- name: Build Facts
+  hosts: all
+  become: true
+  become_user: root
+  vars:
+    endpoints_hostvars: '{{ managers_hostvars | union(elastic_hostvars) | union(kibana_hostvars)  }}'
+    wazuh_managers_common:
+      port: 1514
+      protocol: tcp
+      api_port: 55000
+      api_proto: 'http'
+      api_user: ansible
+      max_retries: 5
+      retry_interval: 5
+  pre_tasks:
+    - name: (converge) build instances list dynamically for cert generator consumption
+      set_fact:
+        odfe_endpoint_list: "{{ odfe_endpoint_list | default({}) | combine({ instance_hostname: instance_item }) }}"
+      vars:
+        instance_hostname: '{{ item.ansible_facts.hostname }}'
+        instance_item:
+          name: '{{ instance_hostname }}'
+          ip: '{{ item.private_ip }}'
+      loop: '{{ endpoints_hostvars }}'
+      no_log: true
+
+    - name: (converge) build wazuh_managers list dynamically for agents to consume
+      set_fact:
+        wazuh_managers_list: '{{ wazuh_managers_list | default([]) | union([manager_item]) }}'
+      vars:
+        manager_item: '{{ wazuh_managers_common | combine({"address": item})  }}'
+      loop: '{{ manager_addresses }}'
+
+    - name: overview of cert configuration
+      debug:
+        var: odfe_endpoint_list
+
+- name: Generate certificates prior to converging
+  hosts: molecule_odfe_elasticsearch_centos7
+  become: true
+  become_user: root
+  roles:
+    - role: ../../roles/opendistro/opendistro-elasticsearch
+      vars:
+        generate_certs: true
+        perform_installation: false
+        instances: '{{ odfe_endpoint_list }}'
+  pre_tasks:
+    - name: overview of cert configuration
+      debug:
+        var: odfe_endpoint_list
+
+- name: Converge
+  hosts: all
+  become: true
+  become_user: root
+  roles:
+    # 1. Elasticsearch
+    - role: ../../roles/opendistro/opendistro-elasticsearch
+      when: inventory_hostname in groups['elastic']
+    # 2. Managers
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      when: inventory_hostname in groups['managers']
+    - role: ../../roles/wazuh/ansible-filebeat-oss
+      when: inventory_hostname in groups['managers']
+    # 3. Kibana
+    - role: ../../roles/opendistro/opendistro-kibana
+      when: inventory_hostname in groups['kibana']
+    # 4. Agents:
+    - role: ../../roles/wazuh/ansible-wazuh-agent
+      vars:
+        wazuh_managers: '{{ wazuh_managers_list }}'
+      when: inventory_hostname in groups['agents']

molecule/distributed-wazuh-odfe/group_vars/agents.yml

@@ -0,0 +1,25 @@
+---
+
+wazuh_agent_config:
+  enrollment:
+    enabled: 'yes'
+    #manager_address: ''
+    #port: 1515
+    agent_name: '{{ ansible_hostname }}'
+    #groups: ''
+    #agent_address: ''
+    #ssl_cipher: HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH
+    #server_ca_path: ''
+    #agent_certificate_path: ''
+    #agent_key_path: ''
+    #authorization_pass_path : /var/ossec/etc/authd.pass
+    #auto_method: 'no'
+    #delay_after_enrollment: 20
+    #use_source_ip: 'no'
+
+wazuh_agent_authd:
+  registration_address: '{{ manager_addresses[0] }}'
+  enable: true
+  port: 1515
+  ssl_agent_ca: null
+  ssl_auto_negotiate: 'no'

molecule/distributed-wazuh-odfe/group_vars/all.yml

@@ -0,0 +1,37 @@
+---
+
+########################################################
+# Helper variables
+private_ip: '{{ ansible_default_ipv4.address }}'
+
+managers_hostvars: "{{ groups['managers'] | map('extract', hostvars)  | list }}"
+elastic_hostvars: "{{ groups['elastic'] | map('extract', hostvars)  | list }}"
+kibana_hostvars: "{{ groups['kibana'] | map('extract', hostvars)  | list }}"
+
+manager_addresses: "{{ managers_hostvars | map(attribute='private_ip') | list }}"
+elastic_addresses: "{{ elastic_hostvars | map(attribute='private_ip') | list }}"
+kibana_addresses: "{{ kibana_hostvars | map(attribute='private_ip') | list }}"
+
+########################################################
+# General ELK stack variables
+
+# Cluster Settings
+#es_version: "7.9.1"
+#es_major_version: "7.x"
+#opendistro_version: 1.10.1
+filebeat_version: 7.9.1
+
+# OpenDistro
+kibana_opendistro_security: true
+
+opendistro_kibana_user: kibanaserver
+opendistro_security_user: elastic
+
+opendistro_kibana_password: changeme
+opendistro_security_password: admin
+opendistro_admin_password: changeme
+
+# All nodes are called by IP name
+elasticsearch_node_name: '{{ ansible_hostname }}'
+kibana_node_name: '{{ ansible_hostname }}'
+filebeat_node_name: '{{ ansible_hostname }}'

molecule/distributed-wazuh-odfe/group_vars/elastic.yml

@@ -0,0 +1,16 @@
+---
+
+single_node: false
+elasticsearch_node_master: true
+minimum_master_nodes: 1
+
+elasticsearch_network_host: '{{ private_ip }}'
+
+elasticsearch_reachable_host: '{{ private_ip }}'
+elasticsearch_http_port: 9200
+
+elasticsearch_bootstrap_node: true
+elasticsearch_cluster_nodes: '{{ elastic_addresses }}'
+elasticsearch_discovery_nodes: '{{ elastic_addresses }}'
+
+opendistro_jvm_xms: 1024

molecule/distributed-wazuh-odfe/group_vars/kibana.yml

@@ -0,0 +1,17 @@
+---
+
+kibana_server_name: '{{ ansible_hostname }}'
+elasticsearch_network_host: "{{ elastic_addresses[0] }}"
+#elasticsearch_http_port: 9200
+
+elasticsearch_node_master: false
+elasticsearch_node_ingest: false
+elasticsearch_node_data: false
+
+wazuh_api_credentials:
+  - id: default
+    url: 'https://{{ manager_addresses[0] }}'
+    port: 55000
+    #port: 1514
+    username: wazuh
+    password: wazuh

molecule/distributed-wazuh-odfe/group_vars/managers.yml

@@ -0,0 +1,19 @@
+---
+
+wazuh_manager_fqdn: '{{ ansible_hostname }}'
+filebeat_output_elasticsearch_hosts: '{{ elastic_addresses }}'
+
+wazuh_manager_config:
+  connection:
+    - type: 'secure'
+      port: '1514'
+      protocol: 'tcp'
+      queue_size: 131072
+  api:
+    https: 'yes'
+  cluster:
+    disable: 'no'
+    node_name: '{{ ansible_hostname }}'
+    node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}"
+    nodes: '{{ manager_addresses }}'
+    hidden: 'no'

molecule/distributed-wazuh-odfe/molecule.yml

@@ -0,0 +1,162 @@
+---
+# Distributed scenario: clustered manager scenario + connected agents
+# 2-core CPU
+# 7 GB of RAM memory
+# 14 GB of SSD disk space
+#
+# Source: https://docs.github.com/en/free-pro-team@latest/actions/reference/specifications-for-github-hosted-runners
+
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint: |
+  yamllint .
+  ansible-lint roles
+  flake8 molecule
+platforms:
+  ################################################
+  # Wazuh Managers
+  ################################################
+  - name: molecule_odfe_manager_centos7
+    hostname: wazuh-mgr01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_odfe_manager_debian9
+    hostname: wazuh-mgr02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Elastic Cluster
+  ################################################
+  - name: molecule_odfe_elasticsearch_centos7
+    hostname: wazuh-es01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_odfe_elasticsearch_centos7_2
+    hostname: wazuh-es02
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Wazuh Agents
+  ################################################
+  - name: molecule_odfe_agent_centos7
+    hostname: wazuh-agent01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: molecule_odfe_agent_debian9
+    hostname: wazuh-agent02
+    image: geerlingguy/docker-debian9-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 1024m
+    memory_reservation: 512m
+    groups:
+      - agents
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Kibana
+  ################################################
+
+  - name: molecule_odfe_kibana_centos7
+    hostname: wazuh-kib01
+    image: geerlingguy/docker-centos7-ansible
+    command: /sbin/init
+    pre_build_image: true
+    privileged: true
+    memory: 2048m
+    memory_reservation: 512m
+    groups:
+      - kibana
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+provisioner:
+  name: ansible
+  ansible_args:
+    - -vv
+  inventory:
+    links:
+      group_vars: group_vars
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    #destroy: destroy.yml
+  config_options:
+    defaults:
+      hash_behaviour: merge
+  env:
+    ANSIBLE_ROLES_PATH: ./roles
+  lint:
+    name: ansible-lint
+    enabled: false
+scenario:
+  name: distributed-wazuh-odfe
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    #- idempotence
+    #- verify
+    - cleanup
+    - destroy
+verifier:
+  name: testinfra

molecule/distributed-wazuh-odfe/tests/test_default.py

@@ -0,0 +1,64 @@
+import os
+import pytest
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "4.0.0"
+
+
+def test_wazuh_packages_are_installed(host):
+    """Test the main packages are installed."""
+    manager = host.package("wazuh-manager")
+    assert manager.is_installed
+    assert manager.version.startswith(get_wazuh_version())
+
+
+def test_wazuh_services_are_running(host):
+    """Test the services are enabled and running.
+
+    When assert commands are commented, this means that the service command has
+    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
+    """
+    # This currently doesn't work with out current Docker base images
+    # manager = host.service("wazuh-manager")
+    # api = host.service("wazuh-api")
+    # assert manager.is_running
+    # assert api.is_running
+    output = host.check_output(
+        'ps aux | grep ossec | tr -s " " | cut -d" " -f11'
+        )
+    assert 'ossec-authd' in output
+    assert 'wazuh-modulesd' in output
+    assert 'wazuh-db' in output
+    assert 'ossec-execd' in output
+    assert 'ossec-monitord' in output
+    assert 'ossec-remoted' in output
+    assert 'ossec-logcollector' in output
+    assert 'ossec-analysisd' in output
+    assert 'ossec-syscheckd' in output
+
+
+@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
+    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
+    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
+    ("/var/ossec/etc/rules/local_rules.xml", "ossec", "ossec", 0o640),
+    ("/var/ossec/etc/lists/audit-keys", "ossec", "ossec", 0o660),
+])
+def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
+    """Test Wazuh related files exist and have proper owners and mode."""
+    wazuh_file_host = host.file(wazuh_file)
+    assert wazuh_file_host.user == wazuh_owner
+    assert wazuh_file_host.group == wazuh_group
+    assert wazuh_file_host.mode == wazuh_mode
+
+
+def test_filebeat_is_installed(host):
+    """Test the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.9.1')

pyproject.toml

@@ -0,0 +1,28 @@
+[tool.poetry]
+name = "wazuh-ansible"
+version = "4.0.0"
+description = ""
+authors = ["neonmei <neonmei@pm.me>"]
+
+[tool.poetry.dependencies]
+python = "^3.6"
+
+# Pin ansible version to that currently present on awx
+ansible = "==2.9.5"
+jinja2 = "^2.11.2"
+
+[tool.poetry.dev-dependencies]
+pytest = "^5.2"
+ansible-lint = "^4.3.5"
+flake8 = "^3.8.4"
+selinux = "^0.2.1"
+yamllint = "^1.25.0"
+
+# minimum version is 3.0.3, because we need docker memory limitation
+# https://github.com/ansible-community/molecule/pull/2615
+molecule = {extras = ["docker"], version = "==3.0.8"}
+testinfra = "^5.3.1"
+
+[build-system]
+requires = ["poetry>=0.12"]
+build-backend = "poetry.masonry.api"