Merge branch '3.9.3_7.2.0'

.gitignore

@@ -5,4 +5,6 @@ wazuh-elastic_stack-single.yml
 wazuh-elastic.yml
 wazuh-kibana.yml
 wazuh-manager.yml
-*.pyc
+*.pyc
+Pipfile.lock
+*.swp

CHANGELOG.md

@@ -1,6 +1,16 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [v3.9.3_7.2.0]
+
+### Added 
+- Update to Wazuh v3.9.3 ([rshad](https://github.com/rshad) [PR#206](https://github.com/wazuh/wazuh-ansible/pull/206#))
+- Added Versioning Control for Wazuh stack's components installation, so now it's possible to specify which package to install for wazuh-manager, wazuh-agent, Filebeat, Elasticsearch and Kibana. ([rshad](https://github.com/rshad) [PR#206](https://github.com/wazuh/wazuh-ansible/pull/206#))
+- Fixes for Molecule testing issues. Issues such as Ansible-Lint and None-Idempotent tasks. ([rshad](https://github.com/rshad) [PR#206](https://github.com/wazuh/wazuh-ansible/pull/206#))
+- Fixes for Wazuh components installations' related issues. Such issues were related to determined OS distributions such as `Ubuntu Trusty` and `CetOS 6`. ([rshad](https://github.com/rshad) [PR#206](https://github.com/wazuh/wazuh-ansible/pull/206#))
+-  Created Ansible playbook and role in order to automate the uninstallation of already installed Wazuh components. ([rshad](https://github.com/rshad) [PR#206](https://github.com/wazuh/wazuh-ansible/pull/206#))
+
+
 ## [v3.9.2_7.1.1]
 
 ### Added 

Pipfile

@@ -4,9 +4,9 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-molecule = "*"
 docker-py = "*"
-ansible = "*"
+ansible = "==2.7.11"
+molecule = "*"
 
 [dev-packages]
 
@@ -16,3 +16,6 @@ python_version = "2.7"
 [scripts]
 test ="molecule test"
 agent ="molecule test -s wazuh-agent"
+elasticsearch ="molecule test -s elasticsearch"
+filebeat ="molecule test -s filebeat"
+kibana ="molecule test -s kibana"

VERSION

@@ -1,2 +1,2 @@
-WAZUH-ANSIBLE_VERSION="v3.9.1"
-REVISION="3901"
+WAZUH-ANSIBLE_VERSION="v3.9.3"
+REVISION="3930"

molecule/default/prepare.yml

@@ -24,3 +24,13 @@
         state: latest
       register: wazuh_manager_dependencies_packages_installed
       until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'

molecule/default/tests/test_default.py

@@ -9,7 +9,7 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
 
 def get_wazuh_version():
     """This return the version of Wazuh."""
-    return "3.9.2"
+    return "3.9.3"
 
 
 def test_wazuh_packages_are_installed(host):

molecule/elasticsearch/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/elasticsearch/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/elasticsearch/molecule.yml

@@ -0,0 +1,63 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
+platforms:
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+    privileged: true
+    memory_reservation: 2048m
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    memory_reservation: 2048m
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+#  - name: trusty
+#    image: ubuntu:trusty
+#    privileged: true
+#    memory_reservation: 2048m
+#    ulimits:
+#      - nofile:262144:262144
+  - name: centos6
+    image: centos:6
+    privileged: true
+    memory_reservation: 2048m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos7
+    image: milcom/centos7-systemd
+    memory_reservation: 2048m
+    privileged: true
+    ulimits:
+      - nofile:262144:262144
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+      prepare: ../default/prepare.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+  inventory:
+    group_vars:
+      all:
+        elasticsearch_jvm_xms: 512
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/elasticsearch/playbook.yml

@@ -0,0 +1,6 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: 'localhost'

molecule/elasticsearch/tests/test_default.py

@@ -0,0 +1,20 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_elasticsearch_is_installed(host):
+    """Test if the elasticsearch package is installed."""
+    elasticsearch = host.package("elasticsearch")
+    assert elasticsearch.is_installed
+    assert elasticsearch.version.startswith('7.2.0')
+
+
+def test_elasticsearch_is_running(host):
+    """Test if the services are enabled and running."""
+    elasticsearch = host.service("elasticsearch")
+    assert elasticsearch.is_enabled
+    assert elasticsearch.is_running

molecule/filebeat/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/filebeat/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/filebeat/molecule.yml

@@ -0,0 +1,45 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
+platforms:
+  - name: trusty
+    image: ubuntu:trusty
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    privileged: true
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    command: /sbin/init
+  - name: centos6
+    image: geerlingguy/docker-centos6-ansible
+    privileged: true
+    command: /sbin/init
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+  - name: centos7
+    image: milcom/centos7-systemd
+    privileged: true
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/filebeat/playbook.yml

@@ -0,0 +1,5 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: wazuh/ansible-filebeat

molecule/filebeat/prepare.yml

@@ -0,0 +1,36 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  tasks:
+
+    - name: "Install Python packages for Trusty to solve trust issues"
+      package:
+        name:
+          - python-setuptools
+          - python-pip
+        state: latest
+      register: wazuh_manager_trusty_packages_installed
+      until: wazuh_manager_trusty_packages_installed is succeeded
+      when:
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version | int == 14
+
+    - name: "Install dependencies"
+      package:
+        name:
+          - curl
+          - net-tools
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'

molecule/filebeat/tests/test_default.py

@@ -0,0 +1,13 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_filebeat_is_installed(host):
+    """Test if the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.2.0')

molecule/kibana/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/kibana/INSTALL.rst

@@ -0,0 +1,22 @@
+*******
+Docker driver installation guide
+*******
+
+Requirements
+============
+
+* Docker Engine
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule[docker]'

molecule/kibana/molecule.yml

@@ -0,0 +1,62 @@
+---
+dependency:
+  name: galaxy
+driver:
+  name: docker
+lint:
+  name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
+platforms:
+  - name: bionic
+    image: solita/ubuntu-systemd:bionic
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+    privileged: true
+    memory_reservation: 1024m
+  - name: xenial
+    image: solita/ubuntu-systemd:xenial
+    privileged: true
+    memory_reservation: 1024m
+    command: /sbin/init
+    ulimits:
+      - nofile:262144:262144
+#  - name: trusty
+#    image: ubuntu:trusty
+#    memory_reservation: 1024m
+#    ulimits:
+#      - nofile:262144:262144
+  - name: centos6
+    image: centos:6
+    privileged: true
+    memory_reservation: 1024m
+    ulimits:
+      - nofile:262144:262144
+  - name: centos7
+    image: milcom/centos7-systemd
+    memory_reservation: 1024m
+    privileged: true
+    ulimits:
+      - nofile:262144:262144
+provisioner:
+  name: ansible
+  playbooks:
+    docker:
+      create: ../default/create.yml
+      destroy: ../default/destroy.yml
+  env:
+    ANSIBLE_ROLES_PATH: ../../roles
+  lint:
+    name: ansible-lint
+    enabled: true
+  inventory:
+    group_vars:
+      all:
+        elasticsearch_jvm_xms: 256
+        kibana_plugin_install_ignore_error: true
+verifier:
+  name: testinfra
+  lint:
+    name: flake8

molecule/kibana/playbook.yml

@@ -0,0 +1,5 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: elastic-stack/ansible-kibana

molecule/kibana/prepare.yml

@@ -0,0 +1,41 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: true
+  pre_tasks:
+
+    - name: "Install Python packages for Trusty to solve trust issues"
+      package:
+        name:
+          - python-setuptools
+          - python-pip
+        state: latest
+      register: wazuh_manager_trusty_packages_installed
+      until: wazuh_manager_trusty_packages_installed is succeeded
+      when:
+        - ansible_distribution == "Ubuntu"
+        - ansible_distribution_major_version | int == 14
+
+    - name: "Install dependencies"
+      package:
+        name:
+          - curl
+          - net-tools
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+
+    - name: "Install (RedHat) dependencies"
+      package:
+        name:
+          - initscripts
+        state: latest
+      register: wazuh_manager_dependencies_packages_installed
+      until: wazuh_manager_dependencies_packages_installed is succeeded
+      when:
+        - ansible_os_family == 'RedHat'
+
+  roles:
+    - role: wazuh/ansible-wazuh-manager
+    - role: elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: 'localhost'

molecule/kibana/tests/test_default.py

@@ -0,0 +1,24 @@
+import os
+
+import testinfra.utils.ansible_runner
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_port_kibana_is_open(host):
+    """Test if the port 5601 is open and listening to connections."""
+    host.socket("tcp://0.0.0.0:5601").is_listening
+
+
+def test_find_correct_elasticsearch_version(host):
+    """Test if we find the kibana/elasticsearch version in package.json"""
+    kibana = host.file("/usr/share/kibana/plugins/wazuh/package.json")
+    assert kibana.contains("7.2.0")
+
+
+def test_wazuh_plugin_installed(host):
+    """Make sure there is a plugin wazuh directory."""
+    kibana = host.file("/usr/share/kibana/plugins/wazuh/")
+
+    assert kibana.is_directory

molecule/wazuh-agent/molecule.yml

@@ -3,8 +3,13 @@ dependency:
   name: galaxy
 driver:
   name: docker
+  #lint:
+  #  name: yamllint
 lint:
   name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
 platforms:
   - name: wazuh_server_centos7
     image: milcom/centos7-systemd
@@ -72,7 +77,6 @@ provisioner:
           ssl_agent_cert: null
           ssl_agent_key: null
           ssl_auto_negotiate: 'no'
-
   lint:
     name: ansible-lint
     enabled: true

molecule/wazuh-agent/tests/test_agents.py

@@ -7,6 +7,11 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
     os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('agent')
 
 
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "3.9.3"
+
+
 def test_ossec_package_installed(Package):
     ossec = Package('wazuh-agent')
     assert ossec.is_installed

playbooks/wazuh-elastic_stack-distributed.yml

@@ -1,9 +1,87 @@
 ---
-- hosts: <your wazuh server host>
+
+- hosts: <node-1 IP>
   roles:
-    - role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-wazuh-manager
-    - {role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-filebeat, filebeat_output_logstash_hosts: 'your elastic stack server IP'}
-- hosts: <your elastic stack server host>
+    - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: <node-1 IP>
+      node_name: node-1
+      elasticsearch_bootstrap_node: true
+      elasticsearch_cluster_nodes: 
+        - <node-1 IP>
+        - <node-2 IP>
+        - <node-3 IP>
+      elasticsearch_discovery_nodes:
+        - <node-1 IP>
+        - <node-2 IP>
+        - <node-3 IP>
+      elasticsearch_xpack_security: true
+      node_certs_generator: true
+      elasticsearch_xpack_security_password: elastic_pass
+
+  vars:
+    instances:
+      - name: node-1       # Important: must be equal to elasticsearch_node_name.                    
+        ip: <node-1 IP>   # When unzipping, the node will search for its node name folder to get the cert.
+
+      - name: node-2
+        ip: <node-2 IP>
+
+      - name: node-3
+        ip: <node-3 IP>
+
+- hosts: <node-2 IP>
   roles:
-    - {role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch, elasticsearch_network_host: 'localhost'}
-    - {role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-kibana, elasticsearch_network_host: 'localhost'}
+    - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch
+      elasticsearch_network_host: <node-2 IP>
+      elasticsearch_node_name: node-2
+      elasticsearch_xpack_security: true
+      elasticsearch_master_candidate: true
+      elasticsearch_discovery_nodes:
+        - <node-1 IP>
+        - <node-2 IP>
+        - <node-3 IP>
+  
+- hosts: <node-3 IP>
+  roles:
+    - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch 
+      elasticsearch_network_host: <node-3 IP>
+      elasticsearch_node_name: node-3
+      elasticsearch_xpack_security: true
+      elasticsearch_master_candidate: true
+      elasticsearch_discovery_nodes:
+        - <node-1 IP>
+        - <node-2 IP>
+        - <node-3 IP>
+
+
+# - hosts: 172.16.0.162
+#   roles:
+#     - role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-wazuh-manager
+
+#     - role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-filebeat
+#       filebeat_output_elasticsearch_hosts: 172.16.0.161:9200
+#       filebeat_xpack_security: true
+#       filebeat_node_name: node-2
+#       node_certs_generator: false
+#       elasticsearch_xpack_security_password: elastic_pass
+
+#     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch
+#       elasticsearch_network_host: 172.16.0.162
+#       node_name: node-2
+#       elasticsearch_bootstrap_node: false
+#       elasticsearch_master_candidate: true
+#       elasticsearch_discovery_nodes: 
+#         - 172.16.0.161
+#         - 172.16.0.162
+#       elasticsearch_xpack_security: true
+#       node_certs_generator: false
+
+
+# - hosts: 172.16.0.163
+#   roles:
+#     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-kibana
+#       kibana_xpack_security: true
+#       kibana_node_name: node-3
+#       elasticsearch_network_host: 172.16.0.161
+#       node_certs_generator: false
+#       elasticsearch_xpack_security_password: elastic_pass

playbooks/wazuh-kibana.yml

@@ -1,4 +1,10 @@
 ---
-- hosts: <your kibana host>
+- hosts: 172.16.0.162
   roles:
-    - {role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-kibana, elasticsearch_network_host: 'your elasticsearch IP'}
+    - role: ../roles/elastic-stack/ansible-kibana
+      kibana_xpack_security: true
+      kibana_user: elastic
+      kibana_password: elastic_pass
+      kibana_node_name: node-2
+      elasticsearch_network_host: 172.16.0.161
+      node_certs_generator: false

playbooks/wazuh-manager.yml

@@ -1,5 +1,10 @@
 ---
-- hosts: <your wazuh server host>
+- hosts: 172.16.0.161
   roles:
-    - role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-wazuh-manager
-    - {role: /etc/ansible/roles/wazuh-ansible/roles/wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'your elasticsearch IP'}
+    - role: ../roles/wazuh/ansible-wazuh-manager
+    - role: ../roles/wazuh/ansible-filebeat
+      filebeat_output_elasticsearch_hosts: 172.16.0.161:9200
+      filebeat_xpack_security: true
+      filebeat_node_name: node-1
+      node_certs_generator: true
+

roles/elastic-stack/ansible-elasticsearch/defaults/main.yml

@@ -4,9 +4,31 @@ elasticsearch_node_name: node-1
 elasticsearch_http_port: 9200
 elasticsearch_network_host: 127.0.0.1
 elasticsearch_jvm_xms: null
-elastic_stack_version: 7.1.1
+elastic_stack_version: 7.2.0
 single_node: false
 elasticsearch_bootstrap_node: false
 elasticsearch_master_candidate: false
 elasticsearch_cluster_nodes:
-  - 127.0.0.1
+  - 127.0.0.1
+elasticsearch_discovery_nodes:
+  - 127.0.0.1
+
+# X-Pack Security 
+elasticsearch_xpack_security: false
+elasticsearch_xpack_security_user: elastic
+elasticsearch_xpack_security_password: elastic_pass
+
+node_certs_generator: false
+node_certs_generator_ip: 172.16.0.161
+node_certs_source: /usr/share/elasticsearch
+node_certs_destination: /etc/elasticsearch/certs
+
+# Rsync
+rsync_path: /usr/bin/rsync
+rsync_user: vagrant
+rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'
+
+
+
+
+

roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml

@@ -1,24 +1,66 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
+  register: elasticsearch_ca_packages_installed
+  until: elasticsearch_ca_packages_installed is succeeded
+
+- name: "Install Java Repo for Trusty"
+  apt_repository: repo='ppa:openjdk-r/ppa'
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Update and upgrade apt packages
+  become: true
+  apt:
+    upgrade: yes
+    update_cache: yes
+    cache_valid_time: 86400 #One day
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Install Oracle Java 8
+  become: true
+  apt: name=openjdk-8-jdk state=latest
+
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Update and upgrade apt packages
+  become: true
+  apt:
+    upgrade: yes
+    update_cache: yes
+    cache_valid_time: 86400 #One day
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
 
 - name: Debian/Ubuntu | Add Elasticsearch GPG key.
   apt_key:
     url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
     state: present
 
+
 - name: Debian/Ubuntu | Install Elastic repo
   apt_repository:
     repo: 'deb https://artifacts.elastic.co/packages/7.x/apt stable main'
     state: present
     filename: 'elastic_repo'
     update_cache: true
+  changed_when: false
 
 - name: Debian/Ubuntu | Install Elasticsarch
   apt:
     name: "elasticsearch={{ elastic_stack_version }}"
     state: present
     cache_valid_time: 3600
+  register: elasticsearch_main_packages_installed
+  until: elasticsearch_main_packages_installed is succeeded
   tags: install

roles/elastic-stack/ansible-elasticsearch/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/7.x/apt stable main
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-elasticsearch/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml

@@ -7,6 +7,14 @@
     baseurl: https://artifacts.elastic.co/packages/7.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false
+
+- name: CentOS x.x => x.x < 7.0 | Installing Java
+  yum:
+    name: java-1.8.0-openjdk.x86_64
+    state: present
+  when:
+    - ansible_distribution in ['CentOS', 'RedHat'] and ansible_distribution_major_version|int < 7
 
 - name: RedHat/CentOS/Fedora | Install Elasticsarch
   package: name=elasticsearch-{{ elastic_stack_version }} state=present

roles/elastic-stack/ansible-elasticsearch/tasks/main.yml

@@ -48,16 +48,6 @@
     - ansible_service_mgr != "systemd"
     - ansible_os_family == "RedHat"
 
-- name: Configure Elasticsearch.
-  template:
-    src: elasticsearch.yml.j2
-    dest: /etc/elasticsearch/elasticsearch.yml
-    owner: root
-    group: elasticsearch
-    mode: 0660
-  notify: restart elasticsearch
-  tags: configure
-
 - name: Configure Elasticsearch JVM memmory.
   template:
     src: jvm.options.j2
@@ -69,16 +59,183 @@
   tags: configure
 
 # fix in new PR (ignore_errors)
-- name: Reload systemd
+
+- import_tasks: "RMRedHat.yml"
+  when: ansible_os_family == "RedHat"
+
+- name: Check if certificate exists locally
+  stat:
+    path: "{{node_certs_destination}}/{{ elasticsearch_node_name }}.crt"
+  register: certificate_file_exists
+  when:
+    - elasticsearch_xpack_security
+
+- name: Write the instances.yml file in the selected node (force = no)
+  template:
+    src: instances.yml.j2
+    dest: "{{node_certs_source}}/instances.yml"
+    force: no
+  register: instances_file_exists
+  tags:
+    - config
+    - xpack-security
+  when:
+    - node_certs_generator
+    - elasticsearch_xpack_security
+    - not certificate_file_exists.stat.exists
+
+- name: Update instances.yml status after generation
+  stat:
+    path: "{{node_certs_source}}/instances.yml"
+  register: instances_file_exists
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+
+- name: Check if the certificates ZIP file exists
+  stat:
+    path: "{{node_certs_source}}/certs.zip"
+  register: xpack_certs_zip
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+
+- name: Generating certificates for Elasticsearch security
+  shell: "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{node_certs_source}}/instances.yml --out {{node_certs_source}}/certs.zip"
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+    - not xpack_certs_zip.stat.exists
+    - not certificate_file_exists.stat.exists
+  register: certs_file_generated
+  tags: xpack-security
+
+- name: Unzip generated certs.zip
+  unarchive:
+    src: "{{node_certs_source}}/certs.zip"
+    dest: "{{node_certs_source}}/"
+    remote_src: yes
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+    - certs_file_generated is defined
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Copy key & certificate files in generator node (locally)
+  synchronize:
+    src: "{{node_certs_source}}/{{elasticsearch_node_name}}/"
+    dest: "{{node_certs_destination}}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+  tags: xpack-security
+
+- name: Copy ca certificate file in generator node (locally)
+  synchronize:
+    src: "{{node_certs_source}}/ca/"
+    dest: "{{node_certs_destination}}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  register: check_certs_permissions
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+  tags: xpack-security
+
+- name: Importing key & certificate files from generator node
+  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{elasticsearch_node_name}}/ {{node_certs_destination}}/"
+  when:
+    - not node_certs_generator
+    - elasticsearch_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Importing ca certificate file from generator node 
+  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/"
+  when:
+    - not node_certs_generator
+    - elasticsearch_xpack_security
+    - not certificate_file_exists.stat.exists
+  register: check_certs_permissions
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  shell: "chown -R elasticsearch: {{node_certs_destination}}/"
+  when:
+    - check_certs_permissions is defined
+    - elasticsearch_xpack_security
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  shell: "chmod -R 770 {{node_certs_destination}}/"
+  when:
+    - check_certs_permissions is defined
+    - elasticsearch_xpack_security
+  tags: xpack-security
+  
+
+- name: Remove generated certs file
+  shell: /bin/rm -f {{node_certs_source}}/certs.zip*
+  when: 
+    - node_certs_generator
+    - elasticsearch_xpack_security
+  tags: xpack-security
+
+- name: Configure Elasticsearch.
+  template:
+    src: elasticsearch.yml.j2
+    dest: /etc/elasticsearch/elasticsearch.yml
+    owner: root
+    group: elasticsearch
+    mode: 0660
+  notify: restart elasticsearch
+  tags: configure
+
+- name: Set elasticsearch bootstrap password
+  shell: "echo '{{elasticsearch_xpack_security_password}}' | {{node_certs_source}}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
+  when:
+    - elasticsearch_xpack_security
+  
+- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
+  lineinfile:
+    path: /etc/security/limits.conf
+    line: elasticsearch - memlock unlimited
+    create: yes
+  become: true
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+  changed_when: false
+
+- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.d/elasticsearch.conf
+  lineinfile:
+    path: /etc/security/limits.d/elasticsearch.conf
+    line: elasticsearch - memlock unlimited
+    create: yes
+  become: true
+  changed_when: false
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Distribution != one of [ centos 6.*,  trusty ] | Reload systemd
   systemd: daemon_reload=true
   ignore_errors: true
   when:
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
+
+- name: Distribution is centos 6.* | Enable Elasticsearch
+  service: name=elasticsearch enabled=yes
+
+- name: Distribution is centos 6.* | Start Elasticsearch
+  service: name=elasticsearch state=started
+  ignore_errors: true
 
 - name: Ensure Elasticsearch started and enabled
-  ignore_errors: true
   service:
     name: elasticsearch
     enabled: true
@@ -90,19 +247,22 @@
     - configure
     - init
 
-- name: Check for Wazuh Alerts template
+- name: Check for Wazuh Alerts template (http)
   uri:
-    url: "http://{{elasticsearch_network_host}}:{{elasticsearch_http_port}}/_template/wazuh"
+    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
     method: GET
     status_code: 200, 404
-  when: not elasticsearch_bootstrap_node or single_node
+  when: 
+    - elasticsearch_bootstrap_node or single_node
+    - not elasticsearch_xpack_security
   poll: 30
   register: wazuh_alerts_template_exits
+  until: wazuh_alerts_template_exits is succeeded
   tags: init
 
-- name: Installing Wazuh Alerts template
+- name: Installing Wazuh Alerts template (http)
   uri:
-    url: "http://{{elasticsearch_network_host}}:{{elasticsearch_http_port}}/_template/wazuh"
+    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
     method: PUT
     status_code: 200
     body_format: json
@@ -110,6 +270,7 @@
   when: 
     - wazuh_alerts_template_exits.status is defined
     - wazuh_alerts_template_exits.status != 200
+    - not elasticsearch_xpack_security
   tags: init
 
 - import_tasks: "RMRedHat.yml"

roles/elastic-stack/ansible-elasticsearch/templates/elasticsearch.yml.j2

@@ -15,10 +15,31 @@ cluster.initial_master_nodes:
 {% for item in elasticsearch_cluster_nodes %}
   - {{ item }}
 {% endfor %}
-{% elif elasticsearch_master_candidate %}
-node.master: true
 discovery.seed_hosts:
-{% for item in elasticsearch_cluster_nodes %}
+{% for item in elasticsearch_discovery_nodes %}
+  - {{ item }}
+{% endfor %}
+{% else %}
+node.master: {{ elasticsearch_master_candidate|lower }}
+discovery.seed_hosts:
+{% for item in elasticsearch_discovery_nodes %}
   - {{ item }}
 {% endfor %}
 {% endif %}
+
+# XPACK Security
+
+{% if elasticsearch_xpack_security %}
+xpack.security.enabled: true
+xpack.security.transport.ssl.enabled: true
+xpack.security.transport.ssl.verification_mode: certificate 
+xpack.security.transport.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key 
+xpack.security.transport.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt 
+xpack.security.transport.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ]
+
+xpack.security.http.ssl.enabled: true
+xpack.security.http.ssl.verification_mode: certificate
+xpack.security.http.ssl.key: {{node_certs_destination}}/{{ elasticsearch_node_name }}.key 
+xpack.security.http.ssl.certificate: {{node_certs_destination}}/{{ elasticsearch_node_name }}.crt 
+xpack.security.http.ssl.certificate_authorities: [ "{{ node_certs_destination }}/ca.crt" ]
+{% endif %}

roles/elastic-stack/ansible-elasticsearch/templates/instances.yml.j2

@@ -0,0 +1,13 @@
+
+# {{ ansible_managed }}
+# TO-DO
+
+{% if node_certs_generator %}
+instances:
+{% for node in instances %}
+- name: "{{ node.name }}"
+  ip:
+   - "{{ node.ip }}"
+{% endfor %}
+
+{% endif %}

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -1,7 +1,25 @@
 ---
+kibana_node_name: node-1
+
 elasticsearch_http_port: "9200"
 elasticsearch_network_host: "127.0.0.1"
 kibana_server_host: "0.0.0.0"
 kibana_server_port: "5601"
-elastic_stack_version: 7.1.1
-wazuh_version: 3.9.2
+elastic_stack_version: 7.2.0
+wazuh_version: 3.9.3
+
+# Xpack Security
+kibana_xpack_security: false
+
+elasticsearch_xpack_security_user: elastic
+elasticsearch_xpack_security_password: elastic_pass
+
+node_certs_generator: false
+node_certs_generator_ip: 172.16.0.161
+node_certs_source: /usr/share/elasticsearch
+node_certs_destination: /etc/kibana/certs
+
+# Rsync
+rsync_path: /usr/bin/rsync
+rsync_user: vagrant
+rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'

roles/elastic-stack/ansible-kibana/tasks/Debian.yml

@@ -1,8 +1,12 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
+  register: kibana_installing_ca_package
+  until: kibana_installing_ca_package is succeeded
 
 - name: Debian/Ubuntu | Add Elasticsearch GPG key
   apt_key:
@@ -15,10 +19,13 @@
     state: present
     filename: 'elastic_repo'
     update_cache: true
+  changed_when: false
 
 - name: Debian/Ubuntu | Install Kibana
   apt:
     name: "kibana={{ elastic_stack_version }}"
     state: present
     cache_valid_time: 3600
+  register: installing_kibana_package
+  until: installing_kibana_package is succeeded
   tags: install

roles/elastic-stack/ansible-kibana/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/7.x/apt stable main
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-kibana/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/elastic-stack/ansible-kibana/tasks/RedHat.yml

@@ -6,7 +6,10 @@
     baseurl: https://artifacts.elastic.co/packages/7.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false
 
 - name: RedHat/CentOS/Fedora | Install Kibana
   package: name=kibana-{{ elastic_stack_version }} state=present
+  register: installing_kibana_package
+  until: installing_kibana_package is succeeded
   tags: install

roles/elastic-stack/ansible-kibana/tasks/main.yml

@@ -5,11 +5,6 @@
 - import_tasks: Debian.yml
   when: ansible_os_family == 'Debian'
 
-- name: Make sure Elasticsearch is running before proceeding.
-  wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300
-  tags: configure
-  ignore_errors: true
-
 - name: Reload systemd
   systemd: daemon_reload=true
   ignore_errors: true
@@ -17,6 +12,79 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
+
+- name: Check if certificate exists locally
+  stat:
+    path: "{{ node_certs_destination }}/{{ kibana_node_name }}.crt"
+  register: certificate_file_exists
+  when:
+    - kibana_xpack_security
+
+- name: Copy key & certificate files in generator node (locally)
+  synchronize:
+    src: "{{ node_certs_source }}/{{ kibana_node_name }}/"
+    dest: "{{ node_certs_destination }}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when:
+    - node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Copy ca certificate file in generator node (locally)
+  synchronize:
+    src: "{{ node_certs_source }}/ca/"
+    dest: "{{ node_certs_destination }}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when:
+    - node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Importing key & certificate files from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/{{ kibana_node_name }}/ {{ node_certs_destination }}/
+  when:
+    - not node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Importing ca certificate file from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
+  when:
+    - not node_certs_generator
+    - kibana_xpack_security
+    - not certificate_file_exists.stat.exists
+  register: check_certs_permissions
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  file:
+    path: "{{ node_certs_destination }}/"
+    state: directory
+    recurse: yes
+    owner: kibana
+    group: kibana
+  when:
+    - check_certs_permissions is defined
+    - kibana_xpack_security
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0770'
+    recurse: yes
+  when:
+    - check_certs_permissions is defined
+    - kibana_xpack_security
+  tags: xpack-security
 
 - name: Kibana configuration
   template:
@@ -29,8 +97,11 @@
   tags: configure
 
 - name: Checking Wazuh-APP version
-  shell: "grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json | xargs echo"
+  shell: |
+    set -o pipefail
+    grep -c -E 'version.*{{ elastic_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json | xargs echo
   args:
+    executable: /bin/bash
     removes: /usr/share/kibana/plugins/wazuh/package.json
   register: wazuh_app_verify
   changed_when: false
@@ -51,9 +122,13 @@
   environment:
     NODE_OPTIONS: "--max-old-space-size=3072"
   args:
+    executable: /bin/bash
     creates: /usr/share/kibana/plugins/wazuh/package.json
   notify: restart kibana
-  tags: install
+  ignore_errors: "{{ kibana_plugin_install_ignore_error }}"
+  tags:
+    - install
+    - skip_ansible_lint
 
 - name: Ensure Kibana started and enabled
   service:

roles/elastic-stack/ansible-kibana/templates/kibana.yml.j2

@@ -19,7 +19,11 @@ server.host: {{ kibana_server_host }}
 #server.name: "your-hostname"
 
 # The URL of the Elasticsearch instance to use for all your queries.
+{% if kibana_xpack_security %}
+elasticsearch.hosts: "https://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
+{% else %}
 elasticsearch.hosts: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
+{% endif %}
 
 # When this setting's value is true Kibana uses the hostname specified in the server.host
 # setting. When the value of this setting is false, Kibana uses the hostname of the host
@@ -98,3 +102,13 @@ elasticsearch.hosts: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_h
 # Set the interval in milliseconds to sample system and process performance
 # metrics. Minimum is 100ms. Defaults to 5000.
 #ops.interval: 5000
+
+# Xpack Security
+{% if kibana_xpack_security %}
+elasticsearch.username: "{{ elasticsearch_xpack_security_user }}"
+elasticsearch.password: "{{ elasticsearch_xpack_security_password }}"
+server.ssl.enabled: true
+server.ssl.key: "{{node_certs_destination}}/{{ kibana_node_name }}.key"
+server.ssl.certificate: "{{node_certs_destination}}/{{ kibana_node_name }}.crt" 
+elasticsearch.ssl.certificateAuthorities: ["{{ node_certs_destination }}/ca.crt"]
+{% endif %}

roles/wazuh/ansible-filebeat/defaults/main.yml

@@ -1,4 +1,6 @@
 ---
+filebeat_version: 7.2.0
+
 filebeat_create_config: true
 
 filebeat_prospectors:
@@ -10,6 +12,8 @@ filebeat_prospectors:
     json.keys_under_root: true
     json.overwrite_keys: true
 
+filebeat_node_name: node-1
+
 filebeat_output_elasticsearch_enabled: false
 filebeat_output_elasticsearch_hosts:
   - "localhost:9200"
@@ -23,3 +27,19 @@ filebeat_ssl_dir: /etc/pki/filebeat
 filebeat_ssl_certificate_file: ""
 filebeat_ssl_key_file: ""
 filebeat_ssl_insecure: "false"
+
+# Xpack Security
+filebeat_xpack_security: false
+
+elasticsearch_xpack_security_user: elastic
+elasticsearch_xpack_security_password: elastic_pass
+
+node_certs_generator : false
+node_certs_generator_ip: 172.16.0.161
+node_certs_source: /usr/share/elasticsearch
+node_certs_destination: /etc/filebeat/certs
+
+# Rsync
+rsync_path: /usr/bin/rsync
+rsync_user: vagrant
+rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'

roles/wazuh/ansible-filebeat/tasks/Debian.yml

@@ -1,9 +1,12 @@
 ---
 - name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
   apt:
-    name: ['apt-transport-https', 'ca-certificates']
+    name:
+      - apt-transport-https
+      - ca-certificates
     state: present
-
+  register: filebeat_ca_packages_install
+  until: filebeat_ca_packages_install is succeeded
 
 - name: Debian/Ubuntu | Add Elasticsearch apt key.
   apt_key:
@@ -15,3 +18,4 @@
     repo: 'deb https://artifacts.elastic.co/packages/7.x/apt stable main'
     state: present
     update_cache: true
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RMDebian.yml

@@ -3,3 +3,4 @@
   apt_repository:
     repo: deb https://artifacts.elastic.co/packages/7.x/apt stable main
     state: absent
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RMRedHat.yml

@@ -3,3 +3,4 @@
   yum_repository:
     name: elastic_repo
     state: absent
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/RedHat.yml

@@ -6,3 +6,4 @@
     baseurl: https://artifacts.elastic.co/packages/7.x/yum
     gpgkey: https://artifacts.elastic.co/GPG-KEY-elasticsearch
     gpgcheck: true
+  changed_when: false

roles/wazuh/ansible-filebeat/tasks/main.yml

@@ -5,13 +5,92 @@
 - import_tasks: Debian.yml
   when: ansible_os_family == 'Debian'
 
-- name: Install Filebeat.
-  package: name=filebeat state=present
+- name: CentOS/RedHat |  Install Filebeat.
+  package: name=filebeat-{{ filebeat_version }} state=present
+  register: filebeat_installing_package
+  until: filebeat_installing_package is succeeded
+  when:
+    - ansible_distribution in ['CentOS','RedHat']
   tags:
     - install
 
+- name: Debian/Ubuntu | Install Filebeat.
+  apt:
+    name: filebeat={{ filebeat_version }}
+    state: present
+    cache_valid_time: 3600
+  register: filebeat_installing_package_debian
+  until: filebeat_installing_package_debian is succeeded
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'])
+  tags:
+    - init
+
+- name: Check if certificate exists locally
+  stat:
+    path: "{{ node_certs_destination }}/{{ filebeat_node_name }}.crt"
+  register: certificate_file_exists
+  when:
+    - filebeat_xpack_security
+
+- name: Copy key & certificate files in generator node (locally)
+  synchronize:
+    src: "{{ node_certs_source }}/{{ filebeat_node_name }}/"
+    dest: "{{ node_certs_destination }}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when:
+    - node_certs_generator
+    - filebeat_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Copy ca certificate file in generator node (locally)
+  synchronize:
+    src: "{{ node_certs_source }}/ca/"
+    dest: "{{ node_certs_destination }}/"
+  delegate_to: "{{ node_certs_generator_ip }}"
+  when:
+    - node_certs_generator
+    - filebeat_xpack_security
+    - not certificate_file_exists.stat.exists
+  register: check_certs_permissions
+  tags: xpack-security
+
+- name: Importing key & certificate files from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/{{ filebeat_node_name }}/ {{ node_certs_destination }}/
+  when:
+    - not node_certs_generator
+    - filebeat_xpack_security
+    - not certificate_file_exists.stat.exists
+  tags: xpack-security
+
+- name: Importing ca certificate file from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
+  when:
+    - not node_certs_generator
+    - filebeat_xpack_security
+    - not certificate_file_exists.stat.exists
+  register: check_certs_permissions
+  tags: xpack-security
+
+- name: Ensuring certificates folder owner
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0770'
+    recurse: yes
+
+  when:
+    - check_certs_permissions is defined
+    - filebeat_xpack_security
+  tags: xpack-security
+
 - import_tasks: config.yml
   when: filebeat_create_config
+  notify: restart filebeat
 
 - name: Reload systemd
   systemd: daemon_reload=yes
@@ -20,6 +99,7 @@
     - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
     - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
 - name: Ensure Filebeat is started and enabled at boot.
   service:

roles/wazuh/ansible-filebeat/templates/filebeat.yml.j2

@@ -53,6 +53,15 @@ output.elasticsearch:
   #pipeline: geoip
   indices:
     - index: 'wazuh-alerts-3.x-%{+yyyy.MM.dd}'
+{% if filebeat_xpack_security %}
+  username: {{ elasticsearch_xpack_security_user }}
+  password: {{ elasticsearch_xpack_security_password }}
+  protocol: https
+  ssl.certificate_authorities: 
+    - {{node_certs_destination}}/ca.crt
+  ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" 
+  ssl.key: "{{node_certs_destination}}/{{ filebeat_node_name }}.key"
+{% endif %}
 
 # Optional. Send events to Logstash instead of Elasticsearch
 #output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"]

roles/wazuh/ansible-wazuh-agent/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
+wazuh_agent_version: 3.9.3
 wazuh_managers:
   - address: 127.0.0.1
     port: 1514
@@ -23,10 +24,10 @@ wazuh_winagent_config:
   install_dir_x86: 'C:\Program Files (x86)\ossec-agent\'
   auth_path: C:\'Program Files'\ossec-agent\agent-auth.exe
   auth_path_x86: C:\'Program Files (x86)'\ossec-agent\agent-auth.exe
-  version: '3.9.2'
+  version: '3.9.3'
   revision: '1'
   repo: https://packages.wazuh.com/3.x/windows/
-  md5: 43936e7bc7eb51bd186f47dac4a6f477
+  md5: c3fdbd6c121ca371b8abcd477ed4e8a4
 wazuh_agent_config:
   active_response:
     ar_disabled: 'no'

roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml

@@ -5,10 +5,22 @@
 - import_tasks: "Debian.yml"
   when: ansible_os_family == "Debian"
 
-- name: Linux | Install wazuh-agent
-  package: name=wazuh-agent state=present
+- name: Linux CentOS/RedHat | Install wazuh-agent
+  package: name=wazuh-agent-{{ wazuh_agent_version }}-1 state=present
   async: 90
-  poll: 15
+  poll: 30
+  when:
+    - ansible_distribution in ['CentOS','RedHat']
+  tags:
+    - init
+
+- name: Linux Debian | Install wazuh-agent
+  apt:
+    name: "wazuh-agent={{ wazuh_agent_version }}-1"
+    state: present
+    cache_valid_time: 3600
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'])
   tags:
     - init
 

roles/wazuh/ansible-wazuh-manager/defaults/main.yml

@@ -1,4 +1,6 @@
 ---
+wazuh_manager_api_version: 3.9.3
+
 wazuh_manager_fqdn: "wazuh-server"
 wazuh_manager_package_state: latest
 

roles/wazuh/ansible-wazuh-manager/tasks/main.yml

@@ -5,19 +5,38 @@
 - import_tasks: "Debian.yml"
   when: ansible_os_family == "Debian"
 
-- name: Install wazuh-manager, wazuh-api and expect
-  package: pkg={{ item }} state={{ wazuh_manager_package_state }}
+- name: CentOS/RedHat | Install wazuh-manager, wazuh-api
+  package: pkg={{ item }}-{{ wazuh_manager_api_version }}-1 state={{ wazuh_manager_package_state }}
   with_items:
     - wazuh-manager
     - wazuh-api
-    - expect
   register: wazuh_manager_main_packages_installed
   until: wazuh_manager_main_packages_installed is succeeded
   when:
-    - not (ansible_distribution in ['CentOS','RedHat'] and ansible_distribution_major_version|int < 6)
+    - ansible_distribution in ['CentOS','RedHat']
   tags:
     - init
 
+- name: Debian/Ubuntu | Install wazuh-manager, wazuh-api
+  apt:
+    name: "{{ item }}={{ wazuh_manager_api_version }}-1"
+    state: present
+    cache_valid_time: 3600
+  with_items:
+    - wazuh-manager
+    - wazuh-api
+  register: wazuh_manager_main_packages_installed
+  until: wazuh_manager_main_packages_installed is succeeded
+  when:
+  - not (ansible_distribution in ['CentOS','RedHat'])
+  tags: init
+
+- name: Install expect
+  package: pkg=expect state={{ wazuh_manager_package_state }}
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'] and ansible_distribution_major_version|int < 6)
+  tags: init
+
 - name: CentOS/RedHat 6 | Enabling python2.7 and sqlite3
   replace:
     path: /etc/init.d/wazuh-manager
@@ -30,7 +49,7 @@
 - name: Install wazuh-manager and expect (EL5)
   package: pkg={{ item }} state={{ wazuh_manager_package_state }}
   with_items:
-    - wazuh-manager
+    - wazuh-manager-{{ wazuh_manager_api_version }}
     - expect
   register: wazuh_manager_main_packages_installed
   until: wazuh_manager_main_packages_installed is succeeded