diff --git a/CHANGELOG.md b/CHANGELOG.md index d2357017..8b1513a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ All notable changes to this project will be documented in this file. - Update to [Wazuh v4.9.0](https://github.com/wazuh/wazuh/blob/v4.9.0/CHANGELOG.md#v490) +## [v4.8.1] + +### Added + +- Update to [Wazuh v4.8.1](https://github.com/wazuh/wazuh/blob/v4.8.1/CHANGELOG.md#v481) + ## [v4.8.0] ### Added diff --git a/README.md b/README.md index 205b1173..77fc4e2c 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,7 @@ These playbooks install and configure Wazuh agent, manager and indexer and dashb | Wazuh version | Elastic | ODFE | |---------------|---------|--------| | v4.9.0 | | | +| v4.8.1 | | | | v4.8.0 | | | | v4.7.1 | | | | v4.7.0 | | | diff --git a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml index 89c7055f..d750753c 100644 --- a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml +++ b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml @@ -8,8 +8,7 @@ filebeat_node_name: node-1 filebeat_output_indexer_hosts: - "localhost:9200" -filebeat_module_package_url: https://packages.wazuh.com/4.x/filebeat -filebeat_module_package_name: wazuh-filebeat-0.2.tar.gz +filebeat_module_package_name: wazuh-filebeat-0.3.tar.gz filebeat_module_package_path: /tmp/ filebeat_module_destination: /usr/share/filebeat/module filebeat_module_folder: /usr/share/filebeat/module/wazuh diff --git a/roles/wazuh/ansible-filebeat-oss/tasks/main.yml b/roles/wazuh/ansible-filebeat-oss/tasks/main.yml index f39f6e73..0e47cb3b 100644 --- a/roles/wazuh/ansible-filebeat-oss/tasks/main.yml +++ b/roles/wazuh/ansible-filebeat-oss/tasks/main.yml @@ -1,4 +1,12 @@ --- +- include_vars: ../../vars/repo_vars.yml + +- include_vars: ../../vars/repo.yml + when: packages_repository == 'production' + +- include_vars: ../../vars/repo_pre-release.yml + when: packages_repository == 'pre-release' + - include_tasks: RedHat.yml when: ansible_os_family == 'RedHat' diff --git a/roles/wazuh/vars/repo.yml b/roles/wazuh/vars/repo.yml index 1703c4c2..09837997 100644 --- a/roles/wazuh/vars/repo.yml +++ b/roles/wazuh/vars/repo.yml @@ -6,6 +6,7 @@ wazuh_repo: wazuh_winagent_config_url: "https://packages.wazuh.com/4.x/windows/wazuh-agent-{{ wazuh_agent_version }}-1.msi" wazuh_winagent_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.msi" wazuh_winagent_sha512_url: "https://packages.wazuh.com/4.x/checksums/wazuh/{{ wazuh_agent_version }}/wazuh-agent-{{ wazuh_agent_version }}-1.msi.sha512" +filebeat_module_package_url: https://packages.wazuh.com/4.x/filebeat wazuh_macos_intel_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.intel64.pkg" wazuh_macos_arm_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.arm64.pkg" @@ -15,4 +16,4 @@ wazuh_macos_arm_package_url: "https://packages.wazuh.com/4.x/macos/{{ wazuh_maco certs_gen_tool_version: 4.8 # Url of certificates generator tool -certs_gen_tool_url: "https://packages.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" \ No newline at end of file +certs_gen_tool_url: "https://packages.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" diff --git a/roles/wazuh/vars/repo_pre-release.yml b/roles/wazuh/vars/repo_pre-release.yml index 502aa584..d4c62524 100644 --- a/roles/wazuh/vars/repo_pre-release.yml +++ b/roles/wazuh/vars/repo_pre-release.yml @@ -6,6 +6,7 @@ wazuh_repo: wazuh_winagent_config_url: "https://packages-dev.wazuh.com/pre-release/windows/wazuh-agent-{{ wazuh_agent_version }}-1.msi" wazuh_winagent_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.msi" wazuh_winagent_sha512_url: "https://packages-dev.wazuh.com/pre-release/checksums/wazuh/{{ wazuh_agent_version }}/wazuh-agent-{{ wazuh_agent_version }}-1.msi.sha512" +filebeat_module_package_url: https://packages-dev.wazuh.com/pre-release/filebeat wazuh_macos_intel_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.intel64.pkg" wazuh_macos_arm_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.arm64.pkg" @@ -15,4 +16,4 @@ wazuh_macos_arm_package_url: "https://packages-dev.wazuh.com/pre-release/macos/{ certs_gen_tool_version: 4.8 # Url of certificates generator tool -certs_gen_tool_url: "https://packages-dev.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" \ No newline at end of file +certs_gen_tool_url: "https://packages-dev.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" diff --git a/roles/wazuh/vars/repo_staging.yml b/roles/wazuh/vars/repo_staging.yml index 7bd37414..6fe182e0 100644 --- a/roles/wazuh/vars/repo_staging.yml +++ b/roles/wazuh/vars/repo_staging.yml @@ -5,6 +5,9 @@ wazuh_repo: key_id: '0DCFCA5547B19D2A6099506096B3EE5F29111145' wazuh_winagent_config_url: "https://packages-dev.wazuh.com/staging/windows/wazuh-agent-{{ wazuh_agent_version }}-1.msi" wazuh_winagent_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.msi" +wazuh_winagent_sha512_url: "https://packages-dev.wazuh.com/staging/checksums/wazuh/{{ wazuh_agent_version }}/wazuh-agent-{{ wazuh_agent_version }}-1.msi.sha512" +check_sha512: False +filebeat_module_package_url: https://packages-dev.wazuh.com/staging/filebeat wazuh_macos_intel_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.intel64.pkg" wazuh_macos_arm_package_name: "wazuh-agent-{{ wazuh_agent_version }}-1.arm64.pkg" @@ -14,4 +17,4 @@ wazuh_macos_arm_package_url: "https://packages-dev.wazuh.com/staging/macos/{{ wa certs_gen_tool_version: 4.8 # Url of certificates generator tool -certs_gen_tool_url: "https://packages-dev.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" \ No newline at end of file +certs_gen_tool_url: "https://packages-dev.wazuh.com/{{ certs_gen_tool_version }}/wazuh-certs-tool.sh" diff --git a/roles/wazuh/wazuh-dashboard/tasks/Debian.yml b/roles/wazuh/wazuh-dashboard/tasks/Debian.yml index e80b605f..7525a10c 100644 --- a/roles/wazuh/wazuh-dashboard/tasks/Debian.yml +++ b/roles/wazuh/wazuh-dashboard/tasks/Debian.yml @@ -13,13 +13,6 @@ state: present update_cache: yes - - name: Install Wazuh dashboard dependencies - apt: - name: [ - 'libnss3-dev', 'fonts-liberation', 'libfontconfig1' - ] - state: present - - name: Install Wazuh dashboard apt: name: "wazuh-dashboard={{ dashboard_version }}-*" diff --git a/roles/wazuh/wazuh-dashboard/tasks/RedHat.yml b/roles/wazuh/wazuh-dashboard/tasks/RedHat.yml index d457e962..5c9f496f 100644 --- a/roles/wazuh/wazuh-dashboard/tasks/RedHat.yml +++ b/roles/wazuh/wazuh-dashboard/tasks/RedHat.yml @@ -9,14 +9,6 @@ gpgkey: "{{ wazuh_repo.gpg }}" gpgcheck: true - - name: Install Wazuh dashboard dependencies - yum: - name: [ - 'libnss3.so', 'xorg-x11-fonts-100dpi', 'xorg-x11-fonts-75dpi', 'xorg-x11-utils', 'xorg-x11-fonts-cyrillic', 'xorg-x11-fonts-Type1', 'xorg-x11-fonts-misc', 'fontconfig', 'freetype' - ] - state: present - ignore_errors: yes - - name: Install Wazuh dashboard package: name: "wazuh-dashboard-{{ dashboard_version }}" diff --git a/roles/wazuh/wazuh-indexer/defaults/main.yml b/roles/wazuh/wazuh-indexer/defaults/main.yml index 4c14ffed..da7be34c 100644 --- a/roles/wazuh/wazuh-indexer/defaults/main.yml +++ b/roles/wazuh/wazuh-indexer/defaults/main.yml @@ -28,6 +28,7 @@ domain_name: wazuh.com indexer_sec_plugin_conf_path: /etc/wazuh-indexer/opensearch-security indexer_sec_plugin_tools_path: /usr/share/wazuh-indexer/plugins/opensearch-security/tools +indexer_bin_path: /usr/share/wazuh-indexer/bin indexer_conf_path: /etc/wazuh-indexer indexer_index_path: /var/lib/wazuh-indexer/ diff --git a/roles/wazuh/wazuh-indexer/tasks/security_actions.yml b/roles/wazuh/wazuh-indexer/tasks/security_actions.yml index 26b83fd7..797e2dbd 100644 --- a/roles/wazuh/wazuh-indexer/tasks/security_actions.yml +++ b/roles/wazuh/wazuh-indexer/tasks/security_actions.yml @@ -52,7 +52,7 @@ {{ indexer_sec_plugin_tools_path }}/hash.sh -p '{{ indexer_admin_password }}' register: indexer_admin_password_hashed no_log: '{{ indexer_nolog_sensible | bool }}' - + - name: Set the Admin user password replace: path: "{{ indexer_sec_plugin_conf_path }}/internal_users.yml" @@ -60,7 +60,7 @@ replace: "{{ indexer_password_hash | quote }}" vars: indexer_password_hash: "{{ indexer_admin_password_hashed.stdout_lines | last }}" - + # this can also be achieved with password_hash, but it requires dependencies on the controller - name: Hash the kibanaserver role/user pasword shell: | @@ -68,7 +68,7 @@ {{ indexer_sec_plugin_tools_path }}/hash.sh -p '{{ dashboard_password }}' register: indexer_kibanaserver_password_hashed no_log: '{{ indexer_nolog_sensible | bool }}' - + - name: Set the kibanaserver user password replace: path: "{{ indexer_sec_plugin_conf_path }}/internal_users.yml" @@ -76,7 +76,7 @@ replace: "{{ indexer_password_hash | quote }}" vars: indexer_password_hash: "{{ indexer_kibanaserver_password_hashed.stdout_lines | last }}" - + - name: Initialize the Opensearch security index in Wazuh indexer command: > sudo -u wazuh-indexer OPENSEARCH_PATH_CONF={{ indexer_conf_path }} @@ -93,8 +93,16 @@ delay: 5 register: result until: result.rc == 0 - run_once: true + - name: Initialize ISM script + command: > + {{ indexer_bin_path }}/indexer-ism-init.sh + -p {{ indexer_admin_password }} + -i {{ target_address }} + become: yes + become_user: root + + run_once: true - name: Create custom user uri: