Added support for Filebeat-oss and several improvements

playbooks/wazuh-manager-oss.yml

@@ -1,8 +1,9 @@
 ---
-- hosts: <WAZUH_MANAGER_HOST>
+- hosts: managers
   roles:
-    - role: ../roles/wazuh/ansible-wazuh-manager
+#    - role: ../roles/wazuh/ansible-wazuh-manager
-    - role: ../roles/wazuh/filebeat-oss
+    - role: ../roles/wazuh/ansible-filebeat-oss
-      filebeat_output_elasticsearch_hosts: 172.16.0.161:9200
+      filebeat_output_elasticsearch_hosts:
-
+      - "172.16.0.161:9200"
-
+      - "172.16.0.162:9200"
+      - "172.16.0.163:9200"

playbooks/wazuh-opendistro.yml

@@ -1,4 +1,4 @@
 ---
-- hosts: es-cluster
+- hosts: es_cluster
   roles:
     - role: ../roles/opendistro/opendistro-elasticsearch

roles/elastic-stack/ansible-elasticsearch/README.md

@@ -134,7 +134,7 @@ It is possible to define users directly on the playbook, these must be defined o
 License and copyright
 ---------------------
 
-WAZUH Copyright (C) 2017 Wazuh Inc. (License GPLv3)
+WAZUH Copyright (C) 2020 Wazuh Inc. (License GPLv3)
 
 ### Based on previous work from geerlingguy
 

roles/elastic-stack/ansible-elasticsearch/defaults/main.yml

@@ -4,7 +4,7 @@ elasticsearch_http_port: 9200
 elasticsearch_network_host: 127.0.0.1
 elasticsearch_reachable_host: 127.0.0.1
 elasticsearch_jvm_xms: null
-elastic_stack_version: 7.6.2
+elastic_stack_version: 7.7.0
 elasticsearch_lower_disk_requirements: false
 
 elasticrepo:

roles/elastic-stack/ansible-kibana/README.md

@@ -37,7 +37,7 @@ Example Playbook
 License and copyright
 ---------------------
 
-WAZUH Copyright (C) 2017 Wazuh Inc. (License GPLv3)
+WAZUH Copyright (C) 2020 Wazuh Inc. (License GPLv3)
 
 ### Based on previous work from geerlingguy
 

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -5,7 +5,7 @@ elasticsearch_http_port: "9200"
 elasticsearch_network_host: "127.0.0.1"
 kibana_server_host: "0.0.0.0"
 kibana_server_port: "5601"
-elastic_stack_version: 7.6.2
+elastic_stack_version: 7.7.0
 wazuh_version: 3.12.3
 wazuh_app_url: https://packages.wazuh.com/wazuhapp/wazuhapp
 

roles/opendistro/hosts

@@ -1,49 +0,0 @@
-# This is the default ansible 'hosts' file.
-#
-# It should live in /etc/ansible/hosts
-#
-#   - Comments begin with the '#' character
-#   - Blank lines are ignored
-#   - Groups of hosts are delimited by [header] elements
-#   - You can enter hostnames or ip addresses
-#   - A hostname/ip can be a member of multiple groups
-
-# Ex 1: Ungrouped hosts, specify before any group headers.
-
-## green.example.com
-## blue.example.com
-## 192.168.100.1
-## 192.168.100.10
-
-# Ex 2: A collection of hosts belonging to the 'webservers' group
-#[elasticsearch_first
-
-
-es1 ansible_host=172.16.0.161  ansible_user=vagrant ip=172.16.0.161
-es2 ansible_host=172.16.0.162 ansible_user=vagrant ip=172.16.0.162
-es3 ansible_host=172.16.0.163  ansible_user=vagrant ip=172.16.0.163
-manager1 ansible_host=172.16.1.250 ansible_user=vagrant ip=172.16.1.250
-
-[managers]
-manager1
-
-[es-cluster]
-es1
-es2
-es3
-manager1
-
-[kibana]
-es1
-
-[single-host]
-172.16.1.15 ansible_ssh_user=vagrant
-[elastic-cluster]
-172.16.0.161 ansible_ssh_user=vagrant
-172.16.0.162 ansible_ssh_user=vagrant
-172.16.0.163 ansible_ssh_user=vagrant
-[agents]
-172.16.0.131 ansible_ssh_user=vagrant
-172.16.0.132 ansible_ssh_user=vagrant
-# If you have multiple hosts following a pattern you can specify
-# them like this:

roles/opendistro/opendistro-elasticsearch/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # The OpenDistro version
-opendistro_version: 1.6.0
+opendistro_version: 1.8.0
 elasticsearch_cluster_name: wazuh-cluster
 
 # Minimum master nodes in cluster, 2 for 3 nodes elasticsearch cluster
@@ -28,7 +28,7 @@ opendistro_sec_plugin_conf_path: /usr/share/elasticsearch/plugins/opendistro_sec
 opendistro_sec_plugin_tools_path: /usr/share/elasticsearch/plugins/opendistro_security/tools
 opendistro_conf_path: /etc/elasticsearch/
 es_nodes: |-
-        {% for item in groups['es-cluster'] -%}
+        {% for item in groups['es_cluster'] -%}
           {{ hostvars[item]['ip'] }}{% if not loop.last %}","{% endif %}
         {%- endfor %}
 

roles/opendistro/opendistro-elasticsearch/tasks/local_actions.yml

@@ -2,36 +2,36 @@
 - block:
 
   - name: Local action | Create local temporary directory for certificates generation
-    local_action:
+    file:
-      module: file
       path: "{{ local_certs_path }}"
       state: directory
 
+  - name: Local action | Check that the generation tool exists
+    stat:
+      path: "{{ local_certs_path }}/search-guard-tlstool-{{ certs_gen_tool_version }}.zip"
+    register: tool_package
+
   - name: Local action | Download certificates generation tool
-    local_action:
+    get_url:
-      module: get_url
       url: "{{ certs_gen_tool_url }}"
       dest: "{{ local_certs_path }}/search-guard-tlstool-{{ certs_gen_tool_version }}.zip"
+    when: not tool_package.stat.exists
 
   - name: Local action | Extract the certificates generation tool
-    local_action:
+    unarchive:
-      module: unarchive
       src: "{{ local_certs_path }}/search-guard-tlstool-1.7.zip"
       dest: "{{ local_certs_path }}/"
 
   - name: Local action | Add the execution bit to the binary
-    local_action:
+    file:
-      module: file
       dest: "{{ local_certs_path }}/tools/sgtlstool.sh"
       mode: a+x
 
   - name: Local action | Prepare the certificates generation template file
-    local_action:
+    template:
-      module: template
       src: "templates/tlsconfig.yml.j2"
       dest: "{{ local_certs_path }}/config/tlsconfig.yml"
 
-
   - name: Create a directory if it does not exist
     file:
       path: "{{ local_certs_path }}/certs/"
@@ -40,20 +40,29 @@
     delegate_to: localhost
 
   - name: Local action | Check if root CA file exists
-    local_action:
+    stat:
-      module: stat
       path: "{{ local_certs_path }}/certs/root-ca.key"
     register: root_ca_file
 
   - name: Local action | Generate the node & admin certificates in local
-    local_action:
+    command: >-
-      module: command {{ local_certs_path }}/tools/sgtlstool.sh -c {{ local_certs_path }}/config/tlsconfig.yml -ca -crt -t {{ local_certs_path }}/certs/ -f -o
+      {{ local_certs_path }}/tools/sgtlstool.sh
+      -c {{ local_certs_path }}/config/tlsconfig.yml
+      -ca -crt
+      -t {{ local_certs_path }}/certs/
+      -f -o
     when: not root_ca_file.stat.exists
 
   - name: Local action | Generate the node & admin certificates using an existing root CA
-    local_action:
+    command: >-
-      module: command {{ local_certs_path }}/tools/sgtlstool.sh -c {{ local_certs_path }}/config/tlsconfig.yml -ca -crt -t {{ local_certs_path }}/certs/ -f
+     {{ local_certs_path }}/tools/sgtlstool.sh
+     -c {{ local_certs_path }}/config/tlsconfig.yml
+     -crt
+     -t {{ local_certs_path }}/certs/
+     -f
     when: root_ca_file.stat.exists
+
   run_once: true
+  delegate_to: localhost
   tags:
   - generate-certs

roles/opendistro/opendistro-elasticsearch/tasks/security_actions.yml

@@ -1,5 +1,4 @@
 - block:
-
   - name: Remove demo certs
     file:
       path: "{{ item }}"
@@ -12,7 +11,7 @@
 
   - name: Copy the node & admin certificates to Elasticsearch cluster
     copy:
-      src: "{{ local_certs_path }}/config/{{ item }}"
+      src: "{{ local_certs_path }}/certs/{{ item }}"
       dest: /etc/elasticsearch/
       mode: 0644
     with_items:
@@ -28,7 +27,7 @@
 
   - name: Copy the OpenDistro security configuration file to cluster
     blockinfile:
-      block: "{{ lookup('file', '{{ local_certs_path }}/config/{{ inventory_hostname }}_elasticsearch_config_snippet.yml') }}"
+      block: "{{ lookup('file', '{{ local_certs_path }}/certs/{{ inventory_hostname }}_elasticsearch_config_snippet.yml') }}"
       dest: "{{ opendistro_conf_path }}/elasticsearch.yml"
       insertafter: EOF
       marker: "## {mark} Opendistro Security Node & Admin certificates configuration ##"
@@ -76,5 +75,5 @@
     run_once: true
 
   tags:
-    - production_ready
+    - security
   when: install.changed

roles/opendistro/opendistro-elasticsearch/templates/tlsconfig.yml.j2

@@ -17,7 +17,6 @@ defaults:
       verifyHostnames: false
       resolveHostnames: false
 
-
 ###
 ### Nodes
 ###
@@ -25,7 +24,7 @@ defaults:
 # Specify the nodes of your ES cluster here
 #
 nodes:
-{% for item in groups['es-cluster'] %}
+{% for item in groups['es_cluster'] %}
   - name: {{ item }}
     dn: CN={{ item }}.{{ domain_name }},OU=Ops,O={{ domain_name }}\, Inc.,DC={{ domain_name }}
     dns: {{ item }}.{{ domain_name }}
@@ -39,6 +38,14 @@ nodes:
     ip: {{ hostvars[item]['ip'] }}
 {% endfor %}
 {% endif %}
+{% if groups['managers'] is defined and groups['managers']|length > 0 %}
+{% for item in groups['managers'] %}
+  - name: {{ item }}
+    dn: CN={{ item }}.{{ domain_name }},OU=Ops,O={{ domain_name }}\, Inc.,DC={{ domain_name }}
+    dns: {{ item }}.{{ domain_name }}
+    ip: {{ hostvars[item]['ip'] }}
+{% endfor %}
+{% endif %}
 ###
 ### Clients
 ###

roles/opendistro/opendistro-kibana/defaults/main.yml

@@ -1,17 +1,18 @@
 ---
 
-elasticsearch_http_port: "9200"
+elasticsearch_http_port: 9200
-elasticsearch_network_host: |-
+elasticsearch_nodes: |-
         {% for item in groups['kibana'] -%}
           {{ hostvars[item]['ip'] }}{% if not loop.last %}","{% endif %}
         {%- endfor %}
-
+elasticsearch_network_host: 172.16.0.161
+elastic_api_protocol: https
 kibana_conf_path: /etc/kibana
 kibana_server_host: "0.0.0.0"
 kibana_server_port: "5601"
 kibana_server_name: "kibana"
 kibana_max_payload_bytes: 1048576
-opendistro_version: 7.6.1
+elastic_stack_version: 7.7.0
 wazuh_version: 3.12.3
 wazuh_app_url: https://packages.wazuh.com/wazuhapp/wazuhapp
 
@@ -41,6 +42,7 @@ kibana_telemetry_optin: "false"
 kibana_telemetry_enabled: "false"
 
 opendistro_security_user: elastic
+opendistro_admin_password: changeme
 opendistro_kibana_user: kibanaserver
 opendistro_kibana_password: changeme
 local_certs_path: /tmp/opendistro-nodecerts

roles/opendistro/opendistro-kibana/tasks/main.yml

@@ -28,7 +28,6 @@
   register: install
   tags: install
 
-
 - name: Remove Kibana configuration file
   file:
     path: "{{ kibana_conf_path }}/kibana.yml"
@@ -48,11 +47,82 @@
     mode: 0640
     marker: "## {mark} Kibana general settings ##"
   notify: restart kibana
-
   tags:
     - install
     - configure
 
+- name: Build and Install Wazuh Kibana Plugin from sources
+  import_tasks: build_wazuh_plugin.yml
+  when:
+    - build_from_sources is defined
+    - build_from_sources
+
+- name: Install Wazuh Plugin (can take a while)
+  shell: >-
+    NODE_OPTIONS="{{ node_options }}" /usr/share/kibana/bin/kibana-plugin install
+    {{ wazuh_app_url }}-{{ wazuh_version }}_{{ elastic_stack_version }}.zip
+  args:
+    executable: /bin/bash
+    creates: /usr/share/kibana/plugins/wazuh/package.json
+    chdir: /usr/share/kibana
+  become: yes
+  become_user: kibana
+  notify: restart kibana
+  tags:
+    - install
+    - skip_ansible_lint
+  when:
+    - not build_from_sources
+
+- name: Kibana optimization (can take a while)
+  shell: /usr/share/kibana/node/bin/node {{ node_options }} /usr/share/kibana/src/cli --optimize
+  args:
+    executable: /bin/bash
+  become: yes
+  become_user: kibana
+  changed_when: false
+  tags:
+    - skip_ansible_lint
+
+- name: Wait for Elasticsearch port
+  wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }}
+
+- name: Select correct API protocol
+  set_fact:
+    elastic_api_protocol: "{% if kibana_xpack_security %}https{% else %}http{% endif %}"
+
+- name: Attempting to delete legacy Wazuh index if exists
+  uri:
+    url: "{{ elastic_api_protocol }}://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/.wazuh"
+    method: DELETE
+    user: "admin"
+    password: "{{ opendistro_admin_password }}"
+    validate_certs: no
+    status_code: 200, 404
+
+- name: Create wazuh plugin config directory
+  file:
+    path: /usr/share/kibana/optimize/wazuh/config/
+    state: directory
+    recurse: yes
+    owner: kibana
+    group: kibana
+    mode: 0751
+  changed_when: False
+
+- name: Configure Wazuh Kibana Plugin
+  template:
+    src: wazuh.yml.j2
+    dest: /usr/share/kibana/optimize/wazuh/config/wazuh.yml
+    owner: kibana
+    group: kibana
+    mode: 0751
+  changed_when: False
+
+- name: Reload systemd configuration
+  systemd:
+    daemon_reload: true
+
 - name: Ensure Kibana started and enabled
   service:
     name: kibana
@@ -60,4 +130,4 @@
     state: started
 
 - import_tasks: RMRedHat.yml
-  when: ansible_os_family == 'RedHat'
+  when: ansible_os_family == 'RedHat'

roles/opendistro/opendistro-kibana/tasks/security_actions.yml

@@ -2,12 +2,12 @@
 
   - name: Copy the certificates from local to the Kibana instance
     copy:
-      src: "{{ local_certs_path }}/config/{{ item }}"
+      src: "{{ local_certs_path }}/certs/{{ item }}"
       dest: /usr/share/kibana
       mode: 0644
     with_items:
       - "{{ inventory_hostname }}_http.key"
       - "{{ inventory_hostname }}_http.pem"
   tags:
-  - production_ready
+  - security
   when: install.changed

roles/opendistro/opendistro-kibana/templates/opendistro_kibana.yml.j2

@@ -8,9 +8,9 @@ server.maxPayloadBytes: {{ kibana_max_payload_bytes }}
 server.name: {{ kibana_server_name }}
 server.host: {{ kibana_server_host }}
 {% if kibana_opendistro_security %}
-elasticsearch.hosts: "https://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
+elasticsearch.hosts: "https://{{ elasticsearch_nodes }}:{{ elasticsearch_http_port }}"
 {% else %}
-elasticsearch.hosts: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}"
+elasticsearch.hosts: "http://{{ elasticsearch_nodes }}:{{ elasticsearch_http_port }}"
 {% endif %}
 
 elasticsearch.username: {{ opendistro_kibana_user }}

roles/wazuh/ansible-filebeat-oss/README.md

@@ -0,0 +1,39 @@
+Ansible Role: Filebeat for Elastic Stack
+------------------------------------
+
+An Ansible Role that installs [Filebeat-oss](https://www.elastic.co/products/beats/filebeat), this can be used in conjunction with [ansible-wazuh-manager](https://github.com/wazuh/wazuh-ansible/ansible-wazuh-server).
+
+Requirements
+------------
+
+This role will work on:
+ * Red Hat
+ * CentOS
+ * Fedora
+ * Debian
+ * Ubuntu
+
+Role Variables
+--------------
+
+Available variables are listed below, along with default values (see `defaults/main.yml`):
+
+```
+  filebeat_output_elasticsearch_enabled: false
+  filebeat_output_elasticsearch_hosts:
+    - "localhost:9200"
+
+```
+
+License and copyright
+---------------------
+
+WAZUH Copyright (C) 2020 Wazuh Inc. (License GPLv3)
+
+### Based on previous work from geerlingguy
+
+ - https://github.com/geerlingguy/ansible-role-filebeat
+
+### Modified by Wazuh
+
+The playbooks have been modified by Wazuh, including some specific requirements, templates and configuration to improve integration with Wazuh ecosystem.

roles/wazuh/ansible-filebeat-oss/defaults/main.yml

@@ -0,0 +1,30 @@
+---
+filebeat_version: 7.7.0
+
+filebeat_create_config: true
+
+filebeat_output_elasticsearch_enabled: false
+filebeat_output_elasticsearch_hosts:
+  - "localhost:9200"
+
+filebeat_module_package_url: https://packages.wazuh.com/3.x/filebeat
+filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz
+filebeat_module_package_path: /tmp/
+filebeat_module_destination: /usr/share/filebeat/module
+filebeat_module_folder: /usr/share/filebeat/module/wazuh
+elasticsearch_security_user: admin
+elasticsearch_security_password: changeme
+# Security plugin
+filebeat_security: true
+filebeat_security_user: admin
+filebeat_security_password: changeme
+filebeat_ssl_dir: /etc/pki/filebeat
+
+# Local path to store the generated certificates (OpenDistro security plugin)
+local_certs_path: /tmp/opendistro-nodecerts
+
+elasticrepo:
+  apt: 'https://artifacts.elastic.co/packages/oss-7.x/apt'
+  yum: 'https://artifacts.elastic.co/packages/oss-7.x/yum'
+  gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'
+  key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'

roles/wazuh/ansible-filebeat-oss/meta/main.yml

@@ -3,7 +3,7 @@ dependencies: []
 
 galaxy_info:
   author: Wazuh
-  description: Installing and maintaining filebeat server.
+  description: Installing and maintaining Filebeat-oss.
   company: wazuh.com
   license: license (GPLv3)
   min_ansible_version: 2.0

roles/wazuh/ansible-filebeat-oss/tasks/Debian.yml

@@ -14,7 +14,7 @@
     id: "{{ elasticrepo.key_id }}"
     state: present
 
-- name: Debian/Ubuntu | Add Filebeat repository.
+- name: Debian/Ubuntu | Add Filebeat-oss repository.
   apt_repository:
     repo: "deb {{ elasticrepo.apt }} stable main"
     state: present

roles/wazuh/ansible-filebeat-oss/tasks/RMRedHat.yml

@@ -1,6 +1,6 @@
 ---
 - name: RedHat/CentOS/Fedora | Remove Filebeat repository (and clean up left-over metadata)
   yum_repository:
-    name: elastic_repo_7
+    name: elastic_oss-repo_7
     state: absent
   changed_when: false

roles/wazuh/ansible-filebeat-oss/tasks/RedHat.yml

@@ -1,7 +1,7 @@
 ---
 - name: RedHat/CentOS/Fedora/Amazon Linux | Install Filebeats repo
   yum_repository:
-    name: elastic_repo_7
+    name: elastic_oss-repo_7
     description: Elastic repository for 7.x packages
     baseurl: "{{ elasticrepo.yum }}"
     gpgkey: "{{ elasticrepo.gpg }}"

roles/wazuh/ansible-filebeat-oss/tasks/config.yml

@@ -0,0 +1,22 @@
+---
+- block:
+  - name: Copy Filebeat configuration.
+    template:
+      src: filebeat.yml.j2
+      dest: "/etc/filebeat/filebeat.yml"
+      owner: root
+      group: root
+      mode: 0400
+    notify: restart filebeat
+
+  - name: Copy Elasticsearch template.
+    template:
+      src: elasticsearch.yml.j2
+      dest: "/etc/filebeat/wazuh-template.json"
+      owner: root
+      group: root
+      mode: 0400
+    notify: restart filebeat
+
+  tags:
+  - configure

roles/wazuh/ansible-filebeat-oss/tasks/main.yml

@@ -0,0 +1,70 @@
+---
+- include_tasks: RedHat.yml
+  when: ansible_os_family == 'RedHat'
+
+- include_tasks: Debian.yml
+  when: ansible_os_family == 'Debian'
+
+- name: Install Filebeat
+  package:
+    name: filebeat
+    state: present
+  register: install
+  tags:
+  - install
+  - init
+
+- include_tasks: security_actions.yml
+  when: ansible_os_family == 'RedHat'
+
+- name: Checking if Filebeat Module folder file exists
+  stat:
+    path: "{{ filebeat_module_folder }}"
+  register: filebeat_module_folder
+
+- name: Download Filebeat module package
+  get_url:
+    url: "{{ filebeat_module_package_url }}/{{ filebeat_module_package_name }}"
+    dest: "{{ filebeat_module_package_path }}"
+  when: not filebeat_module_folder.stat.exists
+
+- name: Unpack Filebeat module package
+  unarchive:
+    src: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+    dest: "{{ filebeat_module_destination }}"
+    remote_src: yes
+  when: not filebeat_module_folder.stat.exists
+
+- name: Setting 0755 permission for Filebeat module folder
+  file: dest={{ filebeat_module_folder }} mode=u=rwX,g=rwX,o=rwX recurse=yes
+  when: not filebeat_module_folder.stat.exists
+
+- name: Checking if Filebeat Module package file exists
+  stat:
+    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+  register: filebeat_module_package
+  when: filebeat_module_package is not defined
+
+- name: Delete Filebeat module package file
+  file:
+    state: absent
+    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+  when: filebeat_module_package.stat.exists
+
+- import_tasks: config.yml
+  notify: restart filebeat
+
+- include_tasks: security_actions.yml
+  when: filebeat_security
+
+- name: Ensure Filebeat is started and enabled at boot.
+  service:
+    name: filebeat
+    state: started
+    enabled: true
+
+- include_tasks: "RMRedHat.yml"
+  when: ansible_os_family == "RedHat"
+
+- include_tasks: "RMDebian.yml"
+  when: ansible_os_family == "Debian"

roles/wazuh/ansible-filebeat-oss/tasks/security_actions.yml

@@ -0,0 +1,29 @@
+- block:
+
+  - name: Ensure Filebeat SSL key pair directory exists.
+    file:
+      path: "{{ filebeat_ssl_dir }}"
+      state: directory
+
+  - name: Copy the certificates from local to the Manager instance
+    copy:
+      src: "{{ local_certs_path }}/certs/{{ item }}"
+      dest: "{{ filebeat_ssl_dir }}"
+      mode: 0644
+    with_items:
+      - "{{ inventory_hostname }}.key"
+      - "{{ inventory_hostname }}.pem"
+      - "root-ca.pem"
+
+  - name: Ensuring folder & certs permissions
+    file:
+      path: "{{ filebeat_ssl_dir }}/"
+      mode: 0774
+      state: directory
+      recurse: yes
+
+  tags:
+  - security
+  when:
+  - filebeat_security
+  - install.changed

roles/wazuh/ansible-filebeat-oss/templates/filebeat.yml.j2

@@ -14,25 +14,18 @@ setup.template.json.name: 'wazuh'
 setup.template.overwrite: true
 setup.ilm.enabled: false
 
-
 # Send events directly to Elasticsearch
 output.elasticsearch:
   hosts: {{ filebeat_output_elasticsearch_hosts | to_json }}
 
-{% if filebeat_opendistro_security %}
+{% if filebeat_security %}
-  username: {{ elasticsearch_opendistro_security_user }}
+  username: {{ elasticsearch_security_user }}
-  password: {{ elasticsearch_opendistro_security_password }}
+  password: {{ elasticsearch_security_password }}
   protocol: https
-{% if generate_CA == true %}
-  ssl.certificate_authorities: 
-    - {{node_certs_destination}}/ca.crt
-{% elif generate_CA == false %}
   ssl.certificate_authorities:
-    - {{node_certs_destination}}/{{ca_cert_name}}
+    - {{ filebeat_ssl_dir }}/root-ca.pem
-{% endif %}
+  ssl.certificate: "{{ filebeat_ssl_dir }}/{{ inventory_hostname }}.pem"
-
+  ssl.key: "{{ filebeat_ssl_dir }}/{{ inventory_hostname }}.key"
-  ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" 
-  ssl.key: "{{node_certs_destination}}/{{ filebeat_node_name }}.key"
 {% endif %}
 
 # Optional. Send events to Logstash instead of Elasticsearch

roles/wazuh/ansible-filebeat/README.md

@@ -28,7 +28,7 @@ Available variables are listed below, along with default values (see `defaults/m
 License and copyright
 ---------------------
 
-WAZUH Copyright (C) 2017 Wazuh Inc. (License GPLv3)
+WAZUH Copyright (C) 2020 Wazuh Inc. (License GPLv3)
 
 ### Based on previous work from geerlingguy
 

roles/wazuh/ansible-filebeat/defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-filebeat_version: 7.6.2
+filebeat_version: 7.7.0
 
 filebeat_create_config: true
 
@@ -22,10 +22,8 @@ filebeat_enable_logging: true
 filebeat_log_level: debug
 filebeat_log_dir: /var/log/mybeat
 filebeat_log_filename: mybeat.log
-
 filebeat_ssl_dir: /etc/pki/filebeat
 filebeat_ssl_certificate_file: ""
-filebeat_ssl_key_file: ""
 filebeat_ssl_insecure: "false"
 
 filebeat_module_package_url: https://packages.wazuh.com/3.x/filebeat

roles/wazuh/ansible-filebeat/tasks/config.yml

@@ -17,23 +17,4 @@
     group: root
     mode: 0400
   notify: restart filebeat
-  tags: configure
+  tags: configure
-
-- name: Ensure Filebeat SSL key pair directory exists.
-  file:
-    path: "{{ filebeat_ssl_dir }}"
-    state: directory
-  when: filebeat_ssl_key_file
-  tags: configure
-
-- name: Copy SSL key and cert for filebeat.
-  copy:
-    src: "{{ item }}"
-    dest: "{{ filebeat_ssl_dir }}/{{ item | basename }}"
-    mode: 0400
-  with_items:
-    - "{{ filebeat_ssl_key_file }}"
-    - "{{ filebeat_ssl_certificate_file }}"
-  notify: restart filebeat
-  when: filebeat_ssl_key_file and filebeat_ssl_certificate_file
-  tags: configure

roles/wazuh/ansible-filebeat/tasks/main.yml

@@ -76,7 +76,7 @@
     dest: "{{ filebeat_module_package_path }}"
   when: not filebeat_module_folder.stat.exists
 
-- name: Unpakcing Filebeat module package
+- name: Unpack Filebeat module package
   unarchive:
     src: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
     dest: "{{ filebeat_module_destination }}"

roles/wazuh/ansible-filebeat/tests/requirements.yml

@@ -1,3 +0,0 @@
----
-- src: geerlingguy.java
-- src: geerlingguy.elasticsearch

roles/wazuh/ansible-filebeat/tests/test.yml

@@ -1,20 +0,0 @@
----
-- hosts: all
-
-  pre_tasks:
-    - name: Update apt cache.
-      apt:
-        cache_valid_time: 600
-      when: ansible_os_family == 'Debian'
-
-    - name: Install test dependencies (RedHat).
-      package: name=which state=present
-      when: ansible_os_family == 'RedHat'
-
-    - name: Install test dependencies.
-      package: name=curl state=present
-
-  roles:
-    - geerlingguy.java
-    - geerlingguy.elasticsearch
-    - role_under_test

roles/wazuh/ansible-wazuh-manager/README.md

@@ -218,7 +218,7 @@ Including an example of how to use your role (for instance, with variables passe
 License and copyright
 ---------------------
 
-WAZUH Copyright (C) 2017 Wazuh Inc. (License GPLv3)
+WAZUH Copyright (C) 2020 Wazuh Inc. (License GPLv3)
 
 ### Based on previous work from dj-wasabi
 

roles/wazuh/filebeat-oss/defaults/main.yml

@@ -1,57 +0,0 @@
----
-filebeat_version: 7.6.2
-
-filebeat_create_config: true
-
-filebeat_prospectors:
-  - input_type: log
-    paths:
-      - "/var/ossec/logs/alerts/alerts.json"
-    document_type: json
-    json.message_key: log
-    json.keys_under_root: true
-    json.overwrite_keys: true
-
-filebeat_node_name: node-1
-
-filebeat_output_elasticsearch_enabled: false
-filebeat_output_elasticsearch_hosts:
-  - "localhost:9200"
-
-filebeat_enable_logging: true
-filebeat_log_level: debug
-filebeat_log_dir: /var/log/mybeat
-filebeat_log_filename: mybeat.log
-
-filebeat_ssl_dir: /etc/pki/filebeat
-filebeat_ssl_certificate_file: ""
-filebeat_ssl_key_file: ""
-filebeat_ssl_insecure: "false"
-
-filebeat_module_package_url: https://packages.wazuh.com/3.x/filebeat
-filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz
-filebeat_module_package_path: /tmp/
-filebeat_module_destination: /usr/share/filebeat/module
-filebeat_module_folder: /usr/share/filebeat/module/wazuh
-
-# Opendistro Security
-filebeat_opendistro_security: false
-
-elasticsearch_opendistro_security_user: elastic
-elasticsearch_opendistro_security_password: elastic_pass
-
-node_certs_generator : false
-node_certs_source: /usr/share/elasticsearch
-node_certs_destination: /etc/filebeat/certs
-
-
-# CA Generation
-master_certs_path: /es_certs
-generate_CA: true
-ca_cert_name: ""
-
-elasticrepo:
-  apt: 'https://artifacts.elastic.co/packages/oss-7.x/apt'
-  yum: 'https://artifacts.elastic.co/packages/oss-7.x/yum'
-  gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'
-  key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'

roles/wazuh/filebeat-oss/tasks/config.yml

@@ -1,39 +0,0 @@
----
-- name: Copy Filebeat configuration.
-  template:
-    src: filebeat.yml.j2
-    dest: "/etc/filebeat/filebeat.yml"
-    owner: root
-    group: root
-    mode: 0400
-  notify: restart filebeat
-  tags: configure
-
-- name: Copy Elasticsearch template.
-  template:
-    src: elasticsearch.yml.j2
-    dest: "/etc/filebeat/wazuh-template.json"
-    owner: root
-    group: root
-    mode: 0400
-  notify: restart filebeat
-  tags: configure
-
-- name: Ensure Filebeat SSL key pair directory exists.
-  file:
-    path: "{{ filebeat_ssl_dir }}"
-    state: directory
-  when: filebeat_ssl_key_file
-  tags: configure
-
-- name: Copy SSL key and cert for filebeat.
-  copy:
-    src: "{{ item }}"
-    dest: "{{ filebeat_ssl_dir }}/{{ item | basename }}"
-    mode: 0400
-  with_items:
-    - "{{ filebeat_ssl_key_file }}"
-    - "{{ filebeat_ssl_certificate_file }}"
-  notify: restart filebeat
-  when: filebeat_ssl_key_file and filebeat_ssl_certificate_file
-  tags: configure

roles/wazuh/filebeat-oss/tasks/main.yml

@@ -1,125 +0,0 @@
----
-- include_tasks: RedHat.yml
-  when: ansible_os_family == 'RedHat'
-
-- include_tasks: Debian.yml
-  when: ansible_os_family == 'Debian'
-
-- name: CentOS/RedHat |  Install Filebeat.
-  package: name=filebeat-{{ filebeat_version }} state=present
-  register: filebeat_installing_package
-  until: filebeat_installing_package is succeeded
-  when:
-    - ansible_distribution in ['CentOS','RedHat', 'Amazon']
-  tags:
-    - install
-
-- name: Debian/Ubuntu | Install Filebeat.
-  apt:
-    name: filebeat={{ filebeat_version }}
-    state: present
-    cache_valid_time: 3600
-  register: filebeat_installing_package_debian
-  until: filebeat_installing_package_debian is succeeded
-  when:
-    - not (ansible_distribution in ['CentOS','RedHat', 'Amazon'])
-  tags:
-    - init
-
-- name: Copying node's certificate from master
-  copy:
-    src: "{{ item }}"
-    dest: "{{ node_certs_destination }}/"
-    mode: 0440
-  with_items:
-    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
-    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
-    - "{{ master_certs_path }}/ca/ca.crt"
-  when:
-    - generate_CA
-    - filebeat_opendistro_security
-  tags: opendistro-security
-
-- name: Copying node's certificate from master (Custom CA)
-  copy:
-    src: "{{ item }}"
-    dest: "{{ node_certs_destination }}/"
-    mode: 0440
-  with_items:
-    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
-    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
-    - "{{ master_certs_path }}/ca/{{ ca_cert_name }}"
-  when:
-    - not generate_CA
-    - filebeat_opendistro_security
-  tags: opendistro-security
-
-- name: Ensuring folder & certs permissions
-  file:
-    path: "{{ node_certs_destination }}/"
-    mode: 0774
-    state: directory
-    recurse: yes
-  when:
-    - filebeat_xpack_security
-  tags: xpack-security
-
-- name: Checking if Filebeat Module folder file exists
-  stat:
-    path: "{{ filebeat_module_folder }}"
-  register: filebeat_module_folder
-
-
-- name: Download Filebeat module package
-  get_url:
-    url: "{{ filebeat_module_package_url }}/{{ filebeat_module_package_name }}"
-    dest: "{{ filebeat_module_package_path }}"
-  when: not filebeat_module_folder.stat.exists
-
-- name: Unpakcing Filebeat module package
-  unarchive:
-    src: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
-    dest: "{{ filebeat_module_destination }}"
-    remote_src: yes
-  when: not filebeat_module_folder.stat.exists
-
-- name: Setting 0755 permission for Filebeat module folder
-  file: dest={{ filebeat_module_folder }} mode=u=rwX,g=rwX,o=rwX recurse=yes
-  when: not filebeat_module_folder.stat.exists
-
-- name: Checking if Filebeat Module package file exists
-  stat:
-    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
-  register: filebeat_module_package
-  when: filebeat_module_package is not defined
-
-- name: Delete Filebeat module package file
-  file:
-    state: absent
-    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
-  when: filebeat_module_package.stat.exists
-
-- import_tasks: config.yml
-  when: filebeat_create_config
-  notify: restart filebeat
-
-- name: Reload systemd
-  systemd: daemon_reload=yes
-  ignore_errors: true
-  when:
-    - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
-    - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
-    - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
-    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
-
-- name: Ensure Filebeat is started and enabled at boot.
-  service:
-    name: filebeat
-    state: started
-    enabled: true
-
-- include_tasks: "RMRedHat.yml"
-  when: ansible_os_family == "RedHat"
-
-- include_tasks: "RMDebian.yml"
-  when: ansible_os_family == "Debian"

roles/wazuh/filebeat-oss/tasks/security_actions.yml

@@ -1,11 +0,0 @@
-- block:
-
-  - name: Copy certificates and root-ca to Filebeat
-    copy:
-      src: "{{ local_certs_path }}/config/{{ item }}"
-      dest: /etc/filebeat/
-      mode: 0644
-    with_items:
-      - root-ca.pem
-      - "{{ inventory_hostname }}.key"
-      - "{{ inventory_hostname }}.pem"

roles/wazuh/filebeat-oss/tests/requirements.yml

@@ -1,3 +0,0 @@
----
-- src: geerlingguy.java
-- src: geerlingguy.elasticsearch

roles/wazuh/filebeat-oss/tests/test.yml

@@ -1,20 +0,0 @@
----
-- hosts: all
-
-  pre_tasks:
-    - name: Update apt cache.
-      apt:
-        cache_valid_time: 600
-      when: ansible_os_family == 'Debian'
-
-    - name: Install test dependencies (RedHat).
-      package: name=which state=present
-      when: ansible_os_family == 'RedHat'
-
-    - name: Install test dependencies.
-      package: name=curl state=present
-
-  roles:
-    - geerlingguy.java
-    - geerlingguy.elasticsearch
-    - role_under_test