diff --git a/README.md b/README.md index 4ec585db..c2ea2bb7 100644 --- a/README.md +++ b/README.md @@ -65,7 +65,7 @@ cp -pr wazuh-playbook/* /etc/ansible/roles/ Create in your home o preferred folder the file agent.yml with the content: ``` -- hosts: all:!wazuh-agents +- hosts: all:!wazuh-manager roles: - { role: ansible-wazuh-agent, ossec_server_ip: 10.0.0.51 } ``` diff --git a/ansible-wazuh-agent/defaults/main.yml b/ansible-wazuh-agent/defaults/main.yml index 5986d569..bf9956ca 100644 --- a/ansible-wazuh-agent/defaults/main.yml +++ b/ansible-wazuh-agent/defaults/main.yml @@ -1,7 +1,8 @@ --- -ossec_server_ip: 127.0.0.1 -ossec_register_client: false -ossec_agent_config: +wazuh_manager_ip: 127.0.0.1 +wazuh_authd_port: 1515 +wazuh_register_client: true +wazuh_agent_config: frequency_check: 43200 syscheck_scan_on_start: 'yes' ignore_files: diff --git a/ansible-wazuh-agent/meta/main.yml b/ansible-wazuh-agent/meta/main.yml index 487537cc..0b2e0a98 100644 --- a/ansible-wazuh-agent/meta/main.yml +++ b/ansible-wazuh-agent/meta/main.yml @@ -1,7 +1,7 @@ --- galaxy_info: - author: Jose Luis Ruiz - description: Installing and maintaining the wazuh-agent. + author: Wazuh + description: Installing, deploying and configuring Wazuh Agent. company: wazuh.com license: license (GPLv3) min_ansible_version: 2.0 diff --git a/ansible-wazuh-agent/tasks/main.yml b/ansible-wazuh-agent/tasks/main.yml index 6ae59ce1..9f332b81 100644 --- a/ansible-wazuh-agent/tasks/main.yml +++ b/ansible-wazuh-agent/tasks/main.yml @@ -10,19 +10,20 @@ tags: - init -- name: "Check if client.keys exists" - stat: path=/var/ossec/etc/client.keys - register: check_keys +- name: "Register agent" + shell: /var/ossec/bin/agent-auth -m {{ wazuh_manager_ip }} -p {{ wazuh_authd_port }} + register: agent_auth_output + when: wazuh_register_client == true tags: - config -- name: "Register client" - shell: /var/ossec/bin/agent-auth -m {{ ossec_server_ip }} -p 1515 - when: ossec_register_client == true and check_keys.stat.size == 0 +- name: "Verify agent registration" + shell: echo {{ agent_auth_output }} | grep "Valid key created" + when: wazuh_register_client == true tags: - config -- name: "Installing the ossec.conf" +- name: "Installing agent configuration (ossec.conf)" template: src=var-ossec-etc-ossec-agent.conf.j2 dest=/var/ossec/etc/ossec.conf owner=root @@ -33,7 +34,7 @@ - init - config -- name: Ensure Wazuh Manager service is started and enabled +- name: Ensure Wazuh Agent service is started and enabled service: name: wazuh-agent enabled: yes diff --git a/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 b/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 index 692a15d9..20a47807 100644 --- a/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 +++ b/ansible-wazuh-agent/templates/var-ossec-etc-ossec-agent.conf.j2 @@ -1,16 +1,80 @@ - +#jinja2: lstrip_blocks: True + - {{ ossec_server_ip }} - {% if ossec_profile is defined %} - {{ ossec_profile }} + {{ wazuh_manager_ip }} + {% if wazuh_profile is defined %} + {{ wazuh_profile }} {% endif %} udp + + no + yes + yes + yes + yes + yes + yes + yes + yes + + + 43200 + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + /var/ossec/etc/shared/system_audit_rcl.txt + /var/ossec/etc/shared/system_audit_ssh.txt + {% if cis_distribution_filename is defined %} + /var/ossec/etc/shared/{{ cis_distribution_filename }} + {% endif %} + + yes + + + + + {{ wazuh_agent_config.frequency_check }} + {{ wazuh_agent_config.syscheck_scan_on_start }} + + + {% for directory in wazuh_agent_config.directories %} + {{ directory.dirs }} + {% endfor %} + + + {% for ignore_file in wazuh_agent_config.ignore_files %} + {{ ignore_file }} + {% endfor %} + + + {% for no_diff in wazuh_agent_config.no_diff %} + {{ no_diff }} + {% endfor %} + + + + {% for localfile in wazuh_agent_config.localfiles %} + + {{ localfile.format }} + {% if localfile.format == 'command' or localfile.format == 'full_command' %} + {{ localfile.command }} + {{ localfile.frequency }} + {% else %} + {{ localfile.location }} + {% endif %} + + {% endfor %} + {% if ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial' %} - + 1800 1d yes @@ -30,12 +94,12 @@ {% elif ansible_distribution_major_version == '6' %} {% endif %} - xccdf_org.ssgproject.content_profile_pci-dss + xccdf_org.ssgproject.content_profile_pci-dss xccdf_org.ssgproject.content_profile_common - {% elif ansible_distribution == 'RedHat' %} - + {% elif ansible_distribution == 'RedHat' %} + 1800 1d yes @@ -45,7 +109,7 @@ {% elif ansible_distribution_major_version == '6' %} {% endif %} - xccdf_org.ssgproject.content_profile_pci-dss + xccdf_org.ssgproject.content_profile_pci-dss xccdf_org.ssgproject.content_profile_common @@ -57,69 +121,10 @@ yes - xccdf_org.ssgproject.content_profile_pci-dss - xccdf_org.ssgproject.content_profile_common + xccdf_org.ssgproject.content_profile_pci-dss + xccdf_org.ssgproject.content_profile_common {% endif %} - - no - yes - yes - yes - yes - yes - yes - yes - yes - - - 43200 - - /var/ossec/etc/shared/rootkit_files.txt - /var/ossec/etc/shared/rootkit_trojans.txt - /var/ossec/etc/shared/system_audit_rcl.txt - /var/ossec/etc/shared/system_audit_ssh.txt - {% if cis_distribution_filename is defined %} - /var/ossec/etc/shared/{{ cis_distribution_filename }} - {% endif %} - - yes - - - - - {{ ossec_agent_config.frequency_check }} - {{ ossec_agent_config.syscheck_scan_on_start }} - - -{% for directory in ossec_agent_config.directories %} - {{ directory.dirs }} -{% endfor %} - - - {% for ignore_file in ossec_agent_config.ignore_files %} - {{ ignore_file }} - {% endfor %} - - - {% for no_diff in ossec_agent_config.no_diff %} - {{ no_diff }} - {% endfor %} - - - -{% for localfile in ossec_agent_config.localfiles %} - - {{ localfile.format }} - {% if localfile.format == 'command' or localfile.format == 'full_command' %} - {{ localfile.command }} - {{ localfile.frequency }} - {% else %} - {{ localfile.location }} - {% endif %} - -{% endfor %} - diff --git a/wazuh-agent.yml b/wazuh-agent.yml index db13438f..61590f47 100644 --- a/wazuh-agent.yml +++ b/wazuh-agent.yml @@ -1,3 +1,4 @@ - hosts: all:!wazuh-manager roles: - - { role: ansible-wazuh-agent, ossec_server_ip: 192.168.33.169 } + - { role: ansible-wazuh-agent, wazuh_manager_ip: 127.0.0.1 } +