Agent playbook - Refactor
This commit is contained in:
Pedro Sanchez
parent
bf1bd87d5b
commit
801340edb0
@ -65,7 +65,7 @@ cp -pr wazuh-playbook/* /etc/ansible/roles/
|
||||
Create in your home o preferred folder the file agent.yml with the content:
|
||||
|
||||
```
|
||||
- hosts: all:!wazuh-agents
|
||||
- hosts: all:!wazuh-manager
|
||||
roles:
|
||||
- { role: ansible-wazuh-agent, ossec_server_ip: 10.0.0.51 }
|
||||
```
|
||||
|
||||
@ -1,7 +1,8 @@
|
||||
---
|
||||
ossec_server_ip: 127.0.0.1
|
||||
ossec_register_client: false
|
||||
ossec_agent_config:
|
||||
wazuh_manager_ip: 127.0.0.1
|
||||
wazuh_authd_port: 1515
|
||||
wazuh_register_client: true
|
||||
wazuh_agent_config:
|
||||
frequency_check: 43200
|
||||
syscheck_scan_on_start: 'yes'
|
||||
ignore_files:
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
galaxy_info:
|
||||
author: Jose Luis Ruiz
|
||||
description: Installing and maintaining the wazuh-agent.
|
||||
author: Wazuh
|
||||
description: Installing, deploying and configuring Wazuh Agent.
|
||||
company: wazuh.com
|
||||
license: license (GPLv3)
|
||||
min_ansible_version: 2.0
|
||||
|
||||
@ -10,19 +10,20 @@
|
||||
tags:
|
||||
- init
|
||||
|
||||
- name: "Check if client.keys exists"
|
||||
stat: path=/var/ossec/etc/client.keys
|
||||
register: check_keys
|
||||
- name: "Register agent"
|
||||
shell: /var/ossec/bin/agent-auth -m {{ wazuh_manager_ip }} -p {{ wazuh_authd_port }}
|
||||
register: agent_auth_output
|
||||
when: wazuh_register_client == true
|
||||
tags:
|
||||
- config
|
||||
|
||||
- name: "Register client"
|
||||
shell: /var/ossec/bin/agent-auth -m {{ ossec_server_ip }} -p 1515
|
||||
when: ossec_register_client == true and check_keys.stat.size == 0
|
||||
- name: "Verify agent registration"
|
||||
shell: echo {{ agent_auth_output }} | grep "Valid key created"
|
||||
when: wazuh_register_client == true
|
||||
tags:
|
||||
- config
|
||||
|
||||
- name: "Installing the ossec.conf"
|
||||
- name: "Installing agent configuration (ossec.conf)"
|
||||
template: src=var-ossec-etc-ossec-agent.conf.j2
|
||||
dest=/var/ossec/etc/ossec.conf
|
||||
owner=root
|
||||
@ -33,7 +34,7 @@
|
||||
- init
|
||||
- config
|
||||
|
||||
- name: Ensure Wazuh Manager service is started and enabled
|
||||
- name: Ensure Wazuh Agent service is started and enabled
|
||||
service:
|
||||
name: wazuh-agent
|
||||
enabled: yes
|
||||
|
||||
@ -1,16 +1,80 @@
|
||||
<!-- OSSEC example config -->
|
||||
#jinja2: lstrip_blocks: True
|
||||
<!--
|
||||
Wazuh - Agent
|
||||
More info at: https://documentation.wazuh.com
|
||||
Mailing list: https://groups.google.com/forum/#!forum/wazuh
|
||||
-->
|
||||
|
||||
<ossec_config>
|
||||
<client>
|
||||
<server-ip>{{ ossec_server_ip }}</server-ip>
|
||||
{% if ossec_profile is defined %}
|
||||
<config-profile>{{ ossec_profile }}</config-profile>
|
||||
<server-ip>{{ wazuh_manager_ip }}</server-ip>
|
||||
{% if wazuh_profile is defined %}
|
||||
<config-profile>{{ wazuh_profile }}</config-profile>
|
||||
{% endif %}
|
||||
<protocol>udp</protocol>
|
||||
</client>
|
||||
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_unixaudit>yes</check_unixaudit>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Rootcheck scan frequency -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
|
||||
<system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
|
||||
<system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
|
||||
{% if cis_distribution_filename is defined %}
|
||||
<system_audit>/var/ossec/etc/shared/{{ cis_distribution_filename }}</system_audit>
|
||||
{% endif %}
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<syscheck>
|
||||
<!-- Syscgeck scan frequency -->
|
||||
<frequency>{{ wazuh_agent_config.frequency_check }}</frequency>
|
||||
<scan_on_start>{{ wazuh_agent_config.syscheck_scan_on_start }}</scan_on_start>
|
||||
|
||||
<!-- Directories to monitor -->
|
||||
{% for directory in wazuh_agent_config.directories %}
|
||||
<directories check_all="{{ directory.check_all }}">{{ directory.dirs }}</directories>
|
||||
{% endfor %}
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
{% for ignore_file in wazuh_agent_config.ignore_files %}
|
||||
<ignore>{{ ignore_file }}</ignore>
|
||||
{% endfor %}
|
||||
|
||||
<!-- Files no diff -->
|
||||
{% for no_diff in wazuh_agent_config.no_diff %}
|
||||
<nodiff>{{ no_diff }}</nodiff>
|
||||
{% endfor %}
|
||||
</syscheck>
|
||||
|
||||
<!-- Files to monitor (localfiles) -->
|
||||
{% for localfile in wazuh_agent_config.localfiles %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
|
||||
{% if ansible_distribution == 'Ubuntu' and ansible_distribution_release == 'xenial' %}
|
||||
<wodle name="open-scap">
|
||||
<wodle name="open-scap">
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
@ -30,12 +94,12 @@
|
||||
{% elif ansible_distribution_major_version == '6' %}
|
||||
<content type="xccdf" path="ssg-centos-6-ds.xml">
|
||||
{% endif %}
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
||||
</content>
|
||||
</wodle>
|
||||
{% elif ansible_distribution == 'RedHat' %}
|
||||
<wodle name="open-scap">
|
||||
<wodle name="open-scap">
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
@ -45,7 +109,7 @@
|
||||
{% elif ansible_distribution_major_version == '6' %}
|
||||
<content type="xccdf" path="ssg-rhel-6-ds.xml">
|
||||
{% endif %}
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
||||
</content>
|
||||
</wodle>
|
||||
@ -57,69 +121,10 @@
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
|
||||
<content type="xccdf" path="ssg-fedora-ds.xml">
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_pci-dss</profile>
|
||||
<profile>xccdf_org.ssgproject.content_profile_common</profile>
|
||||
</content>
|
||||
</wodle>
|
||||
{% endif %}
|
||||
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_unixaudit>yes</check_unixaudit>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
|
||||
<system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
|
||||
<system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
|
||||
{% if cis_distribution_filename is defined %}
|
||||
<system_audit>/var/ossec/etc/shared/{{ cis_distribution_filename }}</system_audit>
|
||||
{% endif %}
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<syscheck>
|
||||
<!-- Frequency that syscheck is executed -- default every 20 hours -->
|
||||
<frequency>{{ ossec_agent_config.frequency_check }}</frequency>
|
||||
<scan_on_start>{{ ossec_agent_config.syscheck_scan_on_start }}</scan_on_start>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
{% for directory in ossec_agent_config.directories %}
|
||||
<directories check_all="{{ directory.check_all }}">{{ directory.dirs }}</directories>
|
||||
{% endfor %}
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
{% for ignore_file in ossec_agent_config.ignore_files %}
|
||||
<ignore>{{ ignore_file }}</ignore>
|
||||
{% endfor %}
|
||||
|
||||
<!-- Files no diff -->
|
||||
{% for no_diff in ossec_agent_config.no_diff %}
|
||||
<nodiff>{{ no_diff }}</nodiff>
|
||||
{% endfor %}
|
||||
</syscheck>
|
||||
|
||||
<!-- Files to monitor (localfiles) -->
|
||||
{% for localfile in ossec_agent_config.localfiles %}
|
||||
<localfile>
|
||||
<log_format>{{ localfile.format }}</log_format>
|
||||
{% if localfile.format == 'command' or localfile.format == 'full_command' %}
|
||||
<command>{{ localfile.command }}</command>
|
||||
<frequency>{{ localfile.frequency }}</frequency>
|
||||
{% else %}
|
||||
<location>{{ localfile.location }}</location>
|
||||
{% endif %}
|
||||
</localfile>
|
||||
{% endfor %}
|
||||
|
||||
</ossec_config>
|
||||
|
||||
@ -1,3 +1,4 @@
|
||||
- hosts: all:!wazuh-manager
|
||||
roles:
|
||||
- { role: ansible-wazuh-agent, ossec_server_ip: 192.168.33.169 }
|
||||
- { role: ansible-wazuh-agent, wazuh_manager_ip: 127.0.0.1 }
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user