Merge pull request #206 from wazuh/3.9.2_7.1.1_tests

Fixes in Molecule tests, Wazuh components installation and Versioning Control

.gitignore

@@ -5,4 +5,6 @@ wazuh-elastic_stack-single.yml
 wazuh-elastic.yml
 wazuh-kibana.yml
 wazuh-manager.yml
-*.pyc
+*.pyc
+Pipfile.lock
+*.swp

Pipfile

@@ -4,9 +4,9 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-molecule = "*"
 docker-py = "*"
-ansible = "*"
+ansible = "==2.7.11"
+molecule = "*"
 
 [dev-packages]
 

molecule/default/tests/test_default.py

@@ -9,7 +9,7 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
 
 def get_wazuh_version():
     """This return the version of Wazuh."""
-    return "3.9.2"
+    return "3.9.0"
 
 
 def test_wazuh_packages_are_installed(host):

molecule/elasticsearch/molecule.yml

@@ -5,6 +5,9 @@ driver:
   name: docker
 lint:
   name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
 platforms:
   - name: bionic
     image: solita/ubuntu-systemd:bionic
@@ -12,28 +15,29 @@ platforms:
     ulimits:
       - nofile:262144:262144
     privileged: true
-    memory_reservation: 1024m
+    memory_reservation: 2048m
   - name: xenial
     image: solita/ubuntu-systemd:xenial
     privileged: true
-    memory_reservation: 1024m
+    memory_reservation: 2048m
     command: /sbin/init
     ulimits:
       - nofile:262144:262144
-  - name: trusty
-    image: ubuntu:trusty
-    memory_reservation: 1024m
-    ulimits:
-      - nofile:262144:262144
+#  - name: trusty
+#    image: ubuntu:trusty
+#    privileged: true
+#    memory_reservation: 2048m
+#    ulimits:
+#      - nofile:262144:262144
   - name: centos6
     image: centos:6
     privileged: true
-    memory_reservation: 1024m
+    memory_reservation: 2048m
     ulimits:
       - nofile:262144:262144
   - name: centos7
     image: milcom/centos7-systemd
-    memory_reservation: 1024m
+    memory_reservation: 2048m
     privileged: true
     ulimits:
       - nofile:262144:262144

molecule/elasticsearch/tests/test_default.py

@@ -10,7 +10,7 @@ def test_elasticsearch_is_installed(host):
     """Test if the elasticsearch package is installed."""
     elasticsearch = host.package("elasticsearch")
     assert elasticsearch.is_installed
-    assert elasticsearch.version.startswith('6.7.1')
+    assert elasticsearch.version.startswith('7.1.1')
 
 
 def test_elasticsearch_is_running(host):

molecule/filebeat/molecule.yml

@@ -5,6 +5,9 @@ driver:
   name: docker
 lint:
   name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
 platforms:
   - name: trusty
     image: ubuntu:trusty

molecule/filebeat/tests/test_default.py

@@ -4,3 +4,10 @@ import testinfra.utils.ansible_runner
 
 testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
     os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def test_filebeat_is_installed(host):
+    """Test if the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.1.1')

molecule/kibana/molecule.yml

@@ -5,6 +5,9 @@ driver:
   name: docker
 lint:
   name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
 platforms:
   - name: bionic
     image: solita/ubuntu-systemd:bionic
@@ -20,11 +23,11 @@ platforms:
     command: /sbin/init
     ulimits:
       - nofile:262144:262144
-  - name: trusty
-    image: ubuntu:trusty
-    memory_reservation: 1024m
-    ulimits:
-      - nofile:262144:262144
+#  - name: trusty
+#    image: ubuntu:trusty
+#    memory_reservation: 1024m
+#    ulimits:
+#      - nofile:262144:262144
   - name: centos6
     image: centos:6
     privileged: true

molecule/kibana/tests/test_default.py

@@ -14,7 +14,7 @@ def test_port_kibana_is_open(host):
 def test_find_correct_elasticsearch_version(host):
     """Test if we find the kibana/elasticsearch version in package.json"""
     kibana = host.file("/usr/share/kibana/plugins/wazuh/package.json")
-    assert kibana.contains("6.7.1")
+    assert kibana.contains("7.1.1")
 
 
 def test_wazuh_plugin_installed(host):

molecule/wazuh-agent/molecule.yml

@@ -3,8 +3,13 @@ dependency:
   name: galaxy
 driver:
   name: docker
+  #lint:
+  #  name: yamllint
 lint:
   name: yamllint
+  options:
+    config-data:
+      ignore: .virtualenv
 platforms:
   - name: wazuh_server_centos7
     image: milcom/centos7-systemd
@@ -72,7 +77,6 @@ provisioner:
           ssl_agent_cert: null
           ssl_agent_key: null
           ssl_auto_negotiate: 'no'
-
   lint:
     name: ansible-lint
     enabled: true

molecule/wazuh-agent/tests/test_agents.py

@@ -7,6 +7,11 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
     os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('agent')
 
 
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "3.9.0"
+
+
 def test_ossec_package_installed(Package):
     ossec = Package('wazuh-agent')
     assert ossec.is_installed

roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml

@@ -14,17 +14,47 @@
     - ansible_distribution == "Ubuntu"
     - ansible_distribution_major_version | int == 14
 
+- name: Update and upgrade apt packages
+  become: true
+  apt:
+    upgrade: yes
+    update_cache: yes
+    cache_valid_time: 86400 #One day
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Install Oracle Java 8
+  become: true
+  apt: name=openjdk-8-jdk state=latest
+
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Update and upgrade apt packages
+  become: true
+  apt:
+    upgrade: yes
+    update_cache: yes
+    cache_valid_time: 86400 #One day
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
 - name: Debian/Ubuntu | Add Elasticsearch GPG key.
   apt_key:
     url: "https://artifacts.elastic.co/GPG-KEY-elasticsearch"
     state: present
 
+
 - name: Debian/Ubuntu | Install Elastic repo
   apt_repository:
     repo: 'deb https://artifacts.elastic.co/packages/7.x/apt stable main'
     state: present
     filename: 'elastic_repo'
     update_cache: true
+  changed_when: false
 
 - name: Debian/Ubuntu | Install Elasticsarch
   apt:

roles/elastic-stack/ansible-elasticsearch/tasks/RedHat.yml

@@ -9,6 +9,13 @@
     gpgcheck: true
   changed_when: false
 
+- name: CentOS x.x => x.x < 7.0 | Installing Java
+  yum:
+    name: java-1.8.0-openjdk.x86_64
+    state: present
+  when:
+    - ansible_distribution in ['CentOS', 'RedHat'] and ansible_distribution_major_version|int < 7
+
 - name: RedHat/CentOS/Fedora | Install Elasticsarch
   package: name=elasticsearch-{{ elastic_stack_version }} state=present
   tags: install

roles/elastic-stack/ansible-elasticsearch/tasks/main.yml

@@ -197,7 +197,29 @@
   when:
     - elasticsearch_xpack_security
   
-- name: Reload systemd
+- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
+  lineinfile:
+    path: /etc/security/limits.conf
+    line: elasticsearch - memlock unlimited
+    create: yes
+  become: true
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+  changed_when: false
+
+- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.d/elasticsearch.conf
+  lineinfile:
+    path: /etc/security/limits.d/elasticsearch.conf
+    line: elasticsearch - memlock unlimited
+    create: yes
+  become: true
+  changed_when: false
+  when:
+    - ansible_distribution == "Ubuntu"
+    - ansible_distribution_major_version | int == 14
+
+- name: Distribution != one of [ centos 6.*,  trusty ] | Reload systemd
   systemd: daemon_reload=true
   ignore_errors: true
   when:
@@ -206,6 +228,13 @@
     - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
     - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
 
+- name: Distribution is centos 6.* | Enable Elasticsearch
+  service: name=elasticsearch enabled=yes
+
+- name: Distribution is centos 6.* | Start Elasticsearch
+  service: name=elasticsearch state=started
+  ignore_errors: true
+
 - name: Ensure Elasticsearch started and enabled
   service:
     name: elasticsearch
@@ -247,6 +276,5 @@
 - import_tasks: "RMRedHat.yml"
   when: ansible_os_family == "RedHat"
 
-
 - import_tasks: "RMDebian.yml"
   when: ansible_os_family == "Debian"

roles/elastic-stack/ansible-kibana/tasks/main.yml

@@ -16,17 +16,17 @@
 
 - name: Check if certificate exists locally
   stat:
-    path: "{{node_certs_destination}}/{{ kibana_node_name }}.crt"
+    path: "{{ node_certs_destination }}/{{ kibana_node_name }}.crt"
   register: certificate_file_exists
   when:
-    - kibana_xpack_security 
+    - kibana_xpack_security
 
 - name: Copy key & certificate files in generator node (locally)
   synchronize:
-    src: "{{node_certs_source}}/{{kibana_node_name}}/"
-    dest: "{{node_certs_destination}}/"
+    src: "{{ node_certs_source }}/{{ kibana_node_name }}/"
+    dest: "{{ node_certs_destination }}/"
   delegate_to: "{{ node_certs_generator_ip }}"
-  when: 
+  when:
     - node_certs_generator
     - kibana_xpack_security
     - not certificate_file_exists.stat.exists
@@ -34,25 +34,29 @@
 
 - name: Copy ca certificate file in generator node (locally)
   synchronize:
-    src: "{{node_certs_source}}/ca/"
-    dest: "{{node_certs_destination}}/"
+    src: "{{ node_certs_source }}/ca/"
+    dest: "{{ node_certs_destination }}/"
   delegate_to: "{{ node_certs_generator_ip }}"
-  when: 
+  when:
     - node_certs_generator
     - kibana_xpack_security
     - not certificate_file_exists.stat.exists
   tags: xpack-security
-  
+
 - name: Importing key & certificate files from generator node
-  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{kibana_node_name}}/ {{node_certs_destination}}/"
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/{{ kibana_node_name }}/ {{ node_certs_destination }}/
   when:
     - not node_certs_generator
     - kibana_xpack_security
     - not certificate_file_exists.stat.exists
   tags: xpack-security
 
-- name: Importing ca certificate file from generator node 
-  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/"
+- name: Importing ca certificate file from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
   when:
     - not node_certs_generator
     - kibana_xpack_security
@@ -61,14 +65,22 @@
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
-  shell: "chown -R kibana: {{node_certs_destination}}/"
+  file:
+    path: "{{ node_certs_destination }}/"
+    state: directory
+    recurse: yes
+    owner: kibana
+    group: kibana
   when:
     - check_certs_permissions is defined
     - kibana_xpack_security
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
-  shell: "chmod -R 770 {{node_certs_destination}}/"
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0770'
+    recurse: yes
   when:
     - check_certs_permissions is defined
     - kibana_xpack_security

roles/wazuh/ansible-filebeat/defaults/main.yml

@@ -1,4 +1,6 @@
 ---
+filebeat_version: 7.1.1
+
 filebeat_create_config: true
 
 filebeat_prospectors:

roles/wazuh/ansible-filebeat/tasks/main.yml

@@ -5,26 +5,40 @@
 - import_tasks: Debian.yml
   when: ansible_os_family == 'Debian'
 
-- name: Install Filebeat.
-  package: name=filebeat state=present
+- name: CentOS/RedHat |  Install Filebeat.
+  package: name=filebeat-{{ filebeat_version }} state=present
   register: filebeat_installing_package
   until: filebeat_installing_package is succeeded
+  when:
+    - ansible_distribution in ['CentOS','RedHat']
   tags:
     - install
 
+- name: Debian/Ubuntu | Install Filebeat.
+  apt:
+    name: filebeat={{ filebeat_version }}
+    state: present
+    cache_valid_time: 3600
+  register: filebeat_installing_package_debian
+  until: filebeat_installing_package_debian is succeeded
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'])
+  tags:
+    - init
+
 - name: Check if certificate exists locally
   stat:
-    path: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt"
+    path: "{{ node_certs_destination }}/{{ filebeat_node_name }}.crt"
   register: certificate_file_exists
   when:
     - filebeat_xpack_security
 
 - name: Copy key & certificate files in generator node (locally)
   synchronize:
-    src: "{{node_certs_source}}/{{filebeat_node_name}}/"
-    dest: "{{node_certs_destination}}/"
+    src: "{{ node_certs_source }}/{{ filebeat_node_name }}/"
+    dest: "{{ node_certs_destination }}/"
   delegate_to: "{{ node_certs_generator_ip }}"
-  when: 
+  when:
     - node_certs_generator
     - filebeat_xpack_security
     - not certificate_file_exists.stat.exists
@@ -32,26 +46,30 @@
 
 - name: Copy ca certificate file in generator node (locally)
   synchronize:
-    src: "{{node_certs_source}}/ca/"
-    dest: "{{node_certs_destination}}/"
+    src: "{{ node_certs_source }}/ca/"
+    dest: "{{ node_certs_destination }}/"
   delegate_to: "{{ node_certs_generator_ip }}"
-  when: 
+  when:
     - node_certs_generator
     - filebeat_xpack_security
     - not certificate_file_exists.stat.exists
   register: check_certs_permissions
   tags: xpack-security
-  
+
 - name: Importing key & certificate files from generator node
-  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{filebeat_node_name}}/ {{node_certs_destination}}/"
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/{{ filebeat_node_name }}/ {{ node_certs_destination }}/
   when:
     - not node_certs_generator
     - filebeat_xpack_security
     - not certificate_file_exists.stat.exists
   tags: xpack-security
 
-- name: Importing ca certificate file from generator node 
-  shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/"
+- name: Importing ca certificate file from generator node
+  command: >-
+    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
+    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
   when:
     - not node_certs_generator
     - filebeat_xpack_security
@@ -60,7 +78,11 @@
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
-  shell: "chmod -R 770 {{node_certs_destination}}/"
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0770'
+    recurse: yes
+
   when:
     - check_certs_permissions is defined
     - filebeat_xpack_security

roles/wazuh/ansible-wazuh-agent/defaults/main.yml

@@ -1,4 +1,5 @@
 ---
+wazuh_agent_version: 3.9.0
 wazuh_managers:
   - address: 127.0.0.1
     port: 1514
@@ -23,10 +24,10 @@ wazuh_winagent_config:
   install_dir_x86: 'C:\Program Files (x86)\ossec-agent\'
   auth_path: C:\'Program Files'\ossec-agent\agent-auth.exe
   auth_path_x86: C:\'Program Files (x86)'\ossec-agent\agent-auth.exe
-  version: '3.9.2'
+  version: '3.9.3'
   revision: '1'
   repo: https://packages.wazuh.com/3.x/windows/
-  md5: 43936e7bc7eb51bd186f47dac4a6f477
+  md5: c3fdbd6c121ca371b8abcd477ed4e8a4
 wazuh_agent_config:
   active_response:
     ar_disabled: 'no'

roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml

@@ -5,10 +5,22 @@
 - import_tasks: "Debian.yml"
   when: ansible_os_family == "Debian"
 
-- name: Linux | Install wazuh-agent
-  package: name=wazuh-agent state=present
+- name: Linux CentOS/RedHat | Install wazuh-agent
+  package: name=wazuh-agent-{{ wazuh_agent_version }}-1 state=present
   async: 90
-  poll: 15
+  poll: 30
+  when:
+    - ansible_distribution in ['CentOS','RedHat']
+  tags:
+    - init
+
+- name: Linux Debian | Install wazuh-agent
+  apt:
+    name: "wazuh-agent={{ wazuh_agent_version }}-1"
+    state: present
+    cache_valid_time: 3600
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'])
   tags:
     - init
 

roles/wazuh/ansible-wazuh-manager/defaults/main.yml

@@ -1,4 +1,6 @@
 ---
+wazuh_manager_api_version: 3.9.0
+
 wazuh_manager_fqdn: "wazuh-server"
 wazuh_manager_package_state: latest
 

roles/wazuh/ansible-wazuh-manager/tasks/main.yml

@@ -5,19 +5,38 @@
 - import_tasks: "Debian.yml"
   when: ansible_os_family == "Debian"
 
-- name: Install wazuh-manager, wazuh-api and expect
-  package: pkg={{ item }} state={{ wazuh_manager_package_state }}
+- name: CentOS/RedHat | Install wazuh-manager, wazuh-api
+  package: pkg={{ item }}-{{ wazuh_manager_api_version }}-1 state={{ wazuh_manager_package_state }}
   with_items:
     - wazuh-manager
     - wazuh-api
-    - expect
   register: wazuh_manager_main_packages_installed
   until: wazuh_manager_main_packages_installed is succeeded
   when:
-    - not (ansible_distribution in ['CentOS','RedHat'] and ansible_distribution_major_version|int < 6)
+    - ansible_distribution in ['CentOS','RedHat']
   tags:
     - init
 
+- name: Debian/Ubuntu | Install wazuh-manager, wazuh-api
+  apt:
+    name: "{{ item }}={{ wazuh_manager_api_version }}-1"
+    state: present
+    cache_valid_time: 3600
+  with_items:
+    - wazuh-manager
+    - wazuh-api
+  register: wazuh_manager_main_packages_installed
+  until: wazuh_manager_main_packages_installed is succeeded
+  when:
+  - not (ansible_distribution in ['CentOS','RedHat'])
+  tags: init
+
+- name: Install expect
+  package: pkg=expect state={{ wazuh_manager_package_state }}
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat'] and ansible_distribution_major_version|int < 6)
+  tags: init
+
 - name: CentOS/RedHat 6 | Enabling python2.7 and sqlite3
   replace:
     path: /etc/init.d/wazuh-manager
@@ -30,7 +49,7 @@
 - name: Install wazuh-manager and expect (EL5)
   package: pkg={{ item }} state={{ wazuh_manager_package_state }}
   with_items:
-    - wazuh-manager
+    - wazuh-manager-{{ wazuh_manager_api_version }}
     - expect
   register: wazuh_manager_main_packages_installed
   until: wazuh_manager_main_packages_installed is succeeded