afmarulanda/wazuh-ansible-4.8.1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removed molecule from root folder

Browse Source
This commit is contained in:
manuasir 2019-09-18 15:35:29 +02:00
parent c7c15f614c
commit 9f08ca93f8
40 changed files with 15 additions and 1295 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
Pipfile
View File

@ -1,35 +0,0 @@
[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"
[packages]
docker-py = "*"
ansible = "==2.7.13"
molecule = "==2.20.2"
[dev-packages]
[requires]
python_version = "2.7"
[scripts]
test ="molecule test --destroy=never"
worker ="molecule test -s worker --destroy=never"
agent ="molecule test -s wazuh-agent --destroy=never"
elasticsearch ="molecule test -s elasticsearch --destroy=never"
kibana ="molecule test -s kibana --destroy=never"
# Verify ..
verify ="molecule verify"
verify_worker ="molecule verify -s worker"
verify_agent ="molecule verify -s agent"
verify_elasticsearch ="molecule verify -s elasticsearch"
verify_kibana ="molecule verify -s kibana"
# Destroy ..
destroy ="molecule destroy"
destroy_worker ="molecule destroy -s worker"
destroy_agent ="molecule destroy -s agent"
destroy_elasticsearch ="molecule destroy -s elasticsearch"
destroy_kibana ="molecule destroy -s kibana"

15
README.md
View File

@ -47,6 +47,21 @@ These playbooks install and configure Wazuh agent, manager and Elastic Stack.
* `master` branch contains the latest code, be aware of possible bugs on this branch.
## Testing
1. Get the `wazuh-ansible` folder from the `wazuh-qa` [repository](https://github.com/wazuh/wazuh-qa/tree/master/ansible/wazuh-ansible).
```
git clone https://github.com/wazuh/wazuh-qa
```
2. Copy the `Pipfile` and the `molecule` folder into the root wazuh-ansible directory:
```
cp wazuh-qa/ansible/wazuh-ansible/* . -R
```
3. Follow these steps for launching the tests. Check the Pipfile for running different scenarios:
```
pip install pipenv
sudo pipenv install

14
molecule/default/Dockerfile.j2
View File

@ -1,14 +0,0 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get upgrade -y && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python2-dnf bash && dnf clean all; \
elif [ $(command -v yum) ]; then yum makecache fast && yum update -y && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
elif [ $(command -v zypper) ]; then zypper refresh && zypper update -y && zypper install -y python sudo bash python-xml && zypper clean -a; \
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

16
molecule/default/INSTALL.rst
View File

@ -1,16 +0,0 @@
*******
Install
*******
Requirements
============
* Docker Engine
* docker-py
Install
=======
.. code-block:: bash
$ sudo pip install docker-py

85
molecule/default/create.yml
View File

@ -1,85 +0,0 @@
---
- name: Create
hosts: localhost
connection: local
gather_facts: false
no_log: false
tasks:
- name: Log into a Docker registry
docker_login:
username: "{{ item.registry.credentials.username }}"
password: "{{ item.registry.credentials.password }}"
email: "{{ item.registry.credentials.email | default(omit) }}"
registry: "{{ item.registry.url }}"
docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
with_items: "{{ molecule_yml.platforms }}"
when:
- item.registry is defined
- item.registry.credentials is defined
- item.registry.credentials.username is defined
- name: Create Dockerfiles from image names
template:
src: "{{ molecule_scenario_directory }}/Dockerfile.j2"
dest: "{{ molecule_ephemeral_directory }}/Dockerfile_{{ item.image | regex_replace('[^a-zA-Z0-9_]', '_') }}"
with_items: "{{ molecule_yml.platforms }}"
register: platforms
- name: Discover local Docker images
docker_image_facts:
name: "molecule_local/{{ item.item.name }}"
docker_host: "{{ item.item.docker_host | default('unix://var/run/docker.sock') }}"
with_items: "{{ platforms.results }}"
register: docker_images
- name: Build an Ansible compatible image
docker_image:
path: "{{ molecule_ephemeral_directory }}"
name: "molecule_local/{{ item.item.image }}"
docker_host: "{{ item.item.docker_host | default('unix://var/run/docker.sock') }}"
dockerfile: "{{ item.item.dockerfile | default(item.invocation.module_args.dest) }}"
force: "{{ item.item.force | default(true) }}"
with_items: "{{ platforms.results }}"
when: platforms.changed or docker_images.results | map(attribute='images') | select('equalto', []) | list | count >= 0
- name: Create docker network(s)
docker_network:
name: "main"
state: present
- name: Sleep 5 seconds till the network gets created if it's not
# Pause for 5 minutes to build app cache.
pause:
seconds: 10
- name: Create molecule instance(s)
docker_container:
name: "{{ item.name }}"
docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
hostname: "{{ item.name }}"
image: "molecule_local/{{ item.image }}"
state: started
recreate: false
log_driver: json-file
command: "{{ item.command | default('bash -c \"while true; do sleep 10000; done\"') }}"
privileged: "{{ item.privileged | default(omit) }}"
volumes: "{{ item.volumes | default(omit) }}"
capabilities: "{{ item.capabilities | default(omit) }}"
exposed_ports: "{{ item.exposed_ports | default(omit) }}"
published_ports: "{{ item.published_ports | default(omit) }}"
ulimits: "{{ item.ulimits | default(omit) }}"
networks:
- name: "main"
dns_servers: "{{ item.dns_servers | default(omit) }}"
register: server
with_items: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) creation to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: docker_jobs
until: docker_jobs.finished
retries: 300
with_items: "{{ server.results }}"

32
molecule/default/destroy.yml
View File

@ -1,32 +0,0 @@
---
- name: Destroy
hosts: localhost
connection: local
gather_facts: false
no_log: false
tasks:
- name: Destroy molecule instance(s)
docker_container:
name: "{{ item.name }}"
docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
state: absent
force_kill: "{{ item.force_kill | default(true) }}"
register: server
with_items: "{{ molecule_yml.platforms }}"
async: 7200
poll: 0
- name: Wait for instance(s) deletion to complete
async_status:
jid: "{{ item.ansible_job_id }}"
register: docker_jobs
until: docker_jobs.finished
retries: 300
with_items: "{{ server.results }}"
- name: Delete docker network(s)
docker_network:
name: "{{ item }}"
docker_host: "{{ item.docker_host | default('unix://var/run/docker.sock') }}"
state: absent
with_items: "{{ molecule_yml.platforms | molecule_get_docker_networks }}"

47
molecule/default/molecule.yml.template
View File

@ -1,47 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
enabled: false
platforms:
- name: manager_platform_
image: imagename
command: /sbin/init
ulimits:
- nofile:262144:262144
privileged: true
memory_reservation: 2048m
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
env:
ANSIBLE_ROLES_PATH: ../../roles
lint:
name: ansible-lint
enabled: true
scenario:
name: default
test_sequence:
- lint
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
- idempotence
- side_effect
- verify
- cleanup
- destroy
verifier:
name: testinfra
lint:
name: flake8
enabled: true

19
molecule/default/playbook.yml
View File

@ -1,19 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-manager
vars:
wazuh_manager_config:
cluster:
disable: 'no'
name: 'wazuh'
node_name: 'manager'
node_type: 'master'
key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
port: '1516'
bind_addr: '0.0.0.0'
nodes:
- 'manager_bionic'
hidden: 'no'
- { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_bionic:9200' }

19
molecule/default/playbook.yml.template
View File

@ -1,19 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-manager
vars:
wazuh_manager_config:
cluster:
disable: 'no'
name: 'wazuh'
node_name: 'manager'
node_type: 'master'
key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
port: '1516'
bind_addr: '0.0.0.0'
nodes:
- 'manager_platform'
hidden: 'no'
- { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_platform:9200' }

36
molecule/default/prepare.yml
View File

@ -1,36 +0,0 @@
---
- name: Prepare
hosts: all
gather_facts: true
tasks:
- name: "Install Python packages for Trusty to solve trust issues"
package:
name:
- python-setuptools
- python-pip
state: latest
register: wazuh_manager_trusty_packages_installed
until: wazuh_manager_trusty_packages_installed is succeeded
when:
- ansible_distribution == "Ubuntu"
- ansible_distribution_major_version | int == 14
- name: "Install dependencies"
package:
name:
- curl
- net-tools
state: latest
register: wazuh_manager_dependencies_packages_installed
until: wazuh_manager_dependencies_packages_installed is succeeded
- name: "Install (RedHat) dependencies"
package:
name:
- initscripts
state: latest
register: wazuh_manager_dependencies_packages_installed
until: wazuh_manager_dependencies_packages_installed is succeeded
when:
- ansible_os_family == 'RedHat'

89
molecule/default/tests/test_default.py
View File

@ -1,89 +0,0 @@
import os
import pytest
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def get_wazuh_version():
"""This return the version of Wazuh."""
return "3.10.0"
def test_wazuh_packages_are_installed(host):
"""Test if the main packages are installed."""
manager = host.package("wazuh-manager")
api = host.package("wazuh-api")
distribution = host.system_info.distribution.lower()
if distribution == 'centos':
if host.system_info.release == "7":
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
assert api.is_installed
assert api.version.startswith(get_wazuh_version())
elif host.system_info.release.startswith("6"):
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
elif distribution == 'ubuntu':
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
def test_wazuh_services_are_running(host):
"""Test if the services are enabled and running.
When assert commands are commented, this means that the service command has
a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
"""
manager = host.service("wazuh-manager")
api = host.service("wazuh-api")
distribution = host.system_info.distribution.lower()
if distribution == 'centos':
# assert manager.is_running
assert manager.is_enabled
# assert not api.is_running
assert not api.is_enabled
elif distribution == 'ubuntu':
# assert manager.is_running
assert manager.is_enabled
# assert api.is_running
assert api.is_enabled
@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
("/var/ossec/etc/rules/local_rules.xml", "root", "ossec", 0o640),
("/var/ossec/etc/lists/audit-keys", "root", "ossec", 0o640),
])
def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
"""Test if Wazuh related files exist and have proper owners and mode."""
wazuh_file_host = host.file(wazuh_file)
assert wazuh_file_host.user == wazuh_owner
assert wazuh_file_host.group == wazuh_group
assert wazuh_file_host.mode == wazuh_mode
def test_open_ports(host):
"""Test if the main port is open and the agent-auth is not open."""
distribution = host.system_info.distribution.lower()
if distribution == 'ubuntu':
assert host.socket("tcp://0.0.0.0:1516").is_listening
assert host.socket("tcp://0.0.0.0:1515").is_listening
assert host.socket("tcp://0.0.0.0:1514").is_listening
elif distribution == 'centos':
assert host.socket("tcp://0.0.0.0:1516").is_listening
assert host.socket("tcp://127.0.0.1:1515").is_listening
assert host.socket("tcp://127.0.0.1:1514").is_listening
def test_filebeat_is_installed(host):
"""Test if the elasticsearch package is installed."""
filebeat = host.package("filebeat")
assert filebeat.is_installed
assert filebeat.version.startswith('7.3.2')

14
molecule/elasticsearch/Dockerfile.j2
View File

@ -1,14 +0,0 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

22
molecule/elasticsearch/INSTALL.rst
View File

@ -1,22 +0,0 @@
*******
Docker driver installation guide
*******
Requirements
============
* Docker Engine
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule[docker]'

57
molecule/elasticsearch/molecule.yml
View File

@ -1,57 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
bionics:
- name: elasticsearch_bionic
image: solita/ubuntu-systemd:bionic
command: /sbin/init
ulimits:
- nofile:262144:262144
privileged: true
memory_reservation: 2048m
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
prepare: ../default/prepare.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
lint:
name: ansible-lint
enabled: true
inventory:
group_vars:
all:
elasticsearch_jvm_xms: 512
scenario:
name: elasticsearch
test_sequence:
- lint
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
#- idempotence
- side_effect
- verify
- cleanup
- destroy
verifier:
name: testinfra
lint:
name: flake8

57
molecule/elasticsearch/molecule.yml.template
View File

@ -1,57 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
platforms:
- name: elasticsearch_platform_
image: imagename
command: /sbin/init
ulimits:
- nofile:262144:262144
privileged: true
memory_reservation: 2048m
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
prepare: ../default/prepare.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
lint:
name: ansible-lint
enabled: true
inventory:
group_vars:
all:
elasticsearch_jvm_xms: 512
scenario:
name: elasticsearch
test_sequence:
- lint
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
- idempotence
- side_effect
- verify
- cleanup
- destroy
verifier:
name: testinfra
lint:
name: flake8

6
molecule/elasticsearch/playbook.yml
View File

@ -1,6 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: elastic-stack/ansible-elasticsearch
elasticsearch_network_host: 'elasticsearch_bionic'

6
molecule/elasticsearch/playbook.yml.template
View File

@ -1,6 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: elastic-stack/ansible-elasticsearch
elasticsearch_network_host: 'elasticsearch_platform'

20
molecule/elasticsearch/tests/test_default.py
View File

@ -1,20 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_elasticsearch_is_installed(host):
"""Test if the elasticsearch package is installed."""
elasticsearch = host.package("elasticsearch")
assert elasticsearch.is_installed
assert elasticsearch.version.startswith('7.3.2')
def test_elasticsearch_is_running(host):
"""Test if the services are enabled and running."""
elasticsearch = host.service("elasticsearch")
assert elasticsearch.is_enabled
assert elasticsearch.is_running

14
molecule/kibana/Dockerfile.j2
View File

@ -1,14 +0,0 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

22
molecule/kibana/INSTALL.rst
View File

@ -1,22 +0,0 @@
*******
Docker driver installation guide
*******
Requirements
============
* Docker Engine
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule[docker]'

40
molecule/kibana/molecule.yml.template
View File

@ -1,40 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
platforms:
- name: kibana_platform_
image: imagename
command: /sbin/init
ulimits:
- nofile:262144:262144
privileged: true
memory_reservation: 1024m
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
lint:
name: ansible-lint
enabled: true
inventory:
group_vars:
all:
elasticsearch_jvm_xms: 256
verifier:
name: testinfra
lint:
name: flake8

6
molecule/kibana/playbook.yml
View File

@ -1,6 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: elastic-stack/ansible-kibana
elasticsearch_network_host: 'elasticsearch_bionic'

6
molecule/kibana/playbook.yml.template
View File

@ -1,6 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: elastic-stack/ansible-kibana
elasticsearch_network_host: 'elasticsearch_platform'

36
molecule/kibana/prepare.yml
View File

@ -1,36 +0,0 @@
---
- name: Prepare
hosts: all
gather_facts: true
pre_tasks:
- name: "Install Python packages for Trusty to solve trust issues"
package:
name:
- python-setuptools
- python-pip
state: latest
register: wazuh_manager_trusty_packages_installed
until: wazuh_manager_trusty_packages_installed is succeeded
when:
- ansible_distribution == "Ubuntu"
- ansible_distribution_major_version | int == 14
- name: "Install dependencies"
package:
name:
- curl
- net-tools
state: latest
register: wazuh_manager_dependencies_packages_installed
until: wazuh_manager_dependencies_packages_installed is succeeded
- name: "Install (RedHat) dependencies"
package:
name:
- initscripts
state: latest
register: wazuh_manager_dependencies_packages_installed
until: wazuh_manager_dependencies_packages_installed is succeeded
when:
- ansible_os_family == 'RedHat'

24
molecule/kibana/tests/test_default.py
View File

@ -1,24 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_port_kibana_is_open(host):
"""Test if the port 5601 is open and listening to connections."""
host.socket("tcp://0.0.0.0:5601").is_listening
def test_find_correct_elasticsearch_version(host):
"""Test if we find the kibana/elasticsearch version in package.json"""
kibana = host.file("/usr/share/kibana/plugins/wazuh/package.json")
assert kibana.contains("7.3.2")
def test_wazuh_plugin_installed(host):
"""Make sure there is a plugin wazuh directory."""
kibana = host.file("/usr/share/kibana/plugins/wazuh/")
assert kibana.is_directory

43
molecule/run_cluster_mode.sh
View File

@ -1,43 +0,0 @@
#!/bin/bash
paths=( "molecule/default/" "molecule/worker/" "molecule/elasticsearch/" "molecule/kibana/" )
images=( "solita/ubuntu-systemd:bionic" "solita/ubuntu-systemd:xenial" "milcom/centos7-systemd" "ubuntu:trusty" "centos:6" )
platform=( "bionic" "xenial" "centos7" "trusty" "centos6" )
echo "Please select an image. "
select IMAGE in "${images[@]}";
do
echo "You picked $IMAGE ($REPLY)"
break
done
index=$(($REPLY - 1))
if [ -z "$IMAGE" ]
then
echo "Platform not selected. Please select a platform of [bionuc, xenial or centos7]. => Aborting"
exit
else
for i in "${paths[@]}"
do
cp "$i/playbook.yml.template" "$i/playbook.yml"
sed -i "s/platform/${platform[$index]}/g" "$i/playbook.yml"
cp "$i/molecule.yml.template" "$i/molecule.yml"
sed -i "s|imagename|${images[$index]}|g" "$i/molecule.yml"
sed -i "s/platform_/${platform[$index]}/g" "$i/molecule.yml"
done
fi
sudo pipenv run elasticsearch
sudo pipenv run test
sudo pipenv run worker
sudo pipenv run kibana
sudo pipenv run destroy
sudo pipenv run destroy_worker
sudo pipenv run destroy_elasticsearch
sudo pipenv run destroy_kibana

14
molecule/wazuh-agent/Dockerfile.j2
View File

@ -1,14 +0,0 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

22
molecule/wazuh-agent/INSTALL.rst
View File

@ -1,22 +0,0 @@
*******
Docker driver installation guide
*******
Requirements
============
* Docker Engine
Install
=======
Please refer to the `Virtual environment`_ documentation for installation best
practices. If not using a virtual environment, please consider passing the
widely recommended `'--user' flag`_ when invoking ``pip``.
.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
.. code-block:: bash
$ pip install 'molecule[docker]'

89
molecule/wazuh-agent/molecule.yml
View File

@ -1,89 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
#lint:
# name: yamllint
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
platforms:
#- name: wazuh_server_centos7
# image: milcom/centos7-systemd
# networks:
# - name: wazuh
# privileged: true
# groups:
# - manager
- name: wazuh_agent_bionic
image: ubuntu:bionic
networks:
- name: wazuh
groups:
- agent
#- name: wazuh_agent_xenial
# image: solita/ubuntu-systemd:xenial
# privileged: true
# command: /sbin/init
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_trusty
# image: ubuntu:trusty
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_centos6
# image: centos:6
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_centos7
# image: milcom/centos7-systemd
# privileged: true
# networks:
# - name: wazuh
# groups:
# - agent
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
inventory:
group_vars:
agent:
api_pass: password
wazuh_managers:
- address: "{{ wazuh_manager_ip }}"
port: 1514
protocol: tcp
api_port: 55000
api_proto: 'http'
api_user: null
wazuh_agent_authd:
enable: true
port: 1515
ssl_agent_ca: null
ssl_agent_cert: null
ssl_agent_key: null
ssl_auto_negotiate: 'no'
lint:
name: ansible-lint
enabled: true
verifier:
name: testinfra
lint:
name: flake8

89
molecule/wazuh-agent/molecule.yml.template
View File

@ -1,89 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
#lint:
# name: yamllint
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
platforms:
#- name: wazuh_server_centos7
# image: milcom/centos7-systemd
# networks:
# - name: wazuh
# privileged: true
# groups:
# - manager
- name: wazuh_agent_bionic
image: ubuntu:bionic
networks:
- name: wazuh
groups:
- agent
#- name: wazuh_agent_xenial
# image: solita/ubuntu-systemd:xenial
# privileged: true
# command: /sbin/init
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_trusty
# image: ubuntu:trusty
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_centos6
# image: centos:6
# networks:
# - name: wazuh
# groups:
# - agent
#- name: wazuh_agent_centos7
# image: milcom/centos7-systemd
# privileged: true
# networks:
# - name: wazuh
# groups:
# - agent
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
inventory:
group_vars:
agent:
api_pass: password
wazuh_managers:
- address: "{{ wazuh_manager_ip }}"
port: 1514
protocol: tcp
api_port: 55000
api_proto: 'http'
api_user: null
wazuh_agent_authd:
enable: true
port: 1515
ssl_agent_ca: null
ssl_agent_cert: null
ssl_agent_key: null
ssl_auto_negotiate: 'no'
lint:
name: ansible-lint
enabled: true
verifier:
name: testinfra
lint:
name: flake8

18
molecule/wazuh-agent/playbook.yml
View File

@ -1,18 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-agent
vars:
wazuh_managers:
- address: 'manager_platform'
port: 1514
protocol: tcp
api_port: 55000
api_proto: 'http'
api_user: ansible
wazuh_agent_authd:
enable: true
port: 1515
ssl_agent_ca: null
ssl_auto_negotiate: 'no'

18
molecule/wazuh-agent/playbook.yml.template
View File

@ -1,18 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-agent
vars:
wazuh_managers:
- address: 'manager_platform'
port: 1514
protocol: tcp
api_port: 55000
api_proto: 'http'
api_user: ansible
wazuh_agent_authd:
enable: true
port: 1515
ssl_agent_ca: null
ssl_auto_negotiate: 'no'

43
molecule/wazuh-agent/prepare.yml
View File

@ -1,43 +0,0 @@
---
- name: Prepare
hosts: manager
gather_facts: true
tasks:
- name: "Install dependencies"
package:
name:
- curl
- net-tools
state: latest
register: wazuh_manager_dependencies_packages_installed
until: wazuh_manager_dependencies_packages_installed is succeeded
roles:
- role: wazuh/ansible-wazuh-manager
- name: Prepare
hosts: agent
gather_facts: true
tasks:
- name: "Install Python packages for Trusty to solve trust issues"
package:
name:
- python-setuptools
- python-pip
state: latest
register: wazuh_manager_trusty_packages_installed
until: wazuh_manager_trusty_packages_installed is succeeded
when:
- ansible_distribution == "Ubuntu"
- ansible_distribution_major_version | int == 14
- name: "Install dependencies"
package:
name:
- curl
- net-tools
state: latest
register: wazuh_agent_dependencies_packages_installed
until: wazuh_agent_dependencies_packages_installed is succeeded

28
molecule/wazuh-agent/tests/test_agents.py
View File

@ -1,28 +0,0 @@
import os
import pytest
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('agent')
def get_wazuh_version():
"""This return the version of Wazuh."""
return "3.10.0"
def test_ossec_package_installed(Package):
ossec = Package('wazuh-agent')
assert ossec.is_installed
@pytest.mark.parametrize("wazuh_service, wazuh_owner", (
("ossec-agentd", "ossec"),
("ossec-execd", "root"),
("ossec-syscheckd", "root"),
("wazuh-modulesd", "root"),
))
def test_wazuh_processes_running(host, wazuh_service, wazuh_owner):
master = host.process.get(user=wazuh_owner, comm=wazuh_service)
assert master.args == "/var/ossec/bin/" + wazuh_service

15
molecule/wazuh-agent/tests/test_manager.py
View File

@ -1,15 +0,0 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('manager')
def test_agents_registered_on_manager(host):
cmd = host.run("/var/ossec/bin/manage_agents -l")
assert 'wazuh_agent_bionic' in cmd.stdout
assert 'wazuh_agent_xenial' in cmd.stdout
assert 'wazuh_agent_trusty' in cmd.stdout
assert 'wazuh_agent_centos6' in cmd.stdout
assert 'wazuh_agent_centos7' in cmd.stdout

14
molecule/worker/Dockerfile.j2
View File

@ -1,14 +0,0 @@
# Molecule managed
{% if item.registry is defined %}
FROM {{ item.registry.url }}/{{ item.image }}
{% else %}
FROM {{ item.image }}
{% endif %}
RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \
elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \
elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

53
molecule/worker/molecule.yml.template
View File

@ -1,53 +0,0 @@
---
dependency:
name: galaxy
driver:
name: docker
lint:
name: yamllint
options:
config-data:
ignore: .virtualenv
platforms:
- name: worker_platform_
image: imagename
command: /sbin/init
ulimits:
- nofile:262144:262144
privileged: true
memory_reservation: 2048m
provisioner:
name: ansible
config_options:
defaults:
hash_behaviour: merge
playbooks:
docker:
create: ../default/create.yml
destroy: ../default/destroy.yml
prepare: ../default/prepare.yml
env:
ANSIBLE_ROLES_PATH: ../../roles
lint:
name: ansible-lint
enabled: true
scenario:
name: worker
test_sequence:
- lint
- dependency
- cleanup
- destroy
- syntax
- create
- prepare
- converge
- idempotence
- side_effect
- verify
- cleanup
- destroy
verifier:
name: testinfra
lint:
name: flake8

21
molecule/worker/playbook.yml
View File

@ -1,21 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-manager
vars:
wazuh_manager_config:
cluster:
disable: 'no'
name: 'wazuh'
node_name: 'worker-01'
node_type: 'worker'
key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
port: '1516'
bind_addr: '0.0.0.0'
nodes:
- 'manager_bionic'
hidden: 'no'
- { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_bionic:9200' }

21
molecule/worker/playbook.yml.template
View File

@ -1,21 +0,0 @@
---
- name: Converge
hosts: all
roles:
- role: wazuh/ansible-wazuh-manager
vars:
wazuh_manager_config:
cluster:
disable: 'no'
name: 'wazuh'
node_name: 'worker-01'
node_type: 'worker'
key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
port: '1516'
bind_addr: '0.0.0.0'
nodes:
- 'manager_platform'
hidden: 'no'
- { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch_platform:9200' }

85
molecule/worker/tests/test_default.py
View File

@ -1,85 +0,0 @@
import os
import pytest
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def get_wazuh_version():
"""This return the version of Wazuh."""
return "3.10.0"
def test_wazuh_packages_are_installed(host):
"""Test if the main packages are installed."""
manager = host.package("wazuh-manager")
api = host.package("wazuh-api")
distribution = host.system_info.distribution.lower()
if distribution == 'centos':
if host.system_info.release == "7":
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
assert api.is_installed
assert api.version.startswith(get_wazuh_version())
elif host.system_info.release.startswith("6"):
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
elif distribution == 'ubuntu':
assert manager.is_installed
assert manager.version.startswith(get_wazuh_version())
def test_wazuh_services_are_running(host):
"""Test if the services are enabled and running.
When assert commands are commented, this means that the service command has
a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
"""
manager = host.service("wazuh-manager")
api = host.service("wazuh-api")
distribution = host.system_info.distribution.lower()
if distribution == 'centos':
# assert manager.is_running
assert manager.is_enabled
# assert not api.is_running
assert not api.is_enabled
elif distribution == 'ubuntu':
# assert manager.is_running
assert manager.is_enabled
# assert api.is_running
assert api.is_enabled
@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
("/var/ossec/etc/rules/local_rules.xml", "root", "ossec", 0o640),
("/var/ossec/etc/lists/audit-keys", "root", "ossec", 0o640),
])
def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
"""Test if Wazuh related files exist and have proper owners and mode."""
wazuh_file_host = host.file(wazuh_file)
assert wazuh_file_host.user == wazuh_owner
assert wazuh_file_host.group == wazuh_group
assert wazuh_file_host.mode == wazuh_mode
def test_open_ports(host):
"""Test if the main port is open and the agent-auth is not open."""
distribution = host.system_info.distribution.lower()
if distribution == 'ubuntu':
assert host.socket("tcp://0.0.0.0:1514").is_listening
elif distribution == 'centos':
assert host.socket("tcp://127.0.0.1:1514").is_listening
def test_filebeat_is_installed(host):
"""Test if the elasticsearch package is installed."""
filebeat = host.package("filebeat")
assert filebeat.is_installed
assert filebeat.version.startswith('7.3.2')