From 9605280db076ac48c4cac13c731aaa2193f64121 Mon Sep 17 00:00:00 2001 From: Michael Both Date: Mon, 15 Jul 2019 14:32:19 +0200 Subject: [PATCH 1/6] Use tcp for all connections --- playbooks/wazuh-agent.yml | 2 +- roles/wazuh/ansible-wazuh-agent/README.md | 2 +- roles/wazuh/ansible-wazuh-manager/defaults/main.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/playbooks/wazuh-agent.yml b/playbooks/wazuh-agent.yml index 8c7eaa69..bd85a3a6 100644 --- a/playbooks/wazuh-agent.yml +++ b/playbooks/wazuh-agent.yml @@ -6,7 +6,7 @@ wazuh_managers: - address: port: 1514 - protocol: udp + protocol: tcp api_port: 55000 api_proto: 'http' api_user: ansible diff --git a/roles/wazuh/ansible-wazuh-agent/README.md b/roles/wazuh/ansible-wazuh-agent/README.md index 703c247b..9709d9b3 100644 --- a/roles/wazuh/ansible-wazuh-agent/README.md +++ b/roles/wazuh/ansible-wazuh-agent/README.md @@ -32,7 +32,7 @@ The following is an example of how this role can be used: wazuh_managers: - address: 127.0.0.1 port: 1514 - protocol: udp + protocol: tcp api_port: 55000 api_proto: 'http' api_user: 'ansible' diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 8cf7ef58..6550cfa8 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -40,7 +40,7 @@ wazuh_manager_config: connection: - type: 'secure' port: '1514' - protocol: 'udp' + protocol: 'tcp' queue_size: 131072 authd: enable: true From 8db9700f023fcd885a49f5b8fb2f0f70f776e000 Mon Sep 17 00:00:00 2001 From: Jani Heikkinen Date: Thu, 18 Jul 2019 09:00:39 +0000 Subject: [PATCH 2/6] added wazuh_agent_nat boolean variable for agents behind nat --- roles/wazuh/ansible-wazuh-agent/defaults/main.yml | 1 + roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml index 7d6135ad..ad2a93c9 100644 --- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml @@ -305,3 +305,4 @@ wazuh_agent_config: list: - key: Env value: Production +wazuh_agent_nat: false diff --git a/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml b/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml index faa28b57..d9415ffc 100644 --- a/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml +++ b/roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml @@ -54,6 +54,7 @@ -A {{ agent_name }} -m {{ wazuh_managers.0.address }} -p {{ wazuh_agent_authd.port }} + {% if wazuh_agent_nat %}-I "any" {% endif %} {% if authd_pass is defined %}-P {{ authd_pass }}{% endif %} {% if wazuh_agent_authd.ssl_agent_ca is not none %} -v "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}" @@ -128,7 +129,7 @@ environment: OSSEC_ACTION: i OSSEC_AGENT_NAME: '{{ newagentdata_api.json.data.name }}' - OSSEC_AGENT_IP: '{{ newagentdata_api.json.data.ip }}' + OSSEC_AGENT_IP: '{% if wazuh_agent_nat %}any{% else %}{{ newagentdata_api.json.data.ip }}{% endif %}' OSSEC_AGENT_ID: '{{ newagent_api.json.data.id }}' OSSEC_AGENT_KEY: '{{ newagent_api.json.data.key }}' OSSEC_ACTION_CONFIRMED: y From 8575aecc88428fe7b4e60f321cc4951b4ab2a0a9 Mon Sep 17 00:00:00 2001 From: rshad Date: Tue, 23 Jul 2019 19:36:09 +0000 Subject: [PATCH 3/6] fixed the problem by adding a new variable to test the connectivity to Elastic --- molecule/elasticsearch/molecule.yml | 12 ++++++------ .../ansible-elasticsearch/defaults/main.yml | 3 ++- .../ansible-elasticsearch/tasks/main.yml | 2 +- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/molecule/elasticsearch/molecule.yml b/molecule/elasticsearch/molecule.yml index 5d6d3075..1ad6ef7b 100644 --- a/molecule/elasticsearch/molecule.yml +++ b/molecule/elasticsearch/molecule.yml @@ -23,12 +23,12 @@ platforms: command: /sbin/init ulimits: - nofile:262144:262144 -# - name: trusty -# image: ubuntu:trusty -# privileged: true -# memory_reservation: 2048m -# ulimits: -# - nofile:262144:262144 + #- name: trusty + #image: ubuntu:trusty + #privileged: true + #memory_reservation: 2048m + #ulimits: + #- nofile:262144:262144 - name: centos6 image: centos:6 privileged: true diff --git a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml index 1340dabb..520e75f4 100644 --- a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml @@ -2,7 +2,8 @@ elasticsearch_cluster_name: wazuh elasticsearch_node_name: node-1 elasticsearch_http_port: 9200 -elasticsearch_network_host: 127.0.0.1 +elasticsearch_network_host: 0.0.0.0 +elasticsearch_check_connection: 127.0.0.1 elasticsearch_jvm_xms: null elastic_stack_version: 7.2.0 single_node: false diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml index 48c25b98..d4015a0b 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml @@ -242,7 +242,7 @@ state: started - name: Make sure Elasticsearch is running before proceeding - wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300 + wait_for: host={{ elasticsearch_check_connection }} port={{ elasticsearch_http_port }} delay=3 timeout=400 tags: - configure - init From fcb584ab2016a9d0e867b6748e1b13877067e3c8 Mon Sep 17 00:00:00 2001 From: rshad Date: Wed, 24 Jul 2019 10:49:17 +0000 Subject: [PATCH 4/6] fixed linting errors by refactoring ansible tests and change a variable name --- .../ansible-elasticsearch/defaults/main.yml | 2 +- .../ansible-elasticsearch/tasks/Debian.yml | 2 +- .../ansible-elasticsearch/tasks/main.yml | 77 +++++++++++-------- 3 files changed, 49 insertions(+), 32 deletions(-) diff --git a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml index 520e75f4..dfe4d3ae 100644 --- a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml @@ -3,7 +3,7 @@ elasticsearch_cluster_name: wazuh elasticsearch_node_name: node-1 elasticsearch_http_port: 9200 elasticsearch_network_host: 0.0.0.0 -elasticsearch_check_connection: 127.0.0.1 +elasticsearch_host: 127.0.0.1 elasticsearch_jvm_xms: null elastic_stack_version: 7.2.0 single_node: false diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml index 2c7dba73..b35f11e1 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml @@ -26,7 +26,7 @@ - name: Install Oracle Java 8 become: true - apt: name=openjdk-8-jdk state=latest + apt: name=openjdk-8-jdk when: - ansible_distribution == "Ubuntu" diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml index d4015a0b..99782056 100644 --- a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml @@ -65,7 +65,7 @@ - name: Check if certificate exists locally stat: - path: "{{node_certs_destination}}/{{ elasticsearch_node_name }}.crt" + path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt" register: certificate_file_exists when: - elasticsearch_xpack_security @@ -73,7 +73,7 @@ - name: Write the instances.yml file in the selected node (force = no) template: src: instances.yml.j2 - dest: "{{node_certs_source}}/instances.yml" + dest: "{{ node_certs_source }}/instances.yml" force: no register: instances_file_exists tags: @@ -86,23 +86,25 @@ - name: Update instances.yml status after generation stat: - path: "{{node_certs_source}}/instances.yml" + path: "{{ node_certs_source }}/instances.yml" register: instances_file_exists - when: + when: - node_certs_generator - elasticsearch_xpack_security - name: Check if the certificates ZIP file exists stat: - path: "{{node_certs_source}}/certs.zip" + path: "{{ node_certs_source }}/certs.zip" register: xpack_certs_zip - when: + when: - node_certs_generator - elasticsearch_xpack_security - name: Generating certificates for Elasticsearch security - shell: "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{node_certs_source}}/instances.yml --out {{node_certs_source}}/certs.zip" - when: + command: >- + "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in + {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip" + when: - node_certs_generator - elasticsearch_xpack_security - not xpack_certs_zip.stat.exists @@ -112,10 +114,10 @@ - name: Unzip generated certs.zip unarchive: - src: "{{node_certs_source}}/certs.zip" - dest: "{{node_certs_source}}/" + src: "{{ node_certs_source }}/certs.zip" + dest: "{{ node_certs_source }}/" remote_src: yes - when: + when: - node_certs_generator - elasticsearch_xpack_security - certs_file_generated is defined @@ -124,35 +126,39 @@ - name: Copy key & certificate files in generator node (locally) synchronize: - src: "{{node_certs_source}}/{{elasticsearch_node_name}}/" - dest: "{{node_certs_destination}}/" + src: "{{ node_certs_source }}/{{ elasticsearch_node_name }}/" + dest: "{{ node_certs_destination }}/" delegate_to: "{{ node_certs_generator_ip }}" - when: + when: - node_certs_generator - elasticsearch_xpack_security tags: xpack-security - name: Copy ca certificate file in generator node (locally) synchronize: - src: "{{node_certs_source}}/ca/" - dest: "{{node_certs_destination}}/" + src: "{{ node_certs_source }}/ca/" + dest: "{{ node_certs_destination }}/" delegate_to: "{{ node_certs_generator_ip }}" register: check_certs_permissions - when: + when: - node_certs_generator - elasticsearch_xpack_security tags: xpack-security - name: Importing key & certificate files from generator node - shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/{{elasticsearch_node_name}}/ {{node_certs_destination}}/" + command: >- + {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}: + {{ node_certs_source }}/{{ elasticsearch_node_name }}/ {{ node_certs_destination }}/ when: - not node_certs_generator - elasticsearch_xpack_security - not certificate_file_exists.stat.exists tags: xpack-security -- name: Importing ca certificate file from generator node - shell: "{{rsync_path}} {{rsync_extra_parameters}} {{rsync_user}}@{{node_certs_generator_ip}}:{{node_certs_source}}/ca/ {{node_certs_destination}}/" +- name: Importing ca certificate file from generator node + command: >- + {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}: + {{ node_certs_source }}/ca/ {{ node_certs_destination }}/ when: - not node_certs_generator - elasticsearch_xpack_security @@ -161,23 +167,32 @@ tags: xpack-security - name: Ensuring certificates folder owner - shell: "chown -R elasticsearch: {{node_certs_destination}}/" + file: + path: "{{ node_certs_destination }}/" + state: directory + recurse: yes + owner: elasticsearch + group: elasticsearch when: - check_certs_permissions is defined - elasticsearch_xpack_security tags: xpack-security - name: Ensuring certificates folder owner - shell: "chmod -R 770 {{node_certs_destination}}/" + file: + path: "{{ node_certs_destination }}/" + mode: '0770' + recurse: yes when: - check_certs_permissions is defined - elasticsearch_xpack_security tags: xpack-security - - name: Remove generated certs file - shell: /bin/rm -f {{node_certs_source}}/certs.zip* - when: + file: + state: absent + path: "{{ node_certs_source }}/certs.zip*" + when: - node_certs_generator - elasticsearch_xpack_security tags: xpack-security @@ -193,10 +208,12 @@ tags: configure - name: Set elasticsearch bootstrap password - shell: "echo '{{elasticsearch_xpack_security_password}}' | {{node_certs_source}}/bin/elasticsearch-keystore add -xf 'bootstrap.password'" + shell: | + set -o pipefail + "echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'" when: - elasticsearch_xpack_security - + - name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf lineinfile: path: /etc/security/limits.conf @@ -242,7 +259,7 @@ state: started - name: Make sure Elasticsearch is running before proceeding - wait_for: host={{ elasticsearch_check_connection }} port={{ elasticsearch_http_port }} delay=3 timeout=400 + wait_for: host={{ elasticsearch_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400 tags: - configure - init @@ -252,7 +269,7 @@ url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh" method: GET status_code: 200, 404 - when: + when: - elasticsearch_bootstrap_node or single_node - not elasticsearch_xpack_security poll: 30 @@ -267,7 +284,7 @@ status_code: 200 body_format: json body: "{{ lookup('template','wazuh-elastic7-template-alerts.json.j2') }}" - when: + when: - wazuh_alerts_template_exits.status is defined - wazuh_alerts_template_exits.status != 200 - not elasticsearch_xpack_security From 31cad22de494d6d2869d10808a2da91d654b75e8 Mon Sep 17 00:00:00 2001 From: manuasir Date: Wed, 24 Jul 2019 14:17:46 +0200 Subject: [PATCH 5/6] Updated CHANGELOG --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b4961a77..3221e38f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,16 @@ # Change Log All notable changes to this project will be documented in this file. +## [v3.9.4_7.2.0] + +### Added + +- Support for registring agents behind NAT [@jheikki100](https://github.com/jheikki100) [#208](https://github.com/wazuh/wazuh-ansible/pull/208) + +### Changed + +- Default protocol to TCP [@ionphractal](https://github.com/ionphractal) [#204](https://github.com/wazuh/wazuh-ansible/pull/204). + ## [v3.9.3_7.2.0] ### Added From 125b2114e6c77f089aac16bf4668cde2290efcbc Mon Sep 17 00:00:00 2001 From: rshad Date: Wed, 24 Jul 2019 12:41:52 +0000 Subject: [PATCH 6/6] changed elasticssearch: network.host from 0.0.0.0 to 127.0.0.1 --- roles/elastic-stack/ansible-elasticsearch/defaults/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml index dfe4d3ae..a07f02e2 100644 --- a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml +++ b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml @@ -2,7 +2,7 @@ elasticsearch_cluster_name: wazuh elasticsearch_node_name: node-1 elasticsearch_http_port: 9200 -elasticsearch_network_host: 0.0.0.0 +elasticsearch_network_host: 127.0.0.1 elasticsearch_host: 127.0.0.1 elasticsearch_jvm_xms: null elastic_stack_version: 7.2.0