Merge 3.9.4_7.2.0

CHANGELOG.md

@@ -1,6 +1,16 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [v3.9.4_7.2.0]
+
+### Added 
+
+- Support for registring agents behind NAT [@jheikki100](https://github.com/jheikki100) [#208](https://github.com/wazuh/wazuh-ansible/pull/208)
+
+### Changed
+
+- Default protocol to TCP [@ionphractal](https://github.com/ionphractal) [#204](https://github.com/wazuh/wazuh-ansible/pull/204).
+
 ## [v3.9.3_7.2.0]
 
 ### Added 

molecule/elasticsearch/molecule.yml

@@ -23,12 +23,12 @@ platforms:
     command: /sbin/init
     ulimits:
       - nofile:262144:262144
-#  - name: trusty
+        #- name: trusty
-#    image: ubuntu:trusty
+        #image: ubuntu:trusty
-#    privileged: true
+        #privileged: true
-#    memory_reservation: 2048m
+        #memory_reservation: 2048m
-#    ulimits:
+        #ulimits:
-#      - nofile:262144:262144
+        #- nofile:262144:262144
   - name: centos6
     image: centos:6
     privileged: true

playbooks/wazuh-agent.yml

@@ -6,7 +6,7 @@
     wazuh_managers:
       - address: <your manager IP>
         port: 1514
-        protocol: udp
+        protocol: tcp
         api_port: 55000
         api_proto: 'http'
         api_user: ansible

roles/elastic-stack/ansible-elasticsearch/defaults/main.yml

@@ -3,6 +3,7 @@ elasticsearch_cluster_name: wazuh
 elasticsearch_node_name: node-1
 elasticsearch_http_port: 9200
 elasticsearch_network_host: 127.0.0.1
+elasticsearch_host: 127.0.0.1
 elasticsearch_jvm_xms: null
 elastic_stack_version: 7.2.0
 single_node: false

roles/elastic-stack/ansible-elasticsearch/tasks/Debian.yml

@@ -26,7 +26,7 @@
 
 - name: Install Oracle Java 8
   become: true
-  apt: name=openjdk-8-jdk state=latest
+  apt: name=openjdk-8-jdk
 
   when:
     - ansible_distribution == "Ubuntu"

roles/elastic-stack/ansible-elasticsearch/tasks/main.yml

@@ -65,7 +65,7 @@
 
 - name: Check if certificate exists locally
   stat:
-    path: "{{node_certs_destination}}/{{ elasticsearch_node_name }}.crt"
+    path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
   register: certificate_file_exists
   when:
     - elasticsearch_xpack_security
@@ -73,7 +73,7 @@
 - name: Write the instances.yml file in the selected node (force = no)
   template:
     src: instances.yml.j2
-    dest: "{{node_certs_source}}/instances.yml"
+    dest: "{{ node_certs_source }}/instances.yml"
     force: no
   register: instances_file_exists
   tags:
@@ -86,23 +86,25 @@
 
 - name: Update instances.yml status after generation
   stat:
-    path: "{{node_certs_source}}/instances.yml"
+    path: "{{ node_certs_source }}/instances.yml"
   register: instances_file_exists
-  when: 
+  when:
     - node_certs_generator
     - elasticsearch_xpack_security
 
 - name: Check if the certificates ZIP file exists
   stat:
-    path: "{{node_certs_source}}/certs.zip"
+    path: "{{ node_certs_source }}/certs.zip"
   register: xpack_certs_zip
-  when: 
+  when:
     - node_certs_generator
     - elasticsearch_xpack_security
 
 - name: Generating certificates for Elasticsearch security
-  shell: "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{node_certs_source}}/instances.yml --out {{node_certs_source}}/certs.zip"
+  command: >-
-  when: 
+     "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in
+     {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip"
+  when:
     - node_certs_generator
     - elasticsearch_xpack_security
     - not xpack_certs_zip.stat.exists
@@ -110,39 +112,6 @@
   register: certs_file_generated
   tags: xpack-security
 
-# - name: Unzip generated certs.zip
-#   unarchive:
-#     src: "{{node_certs_source}}/certs.zip"
-#     dest: "{{node_certs_source}}/"
-#     remote_src: yes
-#   when: 
-#     - node_certs_generator
-#     - elasticsearch_xpack_security
-#     - certs_file_generated is defined
-#     - not certificate_file_exists.stat.exists
-#   tags: xpack-security
-
-# - name: Copy key & certificate files in generator node (locally)
-#   synchronize:
-#     src: "{{node_certs_source}}/{{elasticsearch_node_name}}/"
-#     dest: "{{node_certs_destination}}/"
-#   delegate_to: "{{ node_certs_generator_ip }}"
-#   when: 
-#     - node_certs_generator
-#     - elasticsearch_xpack_security
-#   tags: xpack-security
-
-# - name: Copy ca certificate file in generator node (locally)
-#   synchronize:
-#     src: "{{node_certs_source}}/ca/"
-#     dest: "{{node_certs_destination}}/"
-#   delegate_to: "{{ node_certs_generator_ip }}"
-#   register: check_certs_permissions
-#   when: 
-#     - node_certs_generator
-#     - elasticsearch_xpack_security
-#   tags: xpack-security
-
 - name: Create the certificates directory
   file:
     path: "{{master_certs_destination}}"
@@ -176,14 +145,22 @@
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
-  shell: "chown -R elasticsearch: {{node_certs_destination}}/"
+  file:
+    path: "{{ node_certs_destination }}/"
+    state: directory
+    recurse: yes
+    owner: elasticsearch
+    group: elasticsearch
   when:
     - check_certs_permissions is defined
     - elasticsearch_xpack_security
   tags: xpack-security
 
 - name: Ensuring certificates folder owner
-  shell: "chmod -R 770 {{node_certs_destination}}/"
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: '0770'
+    recurse: yes
   when:
     - check_certs_permissions is defined
     - elasticsearch_xpack_security
@@ -210,10 +187,12 @@
   tags: configure
 
 - name: Set elasticsearch bootstrap password
-  shell: "echo '{{elasticsearch_xpack_security_password}}' | {{node_certs_source}}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
+  shell: |
+     set -o pipefail
+     "echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
   when:
     - elasticsearch_xpack_security
-  
+
 - name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
   lineinfile:
     path: /etc/security/limits.conf
@@ -245,7 +224,7 @@
     - init
 
 - name: Make sure Elasticsearch is running before proceeding
-  wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300
+  wait_for: host={{ elasticsearch_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400
   tags:
     - configure
     - init

roles/wazuh/ansible-wazuh-agent/README.md

@@ -32,7 +32,7 @@ The following is an example of how this role can be used:
          wazuh_managers:
            - address: 127.0.0.1
              port: 1514
-             protocol: udp
+             protocol: tcp
              api_port: 55000
              api_proto: 'http'
              api_user: 'ansible'

roles/wazuh/ansible-wazuh-agent/defaults/main.yml

@@ -305,3 +305,4 @@ wazuh_agent_config:
     list:
       - key: Env
         value: Production
+wazuh_agent_nat: false

roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml

@@ -54,6 +54,7 @@
         -A {{ agent_name }}
         -m {{ wazuh_managers.0.address }}
         -p {{ wazuh_agent_authd.port }}
+        {% if wazuh_agent_nat %}-I "any" {% endif %}
         {% if authd_pass is defined %}-P {{ authd_pass }}{% endif %}
         {% if wazuh_agent_authd.ssl_agent_ca is not none %}
         -v "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}"
@@ -128,7 +129,7 @@
       environment:
         OSSEC_ACTION: i
         OSSEC_AGENT_NAME: '{{ newagentdata_api.json.data.name }}'
-        OSSEC_AGENT_IP: '{{ newagentdata_api.json.data.ip }}'
+        OSSEC_AGENT_IP: '{% if wazuh_agent_nat %}any{% else %}{{ newagentdata_api.json.data.ip }}{% endif %}'
         OSSEC_AGENT_ID: '{{ newagent_api.json.data.id }}'
         OSSEC_AGENT_KEY: '{{ newagent_api.json.data.key }}'
         OSSEC_ACTION_CONFIRMED: y

roles/wazuh/ansible-wazuh-manager/defaults/main.yml

@@ -42,7 +42,7 @@ wazuh_manager_config:
   connection:
     - type: 'secure'
       port: '1514'
-      protocol: 'udp'
+      protocol: 'tcp'
       queue_size: 131072
   authd:
     enable: true