Merge 3.9.4_7.2.0
This commit is contained in:
Jose M
commit
af6e5cb816
10
CHANGELOG.md
10
CHANGELOG.md
@ -1,6 +1,16 @@
|
||||
# Change Log
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [v3.9.4_7.2.0]
|
||||
|
||||
### Added
|
||||
|
||||
- Support for registring agents behind NAT [@jheikki100](https://github.com/jheikki100) [#208](https://github.com/wazuh/wazuh-ansible/pull/208)
|
||||
|
||||
### Changed
|
||||
|
||||
- Default protocol to TCP [@ionphractal](https://github.com/ionphractal) [#204](https://github.com/wazuh/wazuh-ansible/pull/204).
|
||||
|
||||
## [v3.9.3_7.2.0]
|
||||
|
||||
### Added
|
||||
|
||||
@ -23,12 +23,12 @@ platforms:
|
||||
command: /sbin/init
|
||||
ulimits:
|
||||
- nofile:262144:262144
|
||||
# - name: trusty
|
||||
# image: ubuntu:trusty
|
||||
# privileged: true
|
||||
# memory_reservation: 2048m
|
||||
# ulimits:
|
||||
# - nofile:262144:262144
|
||||
#- name: trusty
|
||||
#image: ubuntu:trusty
|
||||
#privileged: true
|
||||
#memory_reservation: 2048m
|
||||
#ulimits:
|
||||
#- nofile:262144:262144
|
||||
- name: centos6
|
||||
image: centos:6
|
||||
privileged: true
|
||||
|
||||
@ -6,7 +6,7 @@
|
||||
wazuh_managers:
|
||||
- address: <your manager IP>
|
||||
port: 1514
|
||||
protocol: udp
|
||||
protocol: tcp
|
||||
api_port: 55000
|
||||
api_proto: 'http'
|
||||
api_user: ansible
|
||||
|
||||
@ -3,6 +3,7 @@ elasticsearch_cluster_name: wazuh
|
||||
elasticsearch_node_name: node-1
|
||||
elasticsearch_http_port: 9200
|
||||
elasticsearch_network_host: 127.0.0.1
|
||||
elasticsearch_host: 127.0.0.1
|
||||
elasticsearch_jvm_xms: null
|
||||
elastic_stack_version: 7.2.0
|
||||
single_node: false
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
|
||||
- name: Install Oracle Java 8
|
||||
become: true
|
||||
apt: name=openjdk-8-jdk state=latest
|
||||
apt: name=openjdk-8-jdk
|
||||
|
||||
when:
|
||||
- ansible_distribution == "Ubuntu"
|
||||
|
||||
@ -65,7 +65,7 @@
|
||||
|
||||
- name: Check if certificate exists locally
|
||||
stat:
|
||||
path: "{{node_certs_destination}}/{{ elasticsearch_node_name }}.crt"
|
||||
path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
|
||||
register: certificate_file_exists
|
||||
when:
|
||||
- elasticsearch_xpack_security
|
||||
@ -73,7 +73,7 @@
|
||||
- name: Write the instances.yml file in the selected node (force = no)
|
||||
template:
|
||||
src: instances.yml.j2
|
||||
dest: "{{node_certs_source}}/instances.yml"
|
||||
dest: "{{ node_certs_source }}/instances.yml"
|
||||
force: no
|
||||
register: instances_file_exists
|
||||
tags:
|
||||
@ -86,23 +86,25 @@
|
||||
|
||||
- name: Update instances.yml status after generation
|
||||
stat:
|
||||
path: "{{node_certs_source}}/instances.yml"
|
||||
path: "{{ node_certs_source }}/instances.yml"
|
||||
register: instances_file_exists
|
||||
when:
|
||||
when:
|
||||
- node_certs_generator
|
||||
- elasticsearch_xpack_security
|
||||
|
||||
- name: Check if the certificates ZIP file exists
|
||||
stat:
|
||||
path: "{{node_certs_source}}/certs.zip"
|
||||
path: "{{ node_certs_source }}/certs.zip"
|
||||
register: xpack_certs_zip
|
||||
when:
|
||||
when:
|
||||
- node_certs_generator
|
||||
- elasticsearch_xpack_security
|
||||
|
||||
- name: Generating certificates for Elasticsearch security
|
||||
shell: "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in {{node_certs_source}}/instances.yml --out {{node_certs_source}}/certs.zip"
|
||||
when:
|
||||
command: >-
|
||||
"/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in
|
||||
{{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip"
|
||||
when:
|
||||
- node_certs_generator
|
||||
- elasticsearch_xpack_security
|
||||
- not xpack_certs_zip.stat.exists
|
||||
@ -110,39 +112,6 @@
|
||||
register: certs_file_generated
|
||||
tags: xpack-security
|
||||
|
||||
# - name: Unzip generated certs.zip
|
||||
# unarchive:
|
||||
# src: "{{node_certs_source}}/certs.zip"
|
||||
# dest: "{{node_certs_source}}/"
|
||||
# remote_src: yes
|
||||
# when:
|
||||
# - node_certs_generator
|
||||
# - elasticsearch_xpack_security
|
||||
# - certs_file_generated is defined
|
||||
# - not certificate_file_exists.stat.exists
|
||||
# tags: xpack-security
|
||||
|
||||
# - name: Copy key & certificate files in generator node (locally)
|
||||
# synchronize:
|
||||
# src: "{{node_certs_source}}/{{elasticsearch_node_name}}/"
|
||||
# dest: "{{node_certs_destination}}/"
|
||||
# delegate_to: "{{ node_certs_generator_ip }}"
|
||||
# when:
|
||||
# - node_certs_generator
|
||||
# - elasticsearch_xpack_security
|
||||
# tags: xpack-security
|
||||
|
||||
# - name: Copy ca certificate file in generator node (locally)
|
||||
# synchronize:
|
||||
# src: "{{node_certs_source}}/ca/"
|
||||
# dest: "{{node_certs_destination}}/"
|
||||
# delegate_to: "{{ node_certs_generator_ip }}"
|
||||
# register: check_certs_permissions
|
||||
# when:
|
||||
# - node_certs_generator
|
||||
# - elasticsearch_xpack_security
|
||||
# tags: xpack-security
|
||||
|
||||
- name: Create the certificates directory
|
||||
file:
|
||||
path: "{{master_certs_destination}}"
|
||||
@ -176,14 +145,22 @@
|
||||
tags: xpack-security
|
||||
|
||||
- name: Ensuring certificates folder owner
|
||||
shell: "chown -R elasticsearch: {{node_certs_destination}}/"
|
||||
file:
|
||||
path: "{{ node_certs_destination }}/"
|
||||
state: directory
|
||||
recurse: yes
|
||||
owner: elasticsearch
|
||||
group: elasticsearch
|
||||
when:
|
||||
- check_certs_permissions is defined
|
||||
- elasticsearch_xpack_security
|
||||
tags: xpack-security
|
||||
|
||||
- name: Ensuring certificates folder owner
|
||||
shell: "chmod -R 770 {{node_certs_destination}}/"
|
||||
file:
|
||||
path: "{{ node_certs_destination }}/"
|
||||
mode: '0770'
|
||||
recurse: yes
|
||||
when:
|
||||
- check_certs_permissions is defined
|
||||
- elasticsearch_xpack_security
|
||||
@ -210,10 +187,12 @@
|
||||
tags: configure
|
||||
|
||||
- name: Set elasticsearch bootstrap password
|
||||
shell: "echo '{{elasticsearch_xpack_security_password}}' | {{node_certs_source}}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
|
||||
shell: |
|
||||
set -o pipefail
|
||||
"echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
|
||||
when:
|
||||
- elasticsearch_xpack_security
|
||||
|
||||
|
||||
- name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
|
||||
lineinfile:
|
||||
path: /etc/security/limits.conf
|
||||
@ -245,7 +224,7 @@
|
||||
- init
|
||||
|
||||
- name: Make sure Elasticsearch is running before proceeding
|
||||
wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300
|
||||
wait_for: host={{ elasticsearch_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400
|
||||
tags:
|
||||
- configure
|
||||
- init
|
||||
|
||||
@ -32,7 +32,7 @@ The following is an example of how this role can be used:
|
||||
wazuh_managers:
|
||||
- address: 127.0.0.1
|
||||
port: 1514
|
||||
protocol: udp
|
||||
protocol: tcp
|
||||
api_port: 55000
|
||||
api_proto: 'http'
|
||||
api_user: 'ansible'
|
||||
|
||||
@ -305,3 +305,4 @@ wazuh_agent_config:
|
||||
list:
|
||||
- key: Env
|
||||
value: Production
|
||||
wazuh_agent_nat: false
|
||||
|
||||
@ -54,6 +54,7 @@
|
||||
-A {{ agent_name }}
|
||||
-m {{ wazuh_managers.0.address }}
|
||||
-p {{ wazuh_agent_authd.port }}
|
||||
{% if wazuh_agent_nat %}-I "any" {% endif %}
|
||||
{% if authd_pass is defined %}-P {{ authd_pass }}{% endif %}
|
||||
{% if wazuh_agent_authd.ssl_agent_ca is not none %}
|
||||
-v "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}"
|
||||
@ -128,7 +129,7 @@
|
||||
environment:
|
||||
OSSEC_ACTION: i
|
||||
OSSEC_AGENT_NAME: '{{ newagentdata_api.json.data.name }}'
|
||||
OSSEC_AGENT_IP: '{{ newagentdata_api.json.data.ip }}'
|
||||
OSSEC_AGENT_IP: '{% if wazuh_agent_nat %}any{% else %}{{ newagentdata_api.json.data.ip }}{% endif %}'
|
||||
OSSEC_AGENT_ID: '{{ newagent_api.json.data.id }}'
|
||||
OSSEC_AGENT_KEY: '{{ newagent_api.json.data.key }}'
|
||||
OSSEC_ACTION_CONFIRMED: y
|
||||
|
||||
@ -42,7 +42,7 @@ wazuh_manager_config:
|
||||
connection:
|
||||
- type: 'secure'
|
||||
port: '1514'
|
||||
protocol: 'udp'
|
||||
protocol: 'tcp'
|
||||
queue_size: 131072
|
||||
authd:
|
||||
enable: true
|
||||
|
||||
Loading…
Reference in New Issue
Block a user