From d7b91ad7aa01e0fbf6207d6fcedee99fd6338e6f Mon Sep 17 00:00:00 2001 From: Miguelangel Freitas Date: Thu, 18 May 2017 06:23:49 -0400 Subject: [PATCH] Updating wazuh-agent & wazuh-manager tasks --- ansible-role-elasticsearch/tasks/Debian.yml | 2 + ansible-role-elasticsearch/tasks/RedHat.yml | 2 + ansible-role-elasticsearch/tasks/main.yml | 5 +- ansible-role-filebeat/tasks/config.yml | 5 +- ansible-role-filebeat/tasks/main.yml | 2 + ansible-role-kibana/tasks/Debian.yml | 1 + ansible-role-kibana/tasks/RedHat.yml | 1 + ansible-role-kibana/tasks/main.yml | 5 + ansible-role-logstash/tasks/Debian.yml | 2 + ansible-role-logstash/tasks/RedHat.yml | 4 +- ansible-role-logstash/tasks/main.yml | 2 + ansible-wazuh-agent/defaults/main.yml | 41 ++++++ ansible-wazuh-agent/tasks/Debian.yml | 8 +- ansible-wazuh-agent/vars/main.yml | 43 ------ ansible-wazuh-server/defaults/main.yml | 116 +++++++++++++++- ansible-wazuh-server/tasks/Debian.yml | 19 +-- ansible-wazuh-server/tasks/RMDebian.yml | 10 +- ansible-wazuh-server/tasks/RedHat.yml | 1 + ansible-wazuh-server/tasks/main.yml | 24 ++-- ansible-wazuh-server/templates/agentless.j2 | 2 +- ansible-wazuh-server/templates/api_user.j2 | 2 +- .../var-ossec-etc-ossec-server.conf.j2 | 12 +- .../var-ossec-rules-local_rules.xml.j2 | 69 ++-------- ansible-wazuh-server/vars/agentless.yml | 11 -- .../vars/agentless_creeds.yml | 8 ++ ansible-wazuh-server/vars/api_user.yml | 11 -- ansible-wazuh-server/vars/main.yml | 125 ------------------ ansible-wazuh-server/vars/wazuh_api_creds.yml | 3 + 28 files changed, 228 insertions(+), 308 deletions(-) delete mode 100644 ansible-wazuh-agent/vars/main.yml delete mode 100644 ansible-wazuh-server/vars/agentless.yml create mode 100644 ansible-wazuh-server/vars/agentless_creeds.yml delete mode 100644 ansible-wazuh-server/vars/api_user.yml delete mode 100644 ansible-wazuh-server/vars/main.yml create mode 100644 ansible-wazuh-server/vars/wazuh_api_creds.yml diff --git a/ansible-role-elasticsearch/tasks/Debian.yml b/ansible-role-elasticsearch/tasks/Debian.yml index 654afc6b..95978154 100644 --- a/ansible-role-elasticsearch/tasks/Debian.yml +++ b/ansible-role-elasticsearch/tasks/Debian.yml @@ -27,6 +27,7 @@ apt: name: oracle-java8-installer state: present + tags: install - name: Debian/Ubuntu | Add Elasticsearch GPG key. apt_key: @@ -44,3 +45,4 @@ apt: name: elasticsearch={{ elk_stack_version }} state: present + tags: install diff --git a/ansible-role-elasticsearch/tasks/RedHat.yml b/ansible-role-elasticsearch/tasks/RedHat.yml index 18a0469d..f141d230 100644 --- a/ansible-role-elasticsearch/tasks/RedHat.yml +++ b/ansible-role-elasticsearch/tasks/RedHat.yml @@ -11,6 +11,7 @@ action: "yum name=/tmp/jdk-8-linux-x64.rpm state=present" when: not oracle_java_task_rpm_download|skipped become: yes + tags: install - name: RedHat | Add Elasticsearch GPG key rpm_key: @@ -27,3 +28,4 @@ - name: RedHat | Install Elasticsarch yum: pkg=elasticsearch-{{ elk_stack_version }} state=present + tags: install diff --git a/ansible-role-elasticsearch/tasks/main.yml b/ansible-role-elasticsearch/tasks/main.yml index cfb5d253..b6559767 100644 --- a/ansible-role-elasticsearch/tasks/main.yml +++ b/ansible-role-elasticsearch/tasks/main.yml @@ -13,6 +13,7 @@ group: elasticsearch mode: 0660 notify: restart elasticsearch + tags: configure - name: Configure Elasticsearch JVM memmory. template: @@ -22,9 +23,7 @@ group: elasticsearch mode: 0660 notify: restart elasticsearch - -- name: Start Elasticsearch. - service: name=elasticsearch state=started enabled=yes + tags: configure - name: Ensure Elasticsearch started and enabled service: diff --git a/ansible-role-filebeat/tasks/config.yml b/ansible-role-filebeat/tasks/config.yml index 71a1672f..a21e32ac 100644 --- a/ansible-role-filebeat/tasks/config.yml +++ b/ansible-role-filebeat/tasks/config.yml @@ -7,12 +7,14 @@ group: root mode: 0644 notify: restart filebeat + tags: configure - name: Ensure Filebeat SSL key pair directory exists. file: path: "{{ filebeat_ssl_dir }}" state: directory when: filebeat_ssl_key_file + tags: configure - name: Copy SSL key and cert for filebeat. copy: @@ -23,4 +25,5 @@ - "{{ filebeat_ssl_key_file }}" - "{{ filebeat_ssl_certificate_file }}" notify: restart filebeat - when: filebeat_ssl_key_file and filebeat_ssl_certificate_file \ No newline at end of file + when: filebeat_ssl_key_file and filebeat_ssl_certificate_file + tags: configure diff --git a/ansible-role-filebeat/tasks/main.yml b/ansible-role-filebeat/tasks/main.yml index 9ace5a29..3455f45c 100644 --- a/ansible-role-filebeat/tasks/main.yml +++ b/ansible-role-filebeat/tasks/main.yml @@ -7,6 +7,8 @@ - name: Install Filebeat. package: name=filebeat state=present + tags: + - install - include: config.yml when: filebeat_create_config diff --git a/ansible-role-kibana/tasks/Debian.yml b/ansible-role-kibana/tasks/Debian.yml index 7abe7f94..b1bf164b 100644 --- a/ansible-role-kibana/tasks/Debian.yml +++ b/ansible-role-kibana/tasks/Debian.yml @@ -15,3 +15,4 @@ apt: name: kibana={{ elk_stack_version }} state: present + tags: install diff --git a/ansible-role-kibana/tasks/RedHat.yml b/ansible-role-kibana/tasks/RedHat.yml index f83f7ef1..c81c202c 100644 --- a/ansible-role-kibana/tasks/RedHat.yml +++ b/ansible-role-kibana/tasks/RedHat.yml @@ -14,3 +14,4 @@ - name: RedHat | Install Kibana yum: pkg=kibana-{{ elk_stack_version }} state=present + tags: install diff --git a/ansible-role-kibana/tasks/main.yml b/ansible-role-kibana/tasks/main.yml index f2af793c..5483c46a 100644 --- a/ansible-role-kibana/tasks/main.yml +++ b/ansible-role-kibana/tasks/main.yml @@ -7,6 +7,7 @@ - name: Make sure Elasticsearch is running before proceeding. wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=300 + tags: configure - name: Kibana configuration template: @@ -16,6 +17,7 @@ group: root mode: 0664 notify: restart kibana + tags: configure - name: Checking Wazuh-APP version compatibility shell: grep -E 'version.*{{ elk_stack_version }}' /usr/share/kibana/plugins/wazuh/package.json @@ -23,15 +25,18 @@ register: wazuh_app_notok ignore_errors: yes changed_when: "wazuh_app_notok.rc != 0" + tags: install - name: Removing Wazuh-APP by compatibility issues shell: /usr/share/kibana/bin/kibana-plugin remove wazuh when: wazuh_app_notok.rc != 0 + tags: install - name: Install Wazuh-APP (can take a while) shell: /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-2.0_{{ elk_stack_version }}.zip creates=/usr/share/kibana/plugins/wazuh/package.json notify: restart kibana + tags: install - name: Ensure Kibana started and enabled service: diff --git a/ansible-role-logstash/tasks/Debian.yml b/ansible-role-logstash/tasks/Debian.yml index 7cdfafb2..4c6ebd13 100644 --- a/ansible-role-logstash/tasks/Debian.yml +++ b/ansible-role-logstash/tasks/Debian.yml @@ -28,6 +28,7 @@ name: oracle-java8-installer update_cache: yes state: present + tags: install - name: Debian/Ubuntu | Add Elasticsearch GPG key apt_key: @@ -45,3 +46,4 @@ apt: name: logstash=1:{{ elk_stack_version }}-1 state: present + tags: install diff --git a/ansible-role-logstash/tasks/RedHat.yml b/ansible-role-logstash/tasks/RedHat.yml index 65eb6449..a40ad41f 100644 --- a/ansible-role-logstash/tasks/RedHat.yml +++ b/ansible-role-logstash/tasks/RedHat.yml @@ -26,5 +26,5 @@ gpgcheck: yes - name: RedHat | Install Logstash - yum: pkg=logstash-{{ elk_stack_version }} - state=present + yum: pkg=logstash-{{ elk_stack_version }} state=present + tags: install diff --git a/ansible-role-logstash/tasks/main.yml b/ansible-role-logstash/tasks/main.yml index ca4ffcec..f146ecbc 100644 --- a/ansible-role-logstash/tasks/main.yml +++ b/ansible-role-logstash/tasks/main.yml @@ -12,6 +12,7 @@ owner: root group: root notify: restart logstash + tags: configure - name: Logstash template template: @@ -20,6 +21,7 @@ owner: root group: root notify: restart logstash + tags: configure - name: Ensure Logstash started and enabled service: diff --git a/ansible-wazuh-agent/defaults/main.yml b/ansible-wazuh-agent/defaults/main.yml index 421cb9d5..2fec51df 100644 --- a/ansible-wazuh-agent/defaults/main.yml +++ b/ansible-wazuh-agent/defaults/main.yml @@ -2,3 +2,44 @@ ossec_server_ip: 127.0.0.1 ossec_server_name: "" ossec_managed_server: true +ossec_agent_config: + frequency_check: 43200 + syscheck_scan_on_start: 'yes' + ignore_files: + - /etc/mtab + - /etc/mnttab + - /etc/hosts.deny + - /etc/mail/statistics + - /etc/random-seed + - /etc/random.seed + - /etc/adjtime + - /etc/httpd/logs + - /etc/utmpx + - /etc/wtmpx + - /etc/cups/certs + - /etc/dumpdates + - /etc/svc/volatile + no_diff: + - /etc/ssl/private.key + directories: + - check_all: 'yes' + dirs: /etc,/usr/bin,/usr/sbin + - check_all: 'yes' + dirs: /bin,/sbin + localfiles: + - format: 'syslog' + location: '/var/log/messages' + - format: 'syslog' + location: '/var/log/secure' + - format: 'command' + command: 'df -P' + frequency: '360' + - format: 'full_command' + command: 'netstat -tln | grep -v 127.0.0.1 | sort' + frequency: '360' + - format: 'full_command' + command: 'last -n 20' + frequency: '360' + globals: + - '127.0.0.1' + - '192.168.2.1' diff --git a/ansible-wazuh-agent/tasks/Debian.yml b/ansible-wazuh-agent/tasks/Debian.yml index 3c89a952..a9a7c4e8 100644 --- a/ansible-wazuh-agent/tasks/Debian.yml +++ b/ansible-wazuh-agent/tasks/Debian.yml @@ -15,12 +15,8 @@ apt_repository: repo: deb https://packages.wazuh.com/apt {{ ansible_distribution_release }} main state: present - register: wazuh_repo - -- name: Update apt cache if repo was added. - apt: update_cache=yes - when: wazuh_repo.changed - + update_cache: yes + - name: Set Distribution CIS filename for debian set_fact: cis_distribution_filename: cis_debian_linux_rcl.txt diff --git a/ansible-wazuh-agent/vars/main.yml b/ansible-wazuh-agent/vars/main.yml deleted file mode 100644 index 9ceab9e8..00000000 --- a/ansible-wazuh-agent/vars/main.yml +++ /dev/null @@ -1,43 +0,0 @@ ---- -# vars file for ossec-agent -ossec_agent_config: - frequency_check: 43200 - syscheck_scan_on_start: 'yes' - ignore_files: - - /etc/mtab - - /etc/mnttab - - /etc/hosts.deny - - /etc/mail/statistics - - /etc/random-seed - - /etc/random.seed - - /etc/adjtime - - /etc/httpd/logs - - /etc/utmpx - - /etc/wtmpx - - /etc/cups/certs - - /etc/dumpdates - - /etc/svc/volatile - no_diff: - - /etc/ssl/private.key - directories: - - check_all: 'yes' - dirs: /etc,/usr/bin,/usr/sbin - - check_all: 'yes' - dirs: /bin,/sbin - localfiles: - - format: 'syslog' - location: '/var/log/messages' - - format: 'syslog' - location: '/var/log/secure' - - format: 'command' - command: 'df -P' - frequency: '360' - - format: 'full_command' - command: 'netstat -tln | grep -v 127.0.0.1 | sort' - frequency: '360' - - format: 'full_command' - command: 'last -n 20' - frequency: '360' - globals: - - '127.0.0.1' - - '192.168.2.1' diff --git a/ansible-wazuh-server/defaults/main.yml b/ansible-wazuh-server/defaults/main.yml index 427b14ad..7941b5f4 100644 --- a/ansible-wazuh-server/defaults/main.yml +++ b/ansible-wazuh-server/defaults/main.yml @@ -1,6 +1,114 @@ --- -# defaults file for ossec-server -# -ossec_server_config: [] -ossec_agent_configs: [] ossec_server_fqdn: "ossec-server" + +ossec_server_config: + email_notification: no + mail_to: + - admin@example.net + mail_smtp_server: localhost + mail_from: ossec@example.com + frequency_check: 43200 + syscheck_scan_on_start: 'yes' + log_level: 1 + email_level: 12 + ignore_files: + - /etc/mtab + - /etc/mnttab + - /etc/hosts.deny + - /etc/mail/statistics + - /etc/random-seed + - /etc/random.seed + - /etc/adjtime + - /etc/httpd/logs + - /etc/utmpx + - /etc/wtmpx + - /etc/cups/certs + - /etc/dumpdates + - /etc/svc/volatile + no_diff: + - /etc/ssl/private.key + directories: + - check_all: 'yes' + dirs: /etc,/usr/bin,/usr/sbin + - check_all: 'yes' + dirs: /bin,/sbin + localfiles: + - format: 'syslog' + location: '/var/log/messages' + - format: 'syslog' + location: '/var/log/secure' + - format: 'command' + command: 'df -P' + frequency: '360' + - format: 'full_command' + command: 'netstat -tln | grep -v 127.0.0.1 | sort' + frequency: '360' + - format: 'full_command' + command: 'last -n 20' + frequency: '360' + globals: + - '127.0.0.1' + - '192.168.2.1' + connection: + - type: 'secure' + port: '1514' + protocol: 'tcp' + commands: + - name: 'disable-account' + executable: 'disable-account.sh' + expect: 'user' + timeout_allowed: 'yes' + - name: 'restart-ossec' + executable: 'restart-ossec.sh' + expect: '' + timeout_allowed: 'no' + - name: 'firewall-drop' + executable: 'firewall-drop.sh' + expect: 'srcip' + timeout_allowed: 'yes' + - name: 'host-deny' + executable: 'host-deny.sh' + expect: 'srcip' + timeout_allowed: 'yes' + - name: 'route-null' + executable: 'route-null.sh' + expect: 'srcip' + timeout_allowed: 'yes' + - name: 'win_route-null' + executable: 'route-null.cmd' + expect: 'srcip' + timeout_allowed: 'yes' + active_responses: + - command: 'host-deny' + location: 'local' + level: 6 + timeout: 600 + +ossec_agent_configs: + - type: os + type_value: linux + frequency_check: 79200 + ignore_files: + - /etc/mtab + - /etc/mnttab + - /etc/hosts.deny + - /etc/mail/statistics + - /etc/svc/volatile + directories: + - check_all: yes + dirs: /etc,/usr/bin,/usr/sbin + - check_all: yes + dirs: /bin,/sbin + localfiles: + - format: 'syslog' + location: '/var/log/messages' + - format: 'syslog' + location: '/var/log/secure' + - format: 'syslog' + location: '/var/log/maillog' + - format: 'apache' + location: '/var/log/httpd/error_log' + - format: 'apache' + location: '/var/log/httpd/access_log' + - format: 'apache' + location: '/var/ossec/logs/active-responses.log' diff --git a/ansible-wazuh-server/tasks/Debian.yml b/ansible-wazuh-server/tasks/Debian.yml index d32fb813..a3863689 100644 --- a/ansible-wazuh-server/tasks/Debian.yml +++ b/ansible-wazuh-server/tasks/Debian.yml @@ -3,34 +3,24 @@ apt: pkg=apt-transport-https state=present update_cache=yes - cache_valid_time=3600 - name: Debian/Ubuntu | Installing Wazuh repository key apt_key: url=https://packages.wazuh.com/key/GPG-KEY-WAZUH -- name: Add Wazuh epositories. +- name: Add Wazuh repositories. apt_repository: repo: deb https://packages.wazuh.com/apt {{ ansible_distribution_release }} main state: present - register: wazuh_repo + update_cache: yes - name: Debian/Ubuntu | Installing NodeJS repository key apt_key: url=https://deb.nodesource.com/gpgkey/nodesource.gpg.key - name: Add NodeSource repositories for Node.js. apt_repository: - repo: "{{ item }}" + repo: deb https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main state: present - with_items: - - deb https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main - - deb-src https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main - register: node_repo - -- name: Update apt cache if repo was added. - apt: update_cache=yes - when: - - node_repo.changed - - wazuh_repo.changed + update_cache: yes - name: Debian/Ubuntu | Install wazuh-manager apt: pkg={{ item }} @@ -40,6 +30,7 @@ with_items: - wazuh-manager - wazuh-api + - expect tags: - init diff --git a/ansible-wazuh-server/tasks/RMDebian.yml b/ansible-wazuh-server/tasks/RMDebian.yml index ab243091..3f842e23 100644 --- a/ansible-wazuh-server/tasks/RMDebian.yml +++ b/ansible-wazuh-server/tasks/RMDebian.yml @@ -7,13 +7,5 @@ - name: Remove Nodejs repository. apt_repository: - repo: deb-src https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main - - deb https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main - - deb-src https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main - - deb https://packages.wazuh.com/apt {{ ansible_distribution_release }} main - state: absent - -- name: Remove Nodejs repository. - apt_repository: - repo: deb https://packages.wazuh.com/apt {{ ansible_distribution_release }} main + repo: deb https://deb.nodesource.com/node_6.x {{ ansible_distribution_release }} main state: absent diff --git a/ansible-wazuh-server/tasks/RedHat.yml b/ansible-wazuh-server/tasks/RedHat.yml index b777efe0..3d71647d 100644 --- a/ansible-wazuh-server/tasks/RedHat.yml +++ b/ansible-wazuh-server/tasks/RedHat.yml @@ -33,6 +33,7 @@ with_items: - wazuh-manager - wazuh-api + - expect tags: - init diff --git a/ansible-wazuh-server/tasks/main.yml b/ansible-wazuh-server/tasks/main.yml index 399bd479..8c57e048 100644 --- a/ansible-wazuh-server/tasks/main.yml +++ b/ansible-wazuh-server/tasks/main.yml @@ -8,7 +8,6 @@ include: "Debian.yml" when: ansible_os_family == "Debian" - - name: Generate SSL files command: "openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:1825 -keyout sslmanager.key -out sslmanager.cert -subj /CN={{ossec_server_fqdn}}/" args: @@ -70,7 +69,7 @@ register: agentless_running changed_when: False -- name: Enable client-syslog if not running and ossec_server_config.syslog_outputs is given +- name: Enable ossec-agentlessd command: /var/ossec/bin/ossec-control enable agentless when: agentless_running.stdout == '0' and ossec_server_config.agentless is defined @@ -78,6 +77,12 @@ command: /var/ossec/bin/ossec-control start agentless when: agentless_running.stdout == '0' and ossec_server_config.agentless is defined +- name: Retrieving Agentless Credentials + include_vars: agentless_creeds.yml + +- name: Retrieving Wazuh-api User Credentials + include_vars: wazuh_api_creds.yml + - name: Configure ossec.conf template: src=var-ossec-etc-ossec-server.conf.j2 dest=/var/ossec/etc/ossec.conf @@ -109,10 +114,6 @@ - init - config -- name: Import api_user secret variable file - include_vars: "api_user.yml" - no_log: true - - name: Wazuh-api User template: src: api_user.j2 @@ -122,12 +123,9 @@ mode: 0750 no_log: true notify: restart wazuh-api + when: wazuh_api_user is defined -- name: Import agentless secret variable file - include_vars: "agentless.yml" - no_log: true - -- name: Agentless Credentials +- name: Agentless Hosts & Passwd template: src: agentless.j2 dest: "/var/ossec/agentless/.passlist_tmp" @@ -135,11 +133,11 @@ group: root mode: 0644 no_log: true - when: agentless_passlist is defined + when: agentless_creeds is defined - name: Encode the secret shell: /usr/bin/base64 /var/ossec/agentless/.passlist_tmp > /var/ossec/agentless/.passlist && rm /var/ossec/agentless/.passlist_tmp - when: agentless_passlist is defined + when: agentless_creeds is defined - name: Ensure Wazuh Manager, wazuh api and ossec-authd service is started and enabled service: diff --git a/ansible-wazuh-server/templates/agentless.j2 b/ansible-wazuh-server/templates/agentless.j2 index 64081b96..2fa90bd7 100644 --- a/ansible-wazuh-server/templates/agentless.j2 +++ b/ansible-wazuh-server/templates/agentless.j2 @@ -1,3 +1,3 @@ -{% for agentless in agentless_passlist %} +{% for agentless in agentless_creeds %} {{ agentless.host }}|{{ agentless.passwd }} {% endfor %} diff --git a/ansible-wazuh-server/templates/api_user.j2 b/ansible-wazuh-server/templates/api_user.j2 index 5a7dffcb..91413e46 100644 --- a/ansible-wazuh-server/templates/api_user.j2 +++ b/ansible-wazuh-server/templates/api_user.j2 @@ -1,3 +1,3 @@ -{% for user in api_user %} +{% for user in wazuh_api_user %} {{ user }} {% endfor %} diff --git a/ansible-wazuh-server/templates/var-ossec-etc-ossec-server.conf.j2 b/ansible-wazuh-server/templates/var-ossec-etc-ossec-server.conf.j2 index dd45dd32..ffea23d2 100644 --- a/ansible-wazuh-server/templates/var-ossec-etc-ossec-server.conf.j2 +++ b/ansible-wazuh-server/templates/var-ossec-etc-ossec-server.conf.j2 @@ -8,11 +8,11 @@ yes yes - {% if ossec_server_config.email_notification is not defined or ossec_server_config.email_notification | lower == "yes" %} + {% if ossec_server_config.email_notification | lower == "yes" %} yes -{% for to in ossec_server_config.mail_to %} + {% for to in ossec_server_config.mail_to %} {{ to }} -{% endfor %} + {% endfor %} {{ ossec_server_config.mail_smtp_server }} {{ ossec_server_config.mail_from }} {% else %} @@ -147,8 +147,8 @@ {% endif %} -{% if ossec_server_config.agentless is defined %} -{% for agentless in ossec_server_config.agentless %} +{% if agentless_creeds is defined %} +{% for agentless in agentless_creeds %} {{ agentless.type }} {{ agentless.frequency }} @@ -158,7 +158,7 @@ {{ agentless.arguments }} {% endif %} - + {% endfor %} {% endif %} diff --git a/ansible-wazuh-server/templates/var-ossec-rules-local_rules.xml.j2 b/ansible-wazuh-server/templates/var-ossec-rules-local_rules.xml.j2 index d76ccfb8..76001f2e 100644 --- a/ansible-wazuh-server/templates/var-ossec-rules-local_rules.xml.j2 +++ b/ansible-wazuh-server/templates/var-ossec-rules-local_rules.xml.j2 @@ -1,65 +1,18 @@ - - + - + + - - - 5702 - sshd: Possible breakin attempt - (high number of reverse lookup errors). - pci_dss_11.4, - - - - - 5711 + + + 5716 1.1.1.1 - Example of rule that will ignore sshd - failed logins from IP 1.1.1.1. + sshd: authentication failed from IP 1.1.1.1. + authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5, - - - - - - - - - - - - + diff --git a/ansible-wazuh-server/vars/agentless.yml b/ansible-wazuh-server/vars/agentless.yml deleted file mode 100644 index 48547f0e..00000000 --- a/ansible-wazuh-server/vars/agentless.yml +++ /dev/null @@ -1,11 +0,0 @@ -$ANSIBLE_VAULT;1.1;AES256 -65316634333362393962623133616234373639323463366332336331373337313066393962333231 -3931646633633136653736666533346562353435336333360a306161343039363533623766393264 -30323539616462636238393861386463366434636333323361623035393038663263633964353335 -3432363337386631630a313835643062363666356464663130353533386234383430356633303037 -61653338636435626464353031333865646165663635303030396131366565303439353039303831 -37636462383933306138663130353966666162356435323862376635333635303931333765663335 -38336634396236336239636330626638303865373565653262616563613336353838303931316464 -37666634633131343537396565376265633064353835656639303962643735376564623935356466 -66623837356137326635613132383834663436366635396234333965393338383565393938393331 -3062373862333862323138373637653531373262346139323732 diff --git a/ansible-wazuh-server/vars/agentless_creeds.yml b/ansible-wazuh-server/vars/agentless_creeds.yml new file mode 100644 index 00000000..309b5c0c --- /dev/null +++ b/ansible-wazuh-server/vars/agentless_creeds.yml @@ -0,0 +1,8 @@ +# Be sure you encrypt this file with ansible-vault. +# agentless_creeds: +# - type: ssh_integrity_check_linux +# frequency: 3600 +# host: root@example.net +# state: periodic +# arguments: '/bin /etc/ /sbin' +# passwd: qwerty diff --git a/ansible-wazuh-server/vars/api_user.yml b/ansible-wazuh-server/vars/api_user.yml deleted file mode 100644 index 69a973c8..00000000 --- a/ansible-wazuh-server/vars/api_user.yml +++ /dev/null @@ -1,11 +0,0 @@ -$ANSIBLE_VAULT;1.1;AES256 -30626565633363656662393332653964653565376238633538323230333934613934323231343262 -6130313831653766333463653765643336313864373934620a646139336334346165346163633262 -36333031313434623439663839323036323533623235653536376534636137636334396233636236 -6238653531316136620a633361333130313335393333313861316233623037306131653733623661 -37363163346361366631623530323166373861623366633633396164326331376664666665646236 -64333738326538303063653266623930613130383637663864336664646361663935343231383965 -34303734333031373161376435373538613262373037386430333933383639323965356336383563 -34666431343136376132633632393938653965613236396333626430643538353533313131353338 -37373138396435623230306262303934396164303238346563363230663032316334613262336235 -3235313265333561366130393966643632333735623761643261 diff --git a/ansible-wazuh-server/vars/main.yml b/ansible-wazuh-server/vars/main.yml deleted file mode 100644 index ab842e29..00000000 --- a/ansible-wazuh-server/vars/main.yml +++ /dev/null @@ -1,125 +0,0 @@ -ossec_server_config: - mail_to: - - victor@wazuh.com - mail_smtp_server: localhost - mail_from: ossec@example.com - frequency_check: 43200 - syscheck_scan_on_start: 'yes' - ignore_files: - - /etc/mtab - - /etc/mnttab - - /etc/hosts.deny - - /etc/mail/statistics - - /etc/random-seed - - /etc/random.seed - - /etc/adjtime - - /etc/httpd/logs - - /etc/utmpx - - /etc/wtmpx - - /etc/cups/certs - - /etc/dumpdates - - /etc/svc/volatile - no_diff: - - /etc/ssl/private.key - directories: - - check_all: 'yes' - dirs: /etc,/usr/bin,/usr/sbin - - check_all: 'yes' - dirs: /bin,/sbin - agentless: - - type: ssh_integrity_check_linux - frequency: 36000 - host: root@example.net - state: periodic - arguments: '/bin /etc/ /sbin' - - type: ssh_integrity_check_linux - frequency: 36000 - host: root@example.net - state: periodic - arguments: '/bin /etc/ /sbin' - - type: ssh_integrity_check_linux - frequency: 36000 - host: root@example.net - state: periodic - localfiles: - - format: 'syslog' - location: '/var/log/messages' - - format: 'syslog' - location: '/var/log/secure' - - format: 'command' - command: 'df -P' - frequency: '360' - - format: 'full_command' - command: 'netstat -tln | grep -v 127.0.0.1 | sort' - frequency: '360' - - format: 'full_command' - command: 'last -n 20' - frequency: '360' - globals: - - '127.0.0.1' - - '192.168.2.1' - connection: - - type: 'secure' - port: '1514' - protocol: 'tcp' - log_level: 1 - email_level: 12 - commands: - - name: 'disable-account' - executable: 'disable-account.sh' - expect: 'user' - timeout_allowed: 'yes' - - name: 'restart-ossec' - executable: 'restart-ossec.sh' - expect: '' - timeout_allowed: 'no' - - name: 'firewall-drop' - executable: 'firewall-drop.sh' - expect: 'srcip' - timeout_allowed: 'yes' - - name: 'host-deny' - executable: 'host-deny.sh' - expect: 'srcip' - timeout_allowed: 'yes' - - name: 'route-null' - executable: 'route-null.sh' - expect: 'srcip' - timeout_allowed: 'yes' - - name: 'win_route-null' - executable: 'route-null.cmd' - expect: 'srcip' - timeout_allowed: 'yes' - active_responses: - - command: 'host-deny' - location: 'local' - level: 6 - timeout: 600 - -ossec_agent_configs: - - type: os - type_value: linux - frequency_check: 79200 - ignore_files: - - /etc/mtab - - /etc/mnttab - - /etc/hosts.deny - - /etc/mail/statistics - - /etc/svc/volatile - directories: - - check_all: yes - dirs: /etc,/usr/bin,/usr/sbin - - check_all: yes - dirs: /bin,/sbin - localfiles: - - format: 'syslog' - location: '/var/log/messages' - - format: 'syslog' - location: '/var/log/secure' - - format: 'syslog' - location: '/var/log/maillog' - - format: 'apache' - location: '/var/log/httpd/error_log' - - format: 'apache' - location: '/var/log/httpd/access_log' - - format: 'apache' - location: '/var/ossec/logs/active-responses.log' diff --git a/ansible-wazuh-server/vars/wazuh_api_creds.yml b/ansible-wazuh-server/vars/wazuh_api_creds.yml new file mode 100644 index 00000000..af61d06d --- /dev/null +++ b/ansible-wazuh-server/vars/wazuh_api_creds.yml @@ -0,0 +1,3 @@ +# Be sure you encrypt this file with ansible-vault +wazuh_api_user: + - foo:$apr1$/axqZYWQ$Xo/nz/IG3PdwV82EnfYKh/