diff --git a/Pipfile b/Pipfile index e7b1b5c0..8aa7757a 100644 --- a/Pipfile +++ b/Pipfile @@ -15,10 +15,10 @@ python_version = "2.7" [scripts] test ="molecule test --destroy=never" -agent ="molecule test -s wazuh-agent" +worker ="molecule test -s worker --destroy=never" +agent ="molecule test -s wazuh-agent --destroy=never" elasticsearch ="molecule test -s elasticsearch --destroy=never" -filebeat ="molecule test -s filebeat" -kibana ="molecule test -s kibana" +kibana ="molecule test -s kibana --destroy=never" # Destroy all the existing containers ' Created by Molecule ' destroy_elasticsearch ="molecule destroy -s elasticsearch" diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml index 2e5dfa0d..054acc00 100644 --- a/molecule/default/molecule.yml +++ b/molecule/default/molecule.yml @@ -57,7 +57,7 @@ scenario: - create - prepare - converge - - idempotence + #- idempotence - side_effect - verify - cleanup diff --git a/molecule/default/tests/test_default.py b/molecule/default/tests/test_default.py index becf02f7..278ce719 100644 --- a/molecule/default/tests/test_default.py +++ b/molecule/default/tests/test_default.py @@ -79,8 +79,9 @@ def test_open_ports(host): assert host.socket("tcp://127.0.0.1:1515").is_listening assert host.socket("tcp://127.0.0.1:1514").is_listening + def test_filebeat_is_installed(host): """Test if the elasticsearch package is installed.""" filebeat = host.package("filebeat") assert filebeat.is_installed - assert filebeat.version.startswith('7.2.1') \ No newline at end of file + assert filebeat.version.startswith('7.2.1') diff --git a/molecule/worker/Dockerfile.j2 b/molecule/worker/Dockerfile.j2 new file mode 100644 index 00000000..e6aa95d3 --- /dev/null +++ b/molecule/worker/Dockerfile.j2 @@ -0,0 +1,14 @@ +# Molecule managed + +{% if item.registry is defined %} +FROM {{ item.registry.url }}/{{ item.image }} +{% else %} +FROM {{ item.image }} +{% endif %} + +RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get install -y python sudo bash ca-certificates && apt-get clean; \ + elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python*-dnf bash && dnf clean all; \ + elif [ $(command -v yum) ]; then yum makecache fast && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \ + elif [ $(command -v zypper) ]; then zypper refresh && zypper install -y python sudo bash python-xml && zypper clean -a; \ + elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \ + elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi diff --git a/molecule/worker/molecule.yml b/molecule/worker/molecule.yml new file mode 100644 index 00000000..c82aacfc --- /dev/null +++ b/molecule/worker/molecule.yml @@ -0,0 +1,60 @@ +--- +dependency: + name: galaxy +driver: + name: docker +lint: + name: yamllint + options: + config-data: + ignore: .virtualenv +platforms: + - name: elasticsearch + image: solita/ubuntu-systemd:bionic + command: /sbin/init + ulimits: + - nofile:262144:262144 + privileged: true + memory_reservation: 2048m + + #- name: xenial + # image: solita/ubuntu-systemd:xenial + # privileged: true + # memory_reservation: 2048m + # command: /sbin/init + # ulimits: + # - nofile:262144:262144 + #- name: trusty + #image: ubuntu:trusty + #privileged: true + #memory_reservation: 2048m + #ulimits: + #- nofile:262144:262144 + #- name: centos6 + # image: centos:6 + # privileged: true + # memory_reservation: 2048m + # ulimits: + # - nofile:262144:262144 + #- name: centos7 + # image: milcom/centos7-systemd + # memory_reservation: 2048m + # privileged: true + # ulimits: + # - nofile:262144:262144 +provisioner: + name: ansible + playbooks: + docker: + create: ../default/create.yml + destroy: ../default/destroy.yml + prepare: ../default/prepare.yml + env: + ANSIBLE_ROLES_PATH: ../../roles + lint: + name: ansible-lint + enabled: true +verifier: + name: testinfra + lint: + name: flake8 diff --git a/molecule/worker/playbook.yml b/molecule/worker/playbook.yml new file mode 100644 index 00000000..6c9a6317 --- /dev/null +++ b/molecule/worker/playbook.yml @@ -0,0 +1,11 @@ +--- +- name: Converge + hosts: all + roles: + - { role: wazuh/ansible-wazuh-manager, + wazuh_manager_config.cluster.disable: 'no', + wazuh_manager_config.cluster.name: 'worker-01', + wazuh_manager_config.cluster.node_type: 'worker' + } + - { role: wazuh/ansible-filebeat, filebeat_output_elasticsearch_hosts: 'elasticsearch:9200' } + diff --git a/molecule/worker/tests/test_default.py b/molecule/worker/tests/test_default.py new file mode 100644 index 00000000..278ce719 --- /dev/null +++ b/molecule/worker/tests/test_default.py @@ -0,0 +1,87 @@ +import os +import pytest + +import testinfra.utils.ansible_runner + +testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( + os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') + + +def get_wazuh_version(): + """This return the version of Wazuh.""" + return "3.9.5" + + +def test_wazuh_packages_are_installed(host): + """Test if the main packages are installed.""" + manager = host.package("wazuh-manager") + api = host.package("wazuh-api") + + distribution = host.system_info.distribution.lower() + if distribution == 'centos': + if host.system_info.release == "7": + assert manager.is_installed + assert manager.version.startswith(get_wazuh_version()) + assert api.is_installed + assert api.version.startswith(get_wazuh_version()) + elif host.system_info.release.startswith("6"): + assert manager.is_installed + assert manager.version.startswith(get_wazuh_version()) + elif distribution == 'ubuntu': + assert manager.is_installed + assert manager.version.startswith(get_wazuh_version()) + + +def test_wazuh_services_are_running(host): + """Test if the services are enabled and running. + + When assert commands are commented, this means that the service command has + a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107 + """ + manager = host.service("wazuh-manager") + api = host.service("wazuh-api") + + distribution = host.system_info.distribution.lower() + if distribution == 'centos': + # assert manager.is_running + assert manager.is_enabled + # assert not api.is_running + assert not api.is_enabled + elif distribution == 'ubuntu': + # assert manager.is_running + assert manager.is_enabled + # assert api.is_running + assert api.is_enabled + + +@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [ + ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640), + ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640), + ("/var/ossec/etc/rules/local_rules.xml", "root", "ossec", 0o640), + ("/var/ossec/etc/lists/audit-keys", "root", "ossec", 0o640), +]) +def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode): + """Test if Wazuh related files exist and have proper owners and mode.""" + wazuh_file_host = host.file(wazuh_file) + + assert wazuh_file_host.user == wazuh_owner + assert wazuh_file_host.group == wazuh_group + assert wazuh_file_host.mode == wazuh_mode + + +def test_open_ports(host): + """Test if the main port is open and the agent-auth is not open.""" + distribution = host.system_info.distribution.lower() + if distribution == 'ubuntu': + assert host.socket("tcp://0.0.0.0:1515").is_listening + assert host.socket("tcp://0.0.0.0:1514").is_listening + elif distribution == 'centos': + assert host.socket("tcp://127.0.0.1:1515").is_listening + assert host.socket("tcp://127.0.0.1:1514").is_listening + + +def test_filebeat_is_installed(host): + """Test if the elasticsearch package is installed.""" + filebeat = host.package("filebeat") + assert filebeat.is_installed + assert filebeat.version.startswith('7.2.1') diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 6041c64d..8c7c1f16 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -35,9 +35,7 @@ wazuh_manager_config: port: '1516' bind_addr: '0.0.0.0' nodes: - - '172.17.0.2' - - '172.17.0.3' - - '172.17.0.4' + - 'manager' hidden: 'no' connection: - type: 'secure' diff --git a/run_cluster_mode.sh b/run_cluster_mode.sh new file mode 100644 index 00000000..e58f0702 --- /dev/null +++ b/run_cluster_mode.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +#sudo pipenv run elasticsearch +sudo pipenv run test +sudo pipenv run worker \ No newline at end of file