molecule: add scenario clustered-wazuh-only

molecule/clustered-wazuh-only/Dockerfile.j2

@@ -0,0 +1,14 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+RUN if [ $(command -v apt-get) ]; then apt-get update && apt-get upgrade -y && apt-get install -y python sudo bash ca-certificates && apt-get clean; \
+    elif [ $(command -v dnf) ]; then dnf makecache && dnf --assumeyes install python sudo python-devel python2-dnf bash && dnf clean all; \
+    elif [ $(command -v yum) ]; then yum makecache fast && yum update -y && yum install -y python sudo yum-plugin-ovl bash && sed -i 's/plugins=0/plugins=1/g' /etc/yum.conf && yum clean all; \
+    elif [ $(command -v zypper) ]; then zypper refresh && zypper update -y && zypper install -y python sudo bash python-xml && zypper clean -a; \
+    elif [ $(command -v apk) ]; then apk update && apk add --no-cache python sudo bash ca-certificates; \
+    elif [ $(command -v xbps-install) ]; then xbps-install -Syu && xbps-install -y python sudo bash ca-certificates && xbps-remove -O; fi

molecule/clustered-wazuh-only/INSTALL.rst

@@ -0,0 +1,16 @@
+*******
+Install
+*******
+
+Requirements
+============
+
+* Docker Engine
+* docker-py
+
+Install
+=======
+
+.. code-block:: bash
+
+  $ sudo pip install docker-py

molecule/clustered-wazuh-only/converge.yml

@@ -0,0 +1,23 @@
+---
+
+- name: Converge
+  hosts: all
+  become: true
+  become_user: root
+  roles:
+    - role: ../../roles/elastic-stack/ansible-elasticsearch
+      when: inventory_hostname in groups['elastic']
+    - role: ../../roles/wazuh/ansible-wazuh-manager
+      when: inventory_hostname in groups['managers']
+    - role: ../../roles/wazuh/ansible-filebeat
+      when: inventory_hostname in groups['managers']
+  pre_tasks:
+    - debug:
+        msg: |
+          -----------------------------------------
+          managers: {{ managers_hostvars | length }}
+          addresses: {{  manager_addresses }}
+          -----------------------------------------
+          elastic: {{ elastic_hostvars | length }}
+          addresses: {{  elastic_addresses }}
+          -----------------------------------------

molecule/clustered-wazuh-only/group_vars/all.yml

@@ -0,0 +1,11 @@
+---
+
+########################################################
+# Helper variables
+private_ip: '{{ ansible_default_ipv4.address }}'
+
+managers_hostvars: "{{ groups['managers'] | map('extract', hostvars)  | list }}"
+elastic_hostvars: "{{ groups['elastic'] | map('extract', hostvars)  | list }}"
+
+manager_addresses: "{{ managers_hostvars | map(attribute='private_ip') | list }}"
+elastic_addresses: "{{ elastic_hostvars | map(attribute='private_ip') | list }}"

molecule/clustered-wazuh-only/group_vars/elastic.yml

@@ -0,0 +1,15 @@
+---
+
+single_node: false
+elasticsearch_node_master: true
+minimum_master_nodes: 1
+
+# ansible_default_ipv4.address
+private_ip: '{{ ansible_host }}'
+elasticsearch_network_host: '{{ private_ip }}'
+elasticsearch_node_name: '{{ ansible_hostname }}'
+
+elasticsearch_cluster_nodes: '{{ elastic_addresses }}'
+
+elasticsearch_discovery_nodes: '{{ elastic_addresses }}'
+

molecule/clustered-wazuh-only/group_vars/managers.yml

@@ -0,0 +1,20 @@
+---
+
+wazuh_manager_fqdn: '{{ ansible_hostname }}'
+filebeat_node_name: '{{ ansible_hostname }}'
+filebeat_output_elasticsearch_hosts: '{{ elastic_addresses }}'
+
+wazuh_manager_config:
+  connection:
+    - type: 'secure'
+      port: '1514'
+      protocol: 'tcp'
+      queue_size: 131072
+  api:
+    https: 'yes'
+  cluster:
+    disable: 'no'
+    node_name: '{{ ansible_hostname }}'
+    node_type: "{{ 'master' if ansible_hostname == 'wazuh-mgr01' else 'worker' }}"
+    nodes: '{{ manager_addresses }}'
+    hidden: 'no'

molecule/clustered-wazuh-only/molecule.yml

@@ -0,0 +1,130 @@
+---
+# Distributed scenario: clustered manager scenario + connected agents
+# 2-core CPU
+# 7 GB of RAM memory
+# 14 GB of SSD disk space
+
+dependency:
+  name: galaxy
+driver:
+  name: docker
+#lint:
+#  name: yamllint
+#  enabled: false
+platforms:
+
+  ################################################
+  # Wazuh Managers
+  ################################################
+  - name: wazuh_manager_centos7
+    hostname: wazuh-mgr01
+    image: geerlingguy/docker-centos7-ansible
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_manager_ubuntu2004
+    hostname: wazuh-mgr02
+    image: geerlingguy/docker-ubuntu2004-ansible
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_manager_debian9
+    hostname: wazuh-mgr03
+    image: geerlingguy/docker-debian9-ansible
+    pre_build_image: true
+    privileged: true
+    memory_reservation: 512m
+    memory: 1024m
+    groups:
+      - managers
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  ################################################
+  # Elastic Cluster
+  ################################################
+  - name: wazuh_elasticsearch_centos7
+    hostname: wazuh-es01
+    image: geerlingguy/docker-centos7-ansible
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    env:
+      ES_JAVA_OPTS: '-Xms1g -Xmx1g'
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+  - name: wazuh_elasticsearch_debian9
+    hostname: wazuh-es03
+    image: geerlingguy/docker-debian9-ansible
+    pre_build_image: true
+    privileged: true
+    memory: 4096m
+    memory_reservation: 2048m
+    env:
+      ES_JAVA_OPTS: '-Xms1g -Xmx1g'
+    groups:
+      - elastic
+    ulimits:
+      - nofile:262144:262144
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+
+provisioner:
+  name: ansible
+  inventory:
+    links:
+      group_vars: group_vars
+      #host_vars: ../../../inventory/host_vars/
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    #destroy: destroy.yml
+  config_options:
+    defaults:
+      hash_behaviour: merge
+  env:
+    ANSIBLE_ROLES_PATH: ./roles
+  lint:
+    name: ansible-lint
+    enabled: false
+scenario:
+  name: clustered-wazuh-only
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    #- idempotence
+    #- verify
+    - cleanup
+    - destroy
+verifier:
+  name: testinfra
+#  lint:
+#    name: flake8
+#    enabled: false

molecule/clustered-wazuh-only/tests/test_default.py

@@ -0,0 +1,65 @@
+import os
+import pytest
+import testinfra.utils.ansible_runner
+import re
+
+testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
+    os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
+
+
+def get_wazuh_version():
+    """This return the version of Wazuh."""
+    return "4.0.0"
+
+
+def test_wazuh_packages_are_installed(host):
+    """Test the main packages are installed."""
+    manager = host.package("wazuh-manager")
+    assert manager.is_installed
+    assert manager.version.startswith(get_wazuh_version())
+
+
+def test_wazuh_services_are_running(host):
+    """Test the services are enabled and running.
+
+    When assert commands are commented, this means that the service command has
+    a wrong exit code: https://github.com/wazuh/wazuh-ansible/issues/107
+    """
+    # This currently doesn't work with out current Docker base images
+    # manager = host.service("wazuh-manager")
+    # api = host.service("wazuh-api")
+    # assert manager.is_running
+    # assert api.is_running
+    output = host.check_output(
+        'ps aux | grep ossec | tr -s " " | cut -d" " -f11'
+        )
+    assert 'ossec-authd' in output
+    assert 'wazuh-modulesd' in output
+    assert 'wazuh-db' in output
+    assert 'ossec-execd' in output
+    assert 'ossec-monitord' in output
+    assert 'ossec-remoted' in output
+    assert 'ossec-logcollector' in output
+    assert 'ossec-analysisd' in output
+    assert 'ossec-syscheckd' in output
+
+
+@pytest.mark.parametrize("wazuh_file, wazuh_owner, wazuh_group, wazuh_mode", [
+    ("/var/ossec/etc/sslmanager.cert", "root", "root", 0o640),
+    ("/var/ossec/etc/sslmanager.key", "root", "root", 0o640),
+    ("/var/ossec/etc/rules/local_rules.xml", "ossec", "ossec", 0o640),
+    ("/var/ossec/etc/lists/audit-keys", "ossec", "ossec", 0o660),
+])
+def test_wazuh_files(host, wazuh_file, wazuh_owner, wazuh_group, wazuh_mode):
+    """Test Wazuh related files exist and have proper owners and mode."""
+    wazuh_file_host = host.file(wazuh_file)
+    assert wazuh_file_host.user == wazuh_owner
+    assert wazuh_file_host.group == wazuh_group
+    assert wazuh_file_host.mode == wazuh_mode
+
+
+def test_filebeat_is_installed(host):
+    """Test the elasticsearch package is installed."""
+    filebeat = host.package("filebeat")
+    assert filebeat.is_installed
+    assert filebeat.version.startswith('7.9.1')

pyproject.toml

@@ -0,0 +1,28 @@
+[tool.poetry]
+name = "wazuh-ansible"
+version = "4.0.0"
+description = ""
+authors = ["neonmei <neonmei@pm.me>"]
+
+[tool.poetry.dependencies]
+python = "^3.8"
+
+# Pin ansible version to that currently present on awx
+ansible = "==2.9.5"
+jinja2 = "^2.11.2"
+selinux = "^0.2.1"
+#molecule = {extras = ["docker"], version = "^2.20"}
+
+# minimum version is 3.0.3, because we need docker memory limitation
+# https://github.com/ansible-community/molecule/pull/2615
+molecule = {extras = ["docker"], version = "==3.0.8"}
+testinfra = "^5.3.1"
+
+[tool.poetry.dev-dependencies]
+pytest = "^5.2"
+ansible-lint = "^4.3.5"
+flake8 = "^3.8"
+
+[build-system]
+requires = ["poetry>=0.12"]
+build-backend = "poetry.masonry.api"