From 7043b653d575675d0297a4c8151080e89078d603 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno Date: Thu, 25 May 2023 21:55:28 +0200 Subject: [PATCH 1/3] Bump to 4.4.3 --- CHANGELOG.md | 6 ++++++ README.md | 1 + VERSION | 4 ++-- roles/elastic-stack/ansible-kibana/defaults/main.yml | 2 +- roles/opendistro/opendistro-kibana/defaults/main.yml | 2 +- roles/wazuh/ansible-filebeat/defaults/main.yml | 2 +- roles/wazuh/ansible-wazuh-agent/defaults/main.yml | 6 +++--- roles/wazuh/ansible-wazuh-manager/defaults/main.yml | 4 ++-- roles/wazuh/check-packages/defaults/main.yml | 2 +- roles/wazuh/wazuh-dashboard/defaults/main.yml | 4 ++-- roles/wazuh/wazuh-dashboard/vars/debian.yml | 2 +- roles/wazuh/wazuh-indexer/defaults/main.yml | 2 +- 12 files changed, 22 insertions(+), 15 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 41e9c708..c0007017 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,12 @@ # Change Log All notable changes to this project will be documented in this file. +## [v4.4.3] + +### Added + +- Update to [Wazuh v4.4.3](https://github.com/wazuh/wazuh/blob/v4.4.3/CHANGELOG.md#v443) + ## [v4.4.2] ### Added diff --git a/README.md b/README.md index b8cfb1a2..8136f77f 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,7 @@ These playbooks install and configure Wazuh agent, manager and indexer and dashb | Wazuh version | Elastic | ODFE | |---------------|---------|--------| +| v4.4.3 | | | | v4.4.2 | | | | v4.4.1 | | | | v4.4.0 | | | diff --git a/VERSION b/VERSION index aada171b..c4b10c80 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-ANSIBLE_VERSION="v4.4.2" -REVISION="40408" +WAZUH-ANSIBLE_VERSION="v4.4.3" +REVISION="40409" diff --git a/roles/elastic-stack/ansible-kibana/defaults/main.yml b/roles/elastic-stack/ansible-kibana/defaults/main.yml index 2a4f1dc0..1a9d74ea 100644 --- a/roles/elastic-stack/ansible-kibana/defaults/main.yml +++ b/roles/elastic-stack/ansible-kibana/defaults/main.yml @@ -7,7 +7,7 @@ kibana_server_host: "0.0.0.0" kibana_server_port: "5601" kibana_conf_path: /etc/kibana elastic_stack_version: 7.10.2 -wazuh_version: 4.4.2 +wazuh_version: 4.4.3 wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana elasticrepo: diff --git a/roles/opendistro/opendistro-kibana/defaults/main.yml b/roles/opendistro/opendistro-kibana/defaults/main.yml index 2e46d255..e7564f93 100644 --- a/roles/opendistro/opendistro-kibana/defaults/main.yml +++ b/roles/opendistro/opendistro-kibana/defaults/main.yml @@ -10,7 +10,7 @@ kibana_server_port: "5601" kibana_server_name: "kibana" kibana_max_payload_bytes: 1048576 elastic_stack_version: 7.10.2 -wazuh_version: 4.4.2 +wazuh_version: 4.4.3 wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana # The OpenDistro package repository diff --git a/roles/wazuh/ansible-filebeat/defaults/main.yml b/roles/wazuh/ansible-filebeat/defaults/main.yml index a82f8cac..0e9a4ebc 100644 --- a/roles/wazuh/ansible-filebeat/defaults/main.yml +++ b/roles/wazuh/ansible-filebeat/defaults/main.yml @@ -1,7 +1,7 @@ --- filebeat_version: 7.10.2 -wazuh_template_branch: v4.4.2 +wazuh_template_branch: v4.4.3 filebeat_create_config: true diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml index 3663c443..1d772269 100644 --- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml @@ -1,6 +1,6 @@ --- -wazuh_agent_version: 4.4.2 +wazuh_agent_version: 4.4.3 # Custom packages installation @@ -12,7 +12,7 @@ wazuh_custom_packages_installation_agent_rpm_url: "" wazuh_agent_sources_installation: enabled: false - branch: "v4.4.2" + branch: "v4.4.3" user_language: "y" user_no_stop: "y" user_install_type: "agent" @@ -54,7 +54,7 @@ wazuh_winagent_config: # Adding quotes to auth_path_x86 since win_shell outputs error otherwise auth_path_x86: C:\'Program Files (x86)'\ossec-agent\agent-auth.exe check_md5: True - md5: e207963ba60b51649522d893f7276fa4 + md5: 921dee671c223ac7e5424d2ce5d54dfe wazuh_dir: "/var/ossec" diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 1598bb0d..37a5248f 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -1,6 +1,6 @@ --- -wazuh_manager_version: 4.4.2 +wazuh_manager_version: 4.4.3 wazuh_manager_fqdn: "wazuh-server" wazuh_manager_package_state: present @@ -13,7 +13,7 @@ wazuh_custom_packages_installation_manager_rpm_url: "https://s3-us-west-1.amazon # Sources installation wazuh_manager_sources_installation: enabled: false - branch: "v4.4.2" + branch: "v4.4.3" user_language: "en" user_no_stop: "y" user_install_type: "server" diff --git a/roles/wazuh/check-packages/defaults/main.yml b/roles/wazuh/check-packages/defaults/main.yml index 24b549c9..58200211 100644 --- a/roles/wazuh/check-packages/defaults/main.yml +++ b/roles/wazuh/check-packages/defaults/main.yml @@ -1,2 +1,2 @@ --- -wazuh_version: 4.4.2 +wazuh_version: 4.4.3 diff --git a/roles/wazuh/wazuh-dashboard/defaults/main.yml b/roles/wazuh/wazuh-dashboard/defaults/main.yml index d75e44b4..693b1a32 100644 --- a/roles/wazuh/wazuh-dashboard/defaults/main.yml +++ b/roles/wazuh/wazuh-dashboard/defaults/main.yml @@ -8,12 +8,12 @@ dashboard_node_name: node-1 dashboard_server_host: "0.0.0.0" dashboard_server_port: "443" dashboard_server_name: "dashboard" -wazuh_version: 4.4.2 +wazuh_version: 4.4.3 indexer_cluster_nodes: - 127.0.0.1 # The Wazuh dashboard package repository -dashboard_version: "4.4.2" +dashboard_version: "4.4.3" # API credentials wazuh_api_credentials: diff --git a/roles/wazuh/wazuh-dashboard/vars/debian.yml b/roles/wazuh/wazuh-dashboard/vars/debian.yml index 691aa2f0..29d20126 100644 --- a/roles/wazuh/wazuh-dashboard/vars/debian.yml +++ b/roles/wazuh/wazuh-dashboard/vars/debian.yml @@ -1,2 +1,2 @@ --- -dashboard_version: 4.4.2 +dashboard_version: 4.4.3 diff --git a/roles/wazuh/wazuh-indexer/defaults/main.yml b/roles/wazuh/wazuh-indexer/defaults/main.yml index 39f22ce2..c7d692b5 100644 --- a/roles/wazuh/wazuh-indexer/defaults/main.yml +++ b/roles/wazuh/wazuh-indexer/defaults/main.yml @@ -1,6 +1,6 @@ --- # Cluster Settings -indexer_version: 4.4.2 +indexer_version: 4.4.3 single_node: false indexer_node_name: node-1 From 2711be734c3cb2fa630cf7c675701fd4656fa9d5 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno Date: Mon, 29 May 2023 18:04:19 +0200 Subject: [PATCH 2/3] Removed deprecated roles --- roles/ansible-galaxy/meta/main.yml | 29 ---- .../ansible-kibana/defaults/main.yml | 53 -------- .../opendistro-elasticsearch/tasks/Debian.yml | 57 -------- .../opendistro-kibana/defaults/main.yml | 60 --------- .../opendistro-kibana/tasks/main.yml | 124 ------------------ .../tasks/security_actions.yml | 13 -- 6 files changed, 336 deletions(-) delete mode 100644 roles/ansible-galaxy/meta/main.yml delete mode 100644 roles/elastic-stack/ansible-kibana/defaults/main.yml delete mode 100644 roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml delete mode 100644 roles/opendistro/opendistro-kibana/defaults/main.yml delete mode 100755 roles/opendistro/opendistro-kibana/tasks/main.yml delete mode 100644 roles/opendistro/opendistro-kibana/tasks/security_actions.yml diff --git a/roles/ansible-galaxy/meta/main.yml b/roles/ansible-galaxy/meta/main.yml deleted file mode 100644 index ba759c5c..00000000 --- a/roles/ansible-galaxy/meta/main.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- - -dependencies: [] - -galaxy_info: - author: Wazuh - categories: - - monitoring - company: wazuh.com - description: Installing, deploying and configuring Wazuh Manager. - galaxy_tags: - - monitoring - - system - - web - license: license (GPLv3) - min_ansible_version: 2.0 - platforms: - - name: Debian - versions: - - all - - name: EL - versions: - - all - - name: Fedora - versions: - - all - - name: Ubuntu - versions: - - all diff --git a/roles/elastic-stack/ansible-kibana/defaults/main.yml b/roles/elastic-stack/ansible-kibana/defaults/main.yml deleted file mode 100644 index 1a9d74ea..00000000 --- a/roles/elastic-stack/ansible-kibana/defaults/main.yml +++ /dev/null @@ -1,53 +0,0 @@ ---- -kibana_node_name: node-1 - -elasticsearch_http_port: "9200" -elasticsearch_network_host: "127.0.0.1" -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_conf_path: /etc/kibana -elastic_stack_version: 7.10.2 -wazuh_version: 4.4.3 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -elasticrepo: - apt: 'https://artifacts.elastic.co/packages/7.x/apt' - yum: 'https://artifacts.elastic.co/packages/7.x/yum' - gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' - key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# Xpack Security -kibana_xpack_security: false -kibana_ssl_verification_mode: "full" - -elasticsearch_xpack_security_user: elastic -elasticsearch_xpack_security_password: elastic_pass - -node_certs_destination: /etc/kibana/certs - -# CA Generation -master_certs_path: "{{ playbook_dir }}/es_certs" -generate_CA: true -ca_cert_name: "" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - -# Build from sources -build_from_sources: false -wazuh_plugin_branch: 4.1-7.10 - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 diff --git a/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml b/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml deleted file mode 100644 index 5b490844..00000000 --- a/roles/opendistro/opendistro-elasticsearch/tasks/Debian.yml +++ /dev/null @@ -1,57 +0,0 @@ - ---- - -- name: Update cache - apt: - update_cache: yes - -- name: Debian 9 (Stretch) - when: (ansible_facts['distribution'] == "Debian" and ansible_facts['distribution_major_version'] == "9") - block: - - - name: Install OpenDistro dependencies - apt: - name: [ - 'unzip', 'wget', 'curl', 'apt-transport-https', software-properties-common - ] - state: present - - - name: Add the repository key for Debian's Stretch Backports repository - ansible.builtin.apt_key: - keyserver: keyserver.ubuntu.com - id: 648ACFD622F3D138 - - - name: Add openjdk repository - apt_repository: - repo: "{{ package_repos.apt.openjdk.baseurl }}" - state: present - update_cache: yes - filename: 'wazuh-openjdk' - -- name: Install openjdk-11-jdk - apt: - name: openjdk-11-jdk - state: present - environment: - JAVA_HOME: /usr - -- name: Add Opendistro repository - block: - - name: Add apt repository signing key - apt_key: - url: "{{ package_repos.apt.opendistro.gpg }}" - state: present - - - name: Add Opendistro repository - apt_repository: - repo: "{{ package_repos.apt.opendistro.baseurl }}" - state: present - filename: 'wazuh-opendistro' - update_cache: yes - -- name: Install OpenDistro - apt: - name: opendistroforelasticsearch={{ opendistro_version }}-1 - state: present - register: install - tags: install \ No newline at end of file diff --git a/roles/opendistro/opendistro-kibana/defaults/main.yml b/roles/opendistro/opendistro-kibana/defaults/main.yml deleted file mode 100644 index e7564f93..00000000 --- a/roles/opendistro/opendistro-kibana/defaults/main.yml +++ /dev/null @@ -1,60 +0,0 @@ ---- - -# Kibana configuration -elasticsearch_http_port: 9200 -elastic_api_protocol: https -kibana_conf_path: /etc/kibana -kibana_node_name: node-1 -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_server_name: "kibana" -kibana_max_payload_bytes: 1048576 -elastic_stack_version: 7.10.2 -wazuh_version: 4.4.3 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -# The OpenDistro package repository -kibana_opendistro_version: 1.13.2-1 # Version includes the - for RedHat family compatibility, replace with = for Debian hosts - -package_repos: - yum: - opendistro: - baseurl: 'https://packages.wazuh.com/4.x/yum/' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - apt: - opendistro: - baseurl: 'deb https://packages.wazuh.com/4.x/apt/ stable main' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# opendistro Security -kibana_opendistro_security: true -kibana_newsfeed_enabled: "false" -kibana_telemetry_optin: "false" -kibana_telemetry_enabled: "false" - -opendistro_admin_password: changeme -opendistro_kibana_user: kibanaserver -opendistro_kibana_password: changeme -local_certs_path: "{{ playbook_dir }}/opendistro/certificates" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - -# Build from sources -build_from_sources: false -wazuh_plugin_branch: 4.1-7.10 - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 diff --git a/roles/opendistro/opendistro-kibana/tasks/main.yml b/roles/opendistro/opendistro-kibana/tasks/main.yml deleted file mode 100755 index acfd1f90..00000000 --- a/roles/opendistro/opendistro-kibana/tasks/main.yml +++ /dev/null @@ -1,124 +0,0 @@ ---- - -- name: Stopping early, trying to compile Wazuh Kibana Plugin on Debian 10 is not possible - fail: - msg: "It's not possible to compile the Wazuh Kibana plugin on Debian 10 due to: https://github.com/wazuh/wazuh-kibana-app/issues/1924" - when: - - build_from_sources - - ansible_distribution == "Debian" - - ansible_distribution_major_version == "10" - -- import_tasks: RedHat.yml - when: ansible_os_family == 'RedHat' - -- import_tasks: Debian.yml - when: ansible_os_family == 'Debian' - -- name: Remove Kibana configuration file - file: - # noqa 503 - path: "{{ kibana_conf_path }}/kibana.yml" - state: absent - tags: install - -- import_tasks: security_actions.yml - -- name: Copy Configuration File - blockinfile: - block: "{{ lookup('template', 'opendistro_kibana.yml.j2') }}" - dest: "{{ kibana_conf_path }}/kibana.yml" - create: true - group: kibana - owner: kibana - mode: 0640 - marker: "## {mark} Kibana general settings ##" - notify: restart kibana - tags: - - install - - configure - -- name: Ensuring Kibana directory owner - file: - # noqa 208 - path: "/usr/share/kibana" - state: directory - owner: kibana - group: kibana - recurse: yes - -- name: Build and Install Wazuh Kibana Plugin from sources - import_tasks: build_wazuh_plugin.yml - when: - - build_from_sources is defined - - build_from_sources - -- name: Install Wazuh Plugin (can take a while) - shell: >- - NODE_OPTIONS="{{ node_options }}" /usr/share/kibana/bin/kibana-plugin install - {{ wazuh_app_url }}-{{ wazuh_version }}_{{ elastic_stack_version }}-1.zip - args: - executable: /bin/bash - creates: /usr/share/kibana/plugins/wazuh/package.json - chdir: /usr/share/kibana - become: yes - become_user: kibana - notify: restart kibana - tags: - - install - - skip_ansible_lint - when: - - not build_from_sources - -- name: Kibana optimization (can take a while) - shell: /usr/share/kibana/node/bin/node {{ node_options }} /usr/share/kibana/src/cli/cli.js --optimize -c {{ kibana_conf_path }}/kibana.yml - args: - executable: /bin/bash - become: yes - become_user: kibana - changed_when: false - tags: - - skip_ansible_lint - -- name: Wait for Elasticsearch port - wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} - -- name: Select correct API protocol - set_fact: - elastic_api_protocol: "{% if kibana_opendistro_security is defined and kibana_opendistro_security %}https{% else %}http{% endif %}" - -- name: Attempting to delete legacy Wazuh index if exists - uri: - url: "{{ elastic_api_protocol }}://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/.wazuh" - method: DELETE - user: "admin" - password: "{{ opendistro_admin_password }}" - validate_certs: no - status_code: 200, 404 - -- name: Create wazuh plugin config directory - file: - path: /usr/share/kibana/data/wazuh/config/ - state: directory - recurse: yes - owner: kibana - group: kibana - mode: 0751 - changed_when: False - -- name: Configure Wazuh Kibana Plugin - template: - src: wazuh.yml.j2 - dest: /usr/share/kibana/data/wazuh/config/wazuh.yml - owner: kibana - group: kibana - mode: 0751 - changed_when: False - -- name: Ensure Kibana started and enabled - service: - name: kibana - enabled: true - state: started - -- import_tasks: RMRedHat.yml - when: ansible_os_family == 'RedHat' diff --git a/roles/opendistro/opendistro-kibana/tasks/security_actions.yml b/roles/opendistro/opendistro-kibana/tasks/security_actions.yml deleted file mode 100644 index ee21f1c1..00000000 --- a/roles/opendistro/opendistro-kibana/tasks/security_actions.yml +++ /dev/null @@ -1,13 +0,0 @@ -- block: - - - name: Copy the certificates from local to the Kibana instance - copy: - src: "{{ local_certs_path }}/certs/{{ item }}" - dest: /usr/share/kibana - mode: 0644 - with_items: - - "root-ca.pem" - - "{{ kibana_node_name }}_http.key" - - "{{ kibana_node_name }}_http.pem" - tags: - - security From 7c55c46662d8e8ab9e4b27c772cf38e8b3be5882 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno Date: Mon, 29 May 2023 18:45:28 +0200 Subject: [PATCH 3/3] Removed deprecated roles --- .../wazuh/ansible-filebeat/defaults/main.yml | 36 ------------------- 1 file changed, 36 deletions(-) delete mode 100644 roles/wazuh/ansible-filebeat/defaults/main.yml diff --git a/roles/wazuh/ansible-filebeat/defaults/main.yml b/roles/wazuh/ansible-filebeat/defaults/main.yml deleted file mode 100644 index 0e9a4ebc..00000000 --- a/roles/wazuh/ansible-filebeat/defaults/main.yml +++ /dev/null @@ -1,36 +0,0 @@ ---- -filebeat_version: 7.10.2 - -wazuh_template_branch: v4.4.3 - -filebeat_create_config: true - -filebeat_node_name: node-1 - -filebeat_output_elasticsearch_hosts: - - "localhost:9200" - -filebeat_module_package_url: https://packages.wazuh.com/4.x/filebeat -filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz -filebeat_module_package_path: /tmp/ -filebeat_module_destination: /usr/share/filebeat/module -filebeat_module_folder: /usr/share/filebeat/module/wazuh - -# Xpack Security -filebeat_xpack_security: false - -elasticsearch_xpack_security_user: elastic -elasticsearch_xpack_security_password: elastic_pass - -node_certs_destination: /etc/filebeat/certs - -# CA Generation -master_certs_path: "{{ playbook_dir }}/es_certs" -generate_CA: true -ca_cert_name: "" - -elasticrepo: - apt: 'https://artifacts.elastic.co/packages/7.x/apt' - yum: 'https://artifacts.elastic.co/packages/7.x/yum' - gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' - key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'