266 lines
8.9 KiB
YAML
266 lines
8.9 KiB
YAML
---
|
|
- include_tasks: "RedHat.yml"
|
|
when: ansible_os_family == "RedHat"
|
|
|
|
- include_tasks: "Debian.yml"
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- include_tasks: "installation_from_sources.yml"
|
|
when:
|
|
- wazuh_agent_sources_installation.enabled
|
|
|
|
- include_tasks: "installation_from_custom_packages.yml"
|
|
when:
|
|
- wazuh_custom_packages_installation_agent_enabled
|
|
|
|
- name: Linux CentOS/RedHat | Install wazuh-agent
|
|
yum:
|
|
name: wazuh-agent-{{ wazuh_agent_version }}
|
|
state: present
|
|
lock_timeout: '{{ wazuh_agent_yum_lock_timeout }}'
|
|
when:
|
|
- ansible_os_family|lower == "redhat"
|
|
- not wazuh_agent_sources_installation.enabled
|
|
- not wazuh_custom_packages_installation_agent_enabled
|
|
tags:
|
|
- init
|
|
|
|
- name: Linux Debian | Install wazuh-agent
|
|
apt:
|
|
name: "wazuh-agent={{ wazuh_agent_version }}"
|
|
state: present
|
|
cache_valid_time: 3600
|
|
when:
|
|
- ansible_os_family|lower != "redhat"
|
|
- not wazuh_agent_sources_installation.enabled
|
|
- not wazuh_custom_packages_installation_agent_enabled
|
|
- not ansible_check_mode
|
|
tags:
|
|
- init
|
|
|
|
- name: Linux | Check if client.keys exists
|
|
stat:
|
|
path: /var/ossec/etc/client.keys
|
|
register: check_keys
|
|
when: wazuh_agent_config.enrollment.enabled == 'yes'
|
|
tags:
|
|
- config
|
|
|
|
- name: Linux | Agent registration via authd
|
|
block:
|
|
|
|
- name: Copy CA root certificate to verify authd
|
|
copy:
|
|
src: "{{ wazuh_agent_authd.ssl_agent_ca }}"
|
|
dest: "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}"
|
|
mode: 0644
|
|
when:
|
|
- wazuh_agent_authd.ssl_agent_ca is not none
|
|
|
|
- name: Copy TLS/SSL certificate for agent verification
|
|
copy:
|
|
src: "{{ item }}"
|
|
dest: "/var/ossec/etc/{{ item | basename }}"
|
|
mode: 0644
|
|
with_items:
|
|
- "{{ wazuh_agent_authd.ssl_agent_cert }}"
|
|
- "{{ wazuh_agent_authd.ssl_agent_key }}"
|
|
when:
|
|
- wazuh_agent_authd.ssl_agent_cert is not none
|
|
- wazuh_agent_authd.ssl_agent_key is not none
|
|
|
|
- name: Linux | Register agent (via authd)
|
|
shell: >
|
|
/var/ossec/bin/agent-auth
|
|
{% if wazuh_agent_authd.agent_name is defined and wazuh_agent_authd.agent_name != None %}
|
|
-A {{ wazuh_agent_authd.agent_name }}
|
|
{% endif %}
|
|
-m {{ wazuh_agent_authd.registration_address }}
|
|
-p {{ wazuh_agent_authd.port }}
|
|
{% if wazuh_agent_nat %} -I "any" {% endif %}
|
|
{% if authd_pass | length > 0 %} -P {{ authd_pass }} {% endif %}
|
|
{% if wazuh_agent_authd.ssl_agent_ca is defined and wazuh_agent_authd.ssl_agent_ca != None %}
|
|
-v "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_ca | basename }}"
|
|
{% endif %}
|
|
{% if wazuh_agent_authd.ssl_agent_cert is defined and wazuh_agent_authd.ssl_agent_cert != None %}
|
|
-x "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_cert | basename }}"
|
|
{% endif %}
|
|
{% if wazuh_agent_authd.ssl_agent_key is defined and wazuh_agent_authd.ssl_agent_key != None %}
|
|
-k "/var/ossec/etc/{{ wazuh_agent_authd.ssl_agent_key | basename }}"
|
|
{% endif %}
|
|
{% if wazuh_agent_authd.ssl_auto_negotiate == 'yes' %} -a {% endif %}
|
|
{% if wazuh_agent_authd.groups is defined and wazuh_agent_authd.groups | length > 0 %}
|
|
-G "{{ wazuh_agent_authd.groups | join(',') }}"
|
|
{% endif %}
|
|
register: agent_auth_output
|
|
notify: restart wazuh-agent
|
|
vars:
|
|
agent_name: "{% if single_agent_name is defined %}{{ single_agent_name }}{% else %}{{ ansible_hostname }}{% endif %}"
|
|
when:
|
|
- not check_keys.stat.exists or check_keys.stat.size == 0
|
|
- wazuh_agent_authd.registration_address is not none
|
|
|
|
- name: Linux | Verify agent registration
|
|
shell: echo {{ agent_auth_output }} | grep "Valid key created"
|
|
when:
|
|
- not check_keys.stat.exists or check_keys.stat.size == 0
|
|
- wazuh_agent_authd.registration_address is not none
|
|
|
|
when:
|
|
- wazuh_agent_authd.enable
|
|
- not wazuh_agent_config.enrollment.enabled | length > 0 or wazuh_agent_config.enrollment.enabled == 'no'
|
|
tags:
|
|
- config
|
|
- authd
|
|
|
|
- name: Linux | Agent registration via rest-API
|
|
block:
|
|
|
|
- name: Establish target Wazuh Manager for registration task
|
|
set_fact:
|
|
target_manager: '{{ manager_primary | length | ternary(manager_primary, manager_fallback) | first }}'
|
|
vars:
|
|
manager_primary: "{{ wazuh_managers | selectattr('register','true') | list }}"
|
|
manager_fallback: "{{ wazuh_managers | list }}"
|
|
|
|
- name: Linux | Obtain JWT Token
|
|
uri:
|
|
url: '{{ target_manager.api_proto }}://{{ target_manager.address }}:{{ target_manager.api_port }}/security/user/authenticate'
|
|
method: GET
|
|
url_username: '{{ target_manager.api_user }}'
|
|
url_password: '{{ api_pass }}'
|
|
status_code: 200
|
|
return_content: yes
|
|
force_basic_auth: yes
|
|
validate_certs: '{{ target_manager.validate_certs | default(false) }}'
|
|
no_log: '{{ wazuh_agent_nolog_sensible | bool }}'
|
|
delegate_to: '{{ ansible_host if wazuh_api_reachable_from_agent else "localhost" }}'
|
|
changed_when: api_jwt_result.json.error == 0
|
|
register: api_jwt_result
|
|
become: no
|
|
tags:
|
|
- config
|
|
- api
|
|
|
|
- name: Linux | Create the agent key via rest-API
|
|
uri:
|
|
url: "{{ wazuh_managers.0.api_proto }}://{{ wazuh_agent_authd.registration_address }}:{{ wazuh_managers.0.api_port }}/agents/"
|
|
validate_certs: false
|
|
method: POST
|
|
body: '{"name":"{{ agent_name }}"}'
|
|
body_format: json
|
|
status_code: 200
|
|
headers:
|
|
Content-Type: "application/json"
|
|
user: "{{ wazuh_managers.0.api_user }}"
|
|
password: "{{ api_pass }}"
|
|
register: newagent_api
|
|
delegate_to: "{{ 'localhost' if not wazuh_api_reachable_from_agent else inventory_hostname }}"
|
|
become: no
|
|
changed_when: newagent_api.json.error == 0
|
|
when:
|
|
- not check_keys.stat.exists or check_keys.stat.size == 0
|
|
- wazuh_managers.0.address is not none
|
|
tags:
|
|
- config
|
|
- api
|
|
|
|
- name: Linux | Retrieve new agent data via rest-API
|
|
uri:
|
|
url: >-
|
|
"{{ wazuh_managers.0.api_proto }}://{{ wazuh_agent_authd.registration_address
|
|
}}:{{ wazuh_managers.0.api_port }}/agents/{{ newagent_api.json.data.id }}"
|
|
validate_certs: false
|
|
method: GET
|
|
return_content: true
|
|
user: "{{ wazuh_managers.0.api_user }}"
|
|
password: "{{ api_pass }}"
|
|
when:
|
|
- not check_keys.stat.exists or check_keys.stat.size == 0
|
|
- wazuh_agent_authd.registration_address is not none
|
|
- newagent_api.json.error == 0
|
|
register: newagentdata_api
|
|
delegate_to: "{{ 'localhost' if not wazuh_api_reachable_from_agent else inventory_hostname }}"
|
|
become: no
|
|
tags:
|
|
- config
|
|
- api
|
|
|
|
- name: Linux | Register agent (via rest-API)
|
|
command: /var/ossec/bin/manage_agents
|
|
environment:
|
|
OSSEC_ACTION: i
|
|
OSSEC_AGENT_NAME: '{{ newagentdata_api.json.data.name }}'
|
|
OSSEC_AGENT_IP: '{% if wazuh_agent_nat %}any{% else %}{{ newagentdata_api.json.data.ip }}{% endif %}'
|
|
OSSEC_AGENT_ID: '{{ newagent_api.json.data.id }}'
|
|
OSSEC_AGENT_KEY: '{{ newagent_api.json.data.key }}'
|
|
OSSEC_ACTION_CONFIRMED: y
|
|
register: manage_agents_output
|
|
when:
|
|
- not check_keys.stat.exists or check_keys.stat.size == 0
|
|
- wazuh_agent_authd.registration_address is not none
|
|
- newagent_api.json.error == 0
|
|
notify: restart wazuh-agent
|
|
|
|
when:
|
|
- not wazuh_agent_authd.enable
|
|
- not wazuh_agent_config.enrollment.enabled | length > 0 or wazuh_agent_config.enrollment.enabled == 'no'
|
|
tags:
|
|
- config
|
|
- api
|
|
|
|
- name: Linux | Installing agent configuration (ossec.conf)
|
|
template:
|
|
src: var-ossec-etc-ossec-agent.conf.j2
|
|
dest: /var/ossec/etc/ossec.conf
|
|
owner: root
|
|
group: ossec
|
|
mode: 0644
|
|
notify: restart wazuh-agent
|
|
tags:
|
|
- init
|
|
- config
|
|
|
|
- name: Linux | Installing local_internal_options.conf
|
|
template:
|
|
src: var-ossec-etc-local-internal-options.conf.j2
|
|
dest: /var/ossec/etc/local_internal_options.conf
|
|
owner: root
|
|
group: ossec
|
|
mode: 0640
|
|
notify: restart wazuh-agent
|
|
tags:
|
|
- init
|
|
- config
|
|
|
|
- name: Create auto-enrollment password file
|
|
template:
|
|
src: authd_pass.j2
|
|
dest: "/var/ossec/etc/authd.pass"
|
|
owner: ossec
|
|
group: ossec
|
|
mode: 0640
|
|
when:
|
|
- wazuh_agent_config.enrollment.enabled == 'yes'
|
|
- wazuh_agent_config.enrollment.authorization_pass_path | length > 0
|
|
- authd_pass | length > 0
|
|
tags:
|
|
- config
|
|
|
|
- name: Linux | Ensure Wazuh Agent service is started and enabled
|
|
service:
|
|
name: wazuh-agent
|
|
enabled: true
|
|
state: started
|
|
tags: config
|
|
|
|
- include_tasks: "RMRedHat.yml"
|
|
when:
|
|
- ansible_os_family == "RedHat"
|
|
- not wazuh_agent_sources_installation.enabled
|
|
|
|
- include_tasks: "RMDebian.yml"
|
|
when:
|
|
- ansible_os_family == "Debian"
|
|
- not wazuh_agent_sources_installation.enabled
|