Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add setcap for node fallback #226

Merged
merged 1 commit into from
Jul 1, 2024
Merged

Conversation

lucianogorza
Copy link
Member

@lucianogorza lucianogorza commented Jun 27, 2024

Description

This PR fixes compatibility with certain operating systems that require older versions of node.

Issues Resolved

#223

Test

  1. Generate wazuh-dashboard rpm package by followign this documentation.
  2. Create Vagrant box: bento/amazonlinux-2
  3. Perform step by step installation with these considerations(v4.9.0).
  • In the Dashboard installation use the generated package:
yum -y install [package_name]
  1. Wait around 10 seconds. Check the Wazuh dashboard status with
systemctl status wazuh-dashboard.

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

@lucianogorza lucianogorza self-assigned this Jun 27, 2024
@lucianogorza lucianogorza linked an issue Jun 27, 2024 that may be closed by this pull request
@lucianogorza lucianogorza marked this pull request as ready for review July 1, 2024 15:19
Copy link
Member

@Tostti Tostti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test

OS
[root@vagrant vagrant]# cat /etc/os-release
NAME="Amazon Linux"
VERSION="2"
ID="amzn"
ID_LIKE="centos rhel fedora"
VERSION_ID="2"
PRETTY_NAME="Amazon Linux 2"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"
HOME_URL="https://amazonlinux.com/"
SUPPORT_END="2025-06-30"
Installation
[root@vagrant vagrant]# curl -sO https://packages.wazuh.com/4.8/wazuh-certs-tool.sh
4.8/config.yml[root@vagrant vagrant]# curl -sO https://packages.wazuh.com/4.8/config.yml
[root@vagrant vagrant]# nano config.yml
[root@vagrant vagrant]# bash ./wazuh-certs-tool.sh -A
01/07/2024 18:00:31 INFO: Generating the root certificate.
01/07/2024 18:00:31 INFO: Generating Admin certificates.
01/07/2024 18:00:31 INFO: Admin certificates created.
01/07/2024 18:00:31 INFO: Generating Wazuh indexer certificates.
01/07/2024 18:00:31 INFO: Wazuh indexer certificates created.
01/07/2024 18:00:31 INFO: Generating Filebeat certificates.
01/07/2024 18:00:32 INFO: Wazuh Filebeat certificates created.
01/07/2024 18:00:32 INFO: Generating Wazuh dashboard certificates.
01/07/2024 18:00:32 INFO: Wazuh dashboard certificates created.
[root@vagrant vagrant]# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./root-ca.key
./root-ca.pem
./admin-key.pem
./admin.pem
./node-1-key.pem
./node-1.pem
./wazuh-1-key.pem
./wazuh-1.pem
./dashboard-key.pem
./dashboard.pem
[root@vagrant vagrant]# rm -rf ./wazuh-certificates
[root@vagrant vagrant]# yum install coreutils
Loaded plugins: langpacks, priorities, update-motd
amzn2extra-docker                                                                                | 2.9 kB  00:00:00
(1/2): amzn2extra-docker/2/x86_64/updateinfo                                                     |  16 kB  00:00:00
(2/2): amzn2extra-docker/2/x86_64/primary_db                                                     | 102 kB  00:00:00
Package coreutils-8.22-24.amzn2.x86_64 already installed and latest version
Nothing to do
[root@vagrant vagrant]# rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
[root@vagrant vagrant]# echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages-dev.wazuh.com/pre-release/yum/\nprotect=1' | tee /etc/yum.repos.d/wa
zuh.repo
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages-dev.wazuh.com/pre-release/yum/
protect=1
[root@vagrant vagrant]# yum -y install wazuh-indexer
Loaded plugins: langpacks, priorities, update-motd
wazuh                                                                                            | 3.4 kB  00:00:00
wazuh/primary_db                                                                                 | 469 kB  00:00:00
Resolving Dependencies
--> Running transaction check
---> Package wazuh-indexer.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================
 Package                          Arch                      Version                      Repository                Size
========================================================================================================================
Installing:
 wazuh-indexer                    x86_64                    4.9.0-1                      wazuh                    813 M

Transaction Summary
========================================================================================================================
Install  1 Package

Total download size: 813 M
Installed size: 1.0 G
Downloading packages:
wazuh-indexer-4.9.0-1.x86_64.rpm                                                                 | 813 MB  00:00:48
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-indexer-4.9.0-1.x86_64                                                                         1/1
### NOT starting on installation, please execute the following statements to configure wazuh-indexer service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable wazuh-indexer.service
### You can start wazuh-indexer service by executing
 sudo systemctl start wazuh-indexer.service
  Verifying  : wazuh-indexer-4.9.0-1.x86_64                                                                         1/1

Installed:
  wazuh-indexer.x86_64 0:4.9.0-1

Complete!
[root@vagrant vagrant]# NODE_NAME=node-1
[root@vagrant vagrant]# mkdir /etc/wazuh-indexer/certs
$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
chmod 500 /etc/wazuh-indexer/certs
chmod 400 /etc/wazuh-indexer/certs/*
chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -Cpem ./admin.pem ./admin-key.pem ./root-ca.pem/$NODE_NAME-key.
[root@vagrant vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@vagrant vagrant]# mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@vagrant vagrant]# chmod 500 /etc/wazuh-indexer/certs
[root@vagrant vagrant]# chmod 400 /etc/wazuh-indexer/certs/*
[root@vagrant vagrant]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
[root@vagrant vagrant]# systemctl daemon-reload
 start wazuh-indexer[root@vagrant vagrant]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@vagrant vagrant]# systemctl start wazuh-indexer
[root@vagrant vagrant]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.13.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
[root@vagrant vagrant]# yum -y install wazuh-manager
Loaded plugins: langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package wazuh-manager.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================
 Package                          Arch                      Version                      Repository                Size
========================================================================================================================
Installing:
 wazuh-manager                    x86_64                    4.9.0-1                      wazuh                    300 M

Transaction Summary
========================================================================================================================
Install  1 Package

Total download size: 300 M
Installed size: 893 M
Downloading packages:
wazuh-manager-4.9.0-1.x86_64.rpm                                                                 | 300 MB  00:00:07
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-manager-4.9.0-1.x86_64                                                                         1/1
  Verifying  : wazuh-manager-4.9.0-1.x86_64                                                                         1/1

Installed:
  wazuh-manager.x86_64 0:4.9.0-1

Complete!
[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v
Switch value: -v not found.

Usage: wazuh-keystore <option(s)>
Options:
        -h                      Show this help message
        -f COLUMN_FAMILY        Specifies the target column family for the insertion.
        -k KEY                  Specifies the key for the key-value pair.
        -v VALUE                Specifies the value associated with the key.

Example:
        ./wazuh-keystore -f indexer -k username -v admin

[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v admin
[root@vagrant vagrant]# /var/ossec/bin/wazuh-keystore -f indexer -k password -v admin
[root@vagrant vagrant]# yum -y install filebeat
Loaded plugins: langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package filebeat.x86_64 0:7.10.2-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================
 Package                      Arch                       Version                        Repository                 Size
========================================================================================================================
Installing:
 filebeat                     x86_64                     7.10.2-1                       wazuh                      21 M

Transaction Summary
========================================================================================================================
Install  1 Package

Total download size: 21 M
Installed size: 70 M
Downloading packages:
filebeat-oss-7.10.2-x86_64.rpm                                                                   |  21 MB  00:00:03
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : filebeat-7.10.2-1.x86_64                                                                             1/1
  Verifying  : filebeat-7.10.2-1.x86_64                                                                             1/1

Installed:
  filebeat.x86_64 0:7.10.2-1

Complete!
[root@vagrant vagrant]# curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.8/tpl/wazuh/filebeat/filebeat.yml
[root@vagrant vagrant]# filebeat keystore create
Created filebeat keystore
[root@vagrant vagrant]# echo admin | filebeat keystore add username --stdin --force
Successfully updated the keystore
[root@vagrant vagrant]# echo admin | filebeat keystore add password --stdin --force
Successfully updated the keystore
[root@vagrant vagrant]# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.8.0/extensions/elasticsearch/7.x/wazuh-template.json
[root@vagrant vagrant]# chmod go+r /etc/filebeat/wazuh-template.json
[root@vagrant vagrant]# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
wazuh/
wazuh/_meta/
wazuh/_meta/docs.asciidoc
wazuh/_meta/fields.yml
wazuh/_meta/config.yml
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/manifest.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/module.yml
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/manifest.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
[root@vagrant vagrant]# NODE_NAME=wazuh-1
[root@vagrant vagrant]# mkdir /etc/filebeat/certs
f ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
mv -n /et[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-/root-ca.pem
c/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
chmod 500 /etc/filebeat/certs
chmod 400 /etc/filebeat/certs/*
chown -R root:root /etc/filebeat/certs[root@vagrant vagrant]# mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
[root@vagrant vagrant]# mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
[root@vagrant vagrant]# chmod 500 /etc/filebeat/certs
[root@vagrant vagrant]# chmod 400 /etc/filebeat/certs/*
[root@vagrant vagrant]# chown -R root:root /etc/filebeat/certs
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable wazuh-manager
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service.
[root@vagrant vagrant]# systemctl start wazuh-manager
[root@vagrant vagrant]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2024-07-01 18:05:31 UTC; 1s ago
  Process: 6856 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/wazuh-manager.service
           ├─6921 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─6961 /var/ossec/bin/wazuh-authd
           ├─6975 /var/ossec/bin/wazuh-db
           ├─6987 /var/ossec/bin/wazuh-execd
           ├─7013 /var/ossec/bin/wazuh-analysisd
           ├─7017 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─7020 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─7023 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
           ├─7036 /var/ossec/bin/wazuh-syscheckd
           ├─7102 /var/ossec/bin/wazuh-remoted
           ├─7137 /var/ossec/bin/wazuh-logcollector
           ├─7155 /var/ossec/bin/wazuh-monitord
           ├─7186 /var/ossec/bin/wazuh-modulesd
           ├─7555 sh -c  yum check-updates --security | grep "No packages"
           ├─7557 /usr/bin/python /usr/bin/yum check-updates --security
           └─7558 grep No packages

Jul 01 18:05:22 vagrant env[6856]: Started wazuh-syscheckd...
Jul 01 18:05:23 vagrant env[6856]: Started wazuh-remoted...
Jul 01 18:05:23 vagrant env[6856]: Started wazuh-logcollector...
Jul 01 18:05:27 vagrant env[6856]: Started wazuh-monitord...
Jul 01 18:05:27 vagrant env[6856]: 2024/07/01 18:05:27 wazuh-modulesd:router: INFO: Loaded router module.
Jul 01 18:05:27 vagrant env[6856]: 2024/07/01 18:05:27 wazuh-modulesd:content_manager: INFO: Loaded content_man...odule.
Jul 01 18:05:29 vagrant env[6856]: Started wazuh-modulesd...
Jul 01 18:05:30 vagrant crontab[7484]: (root) LIST (root)
Jul 01 18:05:31 vagrant env[6856]: Completed.
Jul 01 18:05:31 vagrant systemd[1]: Started Wazuh manager.
Hint: Some lines were ellipsized, use -l to show in full.
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable filebeat
Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service.
[root@vagrant vagrant]# systemctl start filebeat
[root@vagrant vagrant]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@vagrant vagrant]# yum install libcap
Loaded plugins: langpacks, priorities, update-motd
Package libcap-2.54-1.amzn2.0.2.x86_64 already installed and latest version
Nothing to do
[root@vagrant vagrant]# yum -y install ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm
Loaded plugins: langpacks, priorities, update-motd
Examining ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm: wazuh-dashboard-4.9.0-1.x86_64
Marking ./wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package wazuh-dashboard.x86_64 0:4.9.0-1 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================
 Package                  Arch            Version             Repository                                           Size
========================================================================================================================
Installing:
 wazuh-dashboard          x86_64          4.9.0-1             /wazuh-dashboard_4.9.0-1_x86_64_0b4730c68e          889 M

Transaction Summary
========================================================================================================================
Install  1 Package

Total size: 889 M
Installed size: 889 M
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : wazuh-dashboard-4.9.0-1.x86_64                                                                       1/1
  Verifying  : wazuh-dashboard-4.9.0-1.x86_64                                                                       1/1

Installed:
  wazuh-dashboard.x86_64 0:4.9.0-1

Complete!
[root@vagrant vagrant]# NODE_NAME=dashboard
[root@vagrant vagrant]# mkdir /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# tar -xf ./wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
[root@vagrant vagrant]# mv -n /etc/wazuh-dashboard/certs/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
mv: ‘/etc/wazuh-dashboard/certs/dashboard.pem’ and ‘/etc/wazuh-dashboard/certs/dashboard.pem’ are the same file
[root@vagrant vagrant]# mv -n /etc/wazuh-dashboard/certs/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
mv: ‘/etc/wazuh-dashboard/certs/dashboard-key.pem’ and ‘/etc/wazuh-dashboard/certs/dashboard-key.pem’ are the same file
[root@vagrant vagrant]# chmod 500 /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# chmod 400 /etc/wazuh-dashboard/certs/*
[root@vagrant vagrant]# chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
[root@vagrant vagrant]# systemctl daemon-reload
[root@vagrant vagrant]# systemctl enable wazuh-dashboard
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service to /etc/systemd/system/wazuh-dashboard.service.
[root@vagrant vagrant]# systemctl start wazuh-dashboard
[root@vagrant vagrant]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Mon 2024-07-01 18:09:16 UTC; 33s ago
 Main PID: 9006 (node)
   CGroup: /system.slice/wazuh-dashboard.service
           └─9006 /usr/share/wazuh-dashboard/node/fallback/bin/node /usr/share/wazuh-dashboard/src/cli/dist -c /etc/w...

image

Test ✅

CR ✅

LGTM

@Tostti Tostti merged commit bd30be4 into 4.9.0 Jul 1, 2024
60 checks passed
@Tostti Tostti deleted the bug/223-add-setcap-for-node-fallback branch July 1, 2024 18:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BUG] Wazuh dashboard 4.9.0 fails in AL2
2 participants