Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add demo certificates to Indexer packages #566

Merged
merged 3 commits into from
Nov 27, 2024
Merged

Add demo certificates to Indexer packages #566

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
60839c3
Add demo certificates to Indexer packages
f-galland Nov 26, 2024
0129c1f
Format files
AlexRuiz7 Nov 26, 2024
1aeb8b6
Roll back hard coded certs changes
f-galland Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 18 additions & 6 deletions build-scripts/assemble.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,9 +159,9 @@ function parse_args() {
# ====
function add_configuration_files() {
# Add our settings to the configuration files
cat "$PATH_CONF/security/roles.wazuh.yml" >> "$PATH_CONF/opensearch-security/roles.yml"
cat "$PATH_CONF/security/roles_mapping.wazuh.yml" >> "$PATH_CONF/opensearch-security/roles_mapping.yml"
cat "$PATH_CONF/security/roles.wazuh.yml" >>"$PATH_CONF/opensearch-security/roles.yml"
cat "$PATH_CONF/security/roles_mapping.wazuh.yml" >>"$PATH_CONF/opensearch-security/roles_mapping.yml"

cp "$PATH_CONF/opensearch.prod.yml" "$PATH_CONF/opensearch.yml"

rm -r "$PATH_CONF/security"
Expand All @@ -188,9 +188,16 @@ function add_wazuh_tools() {
local download_url
download_url="https://packages-dev.wazuh.com/${version}"

curl -sL "${download_url}/config.yml" -o "$PATH_PLUGINS/opensearch-security/tools/config.yml"
curl -sL "${download_url}/wazuh-passwords-tool.sh" -o "$PATH_PLUGINS/opensearch-security/tools/wazuh-passwords-tool.sh"
curl -sL "${download_url}/wazuh-certs-tool.sh" -o "$PATH_PLUGINS/opensearch-security/tools/wazuh-certs-tool.sh"
curl -sL "${download_url}/config.yml" -o "$PATH_PLUGINS"/opensearch-security/tools/config.yml
curl -sL "${download_url}/wazuh-passwords-tool.sh" -o "$PATH_PLUGINS"/opensearch-security/tools/wazuh-passwords-tool.sh
curl -sL "${download_url}/wazuh-certs-tool.sh" -o "$PATH_PLUGINS"/opensearch-security/tools/wazuh-certs-tool.sh
}

# ====
# Add demo certificates installer
# ====
function add_demo_certs_installer() {
cp install-demo-certificates.sh "$PATH_PLUGINS"/opensearch-security/tools/
}

# ====
Expand Down Expand Up @@ -282,6 +289,7 @@ function assemble_tar() {
# Install plugins
install_plugins "${version}"
fix_log_rotation "${PATH_CONF}"
add_demo_certs_installer
# Swap configuration files
add_configuration_files
remove_unneeded_files
Expand Down Expand Up @@ -322,6 +330,7 @@ function assemble_rpm() {
install_plugins "${version}"
fix_log_rotation ${PATH_CONF}
enable_performance_analyzer_rca ${src_path}
add_demo_certs_installer
# Swap configuration files
add_configuration_files
remove_unneeded_files
Expand Down Expand Up @@ -376,6 +385,7 @@ function assemble_deb() {
install_plugins "${version}"
fix_log_rotation ${PATH_CONF}
enable_performance_analyzer_rca ${src_path}
add_demo_certs_installer
# Swap configuration files
add_configuration_files
remove_unneeded_files
Expand Down Expand Up @@ -421,6 +431,8 @@ function main() {
TMP_DIR="${OUTPUT}/tmp/${TARGET}"
mkdir -p "$TMP_DIR"
cp "${OUTPUT}/dist/$ARTIFACT_BUILD_NAME" "${TMP_DIR}"
# Copy the demo certificates generator
cp distribution/packages/src/common/scripts/install-demo-certificates.sh "$TMP_DIR"

case $PACKAGE in
tar)
Expand Down
54 changes: 54 additions & 0 deletions distribution/packages/src/common/scripts/install-demo-certificates.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
#!/bin/sh
#
# SPDX-License-Identifier: Apache-2.0
#
# The OpenSearch Contributors require contributions made to
# this file be licensed under the Apache-2.0 license or a
# compatible open source license.

# Directories
TMP_DIR="/tmp/wazuh-indexer/certs"
CERTS_DIR="/etc/wazuh-indexer/certs"

# Create directories
mkdir -p "$TMP_DIR"

# Root CA
openssl genrsa -out "$TMP_DIR/root-ca-key-temp.pem" 2048
openssl req -new -x509 -sha256 -key "$TMP_DIR/root-ca-key-temp.pem" -subj "/OU=Wazuh/O=Wazuh/L=California/" -out "$TMP_DIR/root-ca.pem" -days 3650

# Admin cert
openssl genrsa -out "$TMP_DIR/admin-key-temp.pem" 2048
openssl pkcs8 -inform PEM -outform PEM -in "$TMP_DIR/admin-key-temp.pem" -topk8 -nocrypt -v1 PBE-SHA1-3DES -out "$TMP_DIR/admin-key.pem"
openssl req -new -key "$TMP_DIR/admin-key.pem" -subj "/C=US/L=California/O=Wazuh/OU=Wazuh/CN=admin" -out "$TMP_DIR/admin.csr"
openssl x509 -req -in "$TMP_DIR/admin.csr" -CA "$TMP_DIR/root-ca.pem" -CAkey "$TMP_DIR/root-ca-key-temp.pem" -CAcreateserial -sha256 -out "$TMP_DIR/admin.pem" -days 3650

# Node cert
openssl genrsa -out "$TMP_DIR/indexer-key-temp.pem" 2048
openssl pkcs8 -inform PEM -outform PEM -in "$TMP_DIR/indexer-key-temp.pem" -topk8 -nocrypt -v1 PBE-SHA1-3DES -out "$TMP_DIR/indexer-key.pem"
openssl req -new -key "$TMP_DIR/indexer-key.pem" -subj "/C=US/L=California/O=Wazuh/OU=Wazuh/CN=node-0.wazuh.indexer" -out "$TMP_DIR/indexer.csr"
cat <<'INDEXER_EXT' >$TMP_DIR/indexer.ext
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
DNS.2 = *.wazuh.indexer
RID.1 = 1.2.3.4.5
IP.1 = 127.0.0.1
IP.2 = 0:0:0:0:0:0:0:1
INDEXER_EXT

openssl x509 -req -in "$TMP_DIR/indexer.csr" -CA "$TMP_DIR/root-ca.pem" -CAkey "$TMP_DIR/root-ca-key-temp.pem" -CAcreateserial -sha256 -out "$TMP_DIR/indexer.pem" -days 3650 -extfile "$TMP_DIR/indexer.ext"

# Cleanup temporary files
rm "$TMP_DIR/"*.csr "$TMP_DIR"/*.ext "$TMP_DIR"/*.srl "$TMP_DIR"/*-temp.pem

# Move certs to permanent location
mkdir -p "$CERTS_DIR"
mv "$TMP_DIR"/* "$CERTS_DIR/"

chmod 500 "$CERTS_DIR"
chmod 400 "$CERTS_DIR"/*
chown -R wazuh-indexer:wazuh-indexer "$CERTS_DIR"

# Cleanup /tmp directory
rm -r "$TMP_DIR"
19 changes: 12 additions & 7 deletions distribution/packages/src/deb/debian/postinst
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change must be ported to #564

Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@ chown -R wazuh-indexer:wazuh-indexer ${data_dir}
chown -R wazuh-indexer:wazuh-indexer ${pid_dir}
chown -R wazuh-indexer:wazuh-indexer ${tmp_dir}


export OPENSEARCH_PATH_CONF=${OPENSEARCH_PATH_CONF:-${config_dir}}
# Apply Performance Analyzer settings, as per https://github.com/opensearch-project/opensearch-build/blob/2.18.0/scripts/pkg/build_templates/current/opensearch/deb/debian/postinst#L28-L37
if ! grep -q '## OpenSearch Performance Analyzer' "$OPENSEARCH_PATH_CONF/jvm.options"; then
Expand All @@ -44,28 +43,34 @@ if ! grep -q '## OpenSearch Performance Analyzer' "$OPENSEARCH_PATH_CONF/jvm.opt
echo "-Djdk.attach.allowAttachSelf=true"
echo "-Djava.security.policy=file://$OPENSEARCH_PATH_CONF/opensearch-performance-analyzer/opensearch_security.policy"
echo "--add-opens=jdk.attach/sun.tools.attach=ALL-UNNAMED"
} >> "$OPENSEARCH_PATH_CONF/jvm.options"
} >>"$OPENSEARCH_PATH_CONF/jvm.options"
fi

# Reload systemctl daemon
if command -v systemctl > /dev/null; then
if command -v systemctl >/dev/null; then
systemctl daemon-reload
fi

# Reload other configs
if command -v systemctl > /dev/null; then
if command -v systemctl >/dev/null; then
systemctl restart systemd-sysctl.service || true
fi

if command -v systemd-tmpfiles > /dev/null; then
if command -v systemd-tmpfiles >/dev/null; then
systemd-tmpfiles --create wazuh-indexer.conf
fi

if ! [ -d "${config_dir}/certs" ] && [ -f "${product_dir}/plugins/opensearch-security/tools/install-demo-certificates.sh" ]; then
echo "No certificates detected in ${config_dir}, installing demo certificates..."
echo "### If you are using a custom certificates path, ignore this message."
bash "${product_dir}/plugins/opensearch-security/tools/install-demo-certificates.sh" >"${log_dir}/install_demo_certificates.log" 2>&1
fi

if [ -f $restart_service ]; then
rm -f $restart_service
echo "Restarting wazuh-indexer service..."
if command -v systemctl > /dev/null; then
systemctl restart wazuh-indexer.service > /dev/null 2>&1
if command -v systemctl >/dev/null; then
systemctl restart wazuh-indexer.service >/dev/null 2>&1
fi
exit 0
fi
Expand Down
6 changes: 6 additions & 0 deletions distribution/packages/src/rpm/wazuh-indexer.rpm.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,12 @@ if command -v systemd-tmpfiles > /dev/null; then
systemd-tmpfiles --create %{name}.conf
fi

if ! [ -d %{config_dir}/certs ] && [ -f %{product_dir}/plugins/opensearch-security/tools/install-demo-certificates.sh ]; then
echo "No certificates detected in %{config_dir}, installing demo certificates..."
echo "### If you are using a custom certificates path, ignore this message."
bash %{product_dir}/plugins/opensearch-security/tools/install-demo-certificates.sh > %{log_dir}/install_demo_certificates.log 2>&1
fi

if [ -f %{tmp_dir}/wazuh-indexer.restart ]; then
rm -f %{tmp_dir}/wazuh-indexer.restart
if command -v systemctl > /dev/null; then
Expand Down