diff --git a/README.md b/README.md index f239c24f36b5285798652b0439709a98288d9bae..73d38f2b9f06e332af5d8b40fb4ea85064b92f1a 100644 --- a/README.md +++ b/README.md @@ -32,9 +32,17 @@ In addition to Wazuh, ClamAV is also installed on agent machines. 2. Select your `ENVIRONMENT` in `Makefile`. Set it to `full-setup` or `no-collector` (for development purposes, when `evidence-collector` runs on local machine). -> Note: Docker registry credentials used for pulling Evidence Collector are located in `/ansible/docker/credentials/credentials.yml`. They don't need to be changed unless you explicitly want to use other registry. + > Note: Docker registry credentials used for pulling Evidence Collector are located in `/ansible/docker/credentials/credentials.yml`. They don't need to be changed unless you explicitly want to use other registry. -3. Create and provision VMs: +3. If you're using `full-setup` environment, you can set custom environment variable (that will be passed to `evidence-collector`) in `/environments/full-setup/.env`. + + If you wish to set or remove custom resource ID mapping scheme used by `evidence-collector`, you can change mapped values inside `/environments/full-setup/resource-id-map.json`. + + See [Evidence collector's documentation](https://git.code.tecnalia.com/medina/wp3/task_3.2/evidence-collector) for more information. + + > Note: neither of these two files has to be changed for `security-monitoring` to work. You can (and should; in case of `.env`) leave them unchanged. + +4. Create and provision VMs: ``` $ make create provision @@ -173,7 +181,11 @@ Wazuh manager and Evidence collector should be installed on the same, clean mach | `elasticsearch_host_ip` | IP of the machine running Elasticsearch (same as Wazuh manager). | | `wazuh_manager_ip` | IP of the machine running Wazuh manager. | -6. Provision: +6. Set custom resource ID mapping scheme used by `evidence-collector`. Change it in `/custom-provision/resource-id-map.json`. + + > Note: this doesn't need to be changed or set for it to work. + +7. Provision: ``` $ make -B custom-provision @@ -187,7 +199,7 @@ To troubleshoot in more details, check the logs in `/var/ossec/logs/ossec.log` a Two of the most common problems (often times in tandem) are [missing open ports](https://documentation.wazuh.com/current/user-manual/agent-enrollment/troubleshooting.html#testing-communication-with-wazuh-manager) and [invalid agent names](https://documentation.wazuh.com/current/user-manual/agent-enrollment/troubleshooting.html#invalid-agent-name-for-enrollment) (if agent machine's hostname matches hostname of any already existing Wazuh machine). -To enable required ports, run the following commands on Wazuh manager machine: +Current version of `security-monitoring` automatically opens required ports on the manager (using Ansible, see `ansible/provision-managers.yml`). However, if that fails, run the following commands on Wazuh manager machine to enable required ports: ``` $ sudo firewall-cmd --zone=public --add-port=1514/tcp --permanent diff --git a/ansible/provision-evidence-collector.yml b/ansible/provision-evidence-collector.yml index 5cf26f6605cd32010a675a670db99c7cf9d8e351..f0d5741e07d1d7f559c569f4ea530b5049f941f9 100644 --- a/ansible/provision-evidence-collector.yml +++ b/ansible/provision-evidence-collector.yml @@ -20,14 +20,20 @@ ansible_python_interpreter: /usr/bin/python3.6 - name: Create 'evidence-collector' directory file: - path: /home/security-monitoring + path: /home/evidence-collector state: directory owner: "{{ ansible_ssh_user }}" group: "{{ ansible_ssh_user }}" - name: Copy .env file copy: src: "{{ environment_dir }}/.env" - dest: /home/security-monitoring/.env + dest: /home/evidence-collector/.env + owner: "{{ ansible_ssh_user }}" + group: "{{ ansible_ssh_user }}" + - name: Copy resource-id-map.json file + copy: + src: "{{ environment_dir }}/resource-id-map.json" + dest: /home/evidence-collector/resource-id-map.json owner: "{{ ansible_ssh_user }}" group: "{{ ansible_ssh_user }}" - name: Log in to Docker image registry @@ -44,6 +50,7 @@ state: started pull: yes restart_policy: always - env_file: /home/security-monitoring/.env + env_file: /home/evidence-collector/.env + volumes: /home/evidence-collector/resource-id-map.json:/evidence-collector/resource_id_map.json vars: ansible_python_interpreter: /usr/bin/python3.6 \ No newline at end of file diff --git a/ansible/provision-managers.yml b/ansible/provision-managers.yml index 6b57603e940504b9535568ca27bfc5ca698bd0bc..9447c0f0c533b3733d81d1753f1a0129c8140bf3 100644 --- a/ansible/provision-managers.yml +++ b/ansible/provision-managers.yml @@ -30,4 +30,25 @@ instances: node1: name: node-1 # Important: must be equal to elasticsearch_node_name. - ip: "{{ elasticsearch_host_ip }}" \ No newline at end of file + ip: "{{ elasticsearch_host_ip }}" + tasks: + - name: Install firewalld + action: yum name=firewalld state=installed + - name: Enable firewalld on system reboot + service: name=firewalld enabled=yes + - name: Start service firewalld, if not started + service: + name: firewalld + state: started + - name: Enable required ports + firewalld: + permanent: yes + immediate: yes + port: "{{item.port}}/{{item.proto}}" + state: "{{item.state}}" + zone: "{{item.zone}}" + with_items: + - {port: "1514", proto: "tcp", state: "enabled", zone: "public"} + - {port: "1515", proto: "tcp", state: "enabled", zone: "public"} + - {port: "55000", proto: "tcp", state: "enabled", zone: "public"} + - {port: "5601", proto: "tcp", state: "enabled", zone: "public"} \ No newline at end of file diff --git a/custom-provision/resource-id-map.json b/custom-provision/resource-id-map.json new file mode 100644 index 0000000000000000000000000000000000000000..1aeae553f456b718ee2ad6a1c61639c87ff9c8f1 --- /dev/null +++ b/custom-provision/resource-id-map.json @@ -0,0 +1,5 @@ +{ + "manager": "wazuh_manager", + "agent1": "wazuh_agent_1", + "agent2": "wazuh_agent_2" +} \ No newline at end of file diff --git a/environments/full-setup/resource-id-map.json b/environments/full-setup/resource-id-map.json new file mode 100644 index 0000000000000000000000000000000000000000..143a5df626e4b275b0f185eb2b633d4a93d174cb --- /dev/null +++ b/environments/full-setup/resource-id-map.json @@ -0,0 +1,5 @@ +{ + "manager": "test_wazuh_manager", + "agent1": "test_wazuh_agent_1", + "agent2": "test_wazuh_agent_2" +} \ No newline at end of file