first commit
This commit is contained in:
duffyduck
@@ -0,0 +1,179 @@
|
||||
#!/bin/bash
|
||||
# Einrichtung und Hilfsbefehle fuer den Wazuh-SSH-Pull-Stack.
|
||||
#
|
||||
# ./setup.sh Erstinstallation (Passwoerter, Zertifikate, SSH-Key, Images)
|
||||
# ./setup.sh host-script Skript zum Vorbereiten eines Zielhosts ausgeben
|
||||
# ./setup.sh host-script | ssh admin@host sudo sh
|
||||
# Optionen: --sudo (NOPASSWD-sudo), --tunnel (fuer agent_tunnel),
|
||||
# --user=NAME (Standard wazuh-pull)
|
||||
# ./setup.sh keyscan Host-Keys aller Hosts aus hosts.yml nach ssh/known_hosts
|
||||
# ./setup.sh test SSH-Zugriff und Rechte auf allen Hosts pruefen
|
||||
# ./setup.sh apply hosts.yml uebernehmen (Manager + Collector neu starten)
|
||||
# ./setup.sh passwords Zugangsdaten anzeigen
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")"
|
||||
|
||||
if docker compose version >/dev/null 2>&1; then DC=(docker compose); else DC=(docker-compose); fi
|
||||
|
||||
info() { echo -e "\e[1;32m==>\e[0m $*"; }
|
||||
warn() { echo -e "\e[1;33m!!\e[0m $*" >&2; }
|
||||
die() { echo -e "\e[1;31mFEHLER:\e[0m $*" >&2; exit 1; }
|
||||
|
||||
genpw() {
|
||||
# Erfuellt die Wazuh-API-Richtlinie (Gross, klein, Ziffer, Sonderzeichen) und
|
||||
# enthaelt keine Zeichen, die in den sed-Aufrufen der Wazuh-Images stoeren.
|
||||
echo "$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)Aa1."
|
||||
}
|
||||
|
||||
set_env() { # set_env KEY VALUE
|
||||
if grep -q "^$1=" .env; then sed -i "s|^$1=.*|$1=$2|" .env; else echo "$1=$2" >> .env; fi
|
||||
}
|
||||
|
||||
env_get() { grep "^$1=" .env | cut -d= -f2-; }
|
||||
|
||||
cmd_init() {
|
||||
command -v docker >/dev/null || die "docker fehlt"
|
||||
|
||||
# --- Kernel-Parameter fuer den Indexer ---------------------------------
|
||||
local mmc
|
||||
mmc=$(cat /proc/sys/vm/max_map_count)
|
||||
if [ "$mmc" -lt 262144 ]; then
|
||||
warn "vm.max_map_count ist $mmc (empfohlen 262144). Dauerhaft setzen mit:"
|
||||
warn " echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-wazuh.conf && sudo sysctl --system"
|
||||
fi
|
||||
|
||||
# --- .env + Passwoerter -------------------------------------------------
|
||||
[ -f .env ] || cp .env.example .env
|
||||
for k in INDEXER_PASSWORD DASHBOARD_PASSWORD API_PASSWORD; do
|
||||
if [ -z "$(env_get $k)" ]; then set_env "$k" "$(genpw)"; info "$k erzeugt"; fi
|
||||
done
|
||||
chmod 600 .env
|
||||
local version
|
||||
version=$(env_get WAZUH_VERSION)
|
||||
|
||||
# --- internal_users.yml mit Hashes -------------------------------------
|
||||
if [ ! -f config/wazuh_indexer/internal_users.yml ]; then
|
||||
info "Erzeuge Indexer-Benutzer (Passwort-Hashes)"
|
||||
hash() {
|
||||
docker run --rm -e JAVA_HOME=/usr/share/wazuh-indexer/jdk --entrypoint bash \
|
||||
"wazuh/wazuh-indexer:$version" \
|
||||
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh -p "$1" 2>/dev/null | tail -1
|
||||
}
|
||||
local h_admin h_kibana
|
||||
h_admin=$(hash "$(env_get INDEXER_PASSWORD)")
|
||||
h_kibana=$(hash "$(env_get DASHBOARD_PASSWORD)")
|
||||
[[ $h_admin == \$2* && $h_kibana == \$2* ]] || die "Hash-Erzeugung fehlgeschlagen"
|
||||
cat > config/wazuh_indexer/internal_users.yml <<EOF
|
||||
---
|
||||
# Automatisch erzeugt von setup.sh. Passwoerter stehen in .env.
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
admin:
|
||||
hash: "$h_admin"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$h_kibana"
|
||||
reserved: true
|
||||
description: "Dashboard server user"
|
||||
EOF
|
||||
chmod 644 config/wazuh_indexer/internal_users.yml
|
||||
fi
|
||||
|
||||
# --- TLS-Zertifikate ---------------------------------------------------
|
||||
if [ ! -f config/wazuh_indexer_ssl_certs/root-ca.pem ]; then
|
||||
info "Erzeuge TLS-Zertifikate"
|
||||
mkdir -p config/wazuh_indexer_ssl_certs
|
||||
docker run --rm \
|
||||
-e CERT_TOOL_VERSION="${version%.*}" \
|
||||
-v "$PWD/config/wazuh_indexer_ssl_certs/:/certificates/" \
|
||||
-v "$PWD/config/certs.yml:/config/certs.yml:ro" \
|
||||
wazuh/wazuh-certs-generator:0.0.4
|
||||
[ -f config/wazuh_indexer_ssl_certs/root-ca.pem ] || die "Zertifikate wurden nicht erzeugt"
|
||||
fi
|
||||
|
||||
# --- SSH-Schluessel ----------------------------------------------------
|
||||
if [ ! -f ssh/id_ed25519 ]; then
|
||||
info "Erzeuge SSH-Schluessel ssh/id_ed25519"
|
||||
ssh-keygen -q -t ed25519 -N "" -C "wazuh-sshpull@$(hostname)" -f ssh/id_ed25519
|
||||
fi
|
||||
touch ssh/known_hosts
|
||||
chmod 600 ssh/id_ed25519
|
||||
|
||||
[ -f hosts.yml ] || { cp hosts.yml.example hosts.yml; warn "hosts.yml aus Beispiel angelegt - bitte anpassen!"; }
|
||||
|
||||
info "Baue Images"
|
||||
"${DC[@]}" build
|
||||
|
||||
cat <<EOF
|
||||
|
||||
Fertig. Naechste Schritte:
|
||||
1. hosts.yml anpassen
|
||||
2. Zielhosts vorbereiten: ./setup.sh host-script | ssh admin@HOST sudo sh
|
||||
3. Host-Keys holen: ./setup.sh keyscan (Fingerprints pruefen!)
|
||||
4. Zugriff testen: ./setup.sh test
|
||||
5. Starten: ${DC[*]} up -d
|
||||
6. Dashboard: https://<dieser-server>:$(env_get DASHBOARD_PORT) (admin / siehe ./setup.sh passwords)
|
||||
EOF
|
||||
}
|
||||
|
||||
cmd_host_script() {
|
||||
[ -f ssh/id_ed25519.pub ] || die "ssh/id_ed25519.pub fehlt - erst ./setup.sh ausfuehren"
|
||||
local pub user="wazuh-pull" sudo=no opts="restrict"
|
||||
pub=$(cat ssh/id_ed25519.pub)
|
||||
for a in "$@"; do
|
||||
case "$a" in
|
||||
--sudo) sudo=yes ;;
|
||||
--tunnel) opts='restrict,port-forwarding,permitlisten="127.0.0.1:1514",permitlisten="127.0.0.1:1515",permitopen="127.0.0.1:1"' ;;
|
||||
--user=*) user="${a#--user=}" ;;
|
||||
*) die "unbekannte Option $a" ;;
|
||||
esac
|
||||
done
|
||||
cat <<EOF
|
||||
#!/bin/sh
|
||||
# Vorbereitung eines Hosts fuer Wazuh-SSH-Pull (als root ausfuehren)
|
||||
set -e
|
||||
U='$user'
|
||||
if ! id "\$U" >/dev/null 2>&1; then
|
||||
useradd --system --create-home --shell /bin/sh "\$U" 2>/dev/null || adduser -D -s /bin/sh "\$U"
|
||||
usermod -p '*' "\$U" 2>/dev/null || true # kein Passwort, aber nicht gesperrt (sonst lehnt sshd ab)
|
||||
fi
|
||||
# Leserechte auf Logs: journald (systemd-journal) und /var/log (adm)
|
||||
for g in systemd-journal adm; do
|
||||
getent group "\$g" >/dev/null && usermod -aG "\$g" "\$U" 2>/dev/null || true
|
||||
done
|
||||
H=\$(getent passwd "\$U" | cut -d: -f6)
|
||||
mkdir -p "\$H/.ssh"
|
||||
# restrict: kein PTY, kein Agent-/X11-/Port-Forwarding.
|
||||
# Mit --tunnel nur Reverse-Forwarding auf 127.0.0.1:1514/1515 (fuer agent_tunnel).
|
||||
KEY='$opts $pub'
|
||||
grep -qF '$pub' "\$H/.ssh/authorized_keys" 2>/dev/null || echo "\$KEY" >> "\$H/.ssh/authorized_keys"
|
||||
chown -R "\$U:" "\$H/.ssh"; chmod 700 "\$H/.ssh"; chmod 600 "\$H/.ssh/authorized_keys"
|
||||
EOF
|
||||
if [ "$sudo" = yes ]; then
|
||||
cat <<EOF
|
||||
echo "\$U ALL=(root) NOPASSWD: ALL" > /etc/sudoers.d/wazuh-pull
|
||||
chmod 440 /etc/sudoers.d/wazuh-pull
|
||||
visudo -cf /etc/sudoers.d/wazuh-pull
|
||||
EOF
|
||||
fi
|
||||
echo 'echo "Host vorbereitet: Benutzer $U ($(id $U))"'
|
||||
}
|
||||
|
||||
case "${1:-init}" in
|
||||
init) cmd_init ;;
|
||||
host-script) shift; cmd_host_script "$@" ;;
|
||||
keyscan) "${DC[@]}" run --rm --no-deps sshpull.collector keyscan ;;
|
||||
test) "${DC[@]}" run --rm --no-deps sshpull.collector test ;;
|
||||
apply) "${DC[@]}" up -d --force-recreate wazuh.manager sshpull.collector ;;
|
||||
passwords)
|
||||
echo "Dashboard: admin / $(env_get INDEXER_PASSWORD)"
|
||||
echo "Wazuh-API: wazuh-wui / $(env_get API_PASSWORD)"
|
||||
;;
|
||||
*) sed -n '2,13p' "$0"; exit 2 ;;
|
||||
esac
|
||||
Reference in New Issue
Block a user