Setup erkennt Docker oder Podman und deployt entsprechend
- setup.sh erkennt Engine (Docker, Podman, podman-docker-Wrapper) und Compose-Werkzeug (docker compose, docker-compose, podman-compose, podman compose) - Rootless Podman wird mit Hinweis abgelehnt (Ulimits, Port 443, Zertifikatsrechte) - Als root: vm.max_map_count, firewalld-Port und podman-restart.service setzen - Neue Befehle: up, down, ps, logs, info; WAZUH_SKIP_SYSCTL und CONTAINER_ENGINE - Images voll qualifiziert (docker.io/..., localhost/...) wegen Podman-Short-Name-Policy - Bind-Mounts mit :z fuer SELinux (RHEL) - README: Abschnitt Red Hat / Podman, Befehle ueber setup.sh Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
duffyduck
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
8ddceda9e2
commit
61232af61c
@@ -1,7 +1,12 @@
|
||||
#!/bin/bash
|
||||
# Einrichtung und Hilfsbefehle fuer den Wazuh-SSH-Pull-Stack.
|
||||
# Einrichtung und Betrieb des Wazuh-SSH-Pull-Stacks.
|
||||
# Erkennt selbst, ob Docker oder Podman vorhanden ist (RHEL: Podman), und das passende
|
||||
# Compose-Werkzeug (docker compose, docker-compose, podman-compose, podman compose).
|
||||
#
|
||||
# ./setup.sh Erstinstallation (Passwoerter, Zertifikate, SSH-Key, Images)
|
||||
# ./setup.sh up Stack starten (+ Kernel-Parameter, Firewall, Autostart als root)
|
||||
# ./setup.sh down Stack stoppen
|
||||
# ./setup.sh ps | logs [dienst]
|
||||
# ./setup.sh host-script Skript zum Vorbereiten eines Zielhosts ausgeben
|
||||
# ./setup.sh host-script | ssh admin@host sudo sh
|
||||
# Optionen: --sudo (NOPASSWD-sudo), --tunnel (fuer agent_tunnel),
|
||||
@@ -10,15 +15,77 @@
|
||||
# ./setup.sh test SSH-Zugriff und Rechte auf allen Hosts pruefen
|
||||
# ./setup.sh apply hosts.yml uebernehmen (Manager + Collector neu starten)
|
||||
# ./setup.sh passwords Zugangsdaten anzeigen
|
||||
# ./setup.sh info Erkannte Umgebung anzeigen
|
||||
#
|
||||
# Mit Podman bitte als root ausfuehren (sudo ./setup.sh ...), siehe check_rootless.
|
||||
# Erkennung uebersteuern: CONTAINER_ENGINE=docker|podman ./setup.sh ...
|
||||
# Kernel-Parameter nicht anfassen: WAZUH_SKIP_SYSCTL=1 ./setup.sh ...
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")"
|
||||
|
||||
if docker compose version >/dev/null 2>&1; then DC=(docker compose); else DC=(docker-compose); fi
|
||||
|
||||
info() { echo -e "\e[1;32m==>\e[0m $*"; }
|
||||
warn() { echo -e "\e[1;33m!!\e[0m $*" >&2; }
|
||||
die() { echo -e "\e[1;31mFEHLER:\e[0m $*" >&2; exit 1; }
|
||||
|
||||
is_root() { [ "$(id -u)" -eq 0 ]; }
|
||||
|
||||
ENGINE=""
|
||||
DC=()
|
||||
SELINUX=no
|
||||
|
||||
detect_runtime() {
|
||||
[ -n "$ENGINE" ] && return
|
||||
ENGINE="${CONTAINER_ENGINE:-}"
|
||||
if [ -z "$ENGINE" ]; then
|
||||
# Auf RHEL ist "docker" oft nur der podman-docker-Wrapper -> dann Podman nehmen
|
||||
if command -v docker >/dev/null 2>&1 && ! docker --version 2>/dev/null | grep -qi podman; then
|
||||
ENGINE=docker
|
||||
elif command -v podman >/dev/null 2>&1; then
|
||||
ENGINE=podman
|
||||
else
|
||||
die "Weder Docker noch Podman gefunden. RHEL: sudo dnf install -y podman"
|
||||
fi
|
||||
fi
|
||||
|
||||
case "$ENGINE" in
|
||||
docker)
|
||||
docker info >/dev/null 2>&1 || die "Docker-Daemon nicht erreichbar (laeuft dockerd? Benutzer in Gruppe docker?)"
|
||||
if docker compose version >/dev/null 2>&1; then DC=(docker compose)
|
||||
elif command -v docker-compose >/dev/null 2>&1; then DC=(docker-compose)
|
||||
else die "Docker Compose fehlt (Paket docker-compose-plugin)"; fi
|
||||
;;
|
||||
podman)
|
||||
check_rootless
|
||||
if command -v podman-compose >/dev/null 2>&1; then DC=(podman-compose)
|
||||
elif podman compose version >/dev/null 2>&1; then DC=(podman compose)
|
||||
else
|
||||
die "podman-compose fehlt. RHEL 9:
|
||||
sudo dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
|
||||
sudo dnf install -y podman-compose
|
||||
oder: sudo pip3 install podman-compose"
|
||||
fi
|
||||
;;
|
||||
*) die "CONTAINER_ENGINE muss docker oder podman sein" ;;
|
||||
esac
|
||||
|
||||
if command -v getenforce >/dev/null 2>&1 && [ "$(getenforce)" != "Disabled" ]; then
|
||||
SELINUX=yes # docker-compose.yml nutzt ":z" auf allen Bind-Mounts
|
||||
fi
|
||||
}
|
||||
|
||||
check_rootless() {
|
||||
# Rootless Podman scheitert hier an: memlock/nofile-Ulimits der Wazuh-Container,
|
||||
# Port 443 (< 1024) und Zertifikaten, die im Container per chown an UIDs 999/1000 gehen.
|
||||
if [ "$(podman info --format '{{.Host.Security.Rootless}}' 2>/dev/null)" = "true" ]; then
|
||||
die "Podman laeuft rootless. Wazuh braucht erhoehte Ulimits und Port $(env_get DASHBOARD_PORT 2>/dev/null || echo 443).
|
||||
Bitte als root ausfuehren: sudo ./setup.sh ${CMD:-}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Docker oder Podman (gleiche CLI fuer run/images/info)
|
||||
engine() { "$ENGINE" "$@"; }
|
||||
compose() { "${DC[@]}" "$@"; }
|
||||
|
||||
genpw() {
|
||||
# Erfuellt die Wazuh-API-Richtlinie (Gross, klein, Ziffer, Sonderzeichen) und
|
||||
# enthaelt keine Zeichen, die in den sed-Aufrufen der Wazuh-Images stoeren.
|
||||
@@ -29,18 +96,64 @@ set_env() { # set_env KEY VALUE
|
||||
if grep -q "^$1=" .env; then sed -i "s|^$1=.*|$1=$2|" .env; else echo "$1=$2" >> .env; fi
|
||||
}
|
||||
|
||||
env_get() { grep "^$1=" .env | cut -d= -f2-; }
|
||||
env_get() { grep "^$1=" .env 2>/dev/null | cut -d= -f2-; }
|
||||
|
||||
cmd_init() {
|
||||
command -v docker >/dev/null || die "docker fehlt"
|
||||
|
||||
# --- Kernel-Parameter fuer den Indexer ---------------------------------
|
||||
tune_kernel() {
|
||||
local mmc
|
||||
mmc=$(cat /proc/sys/vm/max_map_count)
|
||||
if [ "$mmc" -lt 262144 ]; then
|
||||
warn "vm.max_map_count ist $mmc (empfohlen 262144). Dauerhaft setzen mit:"
|
||||
[ "$mmc" -ge 262144 ] && return
|
||||
[ "${WAZUH_SKIP_SYSCTL:-0}" = 1 ] && { warn "vm.max_map_count=$mmc, Anpassung uebersprungen (WAZUH_SKIP_SYSCTL=1)"; return; }
|
||||
if is_root; then
|
||||
info "Setze vm.max_map_count=262144 (dauerhaft in /etc/sysctl.d/99-wazuh.conf)"
|
||||
echo 'vm.max_map_count=262144' > /etc/sysctl.d/99-wazuh.conf
|
||||
sysctl -q -w vm.max_map_count=262144
|
||||
else
|
||||
warn "vm.max_map_count ist $mmc (benoetigt 262144). Als root setzen mit:"
|
||||
warn " echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-wazuh.conf && sudo sysctl --system"
|
||||
fi
|
||||
}
|
||||
|
||||
open_firewall() {
|
||||
local port
|
||||
port=$(env_get DASHBOARD_PORT)
|
||||
command -v firewall-cmd >/dev/null 2>&1 && firewall-cmd --state >/dev/null 2>&1 || return 0
|
||||
if firewall-cmd --query-port="$port/tcp" >/dev/null 2>&1; then return 0; fi
|
||||
if is_root; then
|
||||
info "firewalld: oeffne Port $port/tcp fuer das Dashboard"
|
||||
firewall-cmd -q --permanent --add-port="$port/tcp" && firewall-cmd -q --reload
|
||||
else
|
||||
warn "firewalld aktiv, Port $port/tcp nicht freigegeben: sudo firewall-cmd --permanent --add-port=$port/tcp && sudo firewall-cmd --reload"
|
||||
fi
|
||||
}
|
||||
|
||||
enable_autostart() {
|
||||
# Docker startet "restart: always"-Container selbst; Podman hat keinen Daemon,
|
||||
# dafuer gibt es podman-restart.service.
|
||||
[ "$ENGINE" = podman ] || return 0
|
||||
command -v systemctl >/dev/null 2>&1 || return 0
|
||||
if systemctl is-enabled podman-restart.service >/dev/null 2>&1; then return 0; fi
|
||||
if is_root; then
|
||||
info "Aktiviere podman-restart.service (Container starten nach Reboot)"
|
||||
systemctl enable -q podman-restart.service
|
||||
else
|
||||
warn "Autostart nach Reboot: sudo systemctl enable podman-restart.service"
|
||||
fi
|
||||
}
|
||||
|
||||
cmd_info() {
|
||||
detect_runtime
|
||||
echo "Engine: $ENGINE ($("$ENGINE" --version | head -1))"
|
||||
echo "Compose: ${DC[*]}"
|
||||
echo "SELinux: $SELINUX"
|
||||
echo "root: $(is_root && echo ja || echo nein)"
|
||||
echo "max_map: $(cat /proc/sys/vm/max_map_count)"
|
||||
}
|
||||
|
||||
cmd_init() {
|
||||
detect_runtime
|
||||
info "Container-Umgebung: $ENGINE mit ${DC[*]} (SELinux: $SELINUX)"
|
||||
command -v ssh-keygen >/dev/null || die "ssh-keygen fehlt (RHEL: dnf install openssh-clients)"
|
||||
tune_kernel
|
||||
|
||||
# --- .env + Passwoerter -------------------------------------------------
|
||||
[ -f .env ] || cp .env.example .env
|
||||
@@ -55,8 +168,8 @@ cmd_init() {
|
||||
if [ ! -f config/wazuh_indexer/internal_users.yml ]; then
|
||||
info "Erzeuge Indexer-Benutzer (Passwort-Hashes)"
|
||||
hash() {
|
||||
docker run --rm -e JAVA_HOME=/usr/share/wazuh-indexer/jdk --entrypoint bash \
|
||||
"wazuh/wazuh-indexer:$version" \
|
||||
engine run --rm -e JAVA_HOME=/usr/share/wazuh-indexer/jdk --entrypoint bash \
|
||||
"docker.io/wazuh/wazuh-indexer:$version" \
|
||||
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh -p "$1" 2>/dev/null | tail -1
|
||||
}
|
||||
local h_admin h_kibana
|
||||
@@ -89,18 +202,18 @@ EOF
|
||||
if [ ! -f config/wazuh_indexer_ssl_certs/root-ca.pem ]; then
|
||||
info "Erzeuge TLS-Zertifikate"
|
||||
mkdir -p config/wazuh_indexer_ssl_certs
|
||||
docker run --rm \
|
||||
engine run --rm \
|
||||
-e CERT_TOOL_VERSION="${version%.*}" \
|
||||
-v "$PWD/config/wazuh_indexer_ssl_certs/:/certificates/" \
|
||||
-v "$PWD/config/certs.yml:/config/certs.yml:ro" \
|
||||
wazuh/wazuh-certs-generator:0.0.4
|
||||
-v "$PWD/config/wazuh_indexer_ssl_certs/:/certificates/:z" \
|
||||
-v "$PWD/config/certs.yml:/config/certs.yml:ro,z" \
|
||||
docker.io/wazuh/wazuh-certs-generator:0.0.4
|
||||
[ -f config/wazuh_indexer_ssl_certs/root-ca.pem ] || die "Zertifikate wurden nicht erzeugt"
|
||||
fi
|
||||
|
||||
# --- SSH-Schluessel ----------------------------------------------------
|
||||
if [ ! -f ssh/id_ed25519 ]; then
|
||||
info "Erzeuge SSH-Schluessel ssh/id_ed25519"
|
||||
ssh-keygen -q -t ed25519 -N "" -C "wazuh-sshpull@$(hostname)" -f ssh/id_ed25519
|
||||
ssh-keygen -q -t ed25519 -N "" -C "wazuh-sshpull@$(uname -n)" -f ssh/id_ed25519
|
||||
fi
|
||||
touch ssh/known_hosts
|
||||
chmod 600 ssh/id_ed25519
|
||||
@@ -108,7 +221,7 @@ EOF
|
||||
[ -f hosts.yml ] || { cp hosts.yml.example hosts.yml; warn "hosts.yml aus Beispiel angelegt - bitte anpassen!"; }
|
||||
|
||||
info "Baue Images"
|
||||
"${DC[@]}" build
|
||||
compose build
|
||||
|
||||
cat <<EOF
|
||||
|
||||
@@ -117,7 +230,7 @@ Fertig. Naechste Schritte:
|
||||
2. Zielhosts vorbereiten: ./setup.sh host-script | ssh admin@HOST sudo sh
|
||||
3. Host-Keys holen: ./setup.sh keyscan (Fingerprints pruefen!)
|
||||
4. Zugriff testen: ./setup.sh test
|
||||
5. Starten: ${DC[*]} up -d
|
||||
5. Starten: ./setup.sh up
|
||||
6. Dashboard: https://<dieser-server>:$(env_get DASHBOARD_PORT) (admin / siehe ./setup.sh passwords)
|
||||
EOF
|
||||
}
|
||||
@@ -165,15 +278,30 @@ EOF
|
||||
echo 'echo "Host vorbereitet: Benutzer $U ($(id $U))"'
|
||||
}
|
||||
|
||||
case "${1:-init}" in
|
||||
cmd_up() {
|
||||
detect_runtime
|
||||
tune_kernel
|
||||
compose up -d
|
||||
enable_autostart
|
||||
open_firewall
|
||||
info "Gestartet ($ENGINE). Dashboard in 1-3 Minuten: https://$(uname -n):$(env_get DASHBOARD_PORT)"
|
||||
}
|
||||
|
||||
CMD="${1:-init}"
|
||||
case "$CMD" in
|
||||
init) cmd_init ;;
|
||||
up) cmd_up ;;
|
||||
down) detect_runtime; compose down ;;
|
||||
ps) detect_runtime; compose ps ;;
|
||||
logs) shift; detect_runtime; compose logs -f --tail=100 "$@" ;;
|
||||
info) cmd_info ;;
|
||||
host-script) shift; cmd_host_script "$@" ;;
|
||||
keyscan) "${DC[@]}" run --rm --no-deps sshpull.collector keyscan ;;
|
||||
test) "${DC[@]}" run --rm --no-deps sshpull.collector test ;;
|
||||
apply) "${DC[@]}" up -d --force-recreate wazuh.manager sshpull.collector ;;
|
||||
keyscan) detect_runtime; compose run --rm --no-deps sshpull.collector keyscan ;;
|
||||
test) detect_runtime; compose run --rm --no-deps sshpull.collector test ;;
|
||||
apply) detect_runtime; compose up -d --force-recreate wazuh.manager sshpull.collector ;;
|
||||
passwords)
|
||||
echo "Dashboard: admin / $(env_get INDEXER_PASSWORD)"
|
||||
echo "Wazuh-API: wazuh-wui / $(env_get API_PASSWORD)"
|
||||
;;
|
||||
*) sed -n '2,13p' "$0"; exit 2 ;;
|
||||
*) sed -n '2,23p' "$0"; exit 2 ;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user