180 lines
7.1 KiB
Bash
Executable File
180 lines
7.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Einrichtung und Hilfsbefehle fuer den Wazuh-SSH-Pull-Stack.
|
|
#
|
|
# ./setup.sh Erstinstallation (Passwoerter, Zertifikate, SSH-Key, Images)
|
|
# ./setup.sh host-script Skript zum Vorbereiten eines Zielhosts ausgeben
|
|
# ./setup.sh host-script | ssh admin@host sudo sh
|
|
# Optionen: --sudo (NOPASSWD-sudo), --tunnel (fuer agent_tunnel),
|
|
# --user=NAME (Standard wazuh-pull)
|
|
# ./setup.sh keyscan Host-Keys aller Hosts aus hosts.yml nach ssh/known_hosts
|
|
# ./setup.sh test SSH-Zugriff und Rechte auf allen Hosts pruefen
|
|
# ./setup.sh apply hosts.yml uebernehmen (Manager + Collector neu starten)
|
|
# ./setup.sh passwords Zugangsdaten anzeigen
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
if docker compose version >/dev/null 2>&1; then DC=(docker compose); else DC=(docker-compose); fi
|
|
|
|
info() { echo -e "\e[1;32m==>\e[0m $*"; }
|
|
warn() { echo -e "\e[1;33m!!\e[0m $*" >&2; }
|
|
die() { echo -e "\e[1;31mFEHLER:\e[0m $*" >&2; exit 1; }
|
|
|
|
genpw() {
|
|
# Erfuellt die Wazuh-API-Richtlinie (Gross, klein, Ziffer, Sonderzeichen) und
|
|
# enthaelt keine Zeichen, die in den sed-Aufrufen der Wazuh-Images stoeren.
|
|
echo "$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)Aa1."
|
|
}
|
|
|
|
set_env() { # set_env KEY VALUE
|
|
if grep -q "^$1=" .env; then sed -i "s|^$1=.*|$1=$2|" .env; else echo "$1=$2" >> .env; fi
|
|
}
|
|
|
|
env_get() { grep "^$1=" .env | cut -d= -f2-; }
|
|
|
|
cmd_init() {
|
|
command -v docker >/dev/null || die "docker fehlt"
|
|
|
|
# --- Kernel-Parameter fuer den Indexer ---------------------------------
|
|
local mmc
|
|
mmc=$(cat /proc/sys/vm/max_map_count)
|
|
if [ "$mmc" -lt 262144 ]; then
|
|
warn "vm.max_map_count ist $mmc (empfohlen 262144). Dauerhaft setzen mit:"
|
|
warn " echo 'vm.max_map_count=262144' | sudo tee /etc/sysctl.d/99-wazuh.conf && sudo sysctl --system"
|
|
fi
|
|
|
|
# --- .env + Passwoerter -------------------------------------------------
|
|
[ -f .env ] || cp .env.example .env
|
|
for k in INDEXER_PASSWORD DASHBOARD_PASSWORD API_PASSWORD; do
|
|
if [ -z "$(env_get $k)" ]; then set_env "$k" "$(genpw)"; info "$k erzeugt"; fi
|
|
done
|
|
chmod 600 .env
|
|
local version
|
|
version=$(env_get WAZUH_VERSION)
|
|
|
|
# --- internal_users.yml mit Hashes -------------------------------------
|
|
if [ ! -f config/wazuh_indexer/internal_users.yml ]; then
|
|
info "Erzeuge Indexer-Benutzer (Passwort-Hashes)"
|
|
hash() {
|
|
docker run --rm -e JAVA_HOME=/usr/share/wazuh-indexer/jdk --entrypoint bash \
|
|
"wazuh/wazuh-indexer:$version" \
|
|
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh -p "$1" 2>/dev/null | tail -1
|
|
}
|
|
local h_admin h_kibana
|
|
h_admin=$(hash "$(env_get INDEXER_PASSWORD)")
|
|
h_kibana=$(hash "$(env_get DASHBOARD_PASSWORD)")
|
|
[[ $h_admin == \$2* && $h_kibana == \$2* ]] || die "Hash-Erzeugung fehlgeschlagen"
|
|
cat > config/wazuh_indexer/internal_users.yml <<EOF
|
|
---
|
|
# Automatisch erzeugt von setup.sh. Passwoerter stehen in .env.
|
|
_meta:
|
|
type: "internalusers"
|
|
config_version: 2
|
|
|
|
admin:
|
|
hash: "$h_admin"
|
|
reserved: true
|
|
backend_roles:
|
|
- "admin"
|
|
description: "Admin user"
|
|
|
|
kibanaserver:
|
|
hash: "$h_kibana"
|
|
reserved: true
|
|
description: "Dashboard server user"
|
|
EOF
|
|
chmod 644 config/wazuh_indexer/internal_users.yml
|
|
fi
|
|
|
|
# --- TLS-Zertifikate ---------------------------------------------------
|
|
if [ ! -f config/wazuh_indexer_ssl_certs/root-ca.pem ]; then
|
|
info "Erzeuge TLS-Zertifikate"
|
|
mkdir -p config/wazuh_indexer_ssl_certs
|
|
docker run --rm \
|
|
-e CERT_TOOL_VERSION="${version%.*}" \
|
|
-v "$PWD/config/wazuh_indexer_ssl_certs/:/certificates/" \
|
|
-v "$PWD/config/certs.yml:/config/certs.yml:ro" \
|
|
wazuh/wazuh-certs-generator:0.0.4
|
|
[ -f config/wazuh_indexer_ssl_certs/root-ca.pem ] || die "Zertifikate wurden nicht erzeugt"
|
|
fi
|
|
|
|
# --- SSH-Schluessel ----------------------------------------------------
|
|
if [ ! -f ssh/id_ed25519 ]; then
|
|
info "Erzeuge SSH-Schluessel ssh/id_ed25519"
|
|
ssh-keygen -q -t ed25519 -N "" -C "wazuh-sshpull@$(hostname)" -f ssh/id_ed25519
|
|
fi
|
|
touch ssh/known_hosts
|
|
chmod 600 ssh/id_ed25519
|
|
|
|
[ -f hosts.yml ] || { cp hosts.yml.example hosts.yml; warn "hosts.yml aus Beispiel angelegt - bitte anpassen!"; }
|
|
|
|
info "Baue Images"
|
|
"${DC[@]}" build
|
|
|
|
cat <<EOF
|
|
|
|
Fertig. Naechste Schritte:
|
|
1. hosts.yml anpassen
|
|
2. Zielhosts vorbereiten: ./setup.sh host-script | ssh admin@HOST sudo sh
|
|
3. Host-Keys holen: ./setup.sh keyscan (Fingerprints pruefen!)
|
|
4. Zugriff testen: ./setup.sh test
|
|
5. Starten: ${DC[*]} up -d
|
|
6. Dashboard: https://<dieser-server>:$(env_get DASHBOARD_PORT) (admin / siehe ./setup.sh passwords)
|
|
EOF
|
|
}
|
|
|
|
cmd_host_script() {
|
|
[ -f ssh/id_ed25519.pub ] || die "ssh/id_ed25519.pub fehlt - erst ./setup.sh ausfuehren"
|
|
local pub user="wazuh-pull" sudo=no opts="restrict"
|
|
pub=$(cat ssh/id_ed25519.pub)
|
|
for a in "$@"; do
|
|
case "$a" in
|
|
--sudo) sudo=yes ;;
|
|
--tunnel) opts='restrict,port-forwarding,permitlisten="127.0.0.1:1514",permitlisten="127.0.0.1:1515",permitopen="127.0.0.1:1"' ;;
|
|
--user=*) user="${a#--user=}" ;;
|
|
*) die "unbekannte Option $a" ;;
|
|
esac
|
|
done
|
|
cat <<EOF
|
|
#!/bin/sh
|
|
# Vorbereitung eines Hosts fuer Wazuh-SSH-Pull (als root ausfuehren)
|
|
set -e
|
|
U='$user'
|
|
if ! id "\$U" >/dev/null 2>&1; then
|
|
useradd --system --create-home --shell /bin/sh "\$U" 2>/dev/null || adduser -D -s /bin/sh "\$U"
|
|
usermod -p '*' "\$U" 2>/dev/null || true # kein Passwort, aber nicht gesperrt (sonst lehnt sshd ab)
|
|
fi
|
|
# Leserechte auf Logs: journald (systemd-journal) und /var/log (adm)
|
|
for g in systemd-journal adm; do
|
|
getent group "\$g" >/dev/null && usermod -aG "\$g" "\$U" 2>/dev/null || true
|
|
done
|
|
H=\$(getent passwd "\$U" | cut -d: -f6)
|
|
mkdir -p "\$H/.ssh"
|
|
# restrict: kein PTY, kein Agent-/X11-/Port-Forwarding.
|
|
# Mit --tunnel nur Reverse-Forwarding auf 127.0.0.1:1514/1515 (fuer agent_tunnel).
|
|
KEY='$opts $pub'
|
|
grep -qF '$pub' "\$H/.ssh/authorized_keys" 2>/dev/null || echo "\$KEY" >> "\$H/.ssh/authorized_keys"
|
|
chown -R "\$U:" "\$H/.ssh"; chmod 700 "\$H/.ssh"; chmod 600 "\$H/.ssh/authorized_keys"
|
|
EOF
|
|
if [ "$sudo" = yes ]; then
|
|
cat <<EOF
|
|
echo "\$U ALL=(root) NOPASSWD: ALL" > /etc/sudoers.d/wazuh-pull
|
|
chmod 440 /etc/sudoers.d/wazuh-pull
|
|
visudo -cf /etc/sudoers.d/wazuh-pull
|
|
EOF
|
|
fi
|
|
echo 'echo "Host vorbereitet: Benutzer $U ($(id $U))"'
|
|
}
|
|
|
|
case "${1:-init}" in
|
|
init) cmd_init ;;
|
|
host-script) shift; cmd_host_script "$@" ;;
|
|
keyscan) "${DC[@]}" run --rm --no-deps sshpull.collector keyscan ;;
|
|
test) "${DC[@]}" run --rm --no-deps sshpull.collector test ;;
|
|
apply) "${DC[@]}" up -d --force-recreate wazuh.manager sshpull.collector ;;
|
|
passwords)
|
|
echo "Dashboard: admin / $(env_get INDEXER_PASSWORD)"
|
|
echo "Wazuh-API: wazuh-wui / $(env_get API_PASSWORD)"
|
|
;;
|
|
*) sed -n '2,13p' "$0"; exit 2 ;;
|
|
esac
|