CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 01:32:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1165 from Security-Onion-Solutions/feature/esssl

Browse Source 
TLS Transport Encryption
This commit is contained in:
Mike Reeves
2020-08-12 15:39:17 -04:00
committed by GitHub
parent c02a363e92 9980d02844
commit 0129519d0c
3 changed files with 20 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/sotls.yaml
View File

@@ -1,4 +1,4 @@
keystore.path: /etc/pki/ca-trust/extracted/java/sokeys keystore.path: /usr/share/elasticsearch/config/sokeys
keystore.password: changeit keystore.password: changeit
keystore.algorithm: SunX509 keystore.algorithm: SunX509
truststore.path: /etc/pki/ca-trust/extracted/java/cacerts truststore.path: /etc/pki/ca-trust/extracted/java/cacerts

12
salt/elasticsearch/init.sls
View File

@@ -139,6 +139,13 @@ esyml:
- group: 939 - group: 939
- template: jinja - template: jinja
sotls:
file.managed:
- name: /opt/so/conf/elasticsearch/sotls.yml
- source: salt://elasticsearch/files/sotls.yml
- user: 930
- group: 939
#sync templates to /opt/so/conf/elasticsearch/templates #sync templates to /opt/so/conf/elasticsearch/templates
{% for TEMPLATE in TEMPLATES %} {% for TEMPLATE in TEMPLATES %}
es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}: es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
@@ -200,8 +207,9 @@ so-elasticsearch:
- /opt/so/log/elasticsearch:/var/log/elasticsearch:rw - /opt/so/log/elasticsearch:/var/log/elasticsearch:rw
- /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro - /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro
- /etc/pki/ca.crt:/usr/share/elasticsearch/config/ca.crt:ro - /etc/pki/ca.crt:/usr/share/elasticsearch/config/ca.crt:ro
- /etc/pki/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key:ro - /etc/pki/elasticsearch.p12:/usr/share/elasticsearch/config/elasticsearch.p12:ro
- /etc/pki/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt:ro - /opt/so/conf/elasticsearch/sotls.yml:/usr/share/elasticsearch/config/sotls.yml:ro
- watch: - watch:
- file: cacertz - file: cacertz

10
salt/ssl/init.sls
View File

@@ -243,6 +243,10 @@ miniokeyperms:
# https://github.com/saltstack/salt/issues/52167 # https://github.com/saltstack/salt/issues/52167
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:"
- onchanges:
- x509: /etc/pki/elasticsearch.key
ealstickeyperms: ealstickeyperms:
file.managed: file.managed:
@@ -507,7 +511,7 @@ fleetkeyperms:
{% if salt['file.file_exists']('/etc/pki/elasticsearch.key') -%} {% if salt['file.file_exists']('/etc/pki/elasticsearch.key') -%}
- prereq: - prereq:
- x509: /etc/pki/elasticsearch.crt - x509: /etc/pki/elasticsearch.crt
/etc/pki/elasticsearch.crt: /etc/pki/elasticsearch.crt:
x509.certificate_managed: x509.certificate_managed:
- ca_server: {{ ca_server }} - ca_server: {{ ca_server }}
@@ -521,6 +525,10 @@ fleetkeyperms:
# https://github.com/saltstack/salt/issues/52167 # https://github.com/saltstack/salt/issues/52167
# Will trigger 5 days (432000 sec) from cert expiration # Will trigger 5 days (432000 sec) from cert expiration
- 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]' - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticsearch.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
cmd.run:
- name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:"
- onchanges:
- x509: /etc/pki/elasticsearch.key
miniokeyperms: miniokeyperms:
file.managed: file.managed: