CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

configure redis in ui

Browse Source
This commit is contained in:
m0duspwnens
2023-05-10 11:54:21 -04:00
parent 1b9ed1c72b
commit 02e1a29f0c
12 changed files with 209 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
salt/allowed_states.map.jinja
View File

@@ -247,15 +247,11 @@
{% do allowed_states.append('playbook') %}
{% endif %}
{% if (REDIS !=0) and grains.role in ['so-eval'] %}
{% do allowed_states.append('redis') %}
{% endif %}
{% if grains.role in ['so-helixsensor', 'so-manager', 'so-standalone', 'so-searchnode', 'so-managersearch', 'so-heavynode', 'so-receiver'] %}
{% do allowed_states.append('logstash') %}
{% endif %}
{% if REDIS and grains.role in ['so-manager', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-receiver'] %}
{% if REDIS and grains.role in ['so-manager', 'so-standalone', 'so-managersearch', 'so-heavynode', 'so-receiver', 'so-eval'] %}
{% do allowed_states.append('redis') %}
{% endif %}

11
salt/manager/tools/sbin/so-minion
View File

@@ -242,6 +242,12 @@ function add_kibana_to_minion() {
" " >> $PILLARFILE
}
function add_redis_to_minion() {
printf '%s\n'\
"redis:"\
" enabled: True"\
" " >> $PILLARFILE
}
function create_fleet_policy() {
@@ -300,6 +306,7 @@ function createSTANDALONE() {
add_playbook_to_minion
add_elastalert_to_minion
add_kibana_to_minion
add_redis_to_minion
}
function createMANAGER() {
@@ -308,6 +315,7 @@ function createMANAGER() {
add_playbook_to_minion
add_elastalert_to_minion
add_kibana_to_minion
add_redis_to_minion
}
function createMANAGERSEARCH() {
@@ -316,6 +324,7 @@ function createMANAGERSEARCH() {
add_playbook_to_minion
add_elastalert_to_minion
add_kibana_to_minion
add_redis_to_minion
}
function createIMPORT() {
@@ -340,6 +349,7 @@ function createHEAVYNODE() {
add_elasticsearch_to_minion
add_logstash_to_minion
add_sensor_to_minion
add_redis_to_minion
}
function createSENSOR() {
@@ -355,6 +365,7 @@ function createSEARCHNODE() {
function createRECEIVER() {
add_logstash_to_minion
add_redis_to_minion
}

68
salt/redis/config.sls Normal file
View File

@@ -0,0 +1,68 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'redis/map.jinja' import REDISMERGED %}
include:
- ssl
# Redis Setup
redisconfdir:
file.directory:
- name: /opt/so/conf/redis/etc
- user: 939
- group: 939
- makedirs: True
redisworkdir:
file.directory:
- name: /opt/so/conf/redis/working
- user: 939
- group: 939
- makedirs: True
redislogdir:
file.directory:
- name: /opt/so/log/redis
- user: 939
- group: 939
- makedirs: True
redisconf:
file.managed:
- name: /opt/so/conf/redis/etc/redis.conf
- source: salt://redis/etc/redis.conf.jinja
- user: 939
- group: 939
- template: jinja
- defaults:
REDISMERGED: {{ REDISMERGED }}
redis_sbin:
file.recurse:
- name: /usr/sbin
- source: salt://redis/tools/sbin
- user: 939
- group: 939
- file_mode: 755
redis_sbin_jinja:
file.recurse:
- name: /usr/sbin
- source: salt://redis/tools/sbin_jinja
- user: 939
- group: 939
- file_mode: 755
- template: jinja
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

1
salt/redis/defaults.yaml
View File

@@ -1,4 +1,5 @@
redis:
enabled: False
config:
bind: '0.0.0.0'
protected-mode: 'yes'

27
salt/redis/disabled.sls Normal file
View File

@@ -0,0 +1,27 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
include:
- redis.sostatus
so-redis:
docker_container.absent:
- force: True
so-redis_so-status.disabled:
file.comment:
- name: /opt/so/conf/so-status/so-status.conf
- regex: ^so-redis$
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

62
salt/redis/enabled.sls Normal file
View File

@@ -0,0 +1,62 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
{% from 'docker/docker.map.jinja' import DOCKER %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
include:
- redis.config
- redis.sostatus
so-redis:
docker_container.running:
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }}
- hostname: so-redis
- user: socore
- networks:
- sobridge:
- ipv4_address: {{ DOCKER.containers['so-redis'].ip }}
- port_bindings:
{% for BINDING in DOCKER.containers['so-redis'].port_bindings %}
- {{ BINDING }}
{% endfor %}
- binds:
- /opt/so/log/redis:/var/log/redis:rw
- /opt/so/conf/redis/etc/redis.conf:/usr/local/etc/redis/redis.conf:ro
- /opt/so/conf/redis/working:/redis:rw
- /etc/pki/redis.crt:/certs/redis.crt:ro
- /etc/pki/redis.key:/certs/redis.key:ro
{% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
- /etc/pki/ca.crt:/certs/ca.crt:ro
{% else %}
- /etc/ssl/certs/intca.crt:/certs/ca.crt:ro
{% endif %}
- entrypoint: "redis-server /usr/local/etc/redis/redis.conf"
- watch:
- file: /opt/so/conf/redis/etc
- require:
- file: redisconf
- x509: redis_crt
- x509: redis_key
{% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
- x509: pki_public_ca_crt
{% else %}
- x509: trusttheca
{% endif %}
delete_so-redis_so-status.disabled:
file.uncomment:
- name: /opt/so/conf/so-status/so-status.conf
- regex: ^so-redis$
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

6
salt/redis/etc/redis.conf.jinja
View File

@@ -1,5 +1,7 @@
{%- import_yaml 'redis/defaults.yaml' as REDISDEFAULTS %}
{%- set REDISMERGED = salt['pillar.get']('redis', default=REDISDEFAULTS.redis, merge=true) %}
{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
https://securityonion.net/license; you may not use this file except in compliance with the
Elastic License 2.0. #}
{%- for k, v in REDISMERGED.config.items() %}
{%- if v is iterable and v is not string %}

103
salt/redis/init.sls
View File

@@ -3,106 +3,11 @@
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %}
{% from 'docker/docker.map.jinja' import DOCKER %}
{% from 'vars/globals.map.jinja' import GLOBALS %}
{% from 'redis/map.jinja' import REDISMERGED %}
include:
- ssl
# Redis Setup
redisconfdir:
file.directory:
- name: /opt/so/conf/redis/etc
- user: 939
- group: 939
- makedirs: True
redisworkdir:
file.directory:
- name: /opt/so/conf/redis/working
- user: 939
- group: 939
- makedirs: True
redislogdir:
file.directory:
- name: /opt/so/log/redis
- user: 939
- group: 939
- makedirs: True
redisconf:
file.managed:
- name: /opt/so/conf/redis/etc/redis.conf
- source: salt://redis/etc/redis.conf.jinja
- user: 939
- group: 939
- template: jinja
redis_sbin:
file.recurse:
- name: /usr/sbin
- source: salt://redis/tools/sbin
- user: 939
- group: 939
- file_mode: 755
redis_sbin_jinja:
file.recurse:
- name: /usr/sbin
- source: salt://redis/tools/sbin_jinja
- user: 939
- group: 939
- file_mode: 755
- template: jinja
so-redis:
docker_container.running:
- image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-redis:{{ GLOBALS.so_version }}
- hostname: so-redis
- user: socore
- networks:
- sobridge:
- ipv4_address: {{ DOCKER.containers['so-redis'].ip }}
- port_bindings:
{% for BINDING in DOCKER.containers['so-redis'].port_bindings %}
- {{ BINDING }}
{% endfor %}
- binds:
- /opt/so/log/redis:/var/log/redis:rw
- /opt/so/conf/redis/etc/redis.conf:/usr/local/etc/redis/redis.conf:ro
- /opt/so/conf/redis/working:/redis:rw
- /etc/pki/redis.crt:/certs/redis.crt:ro
- /etc/pki/redis.key:/certs/redis.key:ro
{% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
- /etc/pki/ca.crt:/certs/ca.crt:ro
{% if REDISMERGED.enabled %}
- redis.enabled
{% else %}
- /etc/ssl/certs/intca.crt:/certs/ca.crt:ro
{% endif %}
- entrypoint: "redis-server /usr/local/etc/redis/redis.conf"
- watch:
- file: /opt/so/conf/redis/etc
- require:
- file: redisconf
- x509: redis_crt
- x509: redis_key
{% if grains['role'] in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
- x509: pki_public_ca_crt
{% else %}
- x509: trusttheca
{% endif %}
append_so-redis_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-redis
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
- redis.disabled
{% endif %}

7
salt/redis/map.jinja Normal file
View File

@@ -0,0 +1,7 @@
{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
https://securityonion.net/license; you may not use this file except in compliance with the
Elastic License 2.0. #}
{% import_yaml 'redis/defaults.yaml' as REDISDEFAULTS %}
{% set REDISMERGED = salt['pillar.get']('redis', REDISDEFAULTS.redis, merge=True) %}

3
salt/redis/soc_redis.yaml
View File

@@ -1,4 +1,7 @@
redis:
enabled:
description: You can enable or disable Redis.
helpLink: redis.html
config:
bind:
description: The IP address to bind to.

21
salt/redis/sostatus.sls Normal file
View File

@@ -0,0 +1,21 @@
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls.split('.')[0] in allowed_states %}
append_so-redis_so-status.conf:
file.append:
- name: /opt/so/conf/so-status/so-status.conf
- text: so-redis
- unless: grep -q so-redis /opt/so/conf/so-status/so-status.conf
{% else %}
{{sls}}_state_not_allowed:
test.fail_without_changes:
- name: {{sls}}_state_not_allowed
{% endif %}

13
salt/top.sls
View File

@@ -3,7 +3,6 @@
# https://securityonion.net/license; you may not use this file except in compliance with the
# Elastic License 2.0.
{% set REDIS = salt['pillar.get']('redis:enabled', True) %}
{% set STRELKA = salt['pillar.get']('strelka:enabled', '0') %}
{% import_yaml 'salt/minion.defaults.yaml' as saltversion %}
{% set saltversion = saltversion.salt.minion.version %}
@@ -85,9 +84,7 @@ base:
- utility
- soctopus
- playbook
{%- if REDIS != 0 %}
- redis
{%- endif %}
- elasticfleet
- docker_clean
@@ -111,9 +108,7 @@ base:
- mysql
- elasticsearch
- logstash
{%- if REDIS %}
- redis
{%- endif %}
- elastic-fleet-package-registry
- kibana
- curator
@@ -145,9 +140,7 @@ base:
- mysql
- elasticsearch
- logstash
{%- if REDIS %}
- redis
{%- endif %}
- elastic-fleet-package-registry
- kibana
- pcap
@@ -196,9 +189,7 @@ base:
- mysql
- elasticsearch
- logstash
{%- if REDIS %}
- redis
{%- endif %}
- curator
- elastic-fleet-package-registry
- kibana
@@ -218,9 +209,7 @@ base:
- firewall
- elasticsearch
- logstash
{%- if REDIS %}
- redis
{%- endif %}
- curator
{%- if STRELKA %}
- strelka
@@ -264,9 +253,7 @@ base:
- telegraf
- firewall
- logstash
{%- if REDIS %}
- redis
{%- endif %}
- elasticfleet.install_agent_grid
- docker_clean