Merge pull request #8739 from Security-Onion-Solutions/2.4/elastic-fleet

EA Certs & image

salt/ca/files/signing_policies.conf

@@ -57,7 +57,7 @@ x509_signing_policies:
     - extendedKeyUsage: serverAuth
     - days_valid: 820
     - copypath: /etc/pki/issued_certs/
-  fleet:
+  elasticfleet:
     - minions: '*'
     - signing_private_key: /etc/pki/ca.key
     - signing_cert: /etc/pki/ca.crt
@@ -65,9 +65,8 @@ x509_signing_policies:
     - ST: Utah
     - L: Salt Lake City
     - basicConstraints: "critical CA:false"
-    - keyUsage: "critical keyEncipherment"
+    - keyUsage: "digitalSignature, nonRepudiation"
     - subjectKeyIdentifier: hash
     - authorityKeyIdentifier: keyid,issuer:always
-    - extendedKeyUsage: serverAuth
     - days_valid: 820
     - copypath: /etc/pki/issued_certs/

salt/common/tools/sbin/so-elastic-fleet-setup

@@ -20,10 +20,12 @@ curl -K /opt/so/conf/elasticsearch/curl.config -L -X PUT "localhost:5601/api/fle
 printf "\n\n"
 
 # Create Logstash Output payload
-cp /etc/ssl/certs/intca.crt /opt/so/conf/filebeat/etc/pki/
-LOGSTASHCRT=$(openssl x509 -in /opt/so/conf/filebeat/etc/pki/filebeat.crt)
-LOGSTASHKEY=$(openssl rsa -in  /opt/so/conf/filebeat/etc/pki/filebeat.key)
-LOGSTASHCA=$(openssl x509 -in  /opt/so/conf/filebeat/etc/pki/intca.crt)
+mkdir /opt/so/conf/elastic-fleet/certs
+cp /etc/ssl/certs/intca.crt /opt/so/conf/elastic-fleet/certs
+cp /etc/pki/elasticfleet* /opt/so/conf/elastic-fleet/certs
+LOGSTASHCRT=$(openssl x509 -in /opt/so/conf/elastic-fleet/certs/elasticfleet.crt)
+LOGSTASHKEY=$(openssl rsa -in  /opt/so/conf/elastic-fleet/certs/elasticfleet.key)
+LOGSTASHCA=$(openssl x509 -in  /opt/so/conf/elastic-fleet/certs/intca.crt)
 JSON_STRING=$( jq -n \
                   --arg LOGSTASHCRT "$LOGSTASHCRT" \
                   --arg LOGSTASHKEY "$LOGSTASHKEY" \

salt/common/tools/sbin/so-image-common

@@ -40,6 +40,7 @@ container_list() {
     TRUSTED_CONTAINERS=(
       "so-curator"
       "so-elastalert"
+      "so-elastic-agent"
       "so-elastic-agent-builder"
       "so-elasticsearch"
       "so-filebeat"

salt/elastic-fleet/init.sls

@@ -10,25 +10,49 @@
 {% set FLEETSERVERPOLICY = salt['pillar.get']('elasticfleet:server:server_policy','so-manager') %}
 {% set FLEETURL = salt['pillar.get']('elasticfleet:server:url') %}
 
-elasticfleetdir:
+# Add EA Group
+elasticsagentgroup:
+  group.present:
+    - name: elastic-agent
+    - gid: 947
+
+# Add EA user
+elastic-agent:
+  user.present:
+    - uid: 947
+    - gid: 947
+    - home: /opt/so/conf/elastic-fleet
+    - createhome: False
+
+eaconfdir:
+  file.directory:
+    - name: /opt/so/conf/elastic-fleet
+    - user: 947
+    - group: 939
+    - makedirs: True
+
+eastatedir:
   file.directory:
     - name: /opt/so/conf/elastic-fleet/state
+    - user: 947
+    - group: 939
     - makedirs: True
 
+
   {% if SERVICETOKEN != '' %}
 so-elastic-fleet:
   docker_container.running:
-    - image: docker.elastic.co/beats/elastic-agent:8.4.1
+    - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ GLOBALS.so_version }}
     - name: so-elastic-fleet
     - hostname: Fleet-{{ GLOBALS.hostname }}
     - detach: True
-    - user: root
+    - user: 947
     - extra_hosts:
         - {{ GLOBALS.hostname }}:{{ GLOBALS.node_ip }}
     - port_bindings:
       - 0.0.0.0:8220:8220
     - binds:
-      - /opt/so/conf/filebeat/etc/pki:/etc/pki:ro
+      - /opt/so/conf/elastic-fleet/certs:/etc/pki:ro
       - /opt/so/conf/elastic-fleet/state:/usr/share/elastic-agent/state:rw
     - environment:
       - FLEET_SERVER_ENABLE=true
@@ -37,8 +61,8 @@ so-elastic-fleet:
       - FLEET_SERVER_SERVICE_TOKEN={{ SERVICETOKEN }}
       - FLEET_SERVER_POLICY_ID={{ FLEETSERVERPOLICY }}
       - FLEET_SERVER_ELASTICSEARCH_CA=/etc/pki/intca.crt
-      - FLEET_SERVER_CERT=/etc/pki/filebeat.crt
-      - FLEET_SERVER_CERT_KEY=/etc/pki/filebeat.key
+      - FLEET_SERVER_CERT=/etc/pki/elasticfleet.crt
+      - FLEET_SERVER_CERT_KEY=/etc/pki/elasticfleet.key
       - FLEET_CA=/etc/pki/intca.crt
   {% endif %}
 

salt/ssl/init.sls

@@ -152,6 +152,88 @@ rediskeyperms:
     - group: 939
 {% endif %}
 
+{% if grains['role'] in ['so-manager', 'so-eval', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode'] %}
+etc_elasticfleet_key:
+  x509.private_key_managed:
+    - name: /etc/pki/elasticfleet.key
+    - CN: {{ COMMONNAME }}
+    - bits: 4096
+    - days_remaining: 0
+    - days_valid: 820
+    - backup: True
+    - new: True
+    {% if salt['file.file_exists']('/etc/pki/elasticfleet.key') -%}
+    - prereq:
+      - x509: etc_elasticfleet_crt
+    {%- endif %}
+    - timeout: 30
+    - retry:
+        attempts: 5
+        interval: 30
+
+# Request a cert and drop it where it needs to go to be distributed
+etc_elasticfleet_crt:
+  x509.certificate_managed:
+    - name: /etc/pki/elasticfleet.crt
+    - ca_server: {{ ca_server }}
+    - signing_policy: elasticfleet
+    - public_key: /etc/pki/elasticfleet.key
+    - CN: {{ GLOBALS.hostname }}
+    - subjectAltName: DNS:{{ GLOBALS.hostname }}, IP:{{ GLOBALS.node_ip }}
+    - days_remaining: 0
+    - days_valid: 820
+    - backup: True
+{% if grains.role not in ['so-heavynode'] %}
+    - unless:
+      # https://github.com/saltstack/salt/issues/52167
+      # Will trigger 5 days (432000 sec) from cert expiration
+      - 'enddate=$(date -d "$(openssl x509 -in /etc/pki/elasticfleet.crt -enddate -noout | cut -d= -f2)" +%s) ; now=$(date +%s) ; expire_date=$(( now + 432000)); [ $enddate -gt $expire_date ]'
+{% endif %}
+    - timeout: 30
+    - retry:
+        attempts: 5
+        interval: 30
+  cmd.run:
+    - name: "/usr/bin/openssl pkcs8 -in /etc/pki/elasticfleet.key -topk8 -out /etc/pki/elasticfleet.p8 -nocrypt"
+    - onchanges:
+      - x509: etc_elasticfleet_key
+
+efperms:
+  file.managed:
+    - replace: False
+    - name: /etc/pki/elasticfleet.key
+    - mode: 640
+    - group: 939
+
+chownilogstashelasticfleetp8:
+  file.managed:
+    - replace: False
+    - name: /etc/pki/elasticfleet.p8
+    - mode: 640
+    - user: 947
+    - group: 939
+
+# Create Symlinks to the keys so I can distribute it to all the things
+elasticfleetdircerts:
+  file.directory:
+    - name: /opt/so/saltstack/local/salt/elastic-fleet/files/certs
+    - makedirs: True
+
+efkeylink:
+  file.symlink:
+    - name: /opt/so/saltstack/local/salt/elastic-fleet/files/certs/elasticfleet.p8
+    - target: /etc/pki/elasticfleet.p8
+    - user: socore
+    - group: socore
+
+efcrtlink:
+  file.symlink:
+    - name: /opt/so/saltstack/local/salt/elastic-fleet/files/certs/elasticfleet.crt
+    - target: /etc/pki/elasticfleet.crt
+    - user: socore
+    - group: socore
+{% endif %}
+
 {% if grains['role'] in ['so-manager', 'so-eval', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-receiver'] %}
 etc_filebeat_key:
   x509.private_key_managed: