CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Logstash certs fixup

Browse Source
This commit is contained in:
Josh Brower
2023-04-17 11:34:57 -04:00
parent a7d282b412
commit 1944d09978
5 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
salt/elasticfleet/files/certs/placeholder Normal file
View File

4
salt/elasticfleet/init.sls
View File

@@ -43,7 +43,7 @@ eastatedir:
/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8: /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:
file.managed: file.managed:
- replace: True - replace: True
- source: salt://elasticfleet/files/certs/elasticfleet.p8 - source: salt://elasticfleet/files/certs/elasticfleet-logstash.p8
- mode: 640 - mode: 640
- user: 931 - user: 931
- group: 939 - group: 939
@@ -51,7 +51,7 @@ eastatedir:
/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt: /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:
file.managed: file.managed:
- replace: True - replace: True
- source: salt://elasticfleet/files/certs/elasticfleet.crt - source: salt://elasticfleet/files/certs/elasticfleet-logstash.crt
- mode: 640 - mode: 640
- user: 931 - user: 931
- group: 939 - group: 939

6
salt/logstash/init.sls
View File

@@ -164,9 +164,9 @@ so-logstash:
- /etc/pki/filebeat.crt:/usr/share/logstash/filebeat.crt:ro - /etc/pki/filebeat.crt:/usr/share/logstash/filebeat.crt:ro
- /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro
{% endif %} {% endif %}
{% if GLOBALS.role in ['so-fleet'] %} {% if GLOBALS.role in ['so-manager', 'so-managersearch', 'so-standalone', 'so-import', 'so-eval','so-fleet'] %}
- /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/filebeat.crt:ro - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:/usr/share/logstash/elasticfleet-logstash.crt:ro
- /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/filebeat.key:ro - /opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:/usr/share/logstash/elasticfleet-logstash.key:ro
{% endif %} {% endif %}
{% if GLOBALS.role in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %} {% if GLOBALS.role in ['so-manager', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import'] %}
- /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro - /etc/pki/ca.crt:/usr/share/filebeat/ca.crt:ro

4
salt/logstash/pipelines/config/so/0012_input_elastic_agent.conf
View File

@@ -4,8 +4,8 @@ input {
tags => [ "elastic-agent" ] tags => [ "elastic-agent" ]
ssl => true ssl => true
ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"] ssl_certificate_authorities => ["/usr/share/filebeat/ca.crt"]
ssl_certificate => "/usr/share/logstash/filebeat.crt" ssl_certificate => "/usr/share/logstash/elasticfleet-logstash.crt"
ssl_key => "/usr/share/logstash/filebeat.key" ssl_key => "/usr/share/logstash/elasticfleet-logstash.key"
ssl_verify_mode => "force_peer" ssl_verify_mode => "force_peer"
ecs_compatibility => v8 ecs_compatibility => v8
} }

17
salt/ssl/init.sls
View File

@@ -325,6 +325,23 @@ eflogstashcrtlink:
- group: socore - group: socore
{% endif %} {% endif %}
/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.p8:
file.managed:
- replace: True
- source: salt://elasticfleet/files/certs/elasticfleet-logstash.p8
- mode: 640
- user: 931
- group: 939
/opt/so/conf/elastic-fleet/certs/elasticfleet-logstash.crt:
file.managed:
- replace: True
- source: salt://elasticfleet/files/certs/elasticfleet-logstash.crt
- mode: 640
- user: 931
- group: 939
{% endif %} {% endif %}
{% if grains['role'] in ['so-manager', 'so-eval', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-receiver'] %} {% if grains['role'] in ['so-manager', 'so-eval', 'so-helix', 'so-managersearch', 'so-standalone', 'so-import', 'so-heavynode', 'so-receiver'] %}