From d6fecc761ae2794b0d0f59cc0acf47df408fd463 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 14:43:46 -0400 Subject: [PATCH 1/3] Remove unused elasticsearch.p12/sokeys keystore --- salt/elasticsearch/enabled.sls | 2 -- salt/elasticsearch/ssl.sls | 11 ----------- 2 files changed, 13 deletions(-) diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 48f094d3c..5a611ac94 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -71,7 +71,6 @@ so-elasticsearch: - /etc/pki/tls/certs/intca.crt:/usr/share/elasticsearch/config/ca.crt:ro - /etc/pki/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt:ro - /etc/pki/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key:ro - - /etc/pki/elasticsearch.p12:/usr/share/elasticsearch/config/elasticsearch.p12:ro - /opt/so/conf/elasticsearch/users_roles:/usr/share/elasticsearch/config/users_roles:ro - /opt/so/conf/elasticsearch/users:/usr/share/elasticsearch/config/users:ro {% if ELASTICSEARCHMERGED.config.path.get('repo', False) %} @@ -99,7 +98,6 @@ so-elasticsearch: - file: eslog4jfile - file: nsmesdir - file: eslogdir - - file: elasticp12perms - cmd: auth_users_roles_inode - cmd: auth_users_inode diff --git a/salt/elasticsearch/ssl.sls b/salt/elasticsearch/ssl.sls index a2d327830..7d54dfd56 100644 --- a/salt/elasticsearch/ssl.sls +++ b/salt/elasticsearch/ssl.sls @@ -38,10 +38,6 @@ elasticsearch_crt: - retry: attempts: 5 interval: 30 - cmd.run: - - name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:" - - onchanges: - - x509: /etc/pki/elasticsearch.key elastickeyperms: file.managed: @@ -50,13 +46,6 @@ elastickeyperms: - mode: 640 - group: 930 -elasticp12perms: - file.managed: - - replace: False - - name: /etc/pki/elasticsearch.p12 - - mode: 640 - - group: 930 - {% else %} {{sls}}_state_not_allowed: From 11c8fe3093bbd80ccbc9b6ddb23a468ccae1ca71 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 15:08:21 -0400 Subject: [PATCH 2/3] Use the host CA trust store for all grid containers Anchor the grid CA and blocklist the eMudhra roots in the host trust store (new ca.trust state, also used by the desktop role), then mount the extracted store into each container instead of the frozen copies made by so-catrust. Containers restart when the host trust changes. --- .../files/blocklist/emsign-ecc-root-ca-c3.pem | 14 ++++++ .../files/blocklist/emsign-ecc-root-ca-g3.pem | 15 ++++++ salt/ca/files/blocklist/emsign-root-ca-c1.pem | 21 ++++++++ salt/ca/files/blocklist/emsign-root-ca-c2.pem | 32 ++++++++++++ salt/ca/files/blocklist/emsign-root-ca-g1.pem | 22 +++++++++ salt/ca/files/blocklist/emsign-root-ca-g2.pem | 32 ++++++++++++ .../files/blocklist/emsign-root-cs-ca-g2.pem | 32 ++++++++++++ salt/ca/init.sls | 1 + salt/ca/trust.map.jinja | 12 +++++ salt/ca/trust.sls | 33 +++++++++++++ salt/desktop/trusted-ca.sls | 14 ++---- salt/elastalert/enabled.sls | 7 ++- .../enabled.sls | 7 ++- salt/elasticagent/enabled.sls | 3 ++ salt/elasticfleet/enabled.sls | 3 ++ salt/elasticsearch/ca.sls | 49 ------------------- salt/elasticsearch/enabled.sls | 7 ++- .../elasticsearch/tools/sbin_jinja/so-catrust | 26 ---------- salt/hydra/enabled.sls | 4 ++ salt/influxdb/enabled.sls | 4 ++ salt/kafka/enabled.sls | 4 ++ salt/kibana/enabled.sls | 5 ++ salt/kratos/enabled.sls | 4 ++ salt/logstash/enabled.sls | 19 ++----- salt/manager/tools/sbin/soup | 7 +++ salt/nginx/enabled.sls | 4 ++ salt/postgres/enabled.sls | 4 ++ salt/redis/enabled.sls | 3 ++ salt/registry/enabled.sls | 4 ++ salt/sensoroni/enabled.sls | 4 ++ salt/soc/enabled.sls | 3 ++ salt/telegraf/enabled.sls | 3 ++ 32 files changed, 295 insertions(+), 107 deletions(-) create mode 100644 salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem create mode 100644 salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-c1.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-c2.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-g1.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-g2.pem create mode 100644 salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem create mode 100644 salt/ca/trust.map.jinja create mode 100644 salt/ca/trust.sls delete mode 100644 salt/elasticsearch/ca.sls delete mode 100644 salt/elasticsearch/tools/sbin_jinja/so-catrust diff --git a/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem b/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem new file mode 100644 index 000000000..517c0e1cf --- /dev/null +++ b/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG +EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx +IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw +MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND +IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci +MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti +sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O +BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB +Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c +3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J +0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ== +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem b/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem new file mode 100644 index 000000000..060e943bf --- /dev/null +++ b/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG +EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo +bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g +RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 +WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS +fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB +zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq +hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB +CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD ++JbNR6iC8hZVdyR+EhCVBCyj +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-c1.pem b/salt/ca/files/blocklist/emsign-root-ca-c1.pem new file mode 100644 index 000000000..02bd4a71f --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-c1.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG +A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg +SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw +MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v +dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ +BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ +HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH +3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH +GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c +xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1 +aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq +TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL +BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87 +/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4 +kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG +YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT ++xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo +WXzhriKi4gp6D/piq1JM4fHfyr6DDUI= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-c2.pem b/salt/ca/files/blocklist/emsign-root-ca-c2.pem new file mode 100644 index 000000000..78025196d --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-c2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFcjCCA1qgAwIBAgIKLwq3aw3LSq8nWDANBgkqhkiG9w0BAQwFADBWMQswCQYD +VQQGEwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJ +bmMxHDAaBgNVBAMTE2VtU2lnbiBSb290IENBIC0gQzIwHhcNMTgwMjE4MTgzMDAw +WhcNNDMwMjE4MTgzMDAwWjBWMQswCQYDVQQGEwJVUzETMBEGA1UECxMKZW1TaWdu +IFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMxHDAaBgNVBAMTE2VtU2lnbiBSb290 +IENBIC0gQzIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCMfX1lA+Tb +mh9YInmRgOW97IVx4LUJf2DRZfs837Jrml+py64aVnYgWO4t6C78fgjfS7jX+c4T +inIzEquWcI+zi0fd4Sc8NDf7JONp27VWX0qwUYqzLDRCt+s7zpLcfx1ky0zVIJj6 +L06uPyK3kIr9+YAsrVj+39utm6e2MBQsRNstSI3fCQYAGvoQTQ8fULauTqNWaYAk +NYFe6HUHHQPp2u1Ua00odMXiD5oRFxLcDnGAcE1I/9E9mLCdkggXijYUmico7+Xw +ZeFoPhva6eIJ5p03Lt3Du5W3EcHR0cJmmY1pyeA36JaXKWRNM9IRjYMVNCcp4jhB +2tIYiZ+LVk8bwQ9/1c23txmv3u97taZlV22NF4ttS1qq3J+MOp0oGULBzpKfRx0q +GVqbPukQNGAjOLIN8KDNQNzbR1iAl2d8H+MSoicBo4Aid8TjLWcNv48oCWL53ZrF +BMTDjaIA6frG1t4IpbnHadA7qCJJe2qpJN6n2eQKAUn6UiQDHPsSqNBlcUhQ4Y/0 +Y0mU5rghm2OB9rXQS1Fb1JRCfJMNnJIm5AUB2+2RWzq5Tgz7SbSho8NsZk0UbQnF +xciqQ9uoVTAsK14Sk9oG8Q3zfsM08cdPoRb0WlIZklR6mKD7L8nH/zfGu8PIJv94 +GGB9RZ9U4A69r3ePmy8MvrzfNxHKtH6svwIDAQABo0IwQDAdBgNVHQ4EFgQUs/eK +pNYPiABZ6FEXT9V+7IYigZ0wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB +Af8wDQYJKoZIhvcNAQEMBQADggIBADQlpiWM0cv2nZ0H5jVsBq0x2q62Q0LwqATs +CFvyub7gxNCytRuoA8stmPOEu/lg8Igxj4FIjoyhIrWUVxyiLU7No4P+WjEUOwUT +xIpkEOtvGUQ9fiOlcGHtIZDNBlZq7WpktXAxeV55RPPsor26p2FNAMRFfZQh0sLX +hKgk8iulSSggqx8ezgPye63FaiYEi4c/dzRj3HOCnsZiwZZU02df5YpNFjxSwZvE +41cjGpsrpWMfQFI2s53RbeXp47lSAxYE4NzjBFMe+EwFuEveBCJBEAH5rvYu3pi2 +orsJ424TqWEQV1tCsCkQz+Yq/Okal7yHAkKDeOXcP7oN4A+TdXc2pdqxuVCnBO0R +mWz2JpGSSeJjiTk/OPwRsPNWtwG/KXL04o2ta3jiPpJuICVtWDAc9R3auBEgJl5r +ShRmBdszG0LmzsHuZPCFSYC15RBDCOBsa8bDRJ8pBFU2Wi/CVXCACEuavgoveA4F +a5bt38o0PWxsBP+MpocCdVtDMqzQhxy9IohKuXWAGresoIvKDg3xFk6rBOrjfVwJ +elwi/xAisojHPJVQv9W1zVIoHp+EQg/4MQC21NbIX2RoioB+V3hK439b/w7deU8x +2M8cl1OG0nPfbnARl5GPM7vJgi470jto4SeMg6HMAW3Egb56tQcNLwI9U8mZnNvR +gUMrkAgL +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-g1.pem b/salt/ca/files/blocklist/emsign-root-ca-g1.pem new file mode 100644 index 000000000..c50d2e6d1 --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-g1.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD +VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU +ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH +MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO +MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv +Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz +f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO +8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq +d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM +tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt +Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB +o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD +AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x +PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM +wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d +GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH +6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby +RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx +iN66zB+Afko= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-g2.pem b/salt/ca/files/blocklist/emsign-root-ca-g2.pem new file mode 100644 index 000000000..b24d764ad --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-g2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFlTCCA32gAwIBAgILAIZNvw/jXtd9jtgwDQYJKoZIhvcNAQEMBQAwZzELMAkG +A1UEBhMCSU4xEzARBgNVBAsTCmVtU2lnbiBQS0kxJTAjBgNVBAoTHGVNdWRocmEg +VGVjaG5vbG9naWVzIExpbWl0ZWQxHDAaBgNVBAMTE2VtU2lnbiBSb290IENBIC0g +RzIwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBnMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBHMjCCAiIw +DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMNwGIWW2kHfHK+sXTNwxF07K+IV +ySTuyFM2r1v002wUfcdT+zs5OM5QbMYFFnedXQI6gCFLsjKrcaej48Zt37OyEb3i +aPs7CsP4kAyTwzKH9aZe6gXYHrJq40/ZVMNcQVI2PcIp40B/SAN2gUZ+ZaUtIOvV +jEx26/ebNaXRIsthlkOG/caB+QRwDw1tl7338Zlv0M2oTBUy4B3e7dGP5pgXH71M +jqHPCoNo+xv9f0NTBT+hUDa8h8wUtcGQq9CDeJTpjWcD2bP2AMdVG6oVpMAUeUzo +cCyglvtFdUMjggxBbw4qhau1HXPG8Ot9hwL7ZMi8tkTzrvUIxxb8G9LF/7kKeCE7 +tGZaVzDTnXuifl3msR4ErHsQ4P7lVu2AIjIAhrAXoedDidb7pMcf7TABdrYUT1Jo +G/AiK+J9jO6GTjeADD4LMDSBZhHMuBK/PJ/g0kGBt+/C1L+/HURzQhJkMlRnM6Rv +XoCtfKopSlns5trZmTi971Wjbn88QXP61lGpBCUPwCjs7rpOYvSUJtI+lcbF+37q +kIqOXYkVT3cupDSpw+H89kFtj5GKY+Xny4LxY+3IvDIRiyd6ky1DPj713DI0yqve +EpsIr3A0PdwuyUI7CS1jg0NnGFT6Xxyr0xB+VDt83FJYW8v16k2pbaQ4kVxA3aXd +X9dZYyVR1S59KM75AgMBAAGjQjBAMB0GA1UdDgQWBBTt7E1FYRgo57MjKBEcTaUn +DV7s9DAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQwFAAOCAgEACFC/ilQg8KTCVBxFJW/sazomkS0kNYbEIZg4B3obqwsJ7SX98z8Z +gfzBpz0nYClwwJjWbFN1R2zY8pCEot6/dgmA8Vbq0GxhwPM5YN/SZquNyRIxO3cU +dlAcwf+vSezdVCf9wOzvSAF3q0a5ljvbdbNJNpfScQVp7UUd5sBsZk8jXO1KQ/go +/Vf/GDPnrIFmxpAIGE3sgnO8lAv9FzUaAeuv7HWe47xN9J7+bQzF93yHuIXACPTL +pQHhg2zMv5C7BAbuDHfbj1Cu294Z832yhSfBcziWGskOvl3es2EcHytbS9c9P+0z +Mpka7zGC1FHrvLb/FoduH86TeZt0QjZ6pcplNzoaxDnDvzTJ6CC2Eny+qH/APFCu +VUv5/wjwF+HPm8Pup2ARj9cEp92+0qcerfHacNq5hMeGZdbA/dzdUR/5z5zXdxAk +nl8mcfGb0eMNSTXQmmB/i4AecNnr72uYjzlaXUGYN7Nrb6XouG0pnh0/BBtWWp0U +ShIPpWEAqs7RJBj6+1ZUYXZ4ObrCw962DxhN2p19Hxw9LtuUUcLqqTPrFXYvwO4t +ouj7KJnAkaTUfXGdEaFVtFig1EA30WzJY2X1vAQ7hVnniCjgaXAGqjsU6sklNM9n +xDx5rFCCCEtj9Kh8UHjGK2QqgP5kwgttjOApQMaCoezMfK4KD7WpOXU= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem b/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem new file mode 100644 index 000000000..c2bd264fe --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFdjCCA16gAwIBAgIQCIYhdXKnxAzDuy7l1y1ubDANBgkqhkiG9w0BAQwFADBV +MQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGlt +aXRlZDEfMB0GA1UEAwwWZW1TaWduIFJvb3QgQ1MgQ0EgLSBHMjAeFw0yNDAyMDgw +ODE1MzlaFw00OTAyMDcwODE1MzlaMFUxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxl +TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMR8wHQYDVQQDDBZlbVNpZ24gUm9v +dCBDUyBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4CVO +xuBjdLJXpkrjosA+7ygTGaYzufUJrhQOeIZEuCqeCPI8hDqIu+MIqEqOlgDFetVM +3Cor3CGBlGJzfzzlI31vyElvQq88jjCfo12Ghqcf+NAZDFduJk5+NgC0z3lfdiB6 +NNzxbfVkA+X6oDNNRioVUZsVFuIzT9Qt0Sh4KwQPRFBc/wI2yGpDuKHNsLehcECx +Uw00m33xGYh9UkeL3reOmAaLYWZiO+Pd2vxPtrkXI4wyN4BMlESJ73uP0tyX9lq4 +M4yN2yh3i+ETI8/jzPjxHD7QFaVkCoS+uj2YmBa3mytlqlBgyOoKueNeotX8hfzB +FNm962abpV4mN0SoC6hjkYv8IayseRPFv9VI0meQXg9OLRoNvBOqG5kw937FH0Li +q3CIzKyvdyeYRT0LJdWA2iuB9l+4zzIfCwGyT4M4VDmJuPBhrTmjXKae6AUtm1eO +q2f8gftA6J6AlbD0gRd/t8CrFssFNm+LYAEd36kWRBuolbaOfbSbEww84xNAgj4U +SPwYjtNDsCkQjtgSOaDtDOmolN+Mbk528Y+LHMlbd4T3Xmp+VIWp5+70GhBDOA91 +hhtims+hHkXjRI2U7WrJLcTlcF8ykiymRbFKhwOBvTmtZNbHmDI7scU4wWUAsmW6 +tWaeeoM50KBl8ai28A6yBGYMO//03Ubvqiqst80CAwEAAaNCMEAwHQYDVR0OBBYE +FOYcxqontIvyvYVkX6/0unKm0AF1MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E +BTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQCv5Asord7fdQMT30emwb+oLuDUxdmJ +DQHnzxIXoNvymDTbNHF9LqjeXc+X+XcjIV8PTp4o2I9wyVppHmcaVgRjN/G9FxeN +5tCQ97v5sdx4eAdPljK1xqg7Vhfmzcp+7rSjJG7Sn9gMlZx81kL3Oa2qZj+W5Fi6 +tN4vaR9OLEyvKKHDG/eFxS/qghD1d/Clkb7UGGjBcWJlaZTWVALMKG+QCxiMoELi +oeKaoBbZoXooxfF0mWdkIl9RWNU4r9O/yt66LBE9rj49dX19L+rGg71/4bTi5ua+ ++Wz60XaOc2CdHJaBSols5hWEx/LBjS7UzfU3uJfnpQXVDi0US5sFzIHIlS6kjh7h +YuF4+/9ZAl4Bx3w2TNN7pVm7I39pgYl7XN6KZRwfkAv4aRswPqhWbQfr3+qfcC93 +cgTyFy2RG5YE/OfmpSs6VtYKawqsdEODz/p2nhZfSDrVDnEPvERqahttY5+gaWNc +2fbibgKMfuejTZaJ3yttPslVSko5SDs0xKU423swu34sb/fdISqtOu4NzPCZiHSG +ladaoITmSA6UWFk4fdqaLBI+xSxY5Et3S1APp5r3j/l1KrWPNbb1/+ydHN+YLbh8 +hCBIecKdk6VbnnFRlulm0d2RSgpfCRrWLomN8JHCxCMVv/hBQXz3AXGM1ZlfYTyl +E1BpDby0G2eEkw== +-----END CERTIFICATE----- diff --git a/salt/ca/init.sls b/salt/ca/init.sls index 3a0fdf91c..381064f2c 100644 --- a/salt/ca/init.sls +++ b/salt/ca/init.sls @@ -10,3 +10,4 @@ include: - ca.server {% endif %} - ca.trustca + - ca.trust diff --git a/salt/ca/trust.map.jinja b/salt/ca/trust.map.jinja new file mode 100644 index 000000000..0ea3002bb --- /dev/null +++ b/salt/ca/trust.map.jinja @@ -0,0 +1,12 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{# Containers mount the extracted directory rather than single files: update-ca-trust replaces + files by rename, so a file bind mount would keep pointing at the old inode. #} +{% set CATRUST = { + 'dir': '/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro', + 'java': '/etc/pki/ca-trust/extracted/java/cacerts', + 'pem': '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem' +} %} diff --git a/salt/ca/trust.sls b/salt/ca/trust.sls new file mode 100644 index 000000000..aec613f29 --- /dev/null +++ b/salt/ca/trust.sls @@ -0,0 +1,33 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +ca_trust_anchor: + file.managed: + - name: /etc/pki/ca-trust/source/anchors/so-intca.crt + - source: salt://ca/files/ca.crt + - show_changes: False + - makedirs: True + +ca_trust_legacy_anchor: + file.absent: + - name: /etc/pki/ca-trust/source/anchors/ca.crt + +# clean removes blocklist entries that are no longer shipped +ca_trust_blocklist: + file.recurse: + - name: /etc/pki/ca-trust/source/blocklist + - source: salt://ca/files/blocklist + - clean: True + - makedirs: True + - file_mode: '0644' + - dir_mode: '0755' + +ca_trust_extract: + cmd.run: + - name: update-ca-trust extract + - onchanges: + - file: ca_trust_anchor + - file: ca_trust_legacy_anchor + - file: ca_trust_blocklist diff --git a/salt/desktop/trusted-ca.sls b/salt/desktop/trusted-ca.sls index 5117de1cd..a3a4710f4 100644 --- a/salt/desktop/trusted-ca.sls +++ b/salt/desktop/trusted-ca.sls @@ -1,18 +1,10 @@ - {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'vars/globals.map.jinja' import GLOBALS %} {# we only want this state to run it is CentOS #} {% if GLOBALS.os == 'OEL' %} -trusted_ca: - file.managed: - - name: /etc/pki/ca-trust/source/anchors/ca.crt - - source: salt://ca/files/ca.crt - -update_ca_certs: - cmd.run: - - name: update-ca-trust - - onchanges: - - file: trusted_ca +include: + - ca.trust {% else %} diff --git a/salt/elastalert/enabled.sls b/salt/elastalert/enabled.sls index 8aa9d4b3f..c2469e91c 100644 --- a/salt/elastalert/enabled.sls +++ b/salt/elastalert/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - elastalert.config - elastalert.sostatus @@ -28,6 +30,7 @@ so-elastalert: - ipv4_address: {{ DOCKERMERGED.containers['so-elastalert'].ip }} - detach: True - binds: + - {{ CATRUST.dir }} - /opt/so/rules/elastalert:/opt/elastalert/rules/:ro - /opt/so/log/elastalert:/var/log/elastalert:rw - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro @@ -46,8 +49,9 @@ so-elastalert: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-elastalert'].extra_env %} - environment: + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-elastalert'].extra_env %} {% for XTRAENV in DOCKERMERGED.containers['so-elastalert'].extra_env %} - {{ XTRAENV }} {% endfor %} @@ -65,6 +69,7 @@ so-elastalert: - file: elastacustmodulesdir - file: elastaconf - watch: + - cmd: ca_trust_extract - file: elastaconf - onlyif: - "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 9" {# only run this state if elasticsearch is version 9 #} diff --git a/salt/elastic-fleet-package-registry/enabled.sls b/salt/elastic-fleet-package-registry/enabled.sls index 3bf15c984..82208f003 100644 --- a/salt/elastic-fleet-package-registry/enabled.sls +++ b/salt/elastic-fleet-package-registry/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - elastic-fleet-package-registry.config - elastic-fleet-package-registry.sostatus @@ -34,8 +36,9 @@ so-elastic-fleet-package-registry: {% for BINDING in DOCKERMERGED.containers['so-elastic-fleet-package-registry'].port_bindings %} - {{ BINDING }} {% endfor %} - {% if DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro + {% if DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} - {{ BIND }} {% endfor %} @@ -52,6 +55,8 @@ so-elastic-fleet-package-registry: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract wait_for_so-elastic-fleet-package-registry: http.wait_for_successful_query: diff --git a/salt/elasticagent/enabled.sls b/salt/elasticagent/enabled.sls index c6ee02ddf..1e45a91dd 100644 --- a/salt/elasticagent/enabled.sls +++ b/salt/elasticagent/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: @@ -37,6 +38,7 @@ so-elastic-agent: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/elastic-agent/elastic-agent.yml:/usr/share/elastic-agent/elastic-agent.yml:ro - /opt/so/log/elasticagent:/usr/share/elastic-agent/logs - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro @@ -65,6 +67,7 @@ so-elastic-agent: - file: create-elastic-agent-config - file: trusttheca - watch: + - cmd: ca_trust_extract - file: create-elastic-agent-config - file: trusttheca diff --git a/salt/elasticfleet/enabled.sls b/salt/elasticfleet/enabled.sls index feb83fc2f..e08170097 100644 --- a/salt/elasticfleet/enabled.sls +++ b/salt/elasticfleet/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %} @@ -63,6 +64,7 @@ so-elastic-fleet: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /etc/pki/elasticfleet-server.crt:/etc/pki/elasticfleet-server.crt:ro - /etc/pki/elasticfleet-server.key:/etc/pki/elasticfleet-server.key:ro - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro @@ -95,6 +97,7 @@ so-elastic-fleet: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: etc_elasticfleet_key - x509: etc_elasticfleet_crt diff --git a/salt/elasticsearch/ca.sls b/salt/elasticsearch/ca.sls deleted file mode 100644 index 39d33919c..000000000 --- a/salt/elasticsearch/ca.sls +++ /dev/null @@ -1,49 +0,0 @@ -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -{% from 'allowed_states.map.jinja' import allowed_states %} -{% if sls.split('.')[0] in allowed_states or sls in allowed_states %} -{% from 'vars/globals.map.jinja' import GLOBALS %} - -# Move our new CA over so Elastic and Logstash can use SSL with the internal CA -catrustdir: - file.directory: - - name: /opt/so/conf/ca - - user: 939 - - group: 939 - - makedirs: True - -{% if GLOBALS.is_manager %} -# We have to add the Manager CA to the CA list -catrustscript: - cmd.script: - - source: salt://elasticsearch/tools/sbin_jinja/so-catrust - - template: jinja - - cwd: /opt/so - - defaults: - GLOBALS: {{ GLOBALS }} -{% endif %} - -elasticsearch_cacerts: - file.managed: - - name: /opt/so/conf/ca/cacerts - - source: salt://elasticsearch/cacerts - - user: 939 - - group: 939 - -elasticsearch_capems: - file.managed: - - name: /opt/so/conf/ca/tls-ca-bundle.pem - - source: salt://elasticsearch/tls-ca-bundle.pem - - user: 939 - - group: 939 - -{% else %} - -{{sls}}_state_not_allowed: - test.fail_without_changes: - - name: {{sls}}_state_not_allowed - -{% endif %} diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 5a611ac94..755581ab9 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_NODES %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_SEED_HOSTS %} @@ -13,7 +14,6 @@ include: - ca - - elasticsearch.ca - elasticsearch.ssl - elasticsearch.config - elasticsearch.sostatus @@ -63,11 +63,11 @@ so-elasticsearch: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro - /opt/so/conf/elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro - /nsm/elasticsearch:/usr/share/elasticsearch/data:rw - /opt/so/log/elasticsearch:/var/log/elasticsearch:rw - - /opt/so/conf/ca/cacerts:/usr/share/elasticsearch/jdk/lib/security/cacerts:ro - /etc/pki/tls/certs/intca.crt:/usr/share/elasticsearch/config/ca.crt:ro - /etc/pki/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt:ro - /etc/pki/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key:ro @@ -84,16 +84,15 @@ so-elasticsearch: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: elasticsearch_crt - x509: elasticsearch_key - - file: elasticsearch_cacerts - file: esyml - require: - file: trusttheca - x509: elasticsearch_crt - x509: elasticsearch_key - - file: elasticsearch_cacerts - file: esyml - file: eslog4jfile - file: nsmesdir diff --git a/salt/elasticsearch/tools/sbin_jinja/so-catrust b/salt/elasticsearch/tools/sbin_jinja/so-catrust deleted file mode 100644 index 14f9e5ca1..000000000 --- a/salt/elasticsearch/tools/sbin_jinja/so-catrust +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -# -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -. /usr/sbin/so-common -get_elastic_agent_vars - -# Exit on errors, since all lines must succeed -set -e - -# Check to see if we have extracted the ca cert. -if [ ! -f /opt/so/saltstack/local/salt/elasticsearch/cacerts ]; then - docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:$ELASTIC_AGENT_TARBALL_VERSION -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt - # Make sure symbolic links are followed when copying from container - docker cp -L so-elasticsearchca:/usr/share/elasticsearch/jdk/lib/security/cacerts /opt/so/saltstack/local/salt/elasticsearch/cacerts - docker cp -L so-elasticsearchca:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - docker rm so-elasticsearchca - echo "" >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - echo "sosca" >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - cat /etc/pki/ca.crt >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem -else - exit 0 -fi diff --git a/salt/hydra/enabled.sls b/salt/hydra/enabled.sls index 13fce79cf..cdc8ebe04 100644 --- a/salt/hydra/enabled.sls +++ b/salt/hydra/enabled.sls @@ -13,9 +13,11 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% if 'api' in salt['pillar.get']('features', []) %} include: + - ca.trust - hydra.config - hydra.sostatus @@ -29,6 +31,7 @@ so-hydra: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/hydra/:/hydra-conf:ro - /opt/so/log/hydra/:/hydra-log:rw - /nsm/hydra/db:/hydra-data:rw @@ -60,6 +63,7 @@ so-hydra: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: hydraconfig - require: - file: hydraconfig diff --git a/salt/influxdb/enabled.sls b/salt/influxdb/enabled.sls index 617a56e1e..1ca23e833 100644 --- a/salt/influxdb/enabled.sls +++ b/salt/influxdb/enabled.sls @@ -6,11 +6,13 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set PASSWORD = salt['pillar.get']('secrets:influx_pass') %} {% set TOKEN = salt['pillar.get']('influxdb:token') %} include: + - ca.trust - influxdb.ssl - influxdb.config - influxdb.sostatus @@ -38,6 +40,7 @@ so-influxdb: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/influxdb/:/log:rw - /opt/so/conf/influxdb/config.yaml:/conf/config.yaml:ro - /opt/so/conf/influxdb/etc:/etc/influxdb2:rw @@ -66,6 +69,7 @@ so-influxdb: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: influxdbconf - x509: influxdb_key - x509: influxdb_crt diff --git a/salt/kafka/enabled.sls b/salt/kafka/enabled.sls index 85e05ae4f..9d426cc16 100644 --- a/salt/kafka/enabled.sls +++ b/salt/kafka/enabled.sls @@ -12,12 +12,14 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set KAFKANODES = salt['pillar.get']('kafka:nodes') %} {% set KAFKA_EXTERNAL_ACCESS = salt['pillar.get']('kafka:config:external_access:enabled', default=False) %} {% if 'gmd' in salt['pillar.get']('features', []) %} include: + - ca.trust - kafka.ca - kafka.config - kafka.ssl @@ -51,6 +53,7 @@ so-kafka: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.java }}:/opt/java/openjdk/lib/security/cacerts:ro - /etc/pki/kafka.p12:/etc/pki/kafka.p12:ro - /opt/so/conf/kafka/kafka-truststore.jks:/etc/pki/kafka-truststore.jks:ro - /nsm/kafka/data/:/nsm/kafka/data/:rw @@ -68,6 +71,7 @@ so-kafka: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract {% for sc in ['server', 'client'] %} - file: kafka_kraft_{{sc}}_properties {% endfor %} diff --git a/salt/kibana/enabled.sls b/salt/kibana/enabled.sls index 0e986dbc2..9852242fe 100644 --- a/salt/kibana/enabled.sls +++ b/salt/kibana/enabled.sls @@ -8,8 +8,10 @@ {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCHMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - kibana.config - kibana.sostatus @@ -27,6 +29,7 @@ so-kibana: - ELASTICSEARCH_HOST={{ GLOBALS.manager }} - ELASTICSEARCH_PORT=9200 - MANAGER={{ GLOBALS.manager }} + - NODE_OPTIONS=--use-openssl-ca {% if DOCKERMERGED.containers['so-kibana'].extra_env %} {% for XTRAENV in DOCKERMERGED.containers['so-kibana'].extra_env %} - {{ XTRAENV }} @@ -40,6 +43,7 @@ so-kibana: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/kibana/etc:/usr/share/kibana/config:rw - /opt/so/log/kibana:/var/log/kibana:rw - /opt/so/conf/kibana/customdashboards:/usr/share/kibana/custdashboards:ro @@ -60,6 +64,7 @@ so-kibana: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: kibanaconfig wait_for_so-kibana: diff --git a/salt/kratos/enabled.sls b/salt/kratos/enabled.sls index 38a710cfc..046f890ab 100644 --- a/salt/kratos/enabled.sls +++ b/salt/kratos/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - kratos.config - kratos.sostatus @@ -22,6 +24,7 @@ so-kratos: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-kratos'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/kratos/:/kratos-conf:ro - /opt/so/log/kratos/:/kratos-log:rw - /nsm/kratos/db:/kratos-data:rw @@ -53,6 +56,7 @@ so-kratos: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: kratosschema - file: kratosconfig - require: diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls index 003cabf21..0b3d8447a 100644 --- a/salt/logstash/enabled.sls +++ b/salt/logstash/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'logstash/map.jinja' import LOGSTASH_MERGED %} {% from 'logstash/map.jinja' import LOGSTASH_NODES %} @@ -13,9 +14,6 @@ include: - ca -{% if GLOBALS.role not in ['so-receiver','so-fleet'] %} - - elasticsearch.ca -{% endif %} {# Kafka ca runs on nodes that can run logstash for Kafka input / output. Only when Kafka is global pipeline #} {% if GLOBALS.role in ['so-searchnode', 'so-manager', 'so-managerhype', 'so-managersearch', 'so-receiver', 'so-standalone'] and GLOBALS.pipeline == 'KAFKA' %} - kafka.ca @@ -58,6 +56,8 @@ so-logstash: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} + - {{ CATRUST.java }}:/usr/share/logstash/jdk/lib/security/cacerts:ro - /opt/so/conf/elasticsearch/templates/:/templates/:ro - /opt/so/conf/logstash/etc/:/usr/share/logstash/config/:ro - /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro @@ -78,10 +78,6 @@ so-logstash: - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro {% endif %} {% endif %} - {% if GLOBALS.role not in ['so-receiver','so-fleet'] %} - - /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro - - /opt/so/conf/ca/tls-ca-bundle.pem:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:ro - {% endif %} {% if GLOBALS.pipeline == "KAFKA" and GLOBALS.role in ['so-manager', 'so-managerhype', 'so-managersearch', 'so-standalone', 'so-searchnode'] %} - /etc/pki/kafka-logstash.p12:/usr/share/logstash/kafka-logstash.p12:ro - /opt/so/conf/kafka/kafka-truststore.jks:/etc/pki/kafka-truststore.jks:ro @@ -104,14 +100,11 @@ so-logstash: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: lsetcsync - file: lslog4j2 - file: lspipelinesyml - file: trusttheca - {% if GLOBALS.is_manager %} - - file: elasticsearch_cacerts - - file: elasticsearch_capems - {% endif %} {% if GLOBALS.is_manager or GLOBALS.role in ['so-fleet', 'so-heavynode', 'so-receiver'] %} - x509: etc_elasticfleet_logstash_crt - x509: etc_elasticfleet_logstash_key @@ -133,10 +126,6 @@ so-logstash: {% endif %} - require: - file: trusttheca - {% if GLOBALS.is_manager %} - - file: elasticsearch_cacerts - - file: elasticsearch_capems - {% endif %} {% if GLOBALS.is_manager or GLOBALS.role in ['so-fleet', 'so-heavynode', 'so-receiver'] %} - x509: etc_elasticfleet_logstash_crt - x509: etc_elasticfleet_logstash_key diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index b30e4e650..42f71fcfe 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1261,9 +1261,16 @@ post_to_3.4.0() { add_detection_runtime_fields + remove_frozen_ca_bundles + set_postversion 3.4.0 } +remove_frozen_ca_bundles() { + rm -rf /opt/so/conf/ca >> $SOUP_LOG 2>&1 + rm -f /opt/so/saltstack/local/salt/elasticsearch/cacerts /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem >> $SOUP_LOG 2>&1 +} + add_detection_runtime_fields() { local template=$DEFAULT_SALT_DIR/salt/elasticsearch/templates/component/so/detection-mappings.json local runtime diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls index 3fa99eae2..cf3cb1e81 100644 --- a/salt/nginx/enabled.sls +++ b/salt/nginx/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'nginx/map.jinja' import NGINXMERGED %} include: + - ca.trust - nginx.ssl - nginx.config - nginx.sostatus @@ -47,6 +49,7 @@ so-nginx: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - /opt/so/log/nginx/:/var/log/nginx:rw - /opt/so/tmp/nginx/:/var/lib/nginx:rw @@ -89,6 +92,7 @@ so-nginx: - {{ BINDING }} {% endfor %} - watch: + - cmd: ca_trust_extract - file: nginxconf - file: nginxconfdir {% if GLOBALS.is_manager %} diff --git a/salt/postgres/enabled.sls b/salt/postgres/enabled.sls index fa91d146a..088ad6f54 100644 --- a/salt/postgres/enabled.sls +++ b/salt/postgres/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set SO_POSTGRES_USER = salt['pillar.get']('postgres:auth:users:so_postgres_user:user', 'so_postgres') %} include: + - ca.trust - postgres.auth - postgres.ssl - postgres.config @@ -42,6 +44,7 @@ so-postgres: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/log/postgres/:/log:rw - /nsm/postgres:/var/lib/postgresql/data:rw - /opt/so/conf/postgres/postgresql.conf:/conf/postgresql.conf:ro @@ -69,6 +72,7 @@ so-postgres: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: postgresconf - file: postgreshba - file: postgresinitdb diff --git a/salt/redis/enabled.sls b/salt/redis/enabled.sls index 1c9d1afa0..57bbe279c 100644 --- a/salt/redis/enabled.sls +++ b/salt/redis/enabled.sls @@ -7,6 +7,7 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: - ca @@ -28,6 +29,7 @@ so-redis: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/redis:/var/log/redis:rw - /opt/so/conf/redis/etc/redis.conf:/usr/local/etc/redis/redis.conf:ro - /opt/so/conf/redis/working:/redis:rw @@ -60,6 +62,7 @@ so-redis: {% endif %} - entrypoint: "redis-server /usr/local/etc/redis/redis.conf" - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: redis_crt - x509: redis_key diff --git a/salt/registry/enabled.sls b/salt/registry/enabled.sls index b2bfbc56d..9b69a380a 100644 --- a/salt/registry/enabled.sls +++ b/salt/registry/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - registry.ssl - registry.config - registry.sostatus @@ -29,6 +31,7 @@ so-dockerregistry: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/docker-registry/etc/config.yml:/etc/distribution/config.yml:ro - /opt/so/conf/docker-registry:/var/lib/registry:rw - /nsm/docker-registry/docker:/var/lib/registry/docker:rw @@ -63,6 +66,7 @@ so-dockerregistry: attempts: 5 interval: 30 - watch: + - cmd: ca_trust_extract - x509: registry_crt - x509: registry_key - require: diff --git a/salt/sensoroni/enabled.sls b/salt/sensoroni/enabled.sls index db4b91dd0..0c8086832 100644 --- a/salt/sensoroni/enabled.sls +++ b/salt/sensoroni/enabled.sls @@ -4,10 +4,12 @@ # Elastic License 2.0. {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - sensoroni.config - sensoroni.sostatus @@ -17,6 +19,7 @@ so-sensoroni: - restart_policy: unless-stopped - network_mode: host - binds: + - {{ CATRUST.dir }} - /nsm/import:/nsm/import:rw - /nsm/pcapout:/nsm/pcapout:rw - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro @@ -48,6 +51,7 @@ so-sensoroni: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: /opt/so/conf/sensoroni/sensoroni.json - require: - file: sensoroniagentconf diff --git a/salt/soc/enabled.sls b/salt/soc/enabled.sls index 5c08f8d6b..d20503261 100644 --- a/salt/soc/enabled.sls +++ b/salt/soc/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'soc/merged.map.jinja' import DOCKER_EXTRA_HOSTS %} {% from 'soc/merged.map.jinja' import SOCMERGED %} @@ -27,6 +28,7 @@ so-soc: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-soc'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /nsm/rules:/nsm/rules:rw - /opt/so/conf/strelka:/opt/sensoroni/yara:rw - /opt/so/conf/sigma:/opt/sensoroni/sigma:rw @@ -90,6 +92,7 @@ so-soc: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - file: /opt/so/conf/soc/* - require: diff --git a/salt/telegraf/enabled.sls b/salt/telegraf/enabled.sls index addc55128..9fdb4ec46 100644 --- a/salt/telegraf/enabled.sls +++ b/salt/telegraf/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'telegraf/map.jinja' import TELEGRAFMERGED %} @@ -33,6 +34,7 @@ so-telegraf: - network_mode: host - init: True - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/telegraf:/var/log/telegraf:rw - /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro @@ -73,6 +75,7 @@ so-telegraf: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: tgraf_sbin_jinja - file: lasthighstate_placeholder - file: trusttheca From 02394acf699a31aa94f80bc696870993c5e38198 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 16:24:33 -0400 Subject: [PATCH 3/3] Use the host CA trust store for sensor, strelka and idh containers Mount the host trust store into zeek, suricata, tcpreplay, the strelka containers and idh, and restart them when it changes. Point the Python requests clients in strelka-backend and idh at it instead of certifi. Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust rather than only on the manager in soup. --- salt/ca/trust.sls | 4 ++++ salt/idh/enabled.sls | 13 +++++++++---- salt/manager/tools/sbin/soup | 1 - salt/strelka/backend/enabled.sls | 14 ++++++++++---- salt/strelka/coordinator/enabled.sls | 6 ++++++ salt/strelka/filestream/enabled.sls | 4 ++++ salt/strelka/frontend/enabled.sls | 4 ++++ salt/strelka/gatekeeper/enabled.sls | 5 +++++ salt/strelka/manager/enabled.sls | 4 ++++ salt/suricata/enabled.sls | 4 ++++ salt/tcpreplay/init.sls | 7 +++++++ salt/zeek/enabled.sls | 4 ++++ 12 files changed, 61 insertions(+), 9 deletions(-) diff --git a/salt/ca/trust.sls b/salt/ca/trust.sls index aec613f29..d138fec7a 100644 --- a/salt/ca/trust.sls +++ b/salt/ca/trust.sls @@ -14,6 +14,10 @@ ca_trust_legacy_anchor: file.absent: - name: /etc/pki/ca-trust/source/anchors/ca.crt +ca_trust_legacy_bundles: + file.absent: + - name: /opt/so/conf/ca + # clean removes blocklist entries that are no longer shipped ca_trust_blocklist: file.recurse: diff --git a/salt/idh/enabled.sls b/salt/idh/enabled.sls index 2a02d1f85..95e4976b2 100644 --- a/salt/idh/enabled.sls +++ b/salt/idh/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - idh.config - idh.sostatus @@ -20,6 +22,7 @@ so-idh: - detach: True - network_mode: host - binds: + - {{ CATRUST.dir }} - /nsm/idh:/var/tmp:rw - /opt/so/conf/idh/http-skins:/opt/opencanary/http-skins:ro - /opt/so/conf/idh/opencanary.conf:/etc/opencanaryd/opencanary.conf:ro @@ -34,12 +37,13 @@ so-idh: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-idh'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-idh'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-idh'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-idh'].ulimits %} @@ -47,6 +51,7 @@ so-idh: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: opencanary_config - require: - file: opencanary_config diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 42f71fcfe..35337e925 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1267,7 +1267,6 @@ post_to_3.4.0() { } remove_frozen_ca_bundles() { - rm -rf /opt/so/conf/ca >> $SOUP_LOG 2>&1 rm -f /opt/so/saltstack/local/salt/elasticsearch/cacerts /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem >> $SOUP_LOG 2>&1 } diff --git a/salt/strelka/backend/enabled.sls b/salt/strelka/backend/enabled.sls index e62349f70..ee670a2b1 100644 --- a/salt/strelka/backend/enabled.sls +++ b/salt/strelka/backend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.backend.config - strelka.backend.sostatus @@ -17,6 +19,7 @@ strelka_backend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-backend:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.dir }} - /opt/so/conf/strelka/backend/:/etc/strelka/:ro - /opt/so/conf/strelka/rules/compiled/:/etc/yara/:ro {% if DOCKERMERGED.containers['so-strelka-backend'].custom_bind_mounts %} @@ -36,12 +39,14 @@ strelka_backend: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + - SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-strelka-backend'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-strelka-backend'].ulimits %} @@ -49,6 +54,7 @@ strelka_backend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: strelkasensorcompiledrules - file: backend_backend_config - file: backend_logging_config diff --git a/salt/strelka/coordinator/enabled.sls b/salt/strelka/coordinator/enabled.sls index 8393d7e68..01543c93a 100644 --- a/salt/strelka/coordinator/enabled.sls +++ b/salt/strelka/coordinator/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.coordinator.config - strelka.coordinator.sostatus @@ -39,6 +41,7 @@ strelka_coordinator: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/coord-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} @@ -51,6 +54,9 @@ strelka_coordinator: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract + delete_so-strelka-coordinator_so-status.disabled: file.uncomment: - name: /opt/so/conf/so-status/so-status.conf diff --git a/salt/strelka/filestream/enabled.sls b/salt/strelka/filestream/enabled.sls index c01171565..60e741e5c 100644 --- a/salt/strelka/filestream/enabled.sls +++ b/salt/strelka/filestream/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.filestream.config - strelka.filestream.sostatus @@ -17,6 +19,7 @@ strelka_filestream: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/filestream/:/etc/strelka/:ro - /nsm/strelka:/nsm/strelka {% if DOCKERMERGED.containers['so-strelka-filestream'].custom_bind_mounts %} @@ -49,6 +52,7 @@ strelka_filestream: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: filestream_config delete_so-strelka-filestream_so-status.disabled: diff --git a/salt/strelka/frontend/enabled.sls b/salt/strelka/frontend/enabled.sls index f2d0eecd1..5d19961b5 100644 --- a/salt/strelka/frontend/enabled.sls +++ b/salt/strelka/frontend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.frontend.config - strelka.frontend.sostatus @@ -17,6 +19,7 @@ strelka_frontend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/frontend/:/etc/strelka/:ro - /nsm/strelka/log/:/var/log/strelka/:rw {% if DOCKERMERGED.containers['so-strelka-frontend'].custom_bind_mounts %} @@ -54,6 +57,7 @@ strelka_frontend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: frontend_config delete_so-strelka-frontend_so-status.disabled: diff --git a/salt/strelka/gatekeeper/enabled.sls b/salt/strelka/gatekeeper/enabled.sls index 19d74a6d8..507e1fe02 100644 --- a/salt/strelka/gatekeeper/enabled.sls +++ b/salt/strelka/gatekeeper/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.gatekeeper.config - strelka.gatekeeper.sostatus @@ -33,6 +35,7 @@ strelka_gatekeeper: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/gk-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} @@ -51,6 +54,8 @@ strelka_gatekeeper: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract delete_so-strelka-gatekeeper_so-status.disabled: file.uncomment: diff --git a/salt/strelka/manager/enabled.sls b/salt/strelka/manager/enabled.sls index 272767928..d0fb3d07d 100644 --- a/salt/strelka/manager/enabled.sls +++ b/salt/strelka/manager/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.manager.config - strelka.manager.sostatus @@ -17,6 +19,7 @@ strelka_manager: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/manager/:/etc/strelka/:ro {% if DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} @@ -48,6 +51,7 @@ strelka_manager: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: manager_config delete_so-strelka-manager_so-status.disabled: diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls index d9206798e..ede2c1d31 100644 --- a/salt/suricata/enabled.sls +++ b/salt/suricata/enabled.sls @@ -6,11 +6,13 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'suricata/map.jinja' import SURICATAMERGED %} include: + - ca.trust - suricata.config - suricata.sostatus @@ -33,6 +35,7 @@ so-suricata: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/suricata/suricata.yaml:/etc/suricata/suricata.yaml:ro - /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro - /opt/so/conf/suricata/classification.config:/etc/suricata/classification.config:ro @@ -55,6 +58,7 @@ so-suricata: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: suriconfig - file: surithresholding - file: /opt/so/conf/suricata/bpf diff --git a/salt/tcpreplay/init.sls b/salt/tcpreplay/init.sls index f5b1b05d9..076f0f42c 100644 --- a/salt/tcpreplay/init.sls +++ b/salt/tcpreplay/init.sls @@ -2,6 +2,10 @@ {% if sls in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} + +include: + - ca.trust so-tcpreplay: docker_container.running: @@ -13,7 +17,10 @@ so-tcpreplay: - interactive: True - tty: True - binds: + - {{ CATRUST.dir }} - /opt/so/samples:/opt/so/samples:ro + - watch: + - cmd: ca_trust_extract {% else %} diff --git a/salt/zeek/enabled.sls b/salt/zeek/enabled.sls index ec8148e90..c4a191d89 100644 --- a/salt/zeek/enabled.sls +++ b/salt/zeek/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - zeek.config - zeek.sostatus @@ -30,6 +32,7 @@ so-zeek: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /nsm/zeek/logs:/nsm/zeek/logs:rw - /nsm/zeek/spool:/nsm/zeek/spool:rw - /nsm/zeek/extracted:/nsm/zeek/extracted:rw @@ -63,6 +66,7 @@ so-zeek: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: /opt/so/conf/zeek/local.zeek - file: /opt/so/conf/zeek/node.cfg - file: /opt/so/conf/zeek/networks.cfg