From 3d61897522264a689075ea2f33736f42badfc228 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 21 Aug 2024 08:51:35 -0400 Subject: [PATCH 01/20] ref es version from defaults for kibana --- salt/elasticsearch/defaults.yaml | 1 + salt/kibana/files/config_saved_objects.ndjson | 2 -- salt/kibana/files/config_saved_objects.ndjson.jinja | 3 +++ salt/kibana/so_config_load.sls | 3 ++- salt/kibana/tools/sbin_jinja/so-kibana-config-load | 4 +++- 5 files changed, 9 insertions(+), 4 deletions(-) delete mode 100644 salt/kibana/files/config_saved_objects.ndjson create mode 100644 salt/kibana/files/config_saved_objects.ndjson.jinja diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml index b18ab5a67..767911cf4 100644 --- a/salt/elasticsearch/defaults.yaml +++ b/salt/elasticsearch/defaults.yaml @@ -1,5 +1,6 @@ elasticsearch: enabled: false + version: 8.14.3 index_clean: true config: action: diff --git a/salt/kibana/files/config_saved_objects.ndjson b/salt/kibana/files/config_saved_objects.ndjson deleted file mode 100644 index c52b5cb44..000000000 --- a/salt/kibana/files/config_saved_objects.ndjson +++ /dev/null @@ -1,2 +0,0 @@ -{"attributes": {"buildNum": 39457,"defaultIndex": "logs-*","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "8.14.3","id": "8.14.3","references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="} - diff --git a/salt/kibana/files/config_saved_objects.ndjson.jinja b/salt/kibana/files/config_saved_objects.ndjson.jinja new file mode 100644 index 000000000..4902a1445 --- /dev/null +++ b/salt/kibana/files/config_saved_objects.ndjson.jinja @@ -0,0 +1,3 @@ +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS -%} + +{"attributes": {"buildNum": 39457,"defaultIndex": "logs-*","defaultRoute": "/app/dashboards#/view/a8411b30-6d03-11ea-b301-3d6c35840645","discover:sampleSize": 100,"theme:darkMode": true,"timepicker:timeDefaults": "{\n \"from\": \"now-24h\",\n \"to\": \"now\"\n}"},"coreMigrationVersion": "{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }}","id": "{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }}","references": [],"type": "config","updated_at": "2021-10-10T10:10:10.105Z","version": "WzI5NzUsMl0="} diff --git a/salt/kibana/so_config_load.sls b/salt/kibana/so_config_load.sls index a443e960b..85f97a10a 100644 --- a/salt/kibana/so_config_load.sls +++ b/salt/kibana/so_config_load.sls @@ -9,7 +9,8 @@ include: config_saved_objects: file.managed: - name: /opt/so/conf/kibana/config_saved_objects.ndjson.template - - source: salt://kibana/files/config_saved_objects.ndjson + - source: salt://kibana/files/config_saved_objects.ndjson.jinja + - template: jinja - user: 932 - group: 939 diff --git a/salt/kibana/tools/sbin_jinja/so-kibana-config-load b/salt/kibana/tools/sbin_jinja/so-kibana-config-load index 8177adb5c..921416790 100644 --- a/salt/kibana/tools/sbin_jinja/so-kibana-config-load +++ b/salt/kibana/tools/sbin_jinja/so-kibana-config-load @@ -5,6 +5,8 @@ # Elastic License 2.0. {%- set ENDGAMEHOST = salt['pillar.get']('global:endgamehost', 'ENDGAMEHOST') %} +{%- import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} + . /usr/sbin/so-common check_file() { @@ -63,7 +65,7 @@ update() { IFS=$'\r\n' GLOBIGNORE='*' command eval 'LINES=($(cat $1))' for i in "${LINES[@]}"; do - RESPONSE=$(curl -K /opt/so/conf/elasticsearch/curl.config -X PUT "localhost:5601/api/saved_objects/config/8.14.3" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d " $i ") + RESPONSE=$(curl -K /opt/so/conf/elasticsearch/curl.config -X PUT "localhost:5601/api/saved_objects/config/{{ELASTICSEARCHDEFAULTS.elasticsearch.version}}" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d " $i ") echo $RESPONSE; if [[ "$RESPONSE" != *"\"success\":true"* ]] && [[ "$RESPONSE" != *"updated_at"* ]] ; then RETURN_CODE=1;fi done From da1671fdf1586adc117d95e5f34207251d9d089c Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 21 Aug 2024 11:25:33 -0400 Subject: [PATCH 02/20] add get_elastic_agent_vars function --- salt/common/tools/sbin/so-common | 32 +++++++++++++++++++++----------- salt/manager/tools/sbin/soup | 1 + 2 files changed, 22 insertions(+), 11 deletions(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 902aabaa3..57b86b1f4 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -8,12 +8,6 @@ # Elastic agent is not managed by salt. Because of this we must store this base information in a # script that accompanies the soup system. Since so-common is one of those special soup files, # and since this same logic is required during installation, it's included in this file. -ELASTIC_AGENT_TARBALL_VERSION="8.14.3" -ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" -ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" -ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" -ELASTIC_AGENT_MD5="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" -ELASTIC_AGENT_EXPANSION_DIR=/nsm/elastic-fleet/artifacts/beats/elastic-agent DEFAULT_SALT_DIR=/opt/so/saltstack/default DOC_BASE_URL="https://docs.securityonion.net/en/2.4" @@ -263,11 +257,6 @@ fail() { exit 1 } -get_random_value() { - length=${1:-20} - head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 -} - get_agent_count() { if [ -f /opt/so/log/agents/agentstatus.log ]; then AGENTCOUNT=$(cat /opt/so/log/agents/agentstatus.log | grep -wF active | awk '{print $2}') @@ -276,6 +265,26 @@ get_agent_count() { fi } +get_elastic_agent_vars() { + local path="${1:-/opt/so/saltstack/default}" + local defaultsfile="${path}/salt/elasticsearch/defaults.yaml" + + if [ -f "$defaultsfile" ]; then + ELASTIC_AGENT_TARBALL_VERSION=$(egrep " +version: " $defaultsfile | awk -F: {'print $2'} | tr -d '[:space:]') + ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" + ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" + ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" + ELASTIC_AGENT_MD5="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" + ELASTIC_AGENT_EXPANSION_DIR=/nsm/elastic-fleet/artifacts/beats/elastic-agent + fi + +} + +get_random_value() { + length=${1:-20} + head -c 5000 /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1 +} + gpg_rpm_import() { if [[ $is_oracle ]]; then if [[ "$WHATWOULDYOUSAYYAHDOHERE" == "setup" ]]; then @@ -627,6 +636,7 @@ has_uppercase() { } update_elastic_agent() { + get_elastic_agent_vars echo "Checking if Elastic Agent update is necessary..." download_and_verify "$ELASTIC_AGENT_URL" "$ELASTIC_AGENT_MD5_URL" "$ELASTIC_AGENT_FILE" "$ELASTIC_AGENT_MD5" "$ELASTIC_AGENT_EXPANSION_DIR" } diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 72fda32aa..88ecec9d0 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -854,6 +854,7 @@ determine_elastic_agent_upgrade() { } update_elastic_agent_airgap() { + get_elastic_agent_vars rsync -av /tmp/soagupdate/fleet/* /nsm/elastic-fleet/artifacts/ tar -xf "$ELASTIC_AGENT_FILE" -C "$ELASTIC_AGENT_EXPANSION_DIR" } From cd9c9a25d35160f3aa48cee40aed74ffa9663010 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 21 Aug 2024 11:25:56 -0400 Subject: [PATCH 03/20] reference elastic versions from defaults --- salt/elastic-fleet-package-registry/enabled.sls | 3 ++- salt/elasticagent/enabled.sls | 4 ++-- salt/elasticfleet/enabled.sls | 3 ++- .../tools/sbin_jinja/so-elastic-agent-gen-installers | 3 ++- .../tools/sbin_jinja/so-elastic-agent-grid-upgrade | 7 ++++--- salt/elasticsearch/enabled.sls | 2 +- salt/kibana/enabled.sls | 3 ++- salt/logstash/enabled.sls | 3 ++- 8 files changed, 17 insertions(+), 11 deletions(-) diff --git a/salt/elastic-fleet-package-registry/enabled.sls b/salt/elastic-fleet-package-registry/enabled.sls index 3cd90ba87..640844fe7 100644 --- a/salt/elastic-fleet-package-registry/enabled.sls +++ b/salt/elastic-fleet-package-registry/enabled.sls @@ -7,6 +7,7 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} {% from 'docker/docker.map.jinja' import DOCKER %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} include: - elastic-fleet-package-registry.config @@ -14,7 +15,7 @@ include: so-elastic-fleet-package-registry: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-fleet-package-registry:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-fleet-package-registry:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} - name: so-elastic-fleet-package-registry - hostname: Fleet-package-reg-{{ GLOBALS.hostname }} - detach: True diff --git a/salt/elasticagent/enabled.sls b/salt/elasticagent/enabled.sls index 7d0f401e9..f579a7ff9 100644 --- a/salt/elasticagent/enabled.sls +++ b/salt/elasticagent/enabled.sls @@ -7,7 +7,7 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} {% from 'docker/docker.map.jinja' import DOCKER %} - +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} include: - elasticagent.config @@ -15,7 +15,7 @@ include: so-elastic-agent: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} - name: so-elastic-agent - hostname: {{ GLOBALS.hostname }} - detach: True diff --git a/salt/elasticfleet/enabled.sls b/salt/elasticfleet/enabled.sls index af5e552eb..8a251b709 100644 --- a/salt/elasticfleet/enabled.sls +++ b/salt/elasticfleet/enabled.sls @@ -8,6 +8,7 @@ {% from 'vars/globals.map.jinja' import GLOBALS %} {% from 'docker/docker.map.jinja' import DOCKER %} {% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} {# This value is generated during node install and stored in minion pillar #} {% set SERVICETOKEN = salt['pillar.get']('elasticfleet:config:server:es_token','') %} @@ -71,7 +72,7 @@ elasticagent_syncartifacts: {% if SERVICETOKEN != '' %} so-elastic-fleet: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elastic-agent:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} - name: so-elastic-fleet - hostname: FleetServer-{{ GLOBALS.hostname }} - detach: True diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers index 1ade49e44..e09ce7b67 100755 --- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers +++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers @@ -7,6 +7,7 @@ #so-elastic-agent-gen-installers $FleetHostURLs $EnrollmentToken {% from 'vars/globals.map.jinja' import GLOBALS %} +{%- import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS -%} . /usr/sbin/so-common . /usr/sbin/so-elastic-fleet-common @@ -37,7 +38,7 @@ rm -rf /nsm/elastic-agent-workspace mkdir -p /nsm/elastic-agent-workspace printf "\n### Extracting outer tarball and then each individual tarball/zip\n" -tar -xf /nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz -C /nsm/elastic-agent-workspace/ +tar -xf /nsm/elastic-fleet/artifacts/elastic-agent_SO-{{ELASTICSEARCHDEFAULTS.elasticsearch.version}}.tar.gz -C /nsm/elastic-agent-workspace/ unzip -q /nsm/elastic-agent-workspace/elastic-agent-*.zip -d /nsm/elastic-agent-workspace/ for archive in /nsm/elastic-agent-workspace/*.tar.gz do diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-grid-upgrade b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-grid-upgrade index b911f5896..360aa2cf8 100644 --- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-grid-upgrade +++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-grid-upgrade @@ -5,6 +5,7 @@ # this file except in compliance with the Elastic License 2.0. . /usr/sbin/so-common +{%- import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS -%} # Only run on Managers if ! is_manager_node; then @@ -27,14 +28,14 @@ OUTDATED_LIST=$(jq -r '.items | map(.id) | (tojson)' <<< "$RAW_JSON") if [ "$OUTDATED_LIST" != '[]' ]; then AGENTNUMBERS=$(jq -r '.total' <<< "$RAW_JSON") - printf "Initiating upgrades for $AGENTNUMBERS Agents to Elastic $ELASTIC_AGENT_TARBALL_VERSION...\n\n" + printf "Initiating upgrades for $AGENTNUMBERS Agents to Elastic {{ELASTICSEARCHDEFAULTS.elasticsearch.version}}...\n\n" # Generate updated JSON payload - JSON_STRING=$(jq -n --arg ELASTICVERSION $ELASTIC_AGENT_TARBALL_VERSION --arg UPDATELIST $OUTDATED_LIST '{"version": $ELASTICVERSION,"agents": $UPDATELIST }') + JSON_STRING=$(jq -n --arg ELASTICVERSION {{ELASTICSEARCHDEFAULTS.elasticsearch.version}} --arg UPDATELIST $OUTDATED_LIST '{"version": $ELASTICVERSION,"agents": $UPDATELIST }') # Update Node Agents curl -K /opt/so/conf/elasticsearch/curl.config -L -X POST "http://localhost:5601/api/fleet/agents/bulk_upgrade" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d "$JSON_STRING" else printf "No Agents need updates... Exiting\n\n" exit 0 -fi \ No newline at end of file +fi diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 383fd1cb4..92fa30705 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -19,7 +19,7 @@ include: so-elasticsearch: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ ELASTICSEARCHMERGED.elasticsearch.version }} - hostname: elasticsearch - name: so-elasticsearch - user: elasticsearch diff --git a/salt/kibana/enabled.sls b/salt/kibana/enabled.sls index 56aac26cc..62317b3e6 100644 --- a/salt/kibana/enabled.sls +++ b/salt/kibana/enabled.sls @@ -7,6 +7,7 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKER %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} include: - kibana.config @@ -15,7 +16,7 @@ include: # Start the kibana docker so-kibana: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-kibana:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-kibana:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} - hostname: kibana - user: kibana - networks: diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls index 0f44a3767..5c5102546 100644 --- a/salt/logstash/enabled.sls +++ b/salt/logstash/enabled.sls @@ -10,6 +10,7 @@ {% from 'logstash/map.jinja' import LOGSTASH_MERGED %} {% from 'logstash/map.jinja' import LOGSTASH_NODES %} {% set lsheap = LOGSTASH_MERGED.settings.lsheap %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} include: {% if GLOBALS.role not in ['so-receiver','so-fleet'] %} @@ -26,7 +27,7 @@ include: so-logstash: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-logstash:{{ GLOBALS.so_version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-logstash:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} - hostname: so-logstash - name: so-logstash - networks: From 7fbf448b22c574657caa69697351e453bbf6aa03 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 21 Aug 2024 11:36:06 -0400 Subject: [PATCH 04/20] fail if no defaults file --- salt/common/tools/sbin/so-common | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 57b86b1f4..0be5693ed 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -276,8 +276,9 @@ get_elastic_agent_vars() { ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" ELASTIC_AGENT_MD5="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" ELASTIC_AGENT_EXPANSION_DIR=/nsm/elastic-fleet/artifacts/beats/elastic-agent + else + fail "Could not find salt/elasticsearch/defaults.yaml" fi - } get_random_value() { From 4c10282f40af0c7bddab6b845bc8b0a82c5bb21a Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Mon, 26 Aug 2024 09:37:19 -0400 Subject: [PATCH 05/20] add es version to annotation --- salt/elasticsearch/soc_elasticsearch.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml index 085aab7f0..f59b0c22b 100644 --- a/salt/elasticsearch/soc_elasticsearch.yaml +++ b/salt/elasticsearch/soc_elasticsearch.yaml @@ -2,6 +2,11 @@ elasticsearch: enabled: description: You can enable or disable Elasticsearch. helpLink: elasticsearch.html + version: + description: The version of Elasticsearch + readonly: True + global: True + advanced: True esheap: description: Specify the memory heap size in (m)egabytes for Elasticsearch. helpLink: elasticsearch.html From 529844eb36398d2a93476bfc04b7879e5059b5b8 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 3 Sep 2024 12:36:03 -0400 Subject: [PATCH 06/20] update so-image-common to use es version for es containers --- salt/common/tools/sbin/so-common | 30 ++++++++++++++++++++++++++ salt/common/tools/sbin/so-image-common | 21 +++++++++++++++++- 2 files changed, 50 insertions(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 0be5693ed..5b787e8f5 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -168,6 +168,36 @@ check_salt_minion_status() { return $status } +# compare es versions and return the highest version +compare_es_versions() { + # Save the original IFS + local OLD_IFS="$IFS" + + IFS=. + local i ver1=($1) ver2=($2) + + # Restore the original IFS + IFS="$OLD_IFS" + + # Compare each segment of the versions + for ((i=0; i<${#ver1[@]}; i++)); do + if [[ -z ${ver2[i]} ]]; then + ver2[i]=0 + fi + if ((10#${ver1[i]} > 10#${ver2[i]})); then + echo "$1" + return 0 + fi + if ((10#${ver1[i]} < 10#${ver2[i]})); then + echo "$2" + return 0 + fi + done + + echo "$1" # If versions are equal, return either + return 0 +} + copy_new_files() { # Copy new files over to the salt dir cd $UPDATE_DIR diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 03051cb5f..6846c3e00 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -112,6 +112,9 @@ update_docker_containers() { container_list fi + # all the containers using ELASTICSEARCHDEFAULTS.elasticsearch.version + local CONTAINERS_USING_ES_VERSION=("so-elastic-fleet-package-registry","so-elastic-agent","so-kibana","so-logstash","so-elasticsearch") + rm -rf $SIGNPATH >> "$LOG_FILE" 2>&1 mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1 @@ -139,8 +142,24 @@ update_docker_containers() { $PROGRESS_CALLBACK $i fi + # use version defined in elasticsearch defaults.yaml if an es container + if [[ ${CONTAINERS_USING_ES_VERSION[*]} =~ (^|[[:space:]])"$i"($|[[:space:]]) ]]; then + local UPDATE_DIR='/tmp/sogh/securityonion' + local v1=0 + local v2=0 + if [[ -f "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" ]]; then + v1=$(egrep " +version: " "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" | awk -F: {'print $2'} | tr -d '[:space:]') + fi + if [[ -f "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml"]]; then + v2=$(egrep " +version: " "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" | awk -F: {'print $2'} | tr -d '[:space:]') + fi + local highest_es_version=$(compare_es_versions "$v1" "$v2") + local image=$i:$highest_es_version$IMAGE_TAG_SUFFIX + # use the so version for the version + else + local image=$i:$VERSION$IMAGE_TAG_SUFFIX + fi # Pull down the trusted docker image - local image=$i:$VERSION$IMAGE_TAG_SUFFIX run_check_net_err \ "docker pull $CONTAINER_REGISTRY/$IMAGEREPO/$image" \ "Could not pull $image, please ensure connectivity to $CONTAINER_REGISTRY" >> "$LOG_FILE" 2>&1 From a920adcf7fa7ba46b36eb95c968000a2732ad178 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 3 Sep 2024 12:53:53 -0400 Subject: [PATCH 07/20] handle ver1 missing segment --- salt/common/tools/sbin/so-common | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 5b787e8f5..fcc669fe2 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -181,6 +181,10 @@ compare_es_versions() { # Compare each segment of the versions for ((i=0; i<${#ver1[@]}; i++)); do + # if a segment in ver1 or ver2 is missing, set it to 0 + if [[ -z ${ver1[i]} ]]; then + ver1[i]=0 + fi if [[ -z ${ver2[i]} ]]; then ver2[i]=0 fi From 6d7b76115f1e6f033f6e9348e3480ddb11ecde78 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 3 Sep 2024 13:00:37 -0400 Subject: [PATCH 08/20] use the version that is longest for the loop --- salt/common/tools/sbin/so-common | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index fcc669fe2..8795e6828 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -168,7 +168,7 @@ check_salt_minion_status() { return $status } -# compare es versions and return the highest version +# Compare es versions and return the highest version compare_es_versions() { # Save the original IFS local OLD_IFS="$IFS" @@ -179,9 +179,15 @@ compare_es_versions() { # Restore the original IFS IFS="$OLD_IFS" + # Determine the maximum length between the two version arrays + local max_len=${#ver1[@]} + if [[ ${#ver2[@]} -gt $max_len ]]; then + max_len=${#ver2[@]} + fi + # Compare each segment of the versions - for ((i=0; i<${#ver1[@]}; i++)); do - # if a segment in ver1 or ver2 is missing, set it to 0 + for ((i=0; i Date: Tue, 3 Sep 2024 15:20:49 -0400 Subject: [PATCH 09/20] fix if and awk --- salt/common/tools/sbin/so-image-common | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 6846c3e00..9aac116cd 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -148,10 +148,10 @@ update_docker_containers() { local v1=0 local v2=0 if [[ -f "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" ]]; then - v1=$(egrep " +version: " "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" | awk -F: {'print $2'} | tr -d '[:space:]') + v1=$(egrep " +version: " "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') fi - if [[ -f "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml"]]; then - v2=$(egrep " +version: " "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" | awk -F: {'print $2'} | tr -d '[:space:]') + if [[ -f "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" ]]; then + v2=$(egrep " +version: " "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') fi local highest_es_version=$(compare_es_versions "$v1" "$v2") local image=$i:$highest_es_version$IMAGE_TAG_SUFFIX From 83aa4c9a53c01d03c4ef85303156619186a99798 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 3 Sep 2024 15:22:25 -0400 Subject: [PATCH 10/20] fix awk --- salt/common/tools/sbin/so-common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 8795e6828..68288791d 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -310,7 +310,7 @@ get_elastic_agent_vars() { local defaultsfile="${path}/salt/elasticsearch/defaults.yaml" if [ -f "$defaultsfile" ]; then - ELASTIC_AGENT_TARBALL_VERSION=$(egrep " +version: " $defaultsfile | awk -F: {'print $2'} | tr -d '[:space:]') + ELASTIC_AGENT_TARBALL_VERSION=$(egrep " +version: " $defaultsfile | awk -F: '{print $2}' | tr -d '[:space:]') ELASTIC_AGENT_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" ELASTIC_AGENT_MD5_URL="https://repo.securityonion.net/file/so-repo/prod/2.4/elasticagent/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.md5" ELASTIC_AGENT_FILE="/nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz" From cfdc8ede90bd92580d7e619ec4bd1e619f243125 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 3 Sep 2024 16:49:39 -0400 Subject: [PATCH 11/20] fix es version logic --- salt/common/tools/sbin/so-image-common | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 9aac116cd..63d034608 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -113,7 +113,7 @@ update_docker_containers() { fi # all the containers using ELASTICSEARCHDEFAULTS.elasticsearch.version - local CONTAINERS_USING_ES_VERSION=("so-elastic-fleet-package-registry","so-elastic-agent","so-kibana","so-logstash","so-elasticsearch") + local CONTAINERS_USING_ES_VERSION=("so-elastic-fleet-package-registry" "so-elastic-agent" "so-kibana" "so-logstash" "so-elasticsearch") rm -rf $SIGNPATH >> "$LOG_FILE" 2>&1 mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1 @@ -143,15 +143,15 @@ update_docker_containers() { fi # use version defined in elasticsearch defaults.yaml if an es container - if [[ ${CONTAINERS_USING_ES_VERSION[*]} =~ (^|[[:space:]])"$i"($|[[:space:]]) ]]; then + if [[ " ${CONTAINERS_USING_ES_VERSION[*]} " =~ [[:space:]]${i}[[:space:]] ]]; then local UPDATE_DIR='/tmp/sogh/securityonion' local v1=0 local v2=0 - if [[ -f "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" ]]; then - v1=$(egrep " +version: " "$UPDATE_DIR/salt/elasticsearch.defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') + if [[ -f "$UPDATE_DIR/salt/elasticsearch/defaults.yaml" ]]; then + v1=$(egrep " +version: " "$UPDATE_DIR/salt/elasticsearch/defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') fi - if [[ -f "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" ]]; then - v2=$(egrep " +version: " "$DEFAULT_SALT_DIR/salt/elasticsearch.defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') + if [[ -f "$DEFAULT_SALT_DIR/salt/elasticsearch/defaults.yaml" ]]; then + v2=$(egrep " +version: " "$DEFAULT_SALT_DIR/salt/elasticsearch/defaults.yaml" | awk -F: '{print $2}' | tr -d '[:space:]') fi local highest_es_version=$(compare_es_versions "$v1" "$v2") local image=$i:$highest_es_version$IMAGE_TAG_SUFFIX From 0af2e85f91c76d811b69c648986d9953dc776790 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 10:32:11 -0400 Subject: [PATCH 12/20] update annotation. --- salt/common/tools/sbin/so-image-common | 5 +++-- salt/elasticsearch/soc_elasticsearch.yaml | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 63d034608..c3ec07148 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -113,7 +113,8 @@ update_docker_containers() { fi # all the containers using ELASTICSEARCHDEFAULTS.elasticsearch.version - local CONTAINERS_USING_ES_VERSION=("so-elastic-fleet-package-registry" "so-elastic-agent" "so-kibana" "so-logstash" "so-elasticsearch") + # does not include so-elastic-fleet since that container uses so-elastic-agent image + local IMAGES_USING_ES_VERSION=("so-elastic-fleet-package-registry" "so-elastic-agent" "so-kibana" "so-logstash" "so-elasticsearch") rm -rf $SIGNPATH >> "$LOG_FILE" 2>&1 mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1 @@ -143,7 +144,7 @@ update_docker_containers() { fi # use version defined in elasticsearch defaults.yaml if an es container - if [[ " ${CONTAINERS_USING_ES_VERSION[*]} " =~ [[:space:]]${i}[[:space:]] ]]; then + if [[ " ${IMAGES_USING_ES_VERSION[*]} " =~ [[:space:]]${i}[[:space:]] ]]; then local UPDATE_DIR='/tmp/sogh/securityonion' local v1=0 local v2=0 diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml index f59b0c22b..3a177f255 100644 --- a/salt/elasticsearch/soc_elasticsearch.yaml +++ b/salt/elasticsearch/soc_elasticsearch.yaml @@ -3,7 +3,7 @@ elasticsearch: description: You can enable or disable Elasticsearch. helpLink: elasticsearch.html version: - description: The version of Elasticsearch + description: "This specifies the version of the following containers: so-elastic-fleet-package-registry, so-elastic-agent, so-elastic-fleet, so-kibana, so-logstash and so-elasticsearch. Modifying this value in the Elasticsearch defaults.yaml will result in catastrophic grid failure." readonly: True global: True advanced: True From 2b807c24095be3b5ebc6c37837ad9930fe9a32bd Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 10:33:14 -0400 Subject: [PATCH 13/20] update comment --- salt/common/tools/sbin/so-image-common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index c3ec07148..243f5f187 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -112,7 +112,7 @@ update_docker_containers() { container_list fi - # all the containers using ELASTICSEARCHDEFAULTS.elasticsearch.version + # all the images using ELASTICSEARCHDEFAULTS.elasticsearch.version # does not include so-elastic-fleet since that container uses so-elastic-agent image local IMAGES_USING_ES_VERSION=("so-elastic-fleet-package-registry" "so-elastic-agent" "so-kibana" "so-logstash" "so-elasticsearch") From 94e9772cf6ea9e604067bd927c167077574934d6 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 4 Sep 2024 13:25:45 -0400 Subject: [PATCH 14/20] remove hotfix from dev branch --- HOTFIX | 1 - 1 file changed, 1 deletion(-) diff --git a/HOTFIX b/HOTFIX index 53611e22c..e69de29bb 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +0,0 @@ -20240903 From 7d9b3b1f28ba24800755cddcbb4bf65bfd55a671 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 15:36:17 -0400 Subject: [PATCH 15/20] use correct sig --- salt/common/tools/sbin/so-image-common | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/common/tools/sbin/so-image-common b/salt/common/tools/sbin/so-image-common index 243f5f187..b99beac24 100755 --- a/salt/common/tools/sbin/so-image-common +++ b/salt/common/tools/sbin/so-image-common @@ -167,7 +167,7 @@ update_docker_containers() { # Get signature run_check_net_err \ - "curl --retry 5 --retry-delay 60 -A '$CURLTYPE/$CURRENTVERSION/$OS/$(uname -r)' https://sigs.securityonion.net/$VERSION/$i:$VERSION$IMAGE_TAG_SUFFIX.sig --output $SIGNPATH/$image.sig" \ + "curl --retry 5 --retry-delay 60 -A '$CURLTYPE/$CURRENTVERSION/$OS/$(uname -r)' https://sigs.securityonion.net/$VERSION/$image.sig --output $SIGNPATH/$image.sig" \ "Could not pull signature file for $image, please ensure connectivity to https://sigs.securityonion.net " \ noretry >> "$LOG_FILE" 2>&1 # Dump our hash values From f106191e723ae04097924f0011c85ac7bbf486aa Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 16:01:24 -0400 Subject: [PATCH 16/20] fix image for so-elasticsearch container --- salt/elasticsearch/enabled.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 92fa30705..48280c506 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -19,7 +19,7 @@ include: so-elasticsearch: docker_container.running: - - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ ELASTICSEARCHMERGED.elasticsearch.version }} + - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ ELASTICSEARCHMERGED.version }} - hostname: elasticsearch - name: so-elasticsearch - user: elasticsearch From 72f3eaa8f616408fc90c07e0a6722f811345bf35 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 16:42:19 -0400 Subject: [PATCH 17/20] should not have changed this, so changing it back --- .../tools/sbin_jinja/so-elastic-agent-gen-installers | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers index e09ce7b67..be83963ad 100755 --- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers +++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers @@ -7,13 +7,15 @@ #so-elastic-agent-gen-installers $FleetHostURLs $EnrollmentToken {% from 'vars/globals.map.jinja' import GLOBALS %} -{%- import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS -%} . /usr/sbin/so-common . /usr/sbin/so-elastic-fleet-common LOG="/opt/so/log/elasticfleet/so-elastic-agent-gen-installers.log" +# get the variables needed such as ELASTIC_AGENT_TARBALL_VERSION +get_elastic_agent_vars() + # Check to see if we are already running NUM_RUNNING=$(pgrep -cf "/bin/bash /sbin/so-elastic-agent-gen-installers") [ "$NUM_RUNNING" -gt 1 ] && echo "$(date) - $NUM_RUNNING gen installers script processes running...exiting." >>$LOG && exit 0 @@ -37,8 +39,9 @@ printf "\n### Creating a temp directory at /nsm/elastic-agent-workspace\n" rm -rf /nsm/elastic-agent-workspace mkdir -p /nsm/elastic-agent-workspace + printf "\n### Extracting outer tarball and then each individual tarball/zip\n" -tar -xf /nsm/elastic-fleet/artifacts/elastic-agent_SO-{{ELASTICSEARCHDEFAULTS.elasticsearch.version}}.tar.gz -C /nsm/elastic-agent-workspace/ +tar -xf /nsm/elastic-fleet/artifacts/elastic-agent_SO-$ELASTIC_AGENT_TARBALL_VERSION.tar.gz -C /nsm/elastic-agent-workspace/ unzip -q /nsm/elastic-agent-workspace/elastic-agent-*.zip -d /nsm/elastic-agent-workspace/ for archive in /nsm/elastic-agent-workspace/*.tar.gz do From df14cbad448e12ea596da9a300bb4702a6382a69 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 4 Sep 2024 17:43:49 -0400 Subject: [PATCH 18/20] fix calls to get_elastic_agent_vars --- .../tools/sbin_jinja/so-elastic-agent-gen-installers | 2 +- salt/elasticsearch/tools/sbin_jinja/so-catrust | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers index be83963ad..e2b7d734b 100755 --- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers +++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers @@ -14,7 +14,7 @@ LOG="/opt/so/log/elasticfleet/so-elastic-agent-gen-installers.log" # get the variables needed such as ELASTIC_AGENT_TARBALL_VERSION -get_elastic_agent_vars() +get_elastic_agent_vars # Check to see if we are already running NUM_RUNNING=$(pgrep -cf "/bin/bash /sbin/so-elastic-agent-gen-installers") diff --git a/salt/elasticsearch/tools/sbin_jinja/so-catrust b/salt/elasticsearch/tools/sbin_jinja/so-catrust index fe4ff58bc..16fd3ffdb 100644 --- a/salt/elasticsearch/tools/sbin_jinja/so-catrust +++ b/salt/elasticsearch/tools/sbin_jinja/so-catrust @@ -6,13 +6,14 @@ # Elastic License 2.0. . /usr/sbin/so-common +get_elastic_agent_vars # Exit on errors, since all lines must succeed set -e # Check to see if we have extracted the ca cert. if [ ! -f /opt/so/saltstack/local/salt/elasticsearch/cacerts ]; then - docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }} -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt + docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:$ELASTIC_AGENT_TARBALL_VERSION -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt docker cp so-elasticsearchca:/usr/share/elasticsearch/jdk/lib/security/cacerts /opt/so/saltstack/local/salt/elasticsearch/cacerts docker cp so-elasticsearchca:/etc/ssl/certs/ca-certificates.crt /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem docker rm so-elasticsearchca From 658197950698ab3fd105cba1807ecd4c7356e984 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 5 Sep 2024 07:33:56 -0400 Subject: [PATCH 19/20] retry suricata rule reload --- salt/suricata/tools/sbin/so-suricata-reload-rules | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/salt/suricata/tools/sbin/so-suricata-reload-rules b/salt/suricata/tools/sbin/so-suricata-reload-rules index ea5f636cc..099cd2f7c 100644 --- a/salt/suricata/tools/sbin/so-suricata-reload-rules +++ b/salt/suricata/tools/sbin/so-suricata-reload-rules @@ -5,9 +5,7 @@ # https://securityonion.net/license; you may not use this file except in compliance with the # Elastic License 2.0. - - . /usr/sbin/so-common -docker exec -it so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket -docker exec -it so-suricata /opt/suricata/bin/suricatasc -c ruleset-reload-nonblocking /var/run/suricata/suricata-command.socket +retry 40 3 'docker exec -it so-suricata /opt/suricata/bin/suricatasc -c reload-rules /var/run/suricata/suricata-command.socket' '{"message": "done", "return": "OK"}' +retry 40 3 'docker exec -it so-suricata /opt/suricata/bin/suricatasc -c ruleset-reload-nonblocking /var/run/suricata/suricata-command.socket' '{"message": "done", "return": "OK"}' From 5a1d61a042378f5b45bf58c01c432352113ed22a Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 5 Sep 2024 08:45:44 -0400 Subject: [PATCH 20/20] ref es version --- salt/elasticsearch/download.sls | 3 ++- salt/logstash/download.sls | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/salt/elasticsearch/download.sls b/salt/elasticsearch/download.sls index f74c7059a..c7891dcdc 100644 --- a/salt/elasticsearch/download.sls +++ b/salt/elasticsearch/download.sls @@ -6,10 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} so-elasticsearch_image: docker_image.present: - - name: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ GLOBALS.so_version }} + - name: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} {% else %} diff --git a/salt/logstash/download.sls b/salt/logstash/download.sls index cf1c6176c..9706f31ad 100644 --- a/salt/logstash/download.sls +++ b/salt/logstash/download.sls @@ -6,10 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% import_yaml 'elasticsearch/defaults.yaml' as ELASTICSEARCHDEFAULTS %} so-logstash_image: docker_image.present: - - name: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-logstash:{{ GLOBALS.so_version }} + - name: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-logstash:{{ ELASTICSEARCHDEFAULTS.elasticsearch.version }} {% else %}