diff --git a/files/salt/master/master b/files/salt/master/master index e309a560b..6cf3b94ea 100644 --- a/files/salt/master/master +++ b/files/salt/master/master @@ -41,7 +41,7 @@ file_roots: base: - /opt/so/saltstack/local/salt - /opt/so/saltstack/default/salt - - /opt/so/rules + - /opt/so/rules/nids # The master_roots setting configures a master-only copy of the file_roots dictionary, diff --git a/salt/idstools/enabled.sls b/salt/idstools/enabled.sls index decc5a5b2..5e4c4c066 100644 --- a/salt/idstools/enabled.sls +++ b/salt/idstools/enabled.sls @@ -39,7 +39,7 @@ so-idstools: {% endif %} - binds: - /opt/so/conf/idstools/etc:/opt/so/idstools/etc:ro - - /opt/so/rules/nids:/opt/so/rules/nids:rw + - /opt/so/rules/nids/suri:/opt/so/rules/nids/suri:rw - /nsm/rules/:/nsm/rules/:rw {% if DOCKER.containers['so-idstools'].custom_bind_mounts %} {% for BIND in DOCKER.containers['so-idstools'].custom_bind_mounts %} diff --git a/salt/idstools/etc/rulecat.conf b/salt/idstools/etc/rulecat.conf index d6f3d93d8..f7c784413 100644 --- a/salt/idstools/etc/rulecat.conf +++ b/salt/idstools/etc/rulecat.conf @@ -1,10 +1,10 @@ {%- from 'vars/globals.map.jinja' import GLOBALS -%} {%- from 'idstools/map.jinja' import IDSTOOLSMERGED -%} ---merged=/opt/so/rules/nids/all.rules ---local=/opt/so/rules/nids/local.rules +--merged=/opt/so/rules/nids/suri/all.rules +--local=/opt/so/rules/nids/suri/local.rules {%- if GLOBALS.md_engine == "SURICATA" %} ---local=/opt/so/rules/nids/extraction.rules ---local=/opt/so/rules/nids/filters.rules +--local=/opt/so/rules/nids/suri/extraction.rules +--local=/opt/so/rules/nids/suri/filters.rules {%- endif %} --url=http://{{ GLOBALS.manager }}:7788/suricata/emerging-all.rules --disable=/opt/so/idstools/etc/disable.conf diff --git a/salt/idstools/sync_files.sls b/salt/idstools/sync_files.sls index 64479e937..cdacfaa74 100644 --- a/salt/idstools/sync_files.sls +++ b/salt/idstools/sync_files.sls @@ -21,7 +21,7 @@ idstoolsetcsync: rulesdir: file.directory: - - name: /opt/so/rules/nids + - name: /opt/so/rules/nids/suri - user: 939 - group: 939 - makedirs: True @@ -29,7 +29,7 @@ rulesdir: # Don't show changes because all.rules can be large synclocalnidsrules: file.recurse: - - name: /opt/so/rules/nids/ + - name: /opt/so/rules/nids/suri/ - source: salt://idstools/rules/ - user: 939 - group: 939 diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 5bade9891..02c7c01e0 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -605,7 +605,9 @@ up_to_2.4.50() { # post upgrade changes. POSTVERSION set to INSTALLEDVERSION at start of soup cp -v /etc/salt/master "/etc/salt/master.so-$POSTVERSION.bak" echo "Adding /opt/so/rules to file_roots in /etc/salt/master using so-yaml" - so-yaml.py append /etc/salt/master file_roots.base /opt/so/rules + so-yaml.py append /etc/salt/master file_roots.base /opt/so/rules/nids + echo "Moving Suricata rules" + mv -v /opt/so/rules/nids/* /opt/so/rules/nids/suri/. INSTALLEDVERSION=2.4.50 } diff --git a/salt/suricata/config.sls b/salt/suricata/config.sls index 4804565ce..e0a157a85 100644 --- a/salt/suricata/config.sls +++ b/salt/suricata/config.sls @@ -84,12 +84,12 @@ suridatadir: - mode: 770 - makedirs: True -# salt:// would resolve to /opt/so/rules because of the defined file_roots and -# nids not existing under /opt/so/saltstack/local/salt or /opt/so/saltstack/default/salt +# salt:// would resolve to /opt/so/rules/nids because of the defined file_roots and +# not existing under /opt/so/saltstack/local/salt or /opt/so/saltstack/default/salt surirulesync: file.recurse: - name: /opt/so/conf/suricata/rules/ - - source: salt://nids/ + - source: salt://suricata/ - user: 940 - group: 940 - show_changes: False diff --git a/salt/suricata/manager.sls b/salt/suricata/manager.sls index c196c5cae..3d5183556 100644 --- a/salt/suricata/manager.sls +++ b/salt/suricata/manager.sls @@ -13,7 +13,7 @@ ruleslink: - name: /opt/so/saltstack/local/salt/suricata/rules - user: socore - group: socore - - target: /opt/so/rules/nids + - target: /opt/so/rules/nids/suri refresh_salt_master_fileserver_suricata_ruleslink: salt.runner: @@ -27,4 +27,4 @@ refresh_salt_master_fileserver_suricata_ruleslink: test.fail_without_changes: - name: {{sls}}_state_not_allowed -{% endif %} \ No newline at end of file +{% endif %}