Merge branch 'master' into patch/1.3.91

HOTFIX

@@ -1 +1 @@
-WAZUH AIRGAPFIX 20211206 20211210
+WAZUH AIRGAPFIX 20211206 20211210 20211213

README.md

@@ -1,6 +1,6 @@
-## Security Onion 2.3.90-20211210
+## Security Onion 2.3.90-20211213
 
-Security Onion 2.3.90-20211210 is here!
+Security Onion 2.3.90-20211213 is here!
 
 ## Screenshots
 

VERIFY_ISO.md

@@ -1,18 +1,18 @@
-### 2.3.90-20211210 ISO image built on 2021/12/10
+### 2.3.90-20211213 ISO image built on 2021/12/13
 
 
 
 ### Download and Verify
 
-2.3.90-20211210 ISO image:  
+2.3.90-20211213 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-2.3.90-20211210.iso
+https://download.securityonion.net/file/securityonion/securityonion-2.3.90-20211213.iso
 
-MD5: 512C13089060EE17BC3FA275D62152DC  
+MD5: D7E90433B416627347DD54B7C3C07F18  
-SHA1: A70D3A3C4B74AD2EE9B1353BDE7E5DD327248511  
+SHA1: 11E212B2237162749F5E3BD959C84D6C4720D213  
-SHA256: 271DA7617FBA3549B1E496C60E9AD743B13CC8D0468DF3F7AC9A76B6D496D212 
+SHA256: 01DD0AF3CF5BBFD4AF7463F8897935A885E3D9CC8B9B3B5E9A01E0A2EF37ED95 
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90-20211210.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90-20211213.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS  
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90-20211210.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.90-20211213.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-2.3.90-20211210.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-2.3.90-20211213.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-2.3.90-20211210.iso.sig securityonion-2.3.90-20211210.iso
+gpg --verify securityonion-2.3.90-20211213.iso.sig securityonion-2.3.90-20211213.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Fri 10 Dec 2021 02:52:08 PM EST using RSA key ID FE507013
+gpg: Signature made Mon 13 Dec 2021 11:46:27 AM EST using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

salt/elasticsearch/init.sls

@@ -131,6 +131,13 @@ esrolesdir:
     - group: 939
     - makedirs: True
 
+eslibdir:
+  file.directory:
+    - name: /opt/so/conf/elasticsearch/lib
+    - user: 930
+    - group: 939
+    - makedirs: True
+
 esingestdynamicconf:
   file.recurse:
     - name: /opt/so/conf/elasticsearch/ingest
@@ -179,6 +186,14 @@ es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
     - group: 939
 {% endfor %}
 
+eslibsync:
+  file.managed:
+    - name: /opt/so/conf/elasticsearch/lib/log4j-core-2.11.1-patched.jar
+    - source: salt://elasticsearch/lib/log4j-core-2.11.1-patched.jar
+    - user: 930
+    - group: 939
+    - mode: 644
+
 esroles:
   file.recurse:
     - source: salt://elasticsearch/roles/
@@ -267,6 +282,7 @@ so-elasticsearch:
       - 0.0.0.0:9200:9200
       - 0.0.0.0:9300:9300
     - binds:
+      - /opt/so/conf/elasticsearch/lib/log4j-core-2.11.1-patched.jar:/usr/share/elasticsearch/lib/log4j-core-2.11.1.jar:ro
       - /opt/so/conf/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
       - /opt/so/conf/elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
       - /nsm/elasticsearch:/usr/share/elasticsearch/data:rw

salt/logstash/init.sls

@@ -61,6 +61,13 @@ logstash:
     - gid: 931
     - home: /opt/so/conf/logstash
 
+lslibdir:
+  file.directory:
+    - name: /opt/so/conf/logstash/lib
+    - user: 931
+    - group: 939
+    - makedirs: True
+
 lsetcdir:
   file.directory:
     - name: /opt/so/conf/logstash/etc
@@ -123,6 +130,14 @@ lsetcsync:
     - clean: True
     - exclude_pat: pipelines*
 
+lslibsync:
+  file.managed:
+    - name: /opt/so/conf/logstash/lib/log4j-core-2.14.0-patched.jar
+    - source: salt://logstash/lib/log4j-core-2.14.0-patched.jar
+    - user: 931
+    - group: 939
+    - mode: 644
+
 # Create the import directory
 importdir:
   file.directory:
@@ -162,6 +177,7 @@ so-logstash:
       - {{ BINDING }}
   {% endfor %}
     - binds:
+      - /opt/so/conf/logstash/lib/log4j-core-2.14.0-patched.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.14.0.jar:ro
       - /opt/so/conf/elasticsearch/templates/:/templates/:ro
       - /opt/so/conf/logstash/etc/:/usr/share/logstash/config/:ro
       - /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro