diff --git a/salt/common/tools/sbin/so-status b/salt/common/tools/sbin/so-status index 8dd607bd6..bb05d5f2e 100755 --- a/salt/common/tools/sbin/so-status +++ b/salt/common/tools/sbin/so-status @@ -20,10 +20,25 @@ if ! [ "$(id -u)" = 0 ]; then exit 1 fi +display_help() { +cat < /dev/null && echo "55000" >> /proc/sys/net/ipv4/ip_local_reserved_ports + +# Check to see if Wazuh API port is available +wazuhportavailable: + cmd.run: + - name: netstat -anp | grep 55000 | grep -qv docker && PROCESS=$(netstat -anp | grep 55000 | awk '{print $NF}' | uniq) && echo "Another process ($PROCESS) appears to be using port 55000. Please terminate this process, or reboot to ensure a clean state so that the Wazuh API can start properly." && exit 1 || exit 0 + so-wazuh: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-wazuh:{{ VERSION }} @@ -158,4 +168,4 @@ wazuh_state_not_allowed: test.fail_without_changes: - name: wazuh_state_not_allowed -{% endif %} \ No newline at end of file +{% endif %} diff --git a/setup/automation/distributed_forwardnode_ami b/setup/automation/distributed-ami-forwardnode similarity index 100% rename from setup/automation/distributed_forwardnode_ami rename to setup/automation/distributed-ami-forwardnode diff --git a/setup/automation/distributed_manager_ami b/setup/automation/distributed-ami-manager similarity index 100% rename from setup/automation/distributed_manager_ami rename to setup/automation/distributed-ami-manager diff --git a/setup/automation/distributed_searchnode_ami b/setup/automation/distributed-ami-searchnode similarity index 100% rename from setup/automation/distributed_searchnode_ami rename to setup/automation/distributed-ami-searchnode diff --git a/setup/automation/eval_ami b/setup/automation/eval-ami similarity index 100% rename from setup/automation/eval_ami rename to setup/automation/eval-ami diff --git a/setup/automation/eval_iso b/setup/automation/eval-iso similarity index 100% rename from setup/automation/eval_iso rename to setup/automation/eval-iso diff --git a/setup/automation/standalone_ami b/setup/automation/standalone-ami similarity index 100% rename from setup/automation/standalone_ami rename to setup/automation/standalone-ami diff --git a/setup/automation/standalone_iso b/setup/automation/standalone-iso similarity index 100% rename from setup/automation/standalone_iso rename to setup/automation/standalone-iso diff --git a/setup/so-functions b/setup/so-functions index d0e502941..315334a18 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -97,8 +97,6 @@ airgap_rules() { # Don't leave Strelka out cp -Rv /root/SecurityOnion/agrules/strelka /nsm/repo/rules/ - - } analyze_system() { @@ -116,13 +114,11 @@ accept_salt_key_remote() { echo "Accept the key remotely on the manager" >> "$setup_log" 2>&1 # Delete the key just in case. - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -d "$MINION_ID" -y + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -d "$MINION_ID" -y salt-call state.apply ca >> /dev/null 2>&1 - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -a "$MINION_ID" -y - + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -a "$MINION_ID" -y } - add_admin_user() { # Add an admin user with full sudo rights if this is an ISO install. { @@ -558,7 +554,7 @@ check_requirements() { } compare_versions() { - manager_ver=$(ssh -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) + manager_ver=$("$sshcmd" -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) if [[ $manager_ver == "" ]]; then rm /root/install_opt @@ -671,6 +667,7 @@ copy_salt_master_config() { } copy_minion_tmp_files() { + case "$install_type" in 'MANAGER' | 'EVAL' | 'HELIXSENSOR' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT') echo "Copying pillar and salt files in $temp_install_dir to $local_salt_dir" @@ -682,15 +679,15 @@ copy_minion_tmp_files() { *) { echo "scp pillar and salt files in $temp_install_dir to manager $local_salt_dir"; - ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar; - ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules; - scp -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules; + $scpcmd -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/; if [ -d $temp_install_dir/salt/patch/os/schedules/ ]; then if [ "$(ls -A $temp_install_dir/salt/patch/os/schedules/)" ]; then - scp -prv -i /root/.ssh/so.key $temp_install_dir/salt/patch/os/schedules/* soremote@$MSRV:/tmp/$MINION_ID/schedules; + $scpcmd -prv -i /root/.ssh/so.key $temp_install_dir/salt/patch/os/schedules/* soremote@$MSRV:/tmp/$MINION_ID/schedules; fi fi - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/manager/files/add_minion.sh "$MINION_ID"; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/manager/files/add_minion.sh "$MINION_ID"; } >> "$setup_log" 2>&1 ;; esac @@ -709,7 +706,7 @@ copy_ssh_key() { echo "Copying the SSH key to the manager" #Copy the key over to the manager - ssh-copy-id -f -i /root/.ssh/so.key soremote@"$MSRV" + $sshcopyidcmd -f -i /root/.ssh/so.key soremote@"$MSRV" } create_local_directories() { @@ -974,11 +971,12 @@ docker_seed_registry() { } download_repo_tarball() { + mkdir -p /root/manager_setup/securityonion { local manager_ver - manager_ver=$(ssh -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) - scp -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/repo/"$manager_ver".tar.gz /root/manager_setup + manager_ver=$("$sshcmd" -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) + $scpcmd -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/repo/"$manager_ver".tar.gz /root/manager_setup } >> "$setup_log" 2>&1 # Fail if the file doesn't download @@ -1774,7 +1772,7 @@ saltify() { # Copy down the gpg keys and install them from the manager mkdir "$temp_install_dir"/gpg >> "$setup_log" 2>&1 echo "scp the gpg keys and install them from the manager" >> "$setup_log" 2>&1 - scp -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg >> "$setup_log" 2>&1 + $scpcmd -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg >> "$setup_log" 2>&1 echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" >> "$setup_log" 2>&1 apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1 apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH >> "$setup_log" 2>&1 @@ -1976,6 +1974,20 @@ set_progress_str() { "----" >> "$setup_log" 2>&1 } +set_ssh_cmds() { + local automated=$1 + + if [ $automated == yes ]; then + sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' + sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' + scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' + else + sshcmd='ssh' + sshcopyidcmd='ssh-copy-id' + scpcmd='scp' + fi +} + sensor_pillar() { local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls @@ -2087,24 +2099,24 @@ set_initial_firewall_policy() { $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" ;; 'SENSOR' | 'SEARCHNODE' | 'HEAVYNODE' | 'FLEET') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost minion "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost minion "$MAINIP" case "$install_type" in 'SENSOR') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" ;; 'SEARCHNODE') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost search_node "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost search_node "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" ;; 'HEAVYNODE') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost sensor "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost heavy_node "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost sensor "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost heavy_node "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" ;; 'FLEET') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost beats_endpoint_ssl "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost beats_endpoint_ssl "$MAINIP" ;; esac ;; @@ -2200,6 +2212,13 @@ mark_version() { echo "$SOVERSION" > /etc/soversion } +update_sudoers_for_testing() { + if [ -n "$TESTING" ]; then + info "Ensuring $INSTALLUSERNAME has password-less sudo access for automated testing purposes." + sed -i "s/^$INSTALLUSERNAME ALL=(ALL) ALL/$INSTALLUSERNAME ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers + fi +} + update_sudoers() { if ! grep -qE '^soremote\ ALL=\(ALL\)\ NOPASSWD:(\/usr\/bin\/salt\-key|\/opt\/so\/saltstack)' /etc/sudoers; then diff --git a/setup/so-setup b/setup/so-setup index 8b8f99b01..15189746f 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -124,6 +124,15 @@ if [[ -f automation/$automation && $(basename $automation) == $automation ]]; th ip a | grep "$MNIC:" | grep "state UP" >> $setup_log 2>&1 done echo "Network is up on $MNIC" >> $setup_log 2>&1 + + if [[ ! $is_iso ]]; then + echo "Installing sshpass for automated testing." >> $setup_log 2>&1 + if [ "$OS" == ubuntu ]; then + apt-get -y install sshpass >> $setup_log 2>&1 + else + yum -y install sshpass >> $setup_log 2>&1 + fi + fi fi case "$setup_type" in @@ -136,6 +145,9 @@ case "$setup_type" in ;; esac +#set ssh commands that will be used based on if this is an automated test install or not +set_ssh_cmds $automated + # Allow execution of SO tools during setup local_sbin="$(pwd)/../salt/common/tools/sbin" export PATH=$PATH:$local_sbin @@ -285,7 +297,7 @@ if ! [[ -f $install_opt_file ]]; then fi if [[ $is_minion ]]; then - [ "$automated" == no ] && copy_ssh_key >> $setup_log 2>&1 + copy_ssh_key >> $setup_log 2>&1 fi if [[ $is_minion ]] && ! (compare_versions); then @@ -594,6 +606,7 @@ set_redirect >> $setup_log 2>&1 set_progress_str 10 'Updating sudoers file for soremote user' update_sudoers >> $setup_log 2>&1 + update_sudoers_for_testing >> $setup_log 2>&1 set_progress_str 11 'Generating manager global pillar' #minio_generate_keys