From 81c4d879ebbe09a811c4e757b733a5e4b3bd476f Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 5 Jan 2021 10:26:19 -0500 Subject: [PATCH 01/16] first round of testing for automated testing ssh/scp --- setup/so-functions | 108 ++++++++++++++++++++++++++++++++++----------- setup/so-setup | 25 +++++++---- 2 files changed, 99 insertions(+), 34 deletions(-) diff --git a/setup/so-functions b/setup/so-functions index d0e502941..fa52b4adb 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -97,8 +97,6 @@ airgap_rules() { # Don't leave Strelka out cp -Rv /root/SecurityOnion/agrules/strelka /nsm/repo/rules/ - - } analyze_system() { @@ -112,17 +110,19 @@ analyze_system() { } accept_salt_key_remote() { + + local automated=$1 + local sshcmd=get_ssh_cmd $automated + systemctl restart salt-minion echo "Accept the key remotely on the manager" >> "$setup_log" 2>&1 # Delete the key just in case. - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -d "$MINION_ID" -y + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -d "$MINION_ID" -y salt-call state.apply ca >> /dev/null 2>&1 - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -a "$MINION_ID" -y - + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo salt-key -a "$MINION_ID" -y } - add_admin_user() { # Add an admin user with full sudo rights if this is an ISO install. { @@ -558,7 +558,10 @@ check_requirements() { } compare_versions() { - manager_ver=$(ssh -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) + local automated=$1 + local sshcmd=get_ssh_cmd $automated + + manager_ver=$("$sshcmd" -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) if [[ $manager_ver == "" ]]; then rm /root/install_opt @@ -671,6 +674,11 @@ copy_salt_master_config() { } copy_minion_tmp_files() { + + local automated=$1 + local sshcmd=get_ssh_cmd $automated + local scpcmd=get_scp_cmd $automated + case "$install_type" in 'MANAGER' | 'EVAL' | 'HELIXSENSOR' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT') echo "Copying pillar and salt files in $temp_install_dir to $local_salt_dir" @@ -682,15 +690,15 @@ copy_minion_tmp_files() { *) { echo "scp pillar and salt files in $temp_install_dir to manager $local_salt_dir"; - ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar; - ssh -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules; - scp -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/pillar; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" mkdir -p /tmp/"$MINION_ID"/schedules; + $scpcmd -prv -i /root/.ssh/so.key "$temp_install_dir"/pillar/minions/* soremote@"$MSRV":/tmp/"$MINION_ID"/pillar/; if [ -d $temp_install_dir/salt/patch/os/schedules/ ]; then if [ "$(ls -A $temp_install_dir/salt/patch/os/schedules/)" ]; then - scp -prv -i /root/.ssh/so.key $temp_install_dir/salt/patch/os/schedules/* soremote@$MSRV:/tmp/$MINION_ID/schedules; + $scpcmd -prv -i /root/.ssh/so.key $temp_install_dir/salt/patch/os/schedules/* soremote@$MSRV:/tmp/$MINION_ID/schedules; fi fi - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/manager/files/add_minion.sh "$MINION_ID"; + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/manager/files/add_minion.sh "$MINION_ID"; } >> "$setup_log" 2>&1 ;; esac @@ -698,6 +706,9 @@ copy_minion_tmp_files() { copy_ssh_key() { + local automated=$1 + local sshcopyidcmd=get_ssh_copy_id_cmd $automated + echo "Generating SSH key" # Generate SSH key mkdir -p /root/.ssh @@ -709,7 +720,7 @@ copy_ssh_key() { echo "Copying the SSH key to the manager" #Copy the key over to the manager - ssh-copy-id -f -i /root/.ssh/so.key soremote@"$MSRV" + $sshcopyidcmd -f -i /root/.ssh/so.key soremote@"$MSRV" } create_local_directories() { @@ -974,11 +985,15 @@ docker_seed_registry() { } download_repo_tarball() { + local automated=$1 + local sshcmd=get_ssh_cmd $automated + local scpcmd=get_scp_cmd $automated + mkdir -p /root/manager_setup/securityonion { local manager_ver - manager_ver=$(ssh -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) - scp -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/repo/"$manager_ver".tar.gz /root/manager_setup + manager_ver=$("$sshcmd" -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) + $scpcmd -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/repo/"$manager_ver".tar.gz /root/manager_setup } >> "$setup_log" 2>&1 # Fail if the file doesn't download @@ -1082,6 +1097,42 @@ get_minion_type() { echo "$minion_type" } +get_scp_cmd() { + local automated=$1 + + if [ $automated == yes ]; then + local scpcmd='sshpass -p "PASSWORD" scp -o StrictHostKeyChecking=no' + else + local scpcmd='scp' + fi + + echo $scpcmd +} + +get_ssh_cmd() { + local automated=$1 + + if [ $automated == yes ]; then + local sshcmd='sshpass -p "PASSWORD" ssh -o StrictHostKeyChecking=no' + else + local sshcmd='ssh' + fi + + echo $sshcmd +} + +get_ssh_copy_id_cmd() { + local automated=$1 + + if [ $automated == yes ]; then + local sshcopyidcmd='sshpass -p "PASSWORD" ssh-copy-id -o StrictHostKeyChecking=no' + else + local sshcopyidcmd='ssh-copy-id' + fi + + echo $sshcopyidcmd +} + host_pillar() { local pillar_file="$temp_install_dir"/pillar/minions/"$MINION_ID".sls @@ -1629,6 +1680,9 @@ remove_package() { # - securityonion/salt/salt/minion.defaults.yaml saltify() { + local automated=$1 + local scpcmd=get_scp_cmd $automated + # Install updates and Salt if [ $OS = 'centos' ]; then set_progress_str 5 'Installing Salt repo' @@ -1774,7 +1828,7 @@ saltify() { # Copy down the gpg keys and install them from the manager mkdir "$temp_install_dir"/gpg >> "$setup_log" 2>&1 echo "scp the gpg keys and install them from the manager" >> "$setup_log" 2>&1 - scp -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg >> "$setup_log" 2>&1 + $scpcmd -v -i /root/.ssh/so.key soremote@"$MSRV":/opt/so/gpg/* "$temp_install_dir"/gpg >> "$setup_log" 2>&1 echo "Using apt-key add to add SALTSTACK-GPG-KEY.pub and GPG-KEY-WAZUH" >> "$setup_log" 2>&1 apt-key add "$temp_install_dir"/gpg/SALTSTACK-GPG-KEY.pub >> "$setup_log" 2>&1 apt-key add "$temp_install_dir"/gpg/GPG-KEY-WAZUH >> "$setup_log" 2>&1 @@ -2054,6 +2108,8 @@ set_hostname() { set_initial_firewall_policy() { set_main_ip + local automated=$1 + local sshcmd=get_ssh_cmd $automated if [ -f $default_salt_dir/pillar/data/addtotab.sh ]; then chmod +x $default_salt_dir/pillar/data/addtotab.sh; fi if [ -f $default_salt_dir/salt/common/tools/sbin/so-firewall ]; then chmod +x $default_salt_dir/salt/common/tools/sbin/so-firewall; fi @@ -2087,24 +2143,24 @@ set_initial_firewall_policy() { $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" ;; 'SENSOR' | 'SEARCHNODE' | 'HEAVYNODE' | 'FLEET') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost minion "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost minion "$MAINIP" case "$install_type" in 'SENSOR') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost sensor "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" ;; 'SEARCHNODE') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost search_node "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost search_node "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" ;; 'HEAVYNODE') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost sensor "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost heavy_node "$MAINIP" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall includehost sensor "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost heavy_node "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh sensorstab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" "$INTERFACE" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/pillar/data/addtotab.sh nodestab "$MINION_ID" "$MAINIP" "$num_cpu_cores" "$random_uid" "$MNIC" "$filesystem_root" "$filesystem_nsm" ;; 'FLEET') - ssh -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost beats_endpoint_ssl "$MAINIP" + $sshcmd -i /root/.ssh/so.key soremote@"$MSRV" sudo $default_salt_dir/salt/common/tools/sbin/so-firewall --apply includehost beats_endpoint_ssl "$MAINIP" ;; esac ;; diff --git a/setup/so-setup b/setup/so-setup index bede7990d..f66b0a687 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -124,6 +124,15 @@ if [[ -f automation/$automation && $(basename $automation) == $automation ]]; th ip a | grep "$MNIC:" | grep "state UP" >> $setup_log 2>&1 done echo "Network is up on $MNIC" >> $setup_log 2>&1 + + if [[ ! $is_iso ]]; then + echo "Installing sshpass for automated testing." >> $setup_log 2>&1 + if [ "$OS" == ubuntu ]; then + yum -y install sshpass >> $setup_log 2>&1 + else + apt-get -y install sshpass >> $setup_log 2>&1 + fi + fi fi case "$setup_type" in @@ -287,10 +296,10 @@ if ! [[ -f $install_opt_file ]]; then fi if [[ $is_minion ]]; then - [ "$automated" == no ] && copy_ssh_key >> $setup_log 2>&1 + copy_ssh_key $automated >> $setup_log 2>&1 fi - if [[ $is_minion ]] && ! (compare_versions); then + if [[ $is_minion ]] && ! (compare_versions $automated); then info "Installer version mismatch, downloading correct version from manager" printf '%s\n' \ "install_type=$install_type" \ @@ -298,7 +307,7 @@ if ! [[ -f $install_opt_file ]]; then "HOSTNAME=$HOSTNAME" \ "MSRV=$MSRV" \ "MSRVIP=$MSRVIP" > "$install_opt_file" - download_repo_tarball + download_repo_tarball $automated exec bash /root/manager_setup/securityonion/setup/so-setup "${original_args[@]}" fi @@ -553,7 +562,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 1 'Configuring firewall' - set_initial_firewall_policy >> $setup_log 2>&1 + set_initial_firewall_policy $automated >> $setup_log 2>&1 fi set_progress_str 2 'Updating packages' @@ -573,7 +582,7 @@ set_redirect >> $setup_log 2>&1 fi set_progress_str 5 'Installing Salt and dependencies' - saltify 2>> $setup_log + saltify $automated 2>> $setup_log set_progress_str 6 'Installing Docker and dependencies' docker_install >> $setup_log 2>&1 @@ -626,7 +635,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 20 'Accepting Salt key on manager' - accept_salt_key_remote >> $setup_log 2>&1 + accept_salt_key_remote $automated >> $setup_log 2>&1 fi if [[ $is_manager || $is_import || $is_helix ]]; then @@ -635,7 +644,7 @@ set_redirect >> $setup_log 2>&1 fi set_progress_str 21 'Copying minion pillars to manager' - copy_minion_tmp_files >> $setup_log 2>&1 + copy_minion_tmp_files $automated >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 22 'Checking if the Salt Minion needs to be updated' @@ -647,7 +656,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_manager || $is_helix || $is_import ]]; then set_progress_str 25 'Configuring firewall' - set_initial_firewall_policy >> $setup_log 2>&1 + set_initial_firewall_policy $automated >> $setup_log 2>&1 # create these so the registry state can add so-registry to /opt/so/conf/so-status/so-status.conf mkdir -p /opt/so/conf/so-status/ >> $setup_log 2>&1 From c93dfa7b33980b56538fa4cf993912b52d54efef Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 5 Jan 2021 11:47:22 -0500 Subject: [PATCH 02/16] hardcode automation pw --- setup/so-functions | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/setup/so-functions b/setup/so-functions index fa52b4adb..fc5f79bda 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -1101,7 +1101,7 @@ get_scp_cmd() { local automated=$1 if [ $automated == yes ]; then - local scpcmd='sshpass -p "PASSWORD" scp -o StrictHostKeyChecking=no' + local scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' else local scpcmd='scp' fi @@ -1113,7 +1113,7 @@ get_ssh_cmd() { local automated=$1 if [ $automated == yes ]; then - local sshcmd='sshpass -p "PASSWORD" ssh -o StrictHostKeyChecking=no' + local sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' else local sshcmd='ssh' fi @@ -1125,7 +1125,7 @@ get_ssh_copy_id_cmd() { local automated=$1 if [ $automated == yes ]; then - local sshcopyidcmd='sshpass -p "PASSWORD" ssh-copy-id -o StrictHostKeyChecking=no' + local sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' else local sshcopyidcmd='ssh-copy-id' fi From 0f9bf9deb643be9e5291e45b8680d5e2f06c737c Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 5 Jan 2021 13:49:51 -0500 Subject: [PATCH 03/16] make sshcmd, scpcmd, ssh_copy_id_cmd global to so-functions; --- setup/so-functions | 39 ++++++--------------------------------- setup/so-setup | 17 ++++++++++------- 2 files changed, 16 insertions(+), 40 deletions(-) diff --git a/setup/so-functions b/setup/so-functions index fc5f79bda..8d12156ae 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -110,10 +110,6 @@ analyze_system() { } accept_salt_key_remote() { - - local automated=$1 - local sshcmd=get_ssh_cmd $automated - systemctl restart salt-minion echo "Accept the key remotely on the manager" >> "$setup_log" 2>&1 @@ -558,9 +554,6 @@ check_requirements() { } compare_versions() { - local automated=$1 - local sshcmd=get_ssh_cmd $automated - manager_ver=$("$sshcmd" -i /root/.ssh/so.key soremote@"$MSRV" cat /etc/soversion) if [[ $manager_ver == "" ]]; then @@ -675,10 +668,6 @@ copy_salt_master_config() { copy_minion_tmp_files() { - local automated=$1 - local sshcmd=get_ssh_cmd $automated - local scpcmd=get_scp_cmd $automated - case "$install_type" in 'MANAGER' | 'EVAL' | 'HELIXSENSOR' | 'MANAGERSEARCH' | 'STANDALONE' | 'IMPORT') echo "Copying pillar and salt files in $temp_install_dir to $local_salt_dir" @@ -706,9 +695,6 @@ copy_minion_tmp_files() { copy_ssh_key() { - local automated=$1 - local sshcopyidcmd=get_ssh_copy_id_cmd $automated - echo "Generating SSH key" # Generate SSH key mkdir -p /root/.ssh @@ -985,9 +971,6 @@ docker_seed_registry() { } download_repo_tarball() { - local automated=$1 - local sshcmd=get_ssh_cmd $automated - local scpcmd=get_scp_cmd $automated mkdir -p /root/manager_setup/securityonion { @@ -1101,36 +1084,31 @@ get_scp_cmd() { local automated=$1 if [ $automated == yes ]; then - local scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' + scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' else - local scpcmd='scp' + scpcmd='scp' fi - - echo $scpcmd } get_ssh_cmd() { local automated=$1 if [ $automated == yes ]; then - local sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' + sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' else - local sshcmd='ssh' + sshcmd='ssh' fi - echo $sshcmd } get_ssh_copy_id_cmd() { local automated=$1 if [ $automated == yes ]; then - local sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' + sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' else - local sshcopyidcmd='ssh-copy-id' + sshcopyidcmd='ssh-copy-id' fi - - echo $sshcopyidcmd } host_pillar() { @@ -1680,9 +1658,6 @@ remove_package() { # - securityonion/salt/salt/minion.defaults.yaml saltify() { - local automated=$1 - local scpcmd=get_scp_cmd $automated - # Install updates and Salt if [ $OS = 'centos' ]; then set_progress_str 5 'Installing Salt repo' @@ -2108,8 +2083,6 @@ set_hostname() { set_initial_firewall_policy() { set_main_ip - local automated=$1 - local sshcmd=get_ssh_cmd $automated if [ -f $default_salt_dir/pillar/data/addtotab.sh ]; then chmod +x $default_salt_dir/pillar/data/addtotab.sh; fi if [ -f $default_salt_dir/salt/common/tools/sbin/so-firewall ]; then chmod +x $default_salt_dir/salt/common/tools/sbin/so-firewall; fi diff --git a/setup/so-setup b/setup/so-setup index f66b0a687..020882347 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -108,6 +108,9 @@ if [[ -f automation/$automation && $(basename $automation) == $automation ]]; th echo "Preselecting variable values based on automated setup: $automation" >> $setup_log 2>&1 source automation/$automation automated=yes + get_scp_cmd $automated + get_ssh_cmd $automated + get_ssh_copy_id_cmd $automated attempt=1 attempts=60 @@ -296,7 +299,7 @@ if ! [[ -f $install_opt_file ]]; then fi if [[ $is_minion ]]; then - copy_ssh_key $automated >> $setup_log 2>&1 + copy_ssh_key >> $setup_log 2>&1 fi if [[ $is_minion ]] && ! (compare_versions $automated); then @@ -307,7 +310,7 @@ if ! [[ -f $install_opt_file ]]; then "HOSTNAME=$HOSTNAME" \ "MSRV=$MSRV" \ "MSRVIP=$MSRVIP" > "$install_opt_file" - download_repo_tarball $automated + download_repo_tarball exec bash /root/manager_setup/securityonion/setup/so-setup "${original_args[@]}" fi @@ -562,7 +565,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 1 'Configuring firewall' - set_initial_firewall_policy $automated >> $setup_log 2>&1 + set_initial_firewall_policy >> $setup_log 2>&1 fi set_progress_str 2 'Updating packages' @@ -582,7 +585,7 @@ set_redirect >> $setup_log 2>&1 fi set_progress_str 5 'Installing Salt and dependencies' - saltify $automated 2>> $setup_log + saltify 2>> $setup_log set_progress_str 6 'Installing Docker and dependencies' docker_install >> $setup_log 2>&1 @@ -635,7 +638,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 20 'Accepting Salt key on manager' - accept_salt_key_remote $automated >> $setup_log 2>&1 + accept_salt_key_remote >> $setup_log 2>&1 fi if [[ $is_manager || $is_import || $is_helix ]]; then @@ -644,7 +647,7 @@ set_redirect >> $setup_log 2>&1 fi set_progress_str 21 'Copying minion pillars to manager' - copy_minion_tmp_files $automated >> $setup_log 2>&1 + copy_minion_tmp_files >> $setup_log 2>&1 if [[ $is_minion ]]; then set_progress_str 22 'Checking if the Salt Minion needs to be updated' @@ -656,7 +659,7 @@ set_redirect >> $setup_log 2>&1 if [[ $is_manager || $is_helix || $is_import ]]; then set_progress_str 25 'Configuring firewall' - set_initial_firewall_policy $automated >> $setup_log 2>&1 + set_initial_firewall_policy >> $setup_log 2>&1 # create these so the registry state can add so-registry to /opt/so/conf/so-status/so-status.conf mkdir -p /opt/so/conf/so-status/ >> $setup_log 2>&1 From 749b21e6843877a7a0b73eb1fa07cfbc0dcc02b0 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Tue, 5 Jan 2021 14:12:43 -0500 Subject: [PATCH 04/16] make sure ssh commands get set whether automated install or not --- setup/so-setup | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/setup/so-setup b/setup/so-setup index 020882347..3804b1e96 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -108,9 +108,6 @@ if [[ -f automation/$automation && $(basename $automation) == $automation ]]; th echo "Preselecting variable values based on automated setup: $automation" >> $setup_log 2>&1 source automation/$automation automated=yes - get_scp_cmd $automated - get_ssh_cmd $automated - get_ssh_copy_id_cmd $automated attempt=1 attempts=60 @@ -148,6 +145,11 @@ case "$setup_type" in ;; esac +#set ssh command thats will be used based on if this is an automated test install or not +get_scp_cmd $automated +get_ssh_cmd $automated +get_ssh_copy_id_cmd $automated + # Allow execution of SO tools during setup local_sbin="$(pwd)/../salt/common/tools/sbin" export PATH=$PATH:$local_sbin From 91ad7f26bfe5df04a887fc4ed92f021a1c229ff8 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 6 Jan 2021 08:45:33 -0500 Subject: [PATCH 05/16] no longer need to pass $automated to compare_versions --- setup/so-setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/so-setup b/setup/so-setup index 3804b1e96..3ea6fe570 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -304,7 +304,7 @@ if ! [[ -f $install_opt_file ]]; then copy_ssh_key >> $setup_log 2>&1 fi - if [[ $is_minion ]] && ! (compare_versions $automated); then + if [[ $is_minion ]] && ! (compare_versions); then info "Installer version mismatch, downloading correct version from manager" printf '%s\n' \ "install_type=$install_type" \ From aecc0c025eca68689acce0c86059aab12ab40480 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 6 Jan 2021 08:49:08 -0500 Subject: [PATCH 06/16] fix comment --- setup/so-setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/so-setup b/setup/so-setup index 3ea6fe570..4c5760856 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -145,7 +145,7 @@ case "$setup_type" in ;; esac -#set ssh command thats will be used based on if this is an automated test install or not +#set ssh commands that will be used based on if this is an automated test install or not get_scp_cmd $automated get_ssh_cmd $automated get_ssh_copy_id_cmd $automated From 94fd79cd289a617346f799489a83cba603a35067 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 6 Jan 2021 08:51:33 -0500 Subject: [PATCH 07/16] originally had sshpass package install reveresed, fixed it here --- setup/so-setup | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup/so-setup b/setup/so-setup index 4c5760856..7ab87a23a 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -128,9 +128,9 @@ if [[ -f automation/$automation && $(basename $automation) == $automation ]]; th if [[ ! $is_iso ]]; then echo "Installing sshpass for automated testing." >> $setup_log 2>&1 if [ "$OS" == ubuntu ]; then - yum -y install sshpass >> $setup_log 2>&1 - else apt-get -y install sshpass >> $setup_log 2>&1 + else + yum -y install sshpass >> $setup_log 2>&1 fi fi fi From 48f81d9ac6640e77dddecd2d116953ad7da1957b Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 6 Jan 2021 08:58:33 -0500 Subject: [PATCH 08/16] reduce setting ssh commands down to 1 function and 1 function call --- setup/so-functions | 45 ++++++++++++++------------------------------- setup/so-setup | 4 +--- 2 files changed, 15 insertions(+), 34 deletions(-) diff --git a/setup/so-functions b/setup/so-functions index 8d12156ae..52c8b19c9 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -1080,37 +1080,6 @@ get_minion_type() { echo "$minion_type" } -get_scp_cmd() { - local automated=$1 - - if [ $automated == yes ]; then - scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' - else - scpcmd='scp' - fi -} - -get_ssh_cmd() { - local automated=$1 - - if [ $automated == yes ]; then - sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' - else - sshcmd='ssh' - fi - -} - -get_ssh_copy_id_cmd() { - local automated=$1 - - if [ $automated == yes ]; then - sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' - else - sshcopyidcmd='ssh-copy-id' - fi -} - host_pillar() { local pillar_file="$temp_install_dir"/pillar/minions/"$MINION_ID".sls @@ -2005,6 +1974,20 @@ set_progress_str() { "----" >> "$setup_log" 2>&1 } +set_ssh_cmds() { + local automated=$1 + + if [ $automated == yes ]; then + sshcmd='sshpass -p "automation" ssh -o StrictHostKeyChecking=no' + sshcopyidcmd='sshpass -p "automation" ssh-copy-id -o StrictHostKeyChecking=no' + scpcmd='sshpass -p "automation" scp -o StrictHostKeyChecking=no' + else + sshcmd='ssh' + sshcopyidcmd='ssh-copy-id' + scpcmd='scp' + fi +} + sensor_pillar() { local pillar_file=$temp_install_dir/pillar/minions/$MINION_ID.sls diff --git a/setup/so-setup b/setup/so-setup index 7ab87a23a..991273b65 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -146,9 +146,7 @@ case "$setup_type" in esac #set ssh commands that will be used based on if this is an automated test install or not -get_scp_cmd $automated -get_ssh_cmd $automated -get_ssh_copy_id_cmd $automated +set_ssh_cmds $automated # Allow execution of SO tools during setup local_sbin="$(pwd)/../salt/common/tools/sbin" From f2b677bfcb1045d6b629c6bcc3b703eb1d14aa4e Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 6 Jan 2021 15:52:10 +0000 Subject: [PATCH 09/16] Reserve port for Wazuh API and check if port is already in use --- salt/wazuh/init.sls | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/salt/wazuh/init.sls b/salt/wazuh/init.sls index 99f16cb8a..3cad6c367 100644 --- a/salt/wazuh/init.sls +++ b/salt/wazuh/init.sls @@ -96,6 +96,16 @@ wazuhmgrwhitelist: - mode: 755 - template: jinja +# Reserve OS port for Wazuh API +wazuhreserveport: + cmd.run: + - name: grep -q 55000 /proc/sys/net/ipv4/ip_local_reserved_ports || sysctl -w net.ipv4.ip_local_reserved_ports="55000" > /dev/null && echo "55000" >> /proc/sys/net/ipv4/ip_local_reserved_ports + +# Check to see if Wazuh API port is available +wazuhportavailable: + cmd.run: + - name: netstat -anp | grep 55000 | grep -qv docker && PROCESS=$(netstat -anp | grep 55000 | awk '{print $NF}' | uniq) && echo "Another process ($PROCESS) appears to be using port 55000. Please terminate this process, or reboot to ensure a clean state so that the Wazuh API can start properly." && exit 1 || exit 0 + so-wazuh: docker_container.running: - image: {{ MANAGER }}:5000/{{ IMAGEREPO }}/so-wazuh:{{ VERSION }} @@ -158,4 +168,4 @@ wazuh_state_not_allowed: test.fail_without_changes: - name: wazuh_state_not_allowed -{% endif %} \ No newline at end of file +{% endif %} From 875908dc905ead667387f8af43a2c2fb4c32ee3d Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Wed, 6 Jan 2021 16:47:35 +0000 Subject: [PATCH 10/16] Set @timestamp to winlog.systemTime --- salt/elasticsearch/files/ingest/win.eventlogs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/salt/elasticsearch/files/ingest/win.eventlogs b/salt/elasticsearch/files/ingest/win.eventlogs index 3137e6bb5..2644be7a2 100644 --- a/salt/elasticsearch/files/ingest/win.eventlogs +++ b/salt/elasticsearch/files/ingest/win.eventlogs @@ -4,6 +4,8 @@ { "set": { "if": "ctx.winlog?.channel != null", "field": "event.module", "value": "windows_eventlog", "override": false, "ignore_failure": true } }, { "set": { "if": "ctx.winlog?.channel != null", "field": "event.dataset", "value": "{{winlog.channel}}", "override": true } }, { "set": { "if": "ctx.winlog?.computer_name != null", "field": "observer.name", "value": "{{winlog.computer_name}}", "override": true } }, + { "rename": { "if": "ctx.winlog?.systemTime != null", "field": "@timestamp", "target_field": "ingest.timestamp", "ignore_missing": true } }, + { "set": { "if": "ctx.winlog?.systemTime != null", "field": "@timestamp", "value": "{{winlog.systemTime}}", "override": true } }, { "set": { "field": "event.code", "value": "{{winlog.event_id}}", "override": true } }, { "set": { "field": "event.category", "value": "host", "override": true } }, { "rename": { "field": "winlog.event_data.SubjectUserName", "target_field": "user.name", "ignore_failure": true, "ignore_missing": true } }, From bbdb47703d320da840eae2d7963e7a31f354e493 Mon Sep 17 00:00:00 2001 From: Jason Ertel Date: Wed, 6 Jan 2021 17:21:46 -0500 Subject: [PATCH 11/16] Rename automation files to match environment names for consistency --- .../{distributed_forwardnode_ami => distributed-ami-forwardnode} | 0 .../{distributed_manager_ami => distributed-ami-manager} | 0 .../{distributed_searchnode_ami => distributed-ami-searchnode} | 0 setup/automation/{eval_ami => eval-ami} | 0 setup/automation/{eval_iso => eval-iso} | 0 setup/automation/{standalone_ami => standalone-ami} | 0 setup/automation/{standalone_iso => standalone-iso} | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename setup/automation/{distributed_forwardnode_ami => distributed-ami-forwardnode} (100%) rename setup/automation/{distributed_manager_ami => distributed-ami-manager} (100%) rename setup/automation/{distributed_searchnode_ami => distributed-ami-searchnode} (100%) rename setup/automation/{eval_ami => eval-ami} (100%) rename setup/automation/{eval_iso => eval-iso} (100%) rename setup/automation/{standalone_ami => standalone-ami} (100%) rename setup/automation/{standalone_iso => standalone-iso} (100%) diff --git a/setup/automation/distributed_forwardnode_ami b/setup/automation/distributed-ami-forwardnode similarity index 100% rename from setup/automation/distributed_forwardnode_ami rename to setup/automation/distributed-ami-forwardnode diff --git a/setup/automation/distributed_manager_ami b/setup/automation/distributed-ami-manager similarity index 100% rename from setup/automation/distributed_manager_ami rename to setup/automation/distributed-ami-manager diff --git a/setup/automation/distributed_searchnode_ami b/setup/automation/distributed-ami-searchnode similarity index 100% rename from setup/automation/distributed_searchnode_ami rename to setup/automation/distributed-ami-searchnode diff --git a/setup/automation/eval_ami b/setup/automation/eval-ami similarity index 100% rename from setup/automation/eval_ami rename to setup/automation/eval-ami diff --git a/setup/automation/eval_iso b/setup/automation/eval-iso similarity index 100% rename from setup/automation/eval_iso rename to setup/automation/eval-iso diff --git a/setup/automation/standalone_ami b/setup/automation/standalone-ami similarity index 100% rename from setup/automation/standalone_ami rename to setup/automation/standalone-ami diff --git a/setup/automation/standalone_iso b/setup/automation/standalone-iso similarity index 100% rename from setup/automation/standalone_iso rename to setup/automation/standalone-iso From ae7c0a26be3d39e0f543ee7a05fc3278b31fd0b7 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Wed, 6 Jan 2021 18:46:21 -0500 Subject: [PATCH 12/16] add a quiet mode to so-status for automation testing --- salt/common/tools/sbin/so-status | 107 +++++++++++++++++++++++-------- 1 file changed, 80 insertions(+), 27 deletions(-) diff --git a/salt/common/tools/sbin/so-status b/salt/common/tools/sbin/so-status index 8dd607bd6..dedd11d3e 100755 --- a/salt/common/tools/sbin/so-status +++ b/salt/common/tools/sbin/so-status @@ -20,7 +20,21 @@ if ! [ "$(id -u)" = 0 ]; then exit 1 fi +display_help() { +cat < Date: Wed, 6 Jan 2021 20:14:42 -0500 Subject: [PATCH 13/16] return 99 if setup is running --- salt/common/tools/sbin/so-status | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/common/tools/sbin/so-status b/salt/common/tools/sbin/so-status index dedd11d3e..953d3a43e 100755 --- a/salt/common/tools/sbin/so-status +++ b/salt/common/tools/sbin/so-status @@ -38,6 +38,7 @@ EXITCODE=0 SYSTEM_START_TIME=$(date -d "$( Date: Wed, 6 Jan 2021 20:39:44 -0500 Subject: [PATCH 14/16] Drop password requirement for sudo access during automated tests --- setup/so-functions | 7 +++++++ setup/so-setup | 1 + 2 files changed, 8 insertions(+) diff --git a/setup/so-functions b/setup/so-functions index d0e502941..2c7bc4502 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -2200,6 +2200,13 @@ mark_version() { echo "$SOVERSION" > /etc/soversion } +update_sudoers_for_testing() { + if [ -n "$TESTING" ]; then + info "Ensuring $INSTALLUSERNAME has password-less sudo access for automated testing purposes." + sed -i "s/^$INSTALLUSERNAME ALL=(ALL) ALL/^$INSTALLUSERNAME ALL=(ALL) NOPASSWD:ALL/" /etc/sudoers + fi +} + update_sudoers() { if ! grep -qE '^soremote\ ALL=\(ALL\)\ NOPASSWD:(\/usr\/bin\/salt\-key|\/opt\/so\/saltstack)' /etc/sudoers; then diff --git a/setup/so-setup b/setup/so-setup index 8b8f99b01..be0c73d52 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -594,6 +594,7 @@ set_redirect >> $setup_log 2>&1 set_progress_str 10 'Updating sudoers file for soremote user' update_sudoers >> $setup_log 2>&1 + update_sudoers_for_testing >> $setup_log 2>&1 set_progress_str 11 'Generating manager global pillar' #minio_generate_keys From 83e749369156cae4c3f6483b5da0e609bc3ce0ad Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 7 Jan 2021 11:23:39 -0500 Subject: [PATCH 15/16] add description for exit code 99 --- salt/common/tools/sbin/so-status | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/common/tools/sbin/so-status b/salt/common/tools/sbin/so-status index 953d3a43e..bb05d5f2e 100755 --- a/salt/common/tools/sbin/so-status +++ b/salt/common/tools/sbin/so-status @@ -27,8 +27,8 @@ cat < Date: Thu, 7 Jan 2021 11:33:29 -0500 Subject: [PATCH 16/16] Update sed to disable sudo password prompt for automated testing --- setup/so-functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/so-functions b/setup/so-functions index 533ca110a..315334a18 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -2215,7 +2215,7 @@ mark_version() { update_sudoers_for_testing() { if [ -n "$TESTING" ]; then info "Ensuring $INSTALLUSERNAME has password-less sudo access for automated testing purposes." - sed -i "s/^$INSTALLUSERNAME ALL=(ALL) ALL/^$INSTALLUSERNAME ALL=(ALL) NOPASSWD:ALL/" /etc/sudoers + sed -i "s/^$INSTALLUSERNAME ALL=(ALL) ALL/$INSTALLUSERNAME ALL=(ALL) NOPASSWD: ALL/" /etc/sudoers fi }