From 40e3dafbee8767ce046e11337e2a88e8c7b2c4d2 Mon Sep 17 00:00:00 2001 From: Josh Patterson Date: Tue, 27 Oct 2026 14:04:02 -0400 Subject: [PATCH 01/16] Add custom_bind_mounts to so-kafka and so-soc Every container in docker/defaults.yaml exposes custom_bind_mounts via soc_docker.yaml, but kafka and soc enabled.sls never appended them to binds, so the setting was silently ignored for those two containers. --- salt/kafka/enabled.sls | 5 +++++ salt/soc/enabled.sls | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/salt/kafka/enabled.sls b/salt/kafka/enabled.sls index 85e05ae4f..c6ea60f3e 100644 --- a/salt/kafka/enabled.sls +++ b/salt/kafka/enabled.sls @@ -61,6 +61,11 @@ so-kafka: {% if KAFKA_EXTERNAL_ACCESS %} - /opt/so/conf/kafka/kafka_server_jaas.conf:/opt/kafka/config/kafka_server_jaas.conf:ro {% endif %} + {% if DOCKERMERGED.containers['so-kafka'].custom_bind_mounts %} + {% for BIND in DOCKERMERGED.containers['so-kafka'].custom_bind_mounts %} + - {{ BIND }} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-kafka'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-kafka'].ulimits %} diff --git a/salt/soc/enabled.sls b/salt/soc/enabled.sls index 5c08f8d6b..39c8bf7f4 100644 --- a/salt/soc/enabled.sls +++ b/salt/soc/enabled.sls @@ -62,6 +62,11 @@ so-soc: - /nsm/backup/detections-migration:/nsm/backup/detections-migration:ro - /opt/so/state:/opt/so/state:rw - /etc/pki/tls/certs/intca.crt:/opt/sensoroni/html/so-ca.crt:ro + {% if DOCKERMERGED.containers['so-soc'].custom_bind_mounts %} + {% for BIND in DOCKERMERGED.containers['so-soc'].custom_bind_mounts %} + - {{ BIND }} + {% endfor %} + {% endif %} - extra_hosts: {% for node in DOCKER_EXTRA_HOSTS %} {% for hostname, ip in node.items() %} From d6fecc761ae2794b0d0f59cc0acf47df408fd463 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 14:43:46 -0400 Subject: [PATCH 02/16] Remove unused elasticsearch.p12/sokeys keystore --- salt/elasticsearch/enabled.sls | 2 -- salt/elasticsearch/ssl.sls | 11 ----------- 2 files changed, 13 deletions(-) diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 48f094d3c..5a611ac94 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -71,7 +71,6 @@ so-elasticsearch: - /etc/pki/tls/certs/intca.crt:/usr/share/elasticsearch/config/ca.crt:ro - /etc/pki/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt:ro - /etc/pki/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key:ro - - /etc/pki/elasticsearch.p12:/usr/share/elasticsearch/config/elasticsearch.p12:ro - /opt/so/conf/elasticsearch/users_roles:/usr/share/elasticsearch/config/users_roles:ro - /opt/so/conf/elasticsearch/users:/usr/share/elasticsearch/config/users:ro {% if ELASTICSEARCHMERGED.config.path.get('repo', False) %} @@ -99,7 +98,6 @@ so-elasticsearch: - file: eslog4jfile - file: nsmesdir - file: eslogdir - - file: elasticp12perms - cmd: auth_users_roles_inode - cmd: auth_users_inode diff --git a/salt/elasticsearch/ssl.sls b/salt/elasticsearch/ssl.sls index a2d327830..7d54dfd56 100644 --- a/salt/elasticsearch/ssl.sls +++ b/salt/elasticsearch/ssl.sls @@ -38,10 +38,6 @@ elasticsearch_crt: - retry: attempts: 5 interval: 30 - cmd.run: - - name: "/usr/bin/openssl pkcs12 -inkey /etc/pki/elasticsearch.key -in /etc/pki/elasticsearch.crt -export -out /etc/pki/elasticsearch.p12 -nodes -passout pass:" - - onchanges: - - x509: /etc/pki/elasticsearch.key elastickeyperms: file.managed: @@ -50,13 +46,6 @@ elastickeyperms: - mode: 640 - group: 930 -elasticp12perms: - file.managed: - - replace: False - - name: /etc/pki/elasticsearch.p12 - - mode: 640 - - group: 930 - {% else %} {{sls}}_state_not_allowed: From 11c8fe3093bbd80ccbc9b6ddb23a468ccae1ca71 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 15:08:21 -0400 Subject: [PATCH 03/16] Use the host CA trust store for all grid containers Anchor the grid CA and blocklist the eMudhra roots in the host trust store (new ca.trust state, also used by the desktop role), then mount the extracted store into each container instead of the frozen copies made by so-catrust. Containers restart when the host trust changes. --- .../files/blocklist/emsign-ecc-root-ca-c3.pem | 14 ++++++ .../files/blocklist/emsign-ecc-root-ca-g3.pem | 15 ++++++ salt/ca/files/blocklist/emsign-root-ca-c1.pem | 21 ++++++++ salt/ca/files/blocklist/emsign-root-ca-c2.pem | 32 ++++++++++++ salt/ca/files/blocklist/emsign-root-ca-g1.pem | 22 +++++++++ salt/ca/files/blocklist/emsign-root-ca-g2.pem | 32 ++++++++++++ .../files/blocklist/emsign-root-cs-ca-g2.pem | 32 ++++++++++++ salt/ca/init.sls | 1 + salt/ca/trust.map.jinja | 12 +++++ salt/ca/trust.sls | 33 +++++++++++++ salt/desktop/trusted-ca.sls | 14 ++---- salt/elastalert/enabled.sls | 7 ++- .../enabled.sls | 7 ++- salt/elasticagent/enabled.sls | 3 ++ salt/elasticfleet/enabled.sls | 3 ++ salt/elasticsearch/ca.sls | 49 ------------------- salt/elasticsearch/enabled.sls | 7 ++- .../elasticsearch/tools/sbin_jinja/so-catrust | 26 ---------- salt/hydra/enabled.sls | 4 ++ salt/influxdb/enabled.sls | 4 ++ salt/kafka/enabled.sls | 4 ++ salt/kibana/enabled.sls | 5 ++ salt/kratos/enabled.sls | 4 ++ salt/logstash/enabled.sls | 19 ++----- salt/manager/tools/sbin/soup | 7 +++ salt/nginx/enabled.sls | 4 ++ salt/postgres/enabled.sls | 4 ++ salt/redis/enabled.sls | 3 ++ salt/registry/enabled.sls | 4 ++ salt/sensoroni/enabled.sls | 4 ++ salt/soc/enabled.sls | 3 ++ salt/telegraf/enabled.sls | 3 ++ 32 files changed, 295 insertions(+), 107 deletions(-) create mode 100644 salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem create mode 100644 salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-c1.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-c2.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-g1.pem create mode 100644 salt/ca/files/blocklist/emsign-root-ca-g2.pem create mode 100644 salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem create mode 100644 salt/ca/trust.map.jinja create mode 100644 salt/ca/trust.sls delete mode 100644 salt/elasticsearch/ca.sls delete mode 100644 salt/elasticsearch/tools/sbin_jinja/so-catrust diff --git a/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem b/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem new file mode 100644 index 000000000..517c0e1cf --- /dev/null +++ b/salt/ca/files/blocklist/emsign-ecc-root-ca-c3.pem @@ -0,0 +1,14 @@ +-----BEGIN CERTIFICATE----- +MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG +EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx +IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw +MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND +IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci +MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti +sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O +BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB +Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c +3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J +0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ== +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem b/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem new file mode 100644 index 000000000..060e943bf --- /dev/null +++ b/salt/ca/files/blocklist/emsign-ecc-root-ca-g3.pem @@ -0,0 +1,15 @@ +-----BEGIN CERTIFICATE----- +MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG +EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo +bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g +RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0 +WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS +fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB +zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq +hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB +CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD ++JbNR6iC8hZVdyR+EhCVBCyj +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-c1.pem b/salt/ca/files/blocklist/emsign-root-ca-c1.pem new file mode 100644 index 000000000..02bd4a71f --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-c1.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG +A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg +SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw +MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln +biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v +dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ +BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ +HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH +3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH +GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c +xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1 +aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq +TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL +BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87 +/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4 +kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG +YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT ++xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo +WXzhriKi4gp6D/piq1JM4fHfyr6DDUI= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-c2.pem b/salt/ca/files/blocklist/emsign-root-ca-c2.pem new file mode 100644 index 000000000..78025196d --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-c2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFcjCCA1qgAwIBAgIKLwq3aw3LSq8nWDANBgkqhkiG9w0BAQwFADBWMQswCQYD +VQQGEwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJ +bmMxHDAaBgNVBAMTE2VtU2lnbiBSb290IENBIC0gQzIwHhcNMTgwMjE4MTgzMDAw +WhcNNDMwMjE4MTgzMDAwWjBWMQswCQYDVQQGEwJVUzETMBEGA1UECxMKZW1TaWdu +IFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMxHDAaBgNVBAMTE2VtU2lnbiBSb290 +IENBIC0gQzIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCMfX1lA+Tb +mh9YInmRgOW97IVx4LUJf2DRZfs837Jrml+py64aVnYgWO4t6C78fgjfS7jX+c4T +inIzEquWcI+zi0fd4Sc8NDf7JONp27VWX0qwUYqzLDRCt+s7zpLcfx1ky0zVIJj6 +L06uPyK3kIr9+YAsrVj+39utm6e2MBQsRNstSI3fCQYAGvoQTQ8fULauTqNWaYAk +NYFe6HUHHQPp2u1Ua00odMXiD5oRFxLcDnGAcE1I/9E9mLCdkggXijYUmico7+Xw +ZeFoPhva6eIJ5p03Lt3Du5W3EcHR0cJmmY1pyeA36JaXKWRNM9IRjYMVNCcp4jhB +2tIYiZ+LVk8bwQ9/1c23txmv3u97taZlV22NF4ttS1qq3J+MOp0oGULBzpKfRx0q +GVqbPukQNGAjOLIN8KDNQNzbR1iAl2d8H+MSoicBo4Aid8TjLWcNv48oCWL53ZrF +BMTDjaIA6frG1t4IpbnHadA7qCJJe2qpJN6n2eQKAUn6UiQDHPsSqNBlcUhQ4Y/0 +Y0mU5rghm2OB9rXQS1Fb1JRCfJMNnJIm5AUB2+2RWzq5Tgz7SbSho8NsZk0UbQnF +xciqQ9uoVTAsK14Sk9oG8Q3zfsM08cdPoRb0WlIZklR6mKD7L8nH/zfGu8PIJv94 +GGB9RZ9U4A69r3ePmy8MvrzfNxHKtH6svwIDAQABo0IwQDAdBgNVHQ4EFgQUs/eK +pNYPiABZ6FEXT9V+7IYigZ0wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB +Af8wDQYJKoZIhvcNAQEMBQADggIBADQlpiWM0cv2nZ0H5jVsBq0x2q62Q0LwqATs +CFvyub7gxNCytRuoA8stmPOEu/lg8Igxj4FIjoyhIrWUVxyiLU7No4P+WjEUOwUT +xIpkEOtvGUQ9fiOlcGHtIZDNBlZq7WpktXAxeV55RPPsor26p2FNAMRFfZQh0sLX +hKgk8iulSSggqx8ezgPye63FaiYEi4c/dzRj3HOCnsZiwZZU02df5YpNFjxSwZvE +41cjGpsrpWMfQFI2s53RbeXp47lSAxYE4NzjBFMe+EwFuEveBCJBEAH5rvYu3pi2 +orsJ424TqWEQV1tCsCkQz+Yq/Okal7yHAkKDeOXcP7oN4A+TdXc2pdqxuVCnBO0R +mWz2JpGSSeJjiTk/OPwRsPNWtwG/KXL04o2ta3jiPpJuICVtWDAc9R3auBEgJl5r +ShRmBdszG0LmzsHuZPCFSYC15RBDCOBsa8bDRJ8pBFU2Wi/CVXCACEuavgoveA4F +a5bt38o0PWxsBP+MpocCdVtDMqzQhxy9IohKuXWAGresoIvKDg3xFk6rBOrjfVwJ +elwi/xAisojHPJVQv9W1zVIoHp+EQg/4MQC21NbIX2RoioB+V3hK439b/w7deU8x +2M8cl1OG0nPfbnARl5GPM7vJgi470jto4SeMg6HMAW3Egb56tQcNLwI9U8mZnNvR +gUMrkAgL +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-g1.pem b/salt/ca/files/blocklist/emsign-root-ca-g1.pem new file mode 100644 index 000000000..c50d2e6d1 --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-g1.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD +VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU +ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH +MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO +MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv +Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz +f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO +8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq +d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM +tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt +Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB +o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD +AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x +PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM +wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d +GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH +6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby +RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx +iN66zB+Afko= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-ca-g2.pem b/salt/ca/files/blocklist/emsign-root-ca-g2.pem new file mode 100644 index 000000000..b24d764ad --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-ca-g2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFlTCCA32gAwIBAgILAIZNvw/jXtd9jtgwDQYJKoZIhvcNAQEMBQAwZzELMAkG +A1UEBhMCSU4xEzARBgNVBAsTCmVtU2lnbiBQS0kxJTAjBgNVBAoTHGVNdWRocmEg +VGVjaG5vbG9naWVzIExpbWl0ZWQxHDAaBgNVBAMTE2VtU2lnbiBSb290IENBIC0g +RzIwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBnMQswCQYDVQQGEwJJ +TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s +b2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBHMjCCAiIw +DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMNwGIWW2kHfHK+sXTNwxF07K+IV +ySTuyFM2r1v002wUfcdT+zs5OM5QbMYFFnedXQI6gCFLsjKrcaej48Zt37OyEb3i +aPs7CsP4kAyTwzKH9aZe6gXYHrJq40/ZVMNcQVI2PcIp40B/SAN2gUZ+ZaUtIOvV +jEx26/ebNaXRIsthlkOG/caB+QRwDw1tl7338Zlv0M2oTBUy4B3e7dGP5pgXH71M +jqHPCoNo+xv9f0NTBT+hUDa8h8wUtcGQq9CDeJTpjWcD2bP2AMdVG6oVpMAUeUzo +cCyglvtFdUMjggxBbw4qhau1HXPG8Ot9hwL7ZMi8tkTzrvUIxxb8G9LF/7kKeCE7 +tGZaVzDTnXuifl3msR4ErHsQ4P7lVu2AIjIAhrAXoedDidb7pMcf7TABdrYUT1Jo +G/AiK+J9jO6GTjeADD4LMDSBZhHMuBK/PJ/g0kGBt+/C1L+/HURzQhJkMlRnM6Rv +XoCtfKopSlns5trZmTi971Wjbn88QXP61lGpBCUPwCjs7rpOYvSUJtI+lcbF+37q +kIqOXYkVT3cupDSpw+H89kFtj5GKY+Xny4LxY+3IvDIRiyd6ky1DPj713DI0yqve +EpsIr3A0PdwuyUI7CS1jg0NnGFT6Xxyr0xB+VDt83FJYW8v16k2pbaQ4kVxA3aXd +X9dZYyVR1S59KM75AgMBAAGjQjBAMB0GA1UdDgQWBBTt7E1FYRgo57MjKBEcTaUn +DV7s9DAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQwFAAOCAgEACFC/ilQg8KTCVBxFJW/sazomkS0kNYbEIZg4B3obqwsJ7SX98z8Z +gfzBpz0nYClwwJjWbFN1R2zY8pCEot6/dgmA8Vbq0GxhwPM5YN/SZquNyRIxO3cU +dlAcwf+vSezdVCf9wOzvSAF3q0a5ljvbdbNJNpfScQVp7UUd5sBsZk8jXO1KQ/go +/Vf/GDPnrIFmxpAIGE3sgnO8lAv9FzUaAeuv7HWe47xN9J7+bQzF93yHuIXACPTL +pQHhg2zMv5C7BAbuDHfbj1Cu294Z832yhSfBcziWGskOvl3es2EcHytbS9c9P+0z +Mpka7zGC1FHrvLb/FoduH86TeZt0QjZ6pcplNzoaxDnDvzTJ6CC2Eny+qH/APFCu +VUv5/wjwF+HPm8Pup2ARj9cEp92+0qcerfHacNq5hMeGZdbA/dzdUR/5z5zXdxAk +nl8mcfGb0eMNSTXQmmB/i4AecNnr72uYjzlaXUGYN7Nrb6XouG0pnh0/BBtWWp0U +ShIPpWEAqs7RJBj6+1ZUYXZ4ObrCw962DxhN2p19Hxw9LtuUUcLqqTPrFXYvwO4t +ouj7KJnAkaTUfXGdEaFVtFig1EA30WzJY2X1vAQ7hVnniCjgaXAGqjsU6sklNM9n +xDx5rFCCCEtj9Kh8UHjGK2QqgP5kwgttjOApQMaCoezMfK4KD7WpOXU= +-----END CERTIFICATE----- diff --git a/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem b/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem new file mode 100644 index 000000000..c2bd264fe --- /dev/null +++ b/salt/ca/files/blocklist/emsign-root-cs-ca-g2.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFdjCCA16gAwIBAgIQCIYhdXKnxAzDuy7l1y1ubDANBgkqhkiG9w0BAQwFADBV +MQswCQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGlt +aXRlZDEfMB0GA1UEAwwWZW1TaWduIFJvb3QgQ1MgQ0EgLSBHMjAeFw0yNDAyMDgw +ODE1MzlaFw00OTAyMDcwODE1MzlaMFUxCzAJBgNVBAYTAklOMSUwIwYDVQQKDBxl +TXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVkMR8wHQYDVQQDDBZlbVNpZ24gUm9v +dCBDUyBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4CVO +xuBjdLJXpkrjosA+7ygTGaYzufUJrhQOeIZEuCqeCPI8hDqIu+MIqEqOlgDFetVM +3Cor3CGBlGJzfzzlI31vyElvQq88jjCfo12Ghqcf+NAZDFduJk5+NgC0z3lfdiB6 +NNzxbfVkA+X6oDNNRioVUZsVFuIzT9Qt0Sh4KwQPRFBc/wI2yGpDuKHNsLehcECx +Uw00m33xGYh9UkeL3reOmAaLYWZiO+Pd2vxPtrkXI4wyN4BMlESJ73uP0tyX9lq4 +M4yN2yh3i+ETI8/jzPjxHD7QFaVkCoS+uj2YmBa3mytlqlBgyOoKueNeotX8hfzB +FNm962abpV4mN0SoC6hjkYv8IayseRPFv9VI0meQXg9OLRoNvBOqG5kw937FH0Li +q3CIzKyvdyeYRT0LJdWA2iuB9l+4zzIfCwGyT4M4VDmJuPBhrTmjXKae6AUtm1eO +q2f8gftA6J6AlbD0gRd/t8CrFssFNm+LYAEd36kWRBuolbaOfbSbEww84xNAgj4U +SPwYjtNDsCkQjtgSOaDtDOmolN+Mbk528Y+LHMlbd4T3Xmp+VIWp5+70GhBDOA91 +hhtims+hHkXjRI2U7WrJLcTlcF8ykiymRbFKhwOBvTmtZNbHmDI7scU4wWUAsmW6 +tWaeeoM50KBl8ai28A6yBGYMO//03Ubvqiqst80CAwEAAaNCMEAwHQYDVR0OBBYE +FOYcxqontIvyvYVkX6/0unKm0AF1MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E +BTADAQH/MA0GCSqGSIb3DQEBDAUAA4ICAQCv5Asord7fdQMT30emwb+oLuDUxdmJ +DQHnzxIXoNvymDTbNHF9LqjeXc+X+XcjIV8PTp4o2I9wyVppHmcaVgRjN/G9FxeN +5tCQ97v5sdx4eAdPljK1xqg7Vhfmzcp+7rSjJG7Sn9gMlZx81kL3Oa2qZj+W5Fi6 +tN4vaR9OLEyvKKHDG/eFxS/qghD1d/Clkb7UGGjBcWJlaZTWVALMKG+QCxiMoELi +oeKaoBbZoXooxfF0mWdkIl9RWNU4r9O/yt66LBE9rj49dX19L+rGg71/4bTi5ua+ ++Wz60XaOc2CdHJaBSols5hWEx/LBjS7UzfU3uJfnpQXVDi0US5sFzIHIlS6kjh7h +YuF4+/9ZAl4Bx3w2TNN7pVm7I39pgYl7XN6KZRwfkAv4aRswPqhWbQfr3+qfcC93 +cgTyFy2RG5YE/OfmpSs6VtYKawqsdEODz/p2nhZfSDrVDnEPvERqahttY5+gaWNc +2fbibgKMfuejTZaJ3yttPslVSko5SDs0xKU423swu34sb/fdISqtOu4NzPCZiHSG +ladaoITmSA6UWFk4fdqaLBI+xSxY5Et3S1APp5r3j/l1KrWPNbb1/+ydHN+YLbh8 +hCBIecKdk6VbnnFRlulm0d2RSgpfCRrWLomN8JHCxCMVv/hBQXz3AXGM1ZlfYTyl +E1BpDby0G2eEkw== +-----END CERTIFICATE----- diff --git a/salt/ca/init.sls b/salt/ca/init.sls index 3a0fdf91c..381064f2c 100644 --- a/salt/ca/init.sls +++ b/salt/ca/init.sls @@ -10,3 +10,4 @@ include: - ca.server {% endif %} - ca.trustca + - ca.trust diff --git a/salt/ca/trust.map.jinja b/salt/ca/trust.map.jinja new file mode 100644 index 000000000..0ea3002bb --- /dev/null +++ b/salt/ca/trust.map.jinja @@ -0,0 +1,12 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +{# Containers mount the extracted directory rather than single files: update-ca-trust replaces + files by rename, so a file bind mount would keep pointing at the old inode. #} +{% set CATRUST = { + 'dir': '/etc/pki/ca-trust/extracted:/etc/pki/ca-trust/extracted:ro', + 'java': '/etc/pki/ca-trust/extracted/java/cacerts', + 'pem': '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem' +} %} diff --git a/salt/ca/trust.sls b/salt/ca/trust.sls new file mode 100644 index 000000000..aec613f29 --- /dev/null +++ b/salt/ca/trust.sls @@ -0,0 +1,33 @@ +# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one +# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at +# https://securityonion.net/license; you may not use this file except in compliance with the +# Elastic License 2.0. + +ca_trust_anchor: + file.managed: + - name: /etc/pki/ca-trust/source/anchors/so-intca.crt + - source: salt://ca/files/ca.crt + - show_changes: False + - makedirs: True + +ca_trust_legacy_anchor: + file.absent: + - name: /etc/pki/ca-trust/source/anchors/ca.crt + +# clean removes blocklist entries that are no longer shipped +ca_trust_blocklist: + file.recurse: + - name: /etc/pki/ca-trust/source/blocklist + - source: salt://ca/files/blocklist + - clean: True + - makedirs: True + - file_mode: '0644' + - dir_mode: '0755' + +ca_trust_extract: + cmd.run: + - name: update-ca-trust extract + - onchanges: + - file: ca_trust_anchor + - file: ca_trust_legacy_anchor + - file: ca_trust_blocklist diff --git a/salt/desktop/trusted-ca.sls b/salt/desktop/trusted-ca.sls index 5117de1cd..a3a4710f4 100644 --- a/salt/desktop/trusted-ca.sls +++ b/salt/desktop/trusted-ca.sls @@ -1,18 +1,10 @@ - {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'vars/globals.map.jinja' import GLOBALS %} {# we only want this state to run it is CentOS #} {% if GLOBALS.os == 'OEL' %} -trusted_ca: - file.managed: - - name: /etc/pki/ca-trust/source/anchors/ca.crt - - source: salt://ca/files/ca.crt - -update_ca_certs: - cmd.run: - - name: update-ca-trust - - onchanges: - - file: trusted_ca +include: + - ca.trust {% else %} diff --git a/salt/elastalert/enabled.sls b/salt/elastalert/enabled.sls index 8aa9d4b3f..c2469e91c 100644 --- a/salt/elastalert/enabled.sls +++ b/salt/elastalert/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - elastalert.config - elastalert.sostatus @@ -28,6 +30,7 @@ so-elastalert: - ipv4_address: {{ DOCKERMERGED.containers['so-elastalert'].ip }} - detach: True - binds: + - {{ CATRUST.dir }} - /opt/so/rules/elastalert:/opt/elastalert/rules/:ro - /opt/so/log/elastalert:/var/log/elastalert:rw - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro @@ -46,8 +49,9 @@ so-elastalert: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-elastalert'].extra_env %} - environment: + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-elastalert'].extra_env %} {% for XTRAENV in DOCKERMERGED.containers['so-elastalert'].extra_env %} - {{ XTRAENV }} {% endfor %} @@ -65,6 +69,7 @@ so-elastalert: - file: elastacustmodulesdir - file: elastaconf - watch: + - cmd: ca_trust_extract - file: elastaconf - onlyif: - "so-elasticsearch-query / | jq -r '.version.number[0:1]' | grep -q 9" {# only run this state if elasticsearch is version 9 #} diff --git a/salt/elastic-fleet-package-registry/enabled.sls b/salt/elastic-fleet-package-registry/enabled.sls index 3bf15c984..82208f003 100644 --- a/salt/elastic-fleet-package-registry/enabled.sls +++ b/salt/elastic-fleet-package-registry/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - elastic-fleet-package-registry.config - elastic-fleet-package-registry.sostatus @@ -34,8 +36,9 @@ so-elastic-fleet-package-registry: {% for BINDING in DOCKERMERGED.containers['so-elastic-fleet-package-registry'].port_bindings %} - {{ BINDING }} {% endfor %} - {% if DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro + {% if DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-elastic-fleet-package-registry'].custom_bind_mounts %} - {{ BIND }} {% endfor %} @@ -52,6 +55,8 @@ so-elastic-fleet-package-registry: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract wait_for_so-elastic-fleet-package-registry: http.wait_for_successful_query: diff --git a/salt/elasticagent/enabled.sls b/salt/elasticagent/enabled.sls index c6ee02ddf..1e45a91dd 100644 --- a/salt/elasticagent/enabled.sls +++ b/salt/elasticagent/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: @@ -37,6 +38,7 @@ so-elastic-agent: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/elastic-agent/elastic-agent.yml:/usr/share/elastic-agent/elastic-agent.yml:ro - /opt/so/log/elasticagent:/usr/share/elastic-agent/logs - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro @@ -65,6 +67,7 @@ so-elastic-agent: - file: create-elastic-agent-config - file: trusttheca - watch: + - cmd: ca_trust_extract - file: create-elastic-agent-config - file: trusttheca diff --git a/salt/elasticfleet/enabled.sls b/salt/elasticfleet/enabled.sls index feb83fc2f..e08170097 100644 --- a/salt/elasticfleet/enabled.sls +++ b/salt/elasticfleet/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticfleet/map.jinja' import ELASTICFLEETMERGED %} @@ -63,6 +64,7 @@ so-elastic-fleet: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /etc/pki/elasticfleet-server.crt:/etc/pki/elasticfleet-server.crt:ro - /etc/pki/elasticfleet-server.key:/etc/pki/elasticfleet-server.key:ro - /etc/pki/tls/certs/intca.crt:/etc/pki/tls/certs/intca.crt:ro @@ -95,6 +97,7 @@ so-elastic-fleet: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: etc_elasticfleet_key - x509: etc_elasticfleet_crt diff --git a/salt/elasticsearch/ca.sls b/salt/elasticsearch/ca.sls deleted file mode 100644 index 39d33919c..000000000 --- a/salt/elasticsearch/ca.sls +++ /dev/null @@ -1,49 +0,0 @@ -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -{% from 'allowed_states.map.jinja' import allowed_states %} -{% if sls.split('.')[0] in allowed_states or sls in allowed_states %} -{% from 'vars/globals.map.jinja' import GLOBALS %} - -# Move our new CA over so Elastic and Logstash can use SSL with the internal CA -catrustdir: - file.directory: - - name: /opt/so/conf/ca - - user: 939 - - group: 939 - - makedirs: True - -{% if GLOBALS.is_manager %} -# We have to add the Manager CA to the CA list -catrustscript: - cmd.script: - - source: salt://elasticsearch/tools/sbin_jinja/so-catrust - - template: jinja - - cwd: /opt/so - - defaults: - GLOBALS: {{ GLOBALS }} -{% endif %} - -elasticsearch_cacerts: - file.managed: - - name: /opt/so/conf/ca/cacerts - - source: salt://elasticsearch/cacerts - - user: 939 - - group: 939 - -elasticsearch_capems: - file.managed: - - name: /opt/so/conf/ca/tls-ca-bundle.pem - - source: salt://elasticsearch/tls-ca-bundle.pem - - user: 939 - - group: 939 - -{% else %} - -{{sls}}_state_not_allowed: - test.fail_without_changes: - - name: {{sls}}_state_not_allowed - -{% endif %} diff --git a/salt/elasticsearch/enabled.sls b/salt/elasticsearch/enabled.sls index 5a611ac94..755581ab9 100644 --- a/salt/elasticsearch/enabled.sls +++ b/salt/elasticsearch/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_NODES %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCH_SEED_HOSTS %} @@ -13,7 +14,6 @@ include: - ca - - elasticsearch.ca - elasticsearch.ssl - elasticsearch.config - elasticsearch.sostatus @@ -63,11 +63,11 @@ so-elasticsearch: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro - /opt/so/conf/elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro - /nsm/elasticsearch:/usr/share/elasticsearch/data:rw - /opt/so/log/elasticsearch:/var/log/elasticsearch:rw - - /opt/so/conf/ca/cacerts:/usr/share/elasticsearch/jdk/lib/security/cacerts:ro - /etc/pki/tls/certs/intca.crt:/usr/share/elasticsearch/config/ca.crt:ro - /etc/pki/elasticsearch.crt:/usr/share/elasticsearch/config/elasticsearch.crt:ro - /etc/pki/elasticsearch.key:/usr/share/elasticsearch/config/elasticsearch.key:ro @@ -84,16 +84,15 @@ so-elasticsearch: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: elasticsearch_crt - x509: elasticsearch_key - - file: elasticsearch_cacerts - file: esyml - require: - file: trusttheca - x509: elasticsearch_crt - x509: elasticsearch_key - - file: elasticsearch_cacerts - file: esyml - file: eslog4jfile - file: nsmesdir diff --git a/salt/elasticsearch/tools/sbin_jinja/so-catrust b/salt/elasticsearch/tools/sbin_jinja/so-catrust deleted file mode 100644 index 14f9e5ca1..000000000 --- a/salt/elasticsearch/tools/sbin_jinja/so-catrust +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -# -# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one -# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at -# https://securityonion.net/license; you may not use this file except in compliance with the -# Elastic License 2.0. - -. /usr/sbin/so-common -get_elastic_agent_vars - -# Exit on errors, since all lines must succeed -set -e - -# Check to see if we have extracted the ca cert. -if [ ! -f /opt/so/saltstack/local/salt/elasticsearch/cacerts ]; then - docker run -v /etc/pki/ca.crt:/etc/ssl/ca.crt --name so-elasticsearchca --user root --entrypoint jdk/bin/keytool {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-elasticsearch:$ELASTIC_AGENT_TARBALL_VERSION -keystore /usr/share/elasticsearch/jdk/lib/security/cacerts -alias SOSCA -import -file /etc/ssl/ca.crt -storepass changeit -noprompt - # Make sure symbolic links are followed when copying from container - docker cp -L so-elasticsearchca:/usr/share/elasticsearch/jdk/lib/security/cacerts /opt/so/saltstack/local/salt/elasticsearch/cacerts - docker cp -L so-elasticsearchca:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - docker rm so-elasticsearchca - echo "" >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - echo "sosca" >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem - cat /etc/pki/ca.crt >> /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem -else - exit 0 -fi diff --git a/salt/hydra/enabled.sls b/salt/hydra/enabled.sls index 13fce79cf..cdc8ebe04 100644 --- a/salt/hydra/enabled.sls +++ b/salt/hydra/enabled.sls @@ -13,9 +13,11 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% if 'api' in salt['pillar.get']('features', []) %} include: + - ca.trust - hydra.config - hydra.sostatus @@ -29,6 +31,7 @@ so-hydra: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-hydra'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/hydra/:/hydra-conf:ro - /opt/so/log/hydra/:/hydra-log:rw - /nsm/hydra/db:/hydra-data:rw @@ -60,6 +63,7 @@ so-hydra: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: hydraconfig - require: - file: hydraconfig diff --git a/salt/influxdb/enabled.sls b/salt/influxdb/enabled.sls index 617a56e1e..1ca23e833 100644 --- a/salt/influxdb/enabled.sls +++ b/salt/influxdb/enabled.sls @@ -6,11 +6,13 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set PASSWORD = salt['pillar.get']('secrets:influx_pass') %} {% set TOKEN = salt['pillar.get']('influxdb:token') %} include: + - ca.trust - influxdb.ssl - influxdb.config - influxdb.sostatus @@ -38,6 +40,7 @@ so-influxdb: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/influxdb/:/log:rw - /opt/so/conf/influxdb/config.yaml:/conf/config.yaml:ro - /opt/so/conf/influxdb/etc:/etc/influxdb2:rw @@ -66,6 +69,7 @@ so-influxdb: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: influxdbconf - x509: influxdb_key - x509: influxdb_crt diff --git a/salt/kafka/enabled.sls b/salt/kafka/enabled.sls index 85e05ae4f..9d426cc16 100644 --- a/salt/kafka/enabled.sls +++ b/salt/kafka/enabled.sls @@ -12,12 +12,14 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set KAFKANODES = salt['pillar.get']('kafka:nodes') %} {% set KAFKA_EXTERNAL_ACCESS = salt['pillar.get']('kafka:config:external_access:enabled', default=False) %} {% if 'gmd' in salt['pillar.get']('features', []) %} include: + - ca.trust - kafka.ca - kafka.config - kafka.ssl @@ -51,6 +53,7 @@ so-kafka: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.java }}:/opt/java/openjdk/lib/security/cacerts:ro - /etc/pki/kafka.p12:/etc/pki/kafka.p12:ro - /opt/so/conf/kafka/kafka-truststore.jks:/etc/pki/kafka-truststore.jks:ro - /nsm/kafka/data/:/nsm/kafka/data/:rw @@ -68,6 +71,7 @@ so-kafka: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract {% for sc in ['server', 'client'] %} - file: kafka_kraft_{{sc}}_properties {% endfor %} diff --git a/salt/kibana/enabled.sls b/salt/kibana/enabled.sls index 0e986dbc2..9852242fe 100644 --- a/salt/kibana/enabled.sls +++ b/salt/kibana/enabled.sls @@ -8,8 +8,10 @@ {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'elasticsearch/config.map.jinja' import ELASTICSEARCHMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - kibana.config - kibana.sostatus @@ -27,6 +29,7 @@ so-kibana: - ELASTICSEARCH_HOST={{ GLOBALS.manager }} - ELASTICSEARCH_PORT=9200 - MANAGER={{ GLOBALS.manager }} + - NODE_OPTIONS=--use-openssl-ca {% if DOCKERMERGED.containers['so-kibana'].extra_env %} {% for XTRAENV in DOCKERMERGED.containers['so-kibana'].extra_env %} - {{ XTRAENV }} @@ -40,6 +43,7 @@ so-kibana: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/kibana/etc:/usr/share/kibana/config:rw - /opt/so/log/kibana:/var/log/kibana:rw - /opt/so/conf/kibana/customdashboards:/usr/share/kibana/custdashboards:ro @@ -60,6 +64,7 @@ so-kibana: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: kibanaconfig wait_for_so-kibana: diff --git a/salt/kratos/enabled.sls b/salt/kratos/enabled.sls index 38a710cfc..046f890ab 100644 --- a/salt/kratos/enabled.sls +++ b/salt/kratos/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - kratos.config - kratos.sostatus @@ -22,6 +24,7 @@ so-kratos: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-kratos'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/kratos/:/kratos-conf:ro - /opt/so/log/kratos/:/kratos-log:rw - /nsm/kratos/db:/kratos-data:rw @@ -53,6 +56,7 @@ so-kratos: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: kratosschema - file: kratosconfig - require: diff --git a/salt/logstash/enabled.sls b/salt/logstash/enabled.sls index 003cabf21..0b3d8447a 100644 --- a/salt/logstash/enabled.sls +++ b/salt/logstash/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'logstash/map.jinja' import LOGSTASH_MERGED %} {% from 'logstash/map.jinja' import LOGSTASH_NODES %} @@ -13,9 +14,6 @@ include: - ca -{% if GLOBALS.role not in ['so-receiver','so-fleet'] %} - - elasticsearch.ca -{% endif %} {# Kafka ca runs on nodes that can run logstash for Kafka input / output. Only when Kafka is global pipeline #} {% if GLOBALS.role in ['so-searchnode', 'so-manager', 'so-managerhype', 'so-managersearch', 'so-receiver', 'so-standalone'] and GLOBALS.pipeline == 'KAFKA' %} - kafka.ca @@ -58,6 +56,8 @@ so-logstash: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.dir }} + - {{ CATRUST.java }}:/usr/share/logstash/jdk/lib/security/cacerts:ro - /opt/so/conf/elasticsearch/templates/:/templates/:ro - /opt/so/conf/logstash/etc/:/usr/share/logstash/config/:ro - /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro @@ -78,10 +78,6 @@ so-logstash: - /etc/pki/filebeat.p8:/usr/share/logstash/filebeat.key:ro {% endif %} {% endif %} - {% if GLOBALS.role not in ['so-receiver','so-fleet'] %} - - /opt/so/conf/ca/cacerts:/etc/pki/ca-trust/extracted/java/cacerts:ro - - /opt/so/conf/ca/tls-ca-bundle.pem:/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem:ro - {% endif %} {% if GLOBALS.pipeline == "KAFKA" and GLOBALS.role in ['so-manager', 'so-managerhype', 'so-managersearch', 'so-standalone', 'so-searchnode'] %} - /etc/pki/kafka-logstash.p12:/usr/share/logstash/kafka-logstash.p12:ro - /opt/so/conf/kafka/kafka-truststore.jks:/etc/pki/kafka-truststore.jks:ro @@ -104,14 +100,11 @@ so-logstash: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: lsetcsync - file: lslog4j2 - file: lspipelinesyml - file: trusttheca - {% if GLOBALS.is_manager %} - - file: elasticsearch_cacerts - - file: elasticsearch_capems - {% endif %} {% if GLOBALS.is_manager or GLOBALS.role in ['so-fleet', 'so-heavynode', 'so-receiver'] %} - x509: etc_elasticfleet_logstash_crt - x509: etc_elasticfleet_logstash_key @@ -133,10 +126,6 @@ so-logstash: {% endif %} - require: - file: trusttheca - {% if GLOBALS.is_manager %} - - file: elasticsearch_cacerts - - file: elasticsearch_capems - {% endif %} {% if GLOBALS.is_manager or GLOBALS.role in ['so-fleet', 'so-heavynode', 'so-receiver'] %} - x509: etc_elasticfleet_logstash_crt - x509: etc_elasticfleet_logstash_key diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index b30e4e650..42f71fcfe 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1261,9 +1261,16 @@ post_to_3.4.0() { add_detection_runtime_fields + remove_frozen_ca_bundles + set_postversion 3.4.0 } +remove_frozen_ca_bundles() { + rm -rf /opt/so/conf/ca >> $SOUP_LOG 2>&1 + rm -f /opt/so/saltstack/local/salt/elasticsearch/cacerts /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem >> $SOUP_LOG 2>&1 +} + add_detection_runtime_fields() { local template=$DEFAULT_SALT_DIR/salt/elasticsearch/templates/component/so/detection-mappings.json local runtime diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls index 3fa99eae2..cf3cb1e81 100644 --- a/salt/nginx/enabled.sls +++ b/salt/nginx/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'nginx/map.jinja' import NGINXMERGED %} include: + - ca.trust - nginx.ssl - nginx.config - nginx.sostatus @@ -47,6 +49,7 @@ so-nginx: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/nginx/nginx.conf:/etc/nginx/nginx.conf:ro - /opt/so/log/nginx/:/var/log/nginx:rw - /opt/so/tmp/nginx/:/var/lib/nginx:rw @@ -89,6 +92,7 @@ so-nginx: - {{ BINDING }} {% endfor %} - watch: + - cmd: ca_trust_extract - file: nginxconf - file: nginxconfdir {% if GLOBALS.is_manager %} diff --git a/salt/postgres/enabled.sls b/salt/postgres/enabled.sls index fa91d146a..088ad6f54 100644 --- a/salt/postgres/enabled.sls +++ b/salt/postgres/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% set SO_POSTGRES_USER = salt['pillar.get']('postgres:auth:users:so_postgres_user:user', 'so_postgres') %} include: + - ca.trust - postgres.auth - postgres.ssl - postgres.config @@ -42,6 +44,7 @@ so-postgres: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/log/postgres/:/log:rw - /nsm/postgres:/var/lib/postgresql/data:rw - /opt/so/conf/postgres/postgresql.conf:/conf/postgresql.conf:ro @@ -69,6 +72,7 @@ so-postgres: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: postgresconf - file: postgreshba - file: postgresinitdb diff --git a/salt/redis/enabled.sls b/salt/redis/enabled.sls index 1c9d1afa0..57bbe279c 100644 --- a/salt/redis/enabled.sls +++ b/salt/redis/enabled.sls @@ -7,6 +7,7 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: - ca @@ -28,6 +29,7 @@ so-redis: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/redis:/var/log/redis:rw - /opt/so/conf/redis/etc/redis.conf:/usr/local/etc/redis/redis.conf:ro - /opt/so/conf/redis/working:/redis:rw @@ -60,6 +62,7 @@ so-redis: {% endif %} - entrypoint: "redis-server /usr/local/etc/redis/redis.conf" - watch: + - cmd: ca_trust_extract - file: trusttheca - x509: redis_crt - x509: redis_key diff --git a/salt/registry/enabled.sls b/salt/registry/enabled.sls index b2bfbc56d..9b69a380a 100644 --- a/salt/registry/enabled.sls +++ b/salt/registry/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - registry.ssl - registry.config - registry.sostatus @@ -29,6 +31,7 @@ so-dockerregistry: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/docker-registry/etc/config.yml:/etc/distribution/config.yml:ro - /opt/so/conf/docker-registry:/var/lib/registry:rw - /nsm/docker-registry/docker:/var/lib/registry/docker:rw @@ -63,6 +66,7 @@ so-dockerregistry: attempts: 5 interval: 30 - watch: + - cmd: ca_trust_extract - x509: registry_crt - x509: registry_key - require: diff --git a/salt/sensoroni/enabled.sls b/salt/sensoroni/enabled.sls index db4b91dd0..0c8086832 100644 --- a/salt/sensoroni/enabled.sls +++ b/salt/sensoroni/enabled.sls @@ -4,10 +4,12 @@ # Elastic License 2.0. {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - sensoroni.config - sensoroni.sostatus @@ -17,6 +19,7 @@ so-sensoroni: - restart_policy: unless-stopped - network_mode: host - binds: + - {{ CATRUST.dir }} - /nsm/import:/nsm/import:rw - /nsm/pcapout:/nsm/pcapout:rw - /opt/so/conf/sensoroni/sensoroni.json:/opt/sensoroni/sensoroni.json:ro @@ -48,6 +51,7 @@ so-sensoroni: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: /opt/so/conf/sensoroni/sensoroni.json - require: - file: sensoroniagentconf diff --git a/salt/soc/enabled.sls b/salt/soc/enabled.sls index 5c08f8d6b..d20503261 100644 --- a/salt/soc/enabled.sls +++ b/salt/soc/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'soc/merged.map.jinja' import DOCKER_EXTRA_HOSTS %} {% from 'soc/merged.map.jinja' import SOCMERGED %} @@ -27,6 +28,7 @@ so-soc: - soauth: - ipv4_address: {{ DOCKERMERGED.containers['so-soc'].ips['soauth'] }} - binds: + - {{ CATRUST.dir }} - /nsm/rules:/nsm/rules:rw - /opt/so/conf/strelka:/opt/sensoroni/yara:rw - /opt/so/conf/sigma:/opt/sensoroni/sigma:rw @@ -90,6 +92,7 @@ so-soc: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: trusttheca - file: /opt/so/conf/soc/* - require: diff --git a/salt/telegraf/enabled.sls b/salt/telegraf/enabled.sls index addc55128..9fdb4ec46 100644 --- a/salt/telegraf/enabled.sls +++ b/salt/telegraf/enabled.sls @@ -6,6 +6,7 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'telegraf/map.jinja' import TELEGRAFMERGED %} @@ -33,6 +34,7 @@ so-telegraf: - network_mode: host - init: True - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/log/telegraf:/var/log/telegraf:rw - /opt/so/conf/telegraf/etc/telegraf.conf:/etc/telegraf/telegraf.conf:ro - /opt/so/conf/telegraf/node_config.json:/etc/telegraf/node_config.json:ro @@ -73,6 +75,7 @@ so-telegraf: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: tgraf_sbin_jinja - file: lasthighstate_placeholder - file: trusttheca From 02394acf699a31aa94f80bc696870993c5e38198 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 27 Oct 2026 16:24:33 -0400 Subject: [PATCH 04/16] Use the host CA trust store for sensor, strelka and idh containers Mount the host trust store into zeek, suricata, tcpreplay, the strelka containers and idh, and restart them when it changes. Point the Python requests clients in strelka-backend and idh at it instead of certifi. Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust rather than only on the manager in soup. --- salt/ca/trust.sls | 4 ++++ salt/idh/enabled.sls | 13 +++++++++---- salt/manager/tools/sbin/soup | 1 - salt/strelka/backend/enabled.sls | 14 ++++++++++---- salt/strelka/coordinator/enabled.sls | 6 ++++++ salt/strelka/filestream/enabled.sls | 4 ++++ salt/strelka/frontend/enabled.sls | 4 ++++ salt/strelka/gatekeeper/enabled.sls | 5 +++++ salt/strelka/manager/enabled.sls | 4 ++++ salt/suricata/enabled.sls | 4 ++++ salt/tcpreplay/init.sls | 7 +++++++ salt/zeek/enabled.sls | 4 ++++ 12 files changed, 61 insertions(+), 9 deletions(-) diff --git a/salt/ca/trust.sls b/salt/ca/trust.sls index aec613f29..d138fec7a 100644 --- a/salt/ca/trust.sls +++ b/salt/ca/trust.sls @@ -14,6 +14,10 @@ ca_trust_legacy_anchor: file.absent: - name: /etc/pki/ca-trust/source/anchors/ca.crt +ca_trust_legacy_bundles: + file.absent: + - name: /opt/so/conf/ca + # clean removes blocklist entries that are no longer shipped ca_trust_blocklist: file.recurse: diff --git a/salt/idh/enabled.sls b/salt/idh/enabled.sls index 2a02d1f85..95e4976b2 100644 --- a/salt/idh/enabled.sls +++ b/salt/idh/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - idh.config - idh.sostatus @@ -20,6 +22,7 @@ so-idh: - detach: True - network_mode: host - binds: + - {{ CATRUST.dir }} - /nsm/idh:/var/tmp:rw - /opt/so/conf/idh/http-skins:/opt/opencanary/http-skins:ro - /opt/so/conf/idh/opencanary.conf:/etc/opencanaryd/opencanary.conf:ro @@ -34,12 +37,13 @@ so-idh: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-idh'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-idh'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-idh'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-idh'].ulimits %} @@ -47,6 +51,7 @@ so-idh: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: opencanary_config - require: - file: opencanary_config diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 42f71fcfe..35337e925 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1267,7 +1267,6 @@ post_to_3.4.0() { } remove_frozen_ca_bundles() { - rm -rf /opt/so/conf/ca >> $SOUP_LOG 2>&1 rm -f /opt/so/saltstack/local/salt/elasticsearch/cacerts /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem >> $SOUP_LOG 2>&1 } diff --git a/salt/strelka/backend/enabled.sls b/salt/strelka/backend/enabled.sls index e62349f70..ee670a2b1 100644 --- a/salt/strelka/backend/enabled.sls +++ b/salt/strelka/backend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.backend.config - strelka.backend.sostatus @@ -17,6 +19,7 @@ strelka_backend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-backend:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.dir }} - /opt/so/conf/strelka/backend/:/etc/strelka/:ro - /opt/so/conf/strelka/rules/compiled/:/etc/yara/:ro {% if DOCKERMERGED.containers['so-strelka-backend'].custom_bind_mounts %} @@ -36,12 +39,14 @@ strelka_backend: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + - SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-strelka-backend'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-strelka-backend'].ulimits %} @@ -49,6 +54,7 @@ strelka_backend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: strelkasensorcompiledrules - file: backend_backend_config - file: backend_logging_config diff --git a/salt/strelka/coordinator/enabled.sls b/salt/strelka/coordinator/enabled.sls index 8393d7e68..01543c93a 100644 --- a/salt/strelka/coordinator/enabled.sls +++ b/salt/strelka/coordinator/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.coordinator.config - strelka.coordinator.sostatus @@ -39,6 +41,7 @@ strelka_coordinator: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/coord-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} @@ -51,6 +54,9 @@ strelka_coordinator: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract + delete_so-strelka-coordinator_so-status.disabled: file.uncomment: - name: /opt/so/conf/so-status/so-status.conf diff --git a/salt/strelka/filestream/enabled.sls b/salt/strelka/filestream/enabled.sls index c01171565..60e741e5c 100644 --- a/salt/strelka/filestream/enabled.sls +++ b/salt/strelka/filestream/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.filestream.config - strelka.filestream.sostatus @@ -17,6 +19,7 @@ strelka_filestream: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/filestream/:/etc/strelka/:ro - /nsm/strelka:/nsm/strelka {% if DOCKERMERGED.containers['so-strelka-filestream'].custom_bind_mounts %} @@ -49,6 +52,7 @@ strelka_filestream: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: filestream_config delete_so-strelka-filestream_so-status.disabled: diff --git a/salt/strelka/frontend/enabled.sls b/salt/strelka/frontend/enabled.sls index f2d0eecd1..5d19961b5 100644 --- a/salt/strelka/frontend/enabled.sls +++ b/salt/strelka/frontend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.frontend.config - strelka.frontend.sostatus @@ -17,6 +19,7 @@ strelka_frontend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/frontend/:/etc/strelka/:ro - /nsm/strelka/log/:/var/log/strelka/:rw {% if DOCKERMERGED.containers['so-strelka-frontend'].custom_bind_mounts %} @@ -54,6 +57,7 @@ strelka_frontend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: frontend_config delete_so-strelka-frontend_so-status.disabled: diff --git a/salt/strelka/gatekeeper/enabled.sls b/salt/strelka/gatekeeper/enabled.sls index 19d74a6d8..507e1fe02 100644 --- a/salt/strelka/gatekeeper/enabled.sls +++ b/salt/strelka/gatekeeper/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.gatekeeper.config - strelka.gatekeeper.sostatus @@ -33,6 +35,7 @@ strelka_gatekeeper: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/gk-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} @@ -51,6 +54,8 @@ strelka_gatekeeper: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract delete_so-strelka-gatekeeper_so-status.disabled: file.uncomment: diff --git a/salt/strelka/manager/enabled.sls b/salt/strelka/manager/enabled.sls index 272767928..d0fb3d07d 100644 --- a/salt/strelka/manager/enabled.sls +++ b/salt/strelka/manager/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.manager.config - strelka.manager.sostatus @@ -17,6 +19,7 @@ strelka_manager: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/manager/:/etc/strelka/:ro {% if DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} @@ -48,6 +51,7 @@ strelka_manager: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: manager_config delete_so-strelka-manager_so-status.disabled: diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls index d9206798e..ede2c1d31 100644 --- a/salt/suricata/enabled.sls +++ b/salt/suricata/enabled.sls @@ -6,11 +6,13 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'suricata/map.jinja' import SURICATAMERGED %} include: + - ca.trust - suricata.config - suricata.sostatus @@ -33,6 +35,7 @@ so-suricata: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/suricata/suricata.yaml:/etc/suricata/suricata.yaml:ro - /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro - /opt/so/conf/suricata/classification.config:/etc/suricata/classification.config:ro @@ -55,6 +58,7 @@ so-suricata: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: suriconfig - file: surithresholding - file: /opt/so/conf/suricata/bpf diff --git a/salt/tcpreplay/init.sls b/salt/tcpreplay/init.sls index f5b1b05d9..076f0f42c 100644 --- a/salt/tcpreplay/init.sls +++ b/salt/tcpreplay/init.sls @@ -2,6 +2,10 @@ {% if sls in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} + +include: + - ca.trust so-tcpreplay: docker_container.running: @@ -13,7 +17,10 @@ so-tcpreplay: - interactive: True - tty: True - binds: + - {{ CATRUST.dir }} - /opt/so/samples:/opt/so/samples:ro + - watch: + - cmd: ca_trust_extract {% else %} diff --git a/salt/zeek/enabled.sls b/salt/zeek/enabled.sls index ec8148e90..c4a191d89 100644 --- a/salt/zeek/enabled.sls +++ b/salt/zeek/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - zeek.config - zeek.sostatus @@ -30,6 +32,7 @@ so-zeek: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /nsm/zeek/logs:/nsm/zeek/logs:rw - /nsm/zeek/spool:/nsm/zeek/spool:rw - /nsm/zeek/extracted:/nsm/zeek/extracted:rw @@ -63,6 +66,7 @@ so-zeek: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: /opt/so/conf/zeek/local.zeek - file: /opt/so/conf/zeek/node.cfg - file: /opt/so/conf/zeek/networks.cfg From 691bef2cf4847cdb9ce3575cfbcd13324c178a24 Mon Sep 17 00:00:00 2001 From: Corey Ogburn Date: Wed, 28 Oct 2026 09:29:48 -0600 Subject: [PATCH 05/16] New Configurable Timeouts for Detection Engine Syncs Each engine now has timeouts for how long to allow a sync to go on after detections are modified. --- salt/soc/defaults.yaml | 6 ++++++ salt/soc/soc_soc.yaml | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 5432536d7..f643ac09c 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1441,6 +1441,8 @@ soc: rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint stateFilePath: /opt/sensoroni/fingerprints/elastalertengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 rulesRepos: default: - repo: https://github.com/Security-Onion-Solutions/securityonion-resources @@ -1700,6 +1702,8 @@ soc: yaraRulesFolder: /opt/sensoroni/yara/rules stateFilePath: /opt/sensoroni/fingerprints/strelkaengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 suricataengine: aiRepoUrl: https://github.com/Security-Onion-Solutions/securityonion-resources aiRepoBranch: generated-summaries-published @@ -1715,6 +1719,8 @@ soc: rulesFingerprintFile: /opt/sensoroni/fingerprints/emerging-all.fingerprint stateFilePath: /opt/sensoroni/fingerprints/suricataengine.state integrityCheckFrequencySeconds: 1200 + partialSyncTimeoutSeconds: 300 + bulkSyncTimeoutSeconds: 1800 ignoredSidRanges: - '1100000-1101000' rulesetSources: diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index 29f98f49f..6255fbd23 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -370,6 +370,18 @@ soc: description: 'How often the ElastAlert integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for Sigma rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: sigma + bulkSyncTimeoutSeconds: + description: 'How long to wait for Sigma rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: sigma rulesRepos: default: &eerulesRepos description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Elastalert --> Full Update." @@ -649,6 +661,18 @@ soc: description: 'How often the Strelka integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for YARA rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: yara + bulkSyncTimeoutSeconds: + description: 'How long to wait for YARA rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: yara rulesRepos: default: &serulesRepos description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Strelka --> Full Update." @@ -713,6 +737,18 @@ soc: description: 'How often the Suricata integrity checker runs (in seconds). This verifies the integrity of deployed rules.' global: True advanced: True + partialSyncTimeoutSeconds: + description: 'How long to wait for Suricata rules to deploy after a detection is created, updated, or deleted. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: suricata + bulkSyncTimeoutSeconds: + description: 'How long to wait for Suricata rules to deploy after a bulk enable, disable, or delete has saved its detections. Must allow time for a scheduled rule sync already in progress to finish. Increase on systems with limited resources.' + global: True + advanced: True + forcedType: int + helpLink: suricata customRulesets: description: 'This setting is no longer used. Use Ruleset Sources setting instead.' global: True From 340e7928f61bc88ca255061193cf93e3bfe6eb6e Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 30 Oct 2026 11:36:47 -0400 Subject: [PATCH 06/16] 3.4.0 --- DOWNLOAD_AND_VERIFY_ISO.md | 22 +++++++++++----------- sigs/securityonion-3.4.0-20261101.iso.sig | Bin 0 -> 566 bytes 2 files changed, 11 insertions(+), 11 deletions(-) create mode 100644 sigs/securityonion-3.4.0-20261101.iso.sig diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index 68ae7f2c4..7b077e273 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -1,17 +1,17 @@ -### 3.3.0-20260911 ISO image released on 2026/09/11 +### 3.4.0-20261101 ISO image released on 2026/11/01 ### Download and Verify -3.3.0-20260911 ISO image: -https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso +3.4.0-20261101 ISO image: +https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261101.iso -MD5: 12B18433D3A2198A185892FF79CF638F -SHA1: 2B3C2E1FA7A78ED1F956E7EDCC12E32593C14EEE -SHA256: 0938C73B76CE30EC9E4394D312C79EA7CAC721B6818541697279A6221F7D870D +MD5: 486097F2A33F0553BBBF6B7664656E18 +SHA1: D6E8B100FFF8BD04DC0FC95AF9D89F54166481D1 +SHA256: F65F190E5BE0BD944EA859A48D5031F75A2061FAD57D11C07B190A680CC62E9C Signature for ISO image: -https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig +https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261101.iso.sig Signing key: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS @@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/ Download the signature file for the ISO: ``` -wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig +wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261101.iso.sig ``` Download the ISO image: ``` -wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso +wget https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261101.iso ``` Verify the downloaded ISO image using the signature file: ``` -gpg --verify securityonion-3.3.0-20260911.iso.sig securityonion-3.3.0-20260911.iso +gpg --verify securityonion-3.4.0-20261101.iso.sig securityonion-3.4.0-20261101.iso ``` The output should show "Good signature" and the Primary key fingerprint should match what's shown below: ``` -gpg: Signature made Fri 11 Sep 2026 11:23:56 AM EDT using RSA key ID FE507013 +gpg: Signature made Thu 29 Oct 2026 06:20:38 PM EDT using RSA key ID FE507013 gpg: Good signature from "Security Onion Solutions, LLC " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. diff --git a/sigs/securityonion-3.4.0-20261101.iso.sig b/sigs/securityonion-3.4.0-20261101.iso.sig new file mode 100644 index 0000000000000000000000000000000000000000..eb22d30b41d1f9c7dd849a321fa73e4b3d3a194f GIT binary patch literal 566 zcmV-60?GY}0y6{v0SEvc79j-41gSkXz6^6dp_W8^5Ma0dP;e6k0&3&Nwg3tV5PT3| zxBgIY695Gd|7PD6o9^&(>FQy~ar3$K0k^U8F4;?kaD$(tG}S!osdw12$Cc^V+v)1r zOXzy=@8A0m7)=63~=Bl zdnDymJR+VRJBUqM{geaNVAXl5TXT~{Mf%1 En@al^1ONa4 literal 0 HcmV?d00001 From 092be7f222f17326a58e2ba6afc4d5a3c05dfd55 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Mon, 2 Nov 2026 10:46:19 -0500 Subject: [PATCH 07/16] 3.4.0 --- DOWNLOAD_AND_VERIFY_ISO.md | 22 +++++++++++----------- sigs/securityonion-3.4.0-20261101.iso.sig | Bin 566 -> 0 bytes sigs/securityonion-3.4.0-20261102.iso.sig | Bin 0 -> 566 bytes 3 files changed, 11 insertions(+), 11 deletions(-) delete mode 100644 sigs/securityonion-3.4.0-20261101.iso.sig create mode 100644 sigs/securityonion-3.4.0-20261102.iso.sig diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index 7b077e273..6533c2907 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -1,17 +1,17 @@ -### 3.4.0-20261101 ISO image released on 2026/11/01 +### 3.4.0-20261102 ISO image released on 2026/11/02 ### Download and Verify -3.4.0-20261101 ISO image: -https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261101.iso +3.4.0-20261102 ISO image: +https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261102.iso -MD5: 486097F2A33F0553BBBF6B7664656E18 -SHA1: D6E8B100FFF8BD04DC0FC95AF9D89F54166481D1 -SHA256: F65F190E5BE0BD944EA859A48D5031F75A2061FAD57D11C07B190A680CC62E9C +MD5: FB0380AE996E175D6CC7E7A35D8CC178 +SHA1: D8960F1DA352710BCA209773BF0B3AE8791D0D1B +SHA256: DFC4C87668836852A328EC7A0B755C8C1511FF0E43D423DEE23047A95F676D99 Signature for ISO image: -https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261101.iso.sig +https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261102.iso.sig Signing key: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS @@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/ Download the signature file for the ISO: ``` -wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261101.iso.sig +wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.4.0-20261102.iso.sig ``` Download the ISO image: ``` -wget https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261101.iso +wget https://download.securityonion.net/file/securityonion/securityonion-3.4.0-20261102.iso ``` Verify the downloaded ISO image using the signature file: ``` -gpg --verify securityonion-3.4.0-20261101.iso.sig securityonion-3.4.0-20261101.iso +gpg --verify securityonion-3.4.0-20261102.iso.sig securityonion-3.4.0-20261102.iso ``` The output should show "Good signature" and the Primary key fingerprint should match what's shown below: ``` -gpg: Signature made Thu 29 Oct 2026 06:20:38 PM EDT using RSA key ID FE507013 +gpg: Signature made Sat 31 Oct 2026 09:27:50 AM EDT using RSA key ID FE507013 gpg: Good signature from "Security Onion Solutions, LLC " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. diff --git a/sigs/securityonion-3.4.0-20261101.iso.sig b/sigs/securityonion-3.4.0-20261101.iso.sig deleted file mode 100644 index eb22d30b41d1f9c7dd849a321fa73e4b3d3a194f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 566 zcmV-60?GY}0y6{v0SEvc79j-41gSkXz6^6dp_W8^5Ma0dP;e6k0&3&Nwg3tV5PT3| zxBgIY695Gd|7PD6o9^&(>FQy~ar3$K0k^U8F4;?kaD$(tG}S!osdw12$Cc^V+v)1r zOXzy=@8A0m7)=63~=Bl zdnDymJR+VRJBUqM{geaNVAXl5TXT~{Mf%1 En@al^1ONa4 diff --git a/sigs/securityonion-3.4.0-20261102.iso.sig b/sigs/securityonion-3.4.0-20261102.iso.sig new file mode 100644 index 0000000000000000000000000000000000000000..f838bb93643126a6d6b685f4c4c7d1bfbfcd7708 GIT binary patch literal 566 zcmV-60?GY}0y6{v0SEvc79j-41gSkXz6^6dp_W8^5Ma0dP;e6k0&3;#)&L3#5PT3| zxBgIY6P4Hy0HpiLP%#FIx{=8 z>xpzk0Jo1$|8sP0%Uh7UFtLj`*mj-vG{jVD{mbenYyQ;)r1ZK{H6#Qhj*Pa8&Y`LY zpnJ^y6zfQfI=T5jGvQJR4c!&7>I6TtdEWFTr9lHy8dv{UJDy7)oI>=dUE#rO z13ZlaoU~9qa_4u?t0(6&*~nd{&`pf$Dn4ZoHYV}CvF6cq<%hO@u+$^Wj8wx965Py^ z9{*r&IQVpN=x73yD3L+Twcm1-bR&G9yvG4#xHyeOyHvFH_Q__(0Xz00099Qp8tut7 z6Uj<4t|}hX_C7jF4m`{!U~stuiM8GpTA+j z3VER7d}q`LP45$Eu)(y&BSdzj$?I>ns8Qw+;0?nh>>J~ zTzVb-)JYv%i2KtJqVKM-5wHGG5MmiJEM+LN4nHY^?_B*GKaSc5kkcY?1c^uDhuf$| E11{AFlmGw# literal 0 HcmV?d00001 From d43791c63ed339bc8a026c6ac4636b0e2023171e Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Mon, 2 Nov 2026 11:50:08 -0500 Subject: [PATCH 08/16] Bump version from 3.4.0 to 3.5.0 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 18091983f..1545d9665 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.4.0 +3.5.0 From 824d674eecf110bae7d03ee2337fb90e12885738 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Mon, 2 Nov 2026 11:50:49 -0500 Subject: [PATCH 09/16] Add version 3.5.0 to discussion template --- .github/DISCUSSION_TEMPLATE/3-0.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/DISCUSSION_TEMPLATE/3-0.yml b/.github/DISCUSSION_TEMPLATE/3-0.yml index 52c3144c2..53cf4c487 100644 --- a/.github/DISCUSSION_TEMPLATE/3-0.yml +++ b/.github/DISCUSSION_TEMPLATE/3-0.yml @@ -14,6 +14,7 @@ body: - 3.2.0 - 3.3.0 - 3.4.0 + - 3.5.0 - Other (please provide detail below) validations: required: true From 1849c74cea91ba4ed010ef3dc3ee75a54907ecaa Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Tue, 3 Nov 2026 21:07:29 -0600 Subject: [PATCH 10/16] Skip leftover ISO registry.tar when tags do not match SOVERSION Fixes #16372 --- setup/so-functions | 53 +++++++++++++++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 15 deletions(-) diff --git a/setup/so-functions b/setup/so-functions index 81d00f2c8..0381b6252 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -976,27 +976,50 @@ docker_seed_update() { set_progress_str "$docker_seed_update_percent" "Downloading $name" } +registry_tar_has_soversion() { + local tarfile=$1 + local version=$2 + + [ -n "$version" ] || return 1 + [ -f "$tarfile" ] || return 1 + # grep -q in a pipe SIGPIPEs tar; under pipefail a match would look like failure. + grep -qF "/_manifests/tags/${version}/" < <(tar -tf "$tarfile" 2>/dev/null) +} + docker_seed_registry() { local VERSION="$SOVERSION" + local REGISTRY_TAR=/nsm/docker-registry/docker/registry.tar - if [ -f /nsm/docker-registry/docker/registry.tar ]; then - logCmd "tar xvf /nsm/docker-registry/docker/registry.tar -C /nsm/docker-registry/docker" - logCmd "rm /nsm/docker-registry/docker/registry.tar" + if [ -f "$REGISTRY_TAR" ] && registry_tar_has_soversion "$REGISTRY_TAR" "$VERSION"; then + info "Extracting $REGISTRY_TAR" + if ! tar xvf "$REGISTRY_TAR" -C /nsm/docker-registry/docker >> "$setup_log" 2>&1; then + error "Failed to extract $REGISTRY_TAR" + return 1 + fi + logCmd "rm -f $REGISTRY_TAR" + return 0 + elif [ -f "$REGISTRY_TAR" ]; then + info "Not using $REGISTRY_TAR; it has no images tagged '${VERSION}'" + if [[ "$is_airgap" == true ]]; then + error "Airgap install: $REGISTRY_TAR does not match Security Onion version '${VERSION}'. Use the ISO for this version." + return 1 + fi elif [[ -d /nsm/docker-registry/docker/registry && ( -f /etc/SOCLOUD || "$is_airgap" == true ) ]]; then echo "Using existing docker registry content" - else - if [ "$install_type" == 'IMPORT' ]; then - container_list 'so-import' - else - container_list - fi - - docker_seed_update_percent=25 - - update_docker_containers 'netinstall' '' 'docker_seed_update' '/dev/stdout' 2>&1 | tee -a "$setup_log" - # Use pipe exit status of 'update_docker_containers' for return code - return ${PIPESTATUS[0]} + return 0 fi + + if [ "$install_type" == 'IMPORT' ]; then + container_list 'so-import' + else + container_list + fi + + docker_seed_update_percent=25 + + update_docker_containers 'netinstall' '' 'docker_seed_update' '/dev/stdout' 2>&1 | tee -a "$setup_log" + # Use pipe exit status of 'update_docker_containers' for return code + return ${PIPESTATUS[0]} } elasticfleet_pillar() { From bdf01a5a5a111267b7ad6b6e6d4ffd2e11b90336 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 3 Nov 2026 22:13:58 -0500 Subject: [PATCH 11/16] Remove x86-64-v3 CPU check from soup --- salt/manager/tools/sbin/soup | 95 +----------------------------------- 1 file changed, 1 insertion(+), 94 deletions(-) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 35337e925..ba27ca004 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -121,9 +121,6 @@ check_err() { 161) echo 'Required intermediate Elasticsearch upgrade not complete' ;; - 162) - echo 'One or more Elastic Agent nodes do not support the x86-64-v3 CPU instruction set' - ;; 170) echo "Intermediate upgrade completed successfully to $next_step_so_version, but next soup to Security Onion $originally_requested_so_version could not be started automatically." echo "Start soup again manually to continue the upgrade to Security Onion $originally_requested_so_version." @@ -351,83 +348,6 @@ check_cluster_health() { exit 0 } -no_soup_for_you() { - echo "" - echo "No soup for you!" - exit 162 -} - -check_cpu_compatibility() { - # Roles running a container built from the so-elastic-agent image; mirrors the - # elasticagent and elasticfleet entries in salt/reactor/pillar_push_map.yaml. - local cpu_target='G@role:so-heavynode or G@role:so-eval or G@role:so-fleet or G@role:so-import or G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone' - local expected_nodes cpu_results node result confirm - local -a unsupported=() offline=() - - echo "Checking that Elastic Agent nodes support the x86-64-v3 CPU instruction set now required by Elastic." - - if [[ "$SKIP_CPU_CHECK" == "true" ]]; then - printf "\nSkipping the x86-64-v3 CPU check because --skip-cpu-check was specified.\n\n" - return - fi - - # Nodes that never answer are absent from the results, so diff against who should have. - expected_nodes=$(salt -C "$cpu_target" --preview-target --out=json 2>/dev/null | jq -r '.[]?') || true - if [[ -z "$expected_nodes" ]]; then - printf "\nCould not determine which nodes run the Elastic Agent, so the x86-64-v3 CPU check cannot run.\n" - no_soup_for_you - fi - - cpu_results=$(salt -t 30 -C "$cpu_target" cmd.run "/lib64/ld-linux-x86-64.so.2 --help | grep x86-64-v3" --out=json 2>/dev/null) || true - - while IFS= read -r node; do - [[ -z "$node" ]] && continue - result=$(jq -r --arg node "$node" '.[$node] // empty' <<< "$cpu_results" 2>/dev/null) - if [[ -z "$result" || "$result" == *"did not return"* ]]; then - offline+=("$node") - elif [[ "$result" != *"x86-64-v3 (supported"* ]]; then - # glibc appends "(supported, searched)" only when supported; the open paren keeps - # this from matching a future "(unsupported". - unsupported+=("$node") - fi - done <<< "$expected_nodes" - - if [[ ${#unsupported[@]} -eq 0 && ${#offline[@]} -eq 0 ]]; then - printf "\nAll Elastic Agent nodes support x86-64-v3. We can proceed with SOUP.\n\n" - return - fi - - echo "" - if [[ ${#unsupported[@]} -gt 0 ]]; then - echo "The following node(s) do NOT support the x86-64-v3 CPU instruction set:" - printf ' %s\n' "${unsupported[@]}" - echo "" - echo "Upstream Elastic now builds its binaries for x86-64-v3, so these nodes can no" - echo "longer run Elastic. Upgrading them WILL BREAK them." - echo "" - fi - if [[ ${#offline[@]} -gt 0 ]]; then - echo "The following node(s) did not respond and could not be checked:" - printf ' %s\n' "${offline[@]}" - echo "" - echo "These nodes are offline, so we cannot confirm they support x86-64-v3, which" - echo "upstream Elastic now requires." - echo "" - fi - - if [[ -n $UNATTENDED ]]; then - echo "Unattended mode cannot prompt for an override. Re-run soup interactively, or pass --skip-cpu-check to bypass this check." - no_soup_for_you - fi - - read -rp "Type 'override' to continue anyway, or press Enter to exit: " confirm - if [[ "${confirm,,}" == "override" ]]; then - printf "\nOverride accepted. Continuing at your own risk.\n\n" - else - no_soup_for_you - fi -} - check_fleet_server() { echo "Checking that Elastic Fleet Server is responding." # Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls, @@ -2168,8 +2088,6 @@ main() { echo "Let's see if we need to update Security Onion." upgrade_check - check_cpu_compatibility - upgrade_space echo "Verifying Elasticsearch version compatibility across the grid before upgrading." @@ -2448,17 +2366,6 @@ fi echo "### soup has been served at $(date) ###" } -SKIP_CPU_CHECK=false -declare -a SOUP_ARGS=() -for arg in "$@"; do - if [[ "$arg" == "--skip-cpu-check" ]]; then - SKIP_CPU_CHECK=true - else - SOUP_ARGS+=("$arg") - fi -done -set -- "${SOUP_ARGS[@]}" - while getopts ":b:f:y" opt; do case ${opt} in b ) @@ -2482,7 +2389,7 @@ while getopts ":b:f:y" opt; do ISOLOC="$OPTARG" ;; \? ) - echo "Usage: soup [-b] [-y] [-f ] [--skip-cpu-check]" + echo "Usage: soup [-b] [-y] [-f ]" exit 1 ;; : ) From 99a8ad2d4bd4da3989d4d0db19b596c391fbe97e Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Wed, 4 Nov 2026 11:14:12 -0600 Subject: [PATCH 12/16] Wait for Elasticsearch and retry ILM policy loads Require wait_for_so-elasticsearch, check ES is responsive before dispatch, and retry each policy PUT so soup no longer fails with empty output when ES is not ready yet. Fixes https://github.com/Security-Onion-Solutions/securityonion/issues/16369 --- salt/elasticsearch/cluster.sls | 1 + .../so-elasticsearch-ilm-policy-load | 22 ++++++++++++------- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/salt/elasticsearch/cluster.sls b/salt/elasticsearch/cluster.sls index 45dcf4111..1c036ea4a 100644 --- a/salt/elasticsearch/cluster.sls +++ b/salt/elasticsearch/cluster.sls @@ -115,6 +115,7 @@ so-elasticsearch-ilm-policy-load: - require: - docker_container: so-elasticsearch - file: so-elasticsearch-ilm-policy-load-script + - http: wait_for_so-elasticsearch - onchanges: - file: so-elasticsearch-ilm-policy-load-script diff --git a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load index 9b748ce59..109b002e5 100755 --- a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load +++ b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load @@ -8,10 +8,14 @@ MAX_JOBS=${MAX_ILM_JOBS:-10} +check_elasticsearch_responsive + +ILM_TMP_DIR=$(mktemp -d) +trap 'rm -rf "$ILM_TMP_DIR"' EXIT # Lock used to serialize block writes so concurrent jobs never interleave their output. -ILM_OUTPUT_LOCK=$(mktemp) -ILM_FAIL_FILE=$(mktemp) -trap 'rm -f "$ILM_OUTPUT_LOCK" "$ILM_FAIL_FILE"' EXIT +ILM_OUTPUT_LOCK="$ILM_TMP_DIR/output.lock" +ILM_FAIL_FILE="$ILM_TMP_DIR/failed" +touch "$ILM_FAIL_FILE" # Policies are loaded concurrently (up to MAX_JOBS at a time) for speed. Each policy's block is # printed the moment its curl returns, so output appears in COMPLETION ORDER, not the order @@ -21,11 +25,13 @@ echo put_policy() { local desc="$1" policyname="$2" data="$3" result rc=0 - if ! result=$(curl -K /opt/so/conf/elasticsearch/curl.config -s -k -L --fail \ - -X PUT "https://localhost:9200/_ilm/policy/${policyname}" \ - -H 'Content-Type: application/json' -d"${data}" 2>&1); then - rc=1 - elif ! jq -e '.acknowledged == true' <<<"$result" >/dev/null 2>&1; then + # retry evals and echoes its command, so pass the body by file rather than inline. + local tmpdata="$ILM_TMP_DIR/${policyname}.json" + printf '%s' "$data" >"$tmpdata" + + if result=$(retry 3 3 "so-elasticsearch-query _ilm/policy/${policyname} -d@${tmpdata} -XPUT" "{\"acknowledged\":true}" 2>&1); then + result='{"acknowledged":true}' + else rc=1 fi From 274da18929a63f851fcc8798f8e1b4f577a3f578 Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Wed, 4 Nov 2026 13:18:31 -0600 Subject: [PATCH 13/16] Surface ILM policy validation errors in highstate Fail 4xx ILM PUTs immediately (retry 429/5xx/connect), print the Elasticsearch reason in the salt summary, and retry the load on the next highstate via /opt/so/state/esilm.txt when the last run failed. Fixes https://github.com/Security-Onion-Solutions/sos/issues/277 --- salt/elasticsearch/cluster.sls | 10 ++++- .../so-elasticsearch-ilm-policy-load | 38 +++++++++++++++---- 2 files changed, 38 insertions(+), 10 deletions(-) diff --git a/salt/elasticsearch/cluster.sls b/salt/elasticsearch/cluster.sls index 1c036ea4a..df3314ba1 100644 --- a/salt/elasticsearch/cluster.sls +++ b/salt/elasticsearch/cluster.sls @@ -107,6 +107,12 @@ so-elasticsearch-system-indices-patch: - file: so-elasticsearch-system-indices-patch-script {% endif %} +so-elasticsearch-ilm-policy-reload: + file.absent: + - name: /opt/so/state/esilm.txt + - onchanges: + - file: so-elasticsearch-ilm-policy-load-script + # heavynodes will only load ILM policies for SO managed indices. (Indicies defined in elasticsearch/defaults.yaml) so-elasticsearch-ilm-policy-load: cmd.run: @@ -116,8 +122,8 @@ so-elasticsearch-ilm-policy-load: - docker_container: so-elasticsearch - file: so-elasticsearch-ilm-policy-load-script - http: wait_for_so-elasticsearch - - onchanges: - - file: so-elasticsearch-ilm-policy-load-script + - file: so-elasticsearch-ilm-policy-reload + - unless: test -f /opt/so/state/esilm.txt so-elasticsearch-templates-reload: file.absent: diff --git a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load index 109b002e5..b2f277669 100755 --- a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load +++ b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-ilm-policy-load @@ -7,6 +7,8 @@ . /usr/sbin/so-common MAX_JOBS=${MAX_ILM_JOBS:-10} +ILM_STATEFILE=/opt/so/state/esilm.txt +rm -f "$ILM_STATEFILE" check_elasticsearch_responsive @@ -24,15 +26,30 @@ echo "Loading ILM policies concurrently; output below appears in completion orde echo put_policy() { - local desc="$1" policyname="$2" data="$3" result rc=0 - # retry evals and echoes its command, so pass the body by file rather than inline. - local tmpdata="$ILM_TMP_DIR/${policyname}.json" + local desc="$1" policyname="$2" data="$3" rc=1 attempt out http_code body result reason tmpdata + tmpdata=$(mktemp "$ILM_TMP_DIR/${policyname}.XXXXXX.json") printf '%s' "$data" >"$tmpdata" - if result=$(retry 3 3 "so-elasticsearch-query _ilm/policy/${policyname} -d@${tmpdata} -XPUT" "{\"acknowledged\":true}" 2>&1); then + for attempt in 1 2 3; do + out=$(so-elasticsearch-query "_ilm/policy/${policyname}" -d@"${tmpdata}" -XPUT -w '\n%{http_code}' 2>/dev/null) + http_code=${out##*$'\n'} body=${out%$'\n'*} + + if [[ "$http_code" == 200 ]] && jq -e '.acknowledged == true' <<<"$body" >/dev/null 2>&1; then + rc=0 + break + fi + # 429 = ES rejected/throttled (may succeed later); other 4xx will not + [[ "$http_code" == 4?? && "$http_code" != 429 ]] && break + (( attempt < 3 )) && sleep 3 + done + + if (( rc == 0 )); then result='{"acknowledged":true}' else - rc=1 + result=${body:-"HTTP ${http_code:-000}"} + # flatten tabs/newlines so the TAB fail-file stays one record + reason=$(jq -r '(if (.error|type) == "object" then (.error.reason // .error.type) elif (.error|type) == "string" then .error else empty end) // empty | tostring | gsub("[\t\r\n]+"; " ")' <<<"$body" 2>/dev/null) + reason="HTTP ${http_code:-000}${reason:+: ${reason}}" fi # curl above ran in parallel; serialize just this block write so concurrent jobs never interleave. @@ -40,7 +57,7 @@ put_policy() { flock 200 printf 'Setting up %s policy...\n%s\n\n' "${desc}" "${result}" if (( rc != 0 )); then - printf '%s\n' "${policyname}" >>"$ILM_FAIL_FILE" + printf '%s\t%s\n' "${policyname}" "${reason}" >>"$ILM_FAIL_FILE" fi } 200>>"${ILM_OUTPUT_LOCK}" @@ -88,10 +105,15 @@ wait || true if [[ -s "$ILM_FAIL_FILE" ]]; then echo "ERROR: Failed to load ILM policy(s):" - while read -r POLICY; do - echo " - $POLICY" + while IFS=$'\t' read -r POLICY REASON; do + if [[ -n "$REASON" ]]; then + echo " - ${POLICY}: ${REASON}" + else + echo " - ${POLICY}" + fi done < "$ILM_FAIL_FILE" exit 1 else echo "Successfully loaded all ILM policies." + touch "$ILM_STATEFILE" fi From 9a8dc097b2fd748bf04f159d7e8332ba6e864e55 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Wed, 4 Nov 2026 15:51:16 -0500 Subject: [PATCH 14/16] Install securityonion-so-crates on Security Onion Desktop --- salt/desktop/packages.sls | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/salt/desktop/packages.sls b/salt/desktop/packages.sls index b2a028e60..13704b02b 100644 --- a/salt/desktop/packages.sls +++ b/salt/desktop/packages.sls @@ -438,6 +438,10 @@ install_networkminer: pkg.latest: - name: securityonion-networkminer +install_so_crates: + pkg.latest: + - name: securityonion-so-crates + {% else %} desktop_packages_os_fail: From ec220572f0bf511ae3b95991ae00a5fba8aec4ef Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Mon, 9 Nov 2026 12:32:06 -0600 Subject: [PATCH 15/16] dedup artifact registry config & split ea artifacts out of /opt/socore/html/ into dedicated /opt/socore/elastic-artifacts/artifacts/ --- salt/nginx/enabled.sls | 4 ++-- salt/nginx/etc/nginx.conf | 49 ++++++++++++--------------------------- 2 files changed, 17 insertions(+), 36 deletions(-) diff --git a/salt/nginx/enabled.sls b/salt/nginx/enabled.sls index cf3cb1e81..f1a71238a 100644 --- a/salt/nginx/enabled.sls +++ b/salt/nginx/enabled.sls @@ -54,9 +54,9 @@ so-nginx: - /opt/so/log/nginx/:/var/log/nginx:rw - /opt/so/tmp/nginx/:/var/lib/nginx:rw - /opt/so/tmp/nginx/:/run:rw - - /nsm/elastic-fleet/so_agent-installers/:/opt/socore/html/packages - - /nsm/elastic-fleet/artifacts/:/opt/socore/html/artifacts + - /nsm/elastic-fleet/artifacts/:/opt/socore/elastic-artifacts/artifacts:ro {% if GLOBALS.is_manager %} + - /nsm/elastic-fleet/so_agent-installers/:/opt/socore/html/packages - /etc/pki/managerssl.crt:/etc/pki/nginx/server.crt:ro - /etc/pki/managerssl.key:/etc/pki/nginx/server.key:ro # ATT&CK Navigator binds diff --git a/salt/nginx/etc/nginx.conf b/salt/nginx/etc/nginx.conf index 357fc7e6d..5f9f9858d 100644 --- a/salt/nginx/etc/nginx.conf +++ b/salt/nginx/etc/nginx.conf @@ -4,6 +4,8 @@ {%- set role = grains.id.split('_') | last %} {%- set influxpass = salt['pillar.get']('secrets:influx_pass') %} {%- set influxauth = ('so:' + influxpass) | base64_encode %} +{%- set all_names = [GLOBALS.hostname, GLOBALS.url_base] + NGINXMERGED.ssl.alt_names %} +{%- set full_server_name = all_names | unique | join(' ') %} worker_processes auto; error_log /var/log/nginx/error.log; @@ -39,52 +41,31 @@ http { include /etc/nginx/conf.d/*.conf; - {%- if role in ['fleet'] %} - - server { - listen 8443; - server_name {{ GLOBALS.hostname }}; - root /opt/socore/html; - location /artifacts/ { - try_files $uri =206; - proxy_read_timeout 90; - proxy_connect_timeout 90; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Proxy ""; - proxy_set_header X-Forwarded-Proto $scheme; - } - } - - {%- endif %} - {%- if GLOBALS.is_manager %} - {%- set all_names = [GLOBALS.hostname, GLOBALS.url_base] + NGINXMERGED.ssl.alt_names %} - {%- set full_server_name = all_names | unique | join(' ') %} - server { listen 80 default_server; server_name _; return 307 https://{{ GLOBALS.url_base }}$request_uri; } - + {%- endif %} + {%- if GLOBALS.is_manager or role == 'fleet' %} server { listen 8443; + {%- if GLOBALS.is_manager %} server_name {{ full_server_name }}; - root /opt/socore/html; + {%- else %} + server_name {{ GLOBALS.hostname }}; + {%- endif %} + root /opt/socore/elastic-artifacts; location /artifacts/ { - try_files $uri =206; - proxy_read_timeout 90; - proxy_connect_timeout 90; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Proxy ""; - proxy_set_header X-Forwarded-Proto $scheme; + try_files $uri =404; + } + location / { + return 404; } } - + {%- endif %} + {%- if GLOBALS.is_manager %} server { listen 443 ssl default_server; http2 on; From 4a5253f68802fc9303d6c7dd21b2856e6f53a6ed Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 10 Nov 2026 08:26:19 -0500 Subject: [PATCH 16/16] Telegraf: fix EPS double counting and duplicate metric rows --- salt/telegraf/etc/telegraf.conf | 32 ++++++++++++++----- salt/telegraf/map.jinja | 2 +- salt/telegraf/scripts/checkfiles.sh | 2 +- salt/telegraf/scripts/containers.sh | 5 +-- salt/telegraf/scripts/eps.sh | 49 ++++++++++++++++++----------- salt/telegraf/scripts/features.sh | 3 +- 6 files changed, 62 insertions(+), 31 deletions(-) diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf index ab51ac2a5..0b2bb9bb6 100644 --- a/salt/telegraf/etc/telegraf.conf +++ b/salt/telegraf/etc/telegraf.conf @@ -138,6 +138,10 @@ # AGGREGATOR PLUGINS # ############################################################################### +[[aggregators.merge]] + drop_original = true + namepass = ["system", "swap", "kafka_partition"] + ############################################################################### # INPUT PLUGINS # ############################################################################### @@ -289,7 +293,7 @@ password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}" {%- endif %} -{% if grains.role in ['so-manager','so-managersearch','so-standalone','so-receiver'] and GLOBALS.pipeline == "KAFKA" -%} +{% if grains.role in ['so-manager','so-managerhype','so-managersearch','so-standalone','so-receiver'] and GLOBALS.pipeline == "KAFKA" -%} [[inputs.jolokia2_agent]] name_prefix= "kafka_" urls = ["http://{{ NODEIP }}:8778/jolokia"] @@ -346,6 +350,26 @@ interval = "60s" {%- endif %} +{#- These report state that changes slowly; collecting them every interval only stores duplicate rows #} +{%- set SLOWSCRIPTS = [] %} +{%- for script in ['agentstatus.sh', 'os.sh', 'features.sh', 'raid.sh', 'zeekloss.sh'] %} +{%- if script in TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] %} +{%- do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove(script) %} +{%- do SLOWSCRIPTS.append(script) %} +{%- endif %} +{%- endfor %} +{%- if SLOWSCRIPTS | length > 0 %} +[[inputs.exec]] + commands = [ +{%- for script in SLOWSCRIPTS %} + ["/scripts/{{script}}"]{% if not loop.last %},{% endif %} +{%- endfor %} + ] + data_format = "influx" + timeout = "15s" + interval = "5m" +{%- endif %} + {%- if TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] | length > 0 %} [[inputs.exec]] commands = [ @@ -358,12 +382,6 @@ timeout = "15s" {%- endif %} -{%- if salt['pillar.get']('healthcheck:enabled', False) %} -[[inputs.file]] - files = ["/host/nsm/zeek/logs/zeek_restart.log"] - data_format = "influx" -{%- endif %} - [[inputs.file]] files = ["/etc/telegraf/node_config.json"] name_override = "node_config" diff --git a/salt/telegraf/map.jinja b/salt/telegraf/map.jinja index fe2625bbc..511cd0b89 100644 --- a/salt/telegraf/map.jinja +++ b/salt/telegraf/map.jinja @@ -18,7 +18,7 @@ {% if GLOBALS.pipeline != 'REDIS' %} {# When global pipeline is not REDIS remove redis.sh script. KAFKA metrics are collected via jolokia agent. Config in telegraf.conf #} -{% if GLOBALS.role in ['so-standalone', 'so-manager', 'so-managersearch', 'so-receiver', 'so-heavynode'] %} +{% if GLOBALS.role in ['so-standalone', 'so-manager', 'so-managerhype', 'so-managersearch', 'so-receiver', 'so-heavynode'] %} {% do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove('redis.sh') %} {% endif %} {% endif %} diff --git a/salt/telegraf/scripts/checkfiles.sh b/salt/telegraf/scripts/checkfiles.sh index 6b2f1333d..bc7afb609 100644 --- a/salt/telegraf/scripts/checkfiles.sh +++ b/salt/telegraf/scripts/checkfiles.sh @@ -10,7 +10,7 @@ # if this script isn't already running if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then - FILES=$(ls -1x /host/nsm/strelka/unprocessed | wc -l) + FILES=$(find /host/nsm/strelka/unprocessed -maxdepth 1 -type f | wc -l) echo "faffiles files=$FILES" fi diff --git a/salt/telegraf/scripts/containers.sh b/salt/telegraf/scripts/containers.sh index 836d4a999..3ba991f78 100644 --- a/salt/telegraf/scripts/containers.sh +++ b/salt/telegraf/scripts/containers.sh @@ -12,8 +12,9 @@ if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then CONTAINERSLOG=/var/log/somon/containers.log # the collector rewrites this every minute; report nothing rather than repeating a stale - # file as if it were current, in case a run was skipped or the collector is wedged - MAXAGE=150 + # file as if it were current, in case a run was skipped or the collector is wedged. + # Kept under two collector cycles so a 60s telegraf interval can't emit the same snapshot twice. + MAXAGE=90 if [ -r "$CONTAINERSLOG" ]; then AGE=$(( $(date +%s) - $(stat -c %Y "$CONTAINERSLOG") )) diff --git a/salt/telegraf/scripts/eps.sh b/salt/telegraf/scripts/eps.sh index 10193cc38..fdaaa149b 100644 --- a/salt/telegraf/scripts/eps.sh +++ b/salt/telegraf/scripts/eps.sh @@ -11,27 +11,40 @@ if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then PREVCOUNTFILE='/tmp/eps.txt' - EVENTCOUNTCURRENT="$(curl -s localhost:9600/_node/stats | jq '.events.in')" + STATS="$(curl -s localhost:9600/_node/stats)" - if [ ! -z "$EVENTCOUNTCURRENT" ]; then - - if [ -f "$PREVCOUNTFILE" ]; then - EVENTCOUNTPREVIOUS=`cat $PREVCOUNTFILE` - else - echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE - exit 0 - fi - - echo "${EVENTCOUNTCURRENT}" > $PREVCOUNTFILE - # the division by 30 is because the agent interval is 30 seconds - EVENTS=$(((EVENTCOUNTCURRENT - EVENTCOUNTPREVIOUS)/30)) - if [ "$EVENTS" -lt 0 ]; then - EVENTS=0 - fi - - echo "consumptioneps eps=${EVENTS%%.*}" + if echo "$STATS" | jq -e '.pipelines.search' > /dev/null 2>&1; then + STAGE=search + COUNT="$(echo "$STATS" | jq '.pipelines.search.events.out')" + elif echo "$STATS" | jq -e '.pipelines.receiver' > /dev/null 2>&1; then + STAGE=receiver + COUNT="$(echo "$STATS" | jq '.pipelines.receiver.events.in')" + else + exit 0 fi + if ! [[ "$COUNT" =~ ^[0-9]+$ ]]; then + exit 0 + fi + + NOW=$(date +%s) + read -r PREVEPOCH PREVCOUNT 2>/dev/null < "$PREVCOUNTFILE" + echo "${NOW} ${COUNT}" > "$PREVCOUNTFILE" + + if ! [[ "$PREVEPOCH" =~ ^[0-9]+$ && "$PREVCOUNT" =~ ^[0-9]+$ ]]; then + exit 0 + fi + + ELAPSED=$((NOW - PREVEPOCH)) + DELTA=$((COUNT - PREVCOUNT)) + if [ "$ELAPSED" -le 0 ] || [ "$DELTA" -lt 0 ]; then + EPS=0 + else + EPS=$((DELTA / ELAPSED)) + fi + + echo "consumptioneps,stage=${STAGE} eps=${EPS}" + fi exit 0 diff --git a/salt/telegraf/scripts/features.sh b/salt/telegraf/scripts/features.sh index 7c4fe6f52..bcc47ecb1 100644 --- a/salt/telegraf/scripts/features.sh +++ b/salt/telegraf/scripts/features.sh @@ -10,8 +10,7 @@ if [[ ! "`pidof -x $(basename $0) -o %PPID`" ]]; then FPS_ENABLED=$(cat /var/log/sostatus/fps_enabled) LKS_ENABLED=$(cat /var/log/sostatus/lks_enabled) - echo "features fps=$FPS_ENABLED" - echo "features lks=$LKS_ENABLED" + echo "features fps=$FPS_ENABLED,lks=$LKS_ENABLED" fi exit 0