diff --git a/pillar/top.sls b/pillar/top.sls index 0424fc89d..e2a3a4fdc 100644 --- a/pillar/top.sls +++ b/pillar/top.sls @@ -21,7 +21,7 @@ base: - static - firewall.* - data.* - - auth #Shared secrets + - secrets - minions.{{ grains.id }} '*_master': @@ -33,7 +33,7 @@ base: - firewall.* - data.* - brologs - - auth #Shared secrets + - secrets - logstash - logstash.eval - healthcheck.eval @@ -63,5 +63,5 @@ base: - static - firewall.* - data.* - - auth #Shared secrets + - secrets - minions.{{ grains.id }} diff --git a/salt/auth/init.sls b/salt/auth/init.sls deleted file mode 100644 index abbe514d3..000000000 --- a/salt/auth/init.sls +++ /dev/null @@ -1,30 +0,0 @@ -{% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %} -{% set MASTER = salt['grains.get']('master') %} - -so-auth-api-dir: - file.directory: - - name: /opt/so/conf/auth/api - - user: 939 - - group: 939 - - makedirs: True - -so-auth-api: - docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-auth-api:{{ VERSION }} - - hostname: so-auth-api - - name: so-auth-api - - environment: - - BASE_PATH: "/so-auth/api" - - AUTH_TOKEN_TIMEOUT: 32400 - - binds: - - /opt/so/conf/auth/api:/data - - port_bindings: - - 0.0.0.0:5656:5656 - -so-auth-ui: - docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-auth-ui:{{ VERSION }} - - hostname: so-auth-ui - - name: so-auth-ui - - port_bindings: - - 0.0.0.0:4242:80 diff --git a/salt/common/nginx/index.html b/salt/common/nginx/index.html deleted file mode 100644 index e501e5377..000000000 --- a/salt/common/nginx/index.html +++ /dev/null @@ -1,163 +0,0 @@ - - - -Security Onion - Hybrid Hunter - - - - - - - -
-
- Create New User - Kibana - Grafana - Sensoroni - Playbook - Fleet - TheHive - Osquery Packages - FAQ - Security Onion Solutions - Blog -
- -
-
- - Security Onion - -
-
-

-

-

Hybrid Hunter Alpha 1.1.4 - Feature Parity Release

-
-
-

Changes:

- -

-
- -
- Disclaimer of Warranty -
- - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. - EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM - .AS IS. WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, - THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. - THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, - YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - -
-
- Limitation of Liability -
- - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, - OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, - INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM - (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES - OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE - POSSIBILITY OF SUCH DAMAGES. - -
-
-
- - diff --git a/salt/common/nginx/nginx.conf.so-fleet b/salt/common/nginx/nginx.conf.so-fleet index dd4b22d9b..a97b85e78 100644 --- a/salt/common/nginx/nginx.conf.so-fleet +++ b/salt/common/nginx/nginx.conf.so-fleet @@ -86,14 +86,6 @@ http { } - - error_page 401 = @error401; - - location @error401 { - add_header Set-Cookie "NSREDIRECT=http://{{ MAINIP }}$request_uri;Domain={{ MAINIP }};Path=/;Max-Age=60000"; - return 302 http://{{ MAINIP }}/so-auth/loginpage/; - } - error_page 404 /404.html; location = /40x.html { } diff --git a/salt/common/tools/sbin/so-auth-restart b/salt/common/tools/sbin/so-auth-restart deleted file mode 100755 index 8659b1e3a..000000000 --- a/salt/common/tools/sbin/so-auth-restart +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash - -# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -. /usr/sbin/so-common - -/usr/sbin/so-restart auth $1 - diff --git a/salt/common/tools/sbin/so-auth-start b/salt/common/tools/sbin/so-auth-start deleted file mode 100755 index 5330f662d..000000000 --- a/salt/common/tools/sbin/so-auth-start +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -. /usr/sbin/so-common - -/usr/sbin/so-start auth $1 diff --git a/salt/common/tools/sbin/so-auth-stop b/salt/common/tools/sbin/so-auth-stop deleted file mode 100755 index 5ca6db7e2..000000000 --- a/salt/common/tools/sbin/so-auth-stop +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -# Copyright 2014,2015,2016,2017,2018,2019,2020 Security Onion Solutions, LLC -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -. /usr/sbin/so-common - -/usr/sbin/so-stop auth $1 diff --git a/salt/common/tools/sbin/so-elastic-download b/salt/common/tools/sbin/so-elastic-download index 020a42f79..9e2c56719 100755 --- a/salt/common/tools/sbin/so-elastic-download +++ b/salt/common/tools/sbin/so-elastic-download @@ -2,8 +2,6 @@ MASTER=MASTER VERSION="HH1.1.4" TRUSTED_CONTAINERS=( \ -"so-auth-api:$VERSION" \ -"so-auth-ui:$VERSION" \ "so-core:$VERSION" \ "so-thehive-cortex:$VERSION" \ "so-curator:$VERSION" \ diff --git a/salt/common/tools/sbin/so-restart b/salt/common/tools/sbin/so-restart index 2e3c0a00c..bbcfe4c20 100755 --- a/salt/common/tools/sbin/so-restart +++ b/salt/common/tools/sbin/so-restart @@ -32,6 +32,5 @@ fi case $1 in "cortex") docker stop so-thehive-cortex so-thehive && docker rm so-thehive-cortex so-thehive && salt-call state.apply hive queue=True;; "steno") docker stop so-steno && docker rm so-steno && salt-call state.apply pcap queue=True;; - "auth") docker stop so-auth-api; docker stop so-auth-ui; salt-call state.apply auth queue=True;; *) docker stop so-$1 ; docker rm so-$1 ; salt-call state.apply $1 queue=True;; esac diff --git a/salt/common/tools/sbin/so-start b/salt/common/tools/sbin/so-start index 889160122..a198377a1 100755 --- a/salt/common/tools/sbin/so-start +++ b/salt/common/tools/sbin/so-start @@ -32,16 +32,5 @@ fi case $1 in "all") salt-call state.highstate queue=True;; "steno") if docker ps | grep -q so-$1; then printf "\n$1 is already running!\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply pcap queue=True; fi ;; - "auth") - if docker ps | grep -q so-auth-api; then - if docker ps | grep -q so-auth-ui; then - printf "\n$1 is already running!\n\n" - else - docker rm so-auth-api >/dev/null 2>&1; docker rm so-auth-ui >/dev/null 2>&1; salt-call state.apply $1 queue=True - fi - else - docker rm so-auth-api >/dev/null 2>&1; docker rm so-auth-ui >/dev/null 2>&1; salt-call state.apply $1 queue=True - fi - ;; *) if docker ps | grep -q so-$1; then printf "\n$1 is already running\n\n"; else docker rm so-$1 >/dev/null 2>&1 ; salt-call state.apply $1 queue=True; fi ;; esac diff --git a/salt/common/tools/sbin/so-stop b/salt/common/tools/sbin/so-stop index 8d5770b64..4a0dd944b 100755 --- a/salt/common/tools/sbin/so-stop +++ b/salt/common/tools/sbin/so-stop @@ -24,7 +24,6 @@ printf "Stopping $1...\n" echo $banner case $1 in - "auth") docker stop so-auth-api; docker rm so-auth-api; docker stop so-auth-ui; docker rm so-auth-ui ;; *) docker stop so-$1 ; docker rm so-$1 ;; esac diff --git a/salt/fleet/init.sls b/salt/fleet/init.sls index 9a6ba0330..0a916ae3d 100644 --- a/salt/fleet/init.sls +++ b/salt/fleet/init.sls @@ -1,6 +1,6 @@ -{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', None) -%} -{%- set FLEETPASS = salt['pillar.get']('auth:fleet', None) -%} -{%- set FLEETJWT = salt['pillar.get']('auth:fleet_jwt', None) -%} +{%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} +{%- set FLEETPASS = salt['pillar.get']('secrets:fleet', None) -%} +{%- set FLEETJWT = salt['pillar.get']('secrets:fleet_jwt', None) -%} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %} {% set MASTER = salt['grains.get']('master') %} {% set MAINIP = salt['pillar.get']('node:mainip') %} diff --git a/salt/master/files/registry/scripts/so-docker-download b/salt/master/files/registry/scripts/so-docker-download index 488b45886..f6ca8f4e1 100644 --- a/salt/master/files/registry/scripts/so-docker-download +++ b/salt/master/files/registry/scripts/so-docker-download @@ -17,8 +17,6 @@ TRUSTED_CONTAINERS=( \ "so-thehive-es:$VERSION" \ "so-wazuh:$VERSION" \ "so-kibana:$VERSION" \ -"so-auth-ui:$VERSION" \ -"so-auth-api:$VERSION" \ "so-elastalert:$VERSION" \ "so-navigator:$VERSION" \ "so-filebeat:$VERSION" \ diff --git a/salt/mysql/etc/mypass b/salt/mysql/etc/mypass index 2fb9844db..f5f781c10 100644 --- a/salt/mysql/etc/mypass +++ b/salt/mysql/etc/mypass @@ -1,2 +1,2 @@ -{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', None) -%} +{%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) -%} {{ MYSQLPASS }} diff --git a/salt/mysql/init.sls b/salt/mysql/init.sls index 981d27a73..8c5b91b99 100644 --- a/salt/mysql/init.sls +++ b/salt/mysql/init.sls @@ -1,4 +1,4 @@ -{%- set MYSQLPASS = salt['pillar.get']('auth:mysql', None) %} +{%- set MYSQLPASS = salt['pillar.get']('secrets:mysql', None) %} {%- set MASTERIP = salt['pillar.get']('static:masterip', '') %} {% set VERSION = salt['pillar.get']('static:soversion', 'HH1.1.4') %} {% set MASTER = salt['grains.get']('master') %} diff --git a/salt/top.sls b/salt/top.sls index 7132a4f69..bb629c106 100644 --- a/salt/top.sls +++ b/salt/top.sls @@ -57,7 +57,6 @@ base: - soc - firewall - idstools - - auth #Shared secrets - salt.beacons {%- if FLEETMASTER or FLEETNODE %} - mysql @@ -108,7 +107,6 @@ base: - master - idstools - redis - - auth #Shared secrets {%- if FLEETMASTER or FLEETNODE %} - mysql {%- endif %} @@ -197,7 +195,6 @@ base: - firewall - sensor - master - - auth #Shared secrets {%- if FLEETMASTER or FLEETNODE %} - fleet.install_package {%- endif %} @@ -213,7 +210,6 @@ base: - master - idstools - redis - - auth #Shared secrects {%- if FLEETMASTER or FLEETNODE %} - mysql {%- endif %} diff --git a/setup/so-functions b/setup/so-functions index 2db632572..2ebd38831 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -101,17 +101,17 @@ add_web_user() { echo "Add user result: $?" } -# Create an auth pillar so that passwords survive re-install -auth_pillar(){ +# Create an secrets pillar so that passwords survive re-install +secrets_pillar(){ - if [ ! -f /opt/so/saltstack/pillar/auth.sls ]; then - echo "Creating Auth Pillar" >> $SETUPLOG 2>&1 + if [ ! -f /opt/so/saltstack/pillar/secrets.sls ]; then + echo "Creating Secrets Pillar" >> $SETUPLOG 2>&1 mkdir -p /opt/so/saltstack/pillar - echo "auth:" >> /opt/so/saltstack/pillar/auth.sls - echo " mysql: $MYSQLPASS" >> /opt/so/saltstack/pillar/auth.sls - echo " fleet: $FLEETPASS" >> /opt/so/saltstack/pillar/auth.sls - echo " fleet_jwt: $FLEETJWT" >> /opt/so/saltstack/pillar/auth.sls - echo " fleet_enroll-secret: False" >> /opt/so/saltstack/pillar/auth.sls + echo "secrets:" >> /opt/so/saltstack/pillar/secrets.sls + echo " mysql: $MYSQLPASS" >> /opt/so/saltstack/pillar/secrets.sls + echo " fleet: $FLEETPASS" >> /opt/so/saltstack/pillar/secrets.sls + echo " fleet_jwt: $FLEETJWT" >> /opt/so/saltstack/pillar/secrets.sls + echo " fleet_enroll-secret: False" >> /opt/so/saltstack/pillar/secrets.sls fi } @@ -288,10 +288,10 @@ configure_minion() { echo "mysql.host: '$MAINIP'" >> /etc/salt/minion echo "mysql.port: 3306" >> /etc/salt/minion echo "mysql.user: 'root'" >> /etc/salt/minion - if [ ! -f /opt/so/saltstack/pillar/auth.sls ]; then + if [ ! -f /opt/so/saltstack/pillar/secrets.sls ]; then echo "mysql.pass: '$MYSQLPASS'" >> /etc/salt/minion else - OLDPASS=$(cat /opt/so/saltstack/pillar/auth.sls | grep mysql | awk {'print $2'}) + OLDPASS=$(cat /opt/so/saltstack/pillar/secrets.sls | grep mysql | awk {'print $2'}) echo "mysql.pass: '$OLDPASS'" >> /etc/salt/minion fi elif [ $TYPE == 'helix' ]; then @@ -551,8 +551,6 @@ docker_seed_registry() { if [ $INSTALLTYPE != 'HELIXSENSOR' ]; then TRUSTED_CONTAINERS=( \ "so-acng:$VERSION" \ - "so-auth-api:$VERSION" \ - "so-auth-ui:$VERSION" \ "so-core:$VERSION" \ "so-thehive-cortex:$VERSION" \ "so-curator:$VERSION" \ diff --git a/upgrade/so-update-functions b/upgrade/so-update-functions index ef7bb4597..4f0e48f66 100644 --- a/upgrade/so-update-functions +++ b/upgrade/so-update-functions @@ -35,8 +35,6 @@ HOSTNAME=$(hostname) if [ $MASTERCHECK != 'so-helix' ]; then TRUSTED_CONTAINERS=( \ "so-acng:$BUILD$UPDATEVERSION" \ - "so-auth-api:$BUILD$UPDATEVERSION" \ - "so-auth-ui:$BUILD$UPDATEVERSION" \ "so-core:$BUILD$UPDATEVERSION" \ "so-thehive-cortex:$BUILD$UPDATEVERSION" \ "so-curator:$BUILD$UPDATEVERSION" \