CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

[feat][WIP] Add option to run so-allow -a <ip/cidr> during setup

Browse Source
This commit is contained in:
William Wernert
2020-07-09 14:47:55 -04:00
parent 206bdc60f3
commit c5eff1d89e
3 changed files with 39 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
salt/common/tools/sbin/so-allow
View File

@@ -89,7 +89,7 @@ if [ "$SKIP" -eq 0 ]; then
echo "[p] - Wazuh API - port 55000/tcp" echo "[p] - Wazuh API - port 55000/tcp"
echo "[r] - Wazuh registration service - 1515/tcp" echo "[r] - Wazuh registration service - 1515/tcp"
echo "" echo ""
echo "Please enter your selection (a - analyst, b - beats, o - osquery, w - wazuh):" echo "Please enter your selection:"
read -r ROLE read -r ROLE
echo "Enter a single ip address or range to allow (example: 10.10.10.10 or 10.10.0.0/16):" echo "Enter a single ip address or range to allow (example: 10.10.10.10 or 10.10.0.0/16):"
read -r IP read -r IP
@@ -127,16 +127,16 @@ salt-call state.apply firewall queue=True
if grep -q -R "wazuh: 1" $local_salt_dir/pillar/*; then if grep -q -R "wazuh: 1" $local_salt_dir/pillar/*; then
# If analyst, add to Wazuh AR whitelist # If analyst, add to Wazuh AR whitelist
if [ "$FULLROLE" == "analyst" ]; then if [ "$FULLROLE" == "analyst" ]; then
WAZUH_MGR_CFG="/opt/so/wazuh/etc/ossec.conf" WAZUH_MGR_CFG="/opt/so/wazuh/etc/ossec.conf"
if ! grep -q "<white_list>$IP</white_list>" $WAZUH_MGR_CFG ; then if ! grep -q "<white_list>$IP</white_list>" $WAZUH_MGR_CFG ; then
DATE=$(date) DATE=$(date)
sed -i 's/<\/ossec_config>//' $WAZUH_MGR_CFG sed -i 's/<\/ossec_config>//' $WAZUH_MGR_CFG
sed -i '/^$/N;/^\n$/D' $WAZUH_MGR_CFG sed -i '/^$/N;/^\n$/D' $WAZUH_MGR_CFG
echo -e "<!--Address $IP added by /usr/sbin/so-allow on \"$DATE\"-->\n <global>\n <white_list>$IP</white_list>\n </global>\n</ossec_config>" >> $WAZUH_MGR_CFG echo -e "<!--Address $IP added by /usr/sbin/so-allow on \"$DATE\"-->\n <global>\n <white_list>$IP</white_list>\n </global>\n</ossec_config>" >> $WAZUH_MGR_CFG
echo "Added whitelist entry for $IP in $WAZUH_MGR_CFG." echo "Added whitelist entry for $IP in $WAZUH_MGR_CFG."
echo echo
echo "Restarting OSSEC Server..." echo "Restarting OSSEC Server..."
/usr/sbin/so-wazuh-restart /usr/sbin/so-wazuh-restart
fi fi
fi fi
fi fi

4
setup/so-setup
View File

@@ -331,6 +331,8 @@ else
FLEETNODEPASSWD1=$WEBPASSWD1 FLEETNODEPASSWD1=$WEBPASSWD1
fi fi
if [[ $is_master ]]; then whiptail_so_allow; fi
whiptail_make_changes whiptail_make_changes
if [[ -n "$TURBO" ]]; then if [[ -n "$TURBO" ]]; then
@@ -620,7 +622,7 @@ if [[ -n $ALLOW_ROLE && -n $ALLOW_CIDR ]]; then
IP=$ALLOW_CIDR so-allow -$ALLOW_ROLE >> $setup_log 2>&1 IP=$ALLOW_CIDR so-allow -$ALLOW_ROLE >> $setup_log 2>&1
fi fi
if [[ $success != 0 || $SO_ERROR == 1 ]]; then whiptail_setup_failed if [[ $success != 0 || -n $SO_ERROR ]]; then whiptail_setup_failed
else else
whiptail_setup_complete whiptail_setup_complete
if [[ $THEHIVE == 1 ]]; then check_hive_init; fi if [[ $THEHIVE == 1 ]]; then check_hive_init; fi

26
setup/so-whiptail
View File

@@ -435,9 +435,7 @@ whiptail_homenet_sensor() {
whiptail_check_exitstatus $exitstatus whiptail_check_exitstatus $exitstatus
export HNSENSOR export HNSENSOR
fi fi
} }
whiptail_install_type() { whiptail_install_type() {
@@ -1057,6 +1055,29 @@ whiptail_shard_count() {
} }
whiptail_so_allow() {
[ -n "$TESTING" ] && return
whiptail --title "Security Onion Setup" \
--yesno "Do you want to run so-allow to allow access to the web tools?" \
8 75
local exitstatus=$?
if [[ $exitstatus == 0 ]]; then
ALLOW_CIDR=$(whiptail --title "Security Onion Setup" \
--inputbox "Enter a single ip address or range (in CIDR notation) to allow" \
10 75 125 3>&1 1>&2 2>&3)
local exitstatus=$?
export ALLOW_ROLE='a'
export ALLOW_CIDR
fi
whiptail_check_exitstatus $exitstatus
}
whiptail_strelka_rules() { whiptail_strelka_rules() {
[ -n "$TESTING" ] && return [ -n "$TESTING" ] && return
@@ -1073,7 +1094,6 @@ whiptail_strelka_rules() {
export STRELKARULES export STRELKARULES
fi fi
} }
whiptail_suricata_pins() { whiptail_suricata_pins() {