diff --git a/README.md b/README.md index 1b7661956..bf6b06b23 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,13 @@ +## Hybrid Hunter Beta 1.2.2 - Beta 1 + +### Changes: + +- Updated Saltstack to 2019.2.4 to address [CVE-2020-11651](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11651) +- Updated Suricata to 4.1.8 to address some possible security issues. Details [here](https://suricata-ids.org/2020/04/28/suricata-4-1-8-released/). +- Fixed an issue that was preventing Strelka to function properly. +- ISO installs should now use the built in docker containers instead of re-downloading them. + + ## Hybrid Hunter Beta 1.2.1 - Beta 1 ### Changes: diff --git a/VERSION b/VERSION index 6085e9465..23aa83906 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.2.1 +1.2.2 diff --git a/salt/soc/files/kratos/kratos.yaml b/salt/soc/files/kratos/kratos.yaml index 032027d96..406683a5d 100644 --- a/salt/soc/files/kratos/kratos.yaml +++ b/salt/soc/files/kratos/kratos.yaml @@ -6,6 +6,13 @@ selfservice: password: enabled: true + settings: + privileged_session_max_age: 1m + after: + profile: + hooks: + - hook: verify + verify: return_to: https://{{ WEBACCESS }}/ @@ -14,29 +21,14 @@ selfservice: login: request_lifespan: 10m - after: - password: - - - job: session - - - job: redirect - config: - default_redirect_url: https://{{ WEBACCESS }}/ - allow_user_defined_redirect: true registration: request_lifespan: 10m after: password: - - - job: verify - - - job: session - - - job: redirect - config: - default_redirect_url: https://{{ WEBACCESS }}/ - allow_user_defined_redirect: true + hooks: + - hook: session + - hook: verify log: level: debug @@ -58,7 +50,7 @@ urls: public: https://{{ WEBACCESS }}/auth/ admin: https://{{ WEBACCESS }}/kratos/ default_return_to: https://{{ WEBACCESS }}/ - whitelisted_return_to_domains: + whitelisted_return_to_urls: - http://127.0.0.1 hashers: diff --git a/salt/soc/files/soc/changes.json b/salt/soc/files/soc/changes.json index 3e368d002..a917fe706 100644 --- a/salt/soc/files/soc/changes.json +++ b/salt/soc/files/soc/changes.json @@ -1,6 +1,11 @@ { - "title": "Introducing Hybrid Hunter 1.2.1 Beta 1", + "title": "Introducing Hybrid Hunter 1.2.2 Beta 1", "changes": [ + + { "summary": "Saltstack has been upgraded to 2019.2.4 to address CVE-2020-11651." }, + { "summary": "Updated Suricata to 4.1.8 to address some possible security issues." }, + { "summary": "Fixed an issue that was preventing Strelka to function properly." }, + { "summary": "ISO installs should now use the built in docker containers instead of re-downloading them." }, { "summary": "Full support for Ubuntu 18.04. 16.04 is no longer supported for Hybrid Hunter." }, { "summary": "Introduction of the Security Onion Console. Once logged in you are directly taken to the SOC." }, { "summary": "New authentication using Kratos." }, diff --git a/salt/strelka/init.sls b/salt/strelka/init.sls index b9efef638..482b28db5 100644 --- a/salt/strelka/init.sls +++ b/salt/strelka/init.sls @@ -72,7 +72,7 @@ strelka_gatekeeper: strelka_frontend: docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-frontend:HH1.2.1 + - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-frontend:{{ VERSION }} - binds: - /opt/so/conf/strelka/frontend/:/etc/strelka/:ro - /nsm/strelka/log/:/var/log/strelka/:rw @@ -84,7 +84,7 @@ strelka_frontend: strelka_backend: docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-backend:HH1.2.1 + - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-backend:{{ VERSION }} - binds: - /opt/so/conf/strelka/backend/:/etc/strelka/:ro - /opt/so/conf/strelka/backend/yara:/etc/yara/:ro @@ -94,7 +94,7 @@ strelka_backend: strelka_manager: docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-manager:HH1.2.1 + - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-manager:{{ VERSION }} - binds: - /opt/so/conf/strelka/manager/:/etc/strelka/:ro - name: so-strelka-manager @@ -102,7 +102,7 @@ strelka_manager: strelka_filestream: docker_container.running: - - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-filestream:HH1.2.1 + - image: {{ MASTER }}:5000/soshybridhunter/so-strelka-filestream:{{ VERSION }} - binds: - /opt/so/conf/strelka/filestream/:/etc/strelka/:ro - /nsm/strelka:/nsm/strelka diff --git a/setup/so-functions b/setup/so-functions index 3402dd6b1..5682205a1 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -17,7 +17,7 @@ SCRIPTDIR=$(dirname "$0") source $SCRIPTDIR/so-whiptail -SOVERSION=1.2.1 +SOVERSION=1.2.2 accept_salt_key_local() { echo "Accept the key locally on the master" >> $SETUPLOG 2>&1 @@ -818,10 +818,10 @@ install_master() { else if [ $OSVER != "xenial" ]; then - apt-get install -y salt-common=2019.2.3+ds-1 salt-master=2019.2.3+ds-1 salt-minion=2019.2.3+ds-1 libssl-dev python-m2crypto + apt-get install -y salt-common=2019.2.4+ds-1 salt-master=2019.2.4+ds-1 salt-minion=2019.2.4+ds-1 libssl-dev python-m2crypto apt-mark hold salt-common salt-master salt-minion else - apt-get install -y salt-common=2019.2.3+ds-1 salt-master=2019.2.3+ds-1 salt-minion=2019.2.3+ds-1 libssl-dev python-m2crypto + apt-get install -y salt-common=2019.2.4+ds-1 salt-master=2019.2.4+ds-1 salt-minion=2019.2.4+ds-1 libssl-dev python-m2crypto apt-mark hold salt-common salt-master salt-minion fi fi @@ -1233,17 +1233,17 @@ EOF fi yum clean expire-cache - yum -y install epel-release salt-minion-2019.2.3 yum-utils device-mapper-persistent-data lvm2 openssl jq + yum -y install epel-release salt-minion-2019.2.4 yum-utils device-mapper-persistent-data lvm2 openssl jq yum -y update exclude=salt* systemctl enable salt-minion if [ $INSTALLTYPE == 'MASTER' ] || [ $INSTALLTYPE == 'EVAL' ] || [ $INSTALLTYPE == 'HELIXSENSOR' ] || [ $INSTALLTYPE == 'MASTERSEARCH' ]; then - yum -y install salt-master-2019.2.3 python3 python36-m2crypto salt-minion-2019.2.3 python36-dateutil python36-mysql python36-docker + yum -y install salt-master-2019.2.4 python3 python36-m2crypto salt-minion-2019.2.4 python36-dateutil python36-mysql python36-docker systemctl enable salt-master elif [ $INSTALLTYPE == 'FLEET' ]; then - yum -y install salt-minion-2019.2.3 python3 python36-m2crypto python36-dateutil python36-docker python36-mysql + yum -y install salt-minion-2019.2.4 python3 python36-m2crypto python36-dateutil python36-docker python36-mysql else - yum -y install salt-minion-2019.2.3 python3 python36-m2crypto python36-dateutil python36-docker + yum -y install salt-minion-2019.2.4 python3 python36-m2crypto python36-dateutil python36-docker fi echo "exclude=salt*" >> /etc/yum.conf @@ -1298,11 +1298,11 @@ EOF # Initialize the new repos apt-get update >> $SETUPLOG 2>&1 if [ $OSVER != "xenial" ]; then - apt-get -y install salt-minion=2019.2.3+ds-1 salt-common=2019.2.3+ds-1 python3-dateutil python3-m2crypto sqlite3 argon2 curl jq openssl >> $SETUPLOG 2>&1 + apt-get -y install salt-minion=2019.2.4+ds-1 salt-common=2019.2.4+ds-1 python3-dateutil python3-m2crypto sqlite3 argon2 curl jq openssl >> $SETUPLOG 2>&1 apt-mark hold salt-minion salt-common else # Need to add python packages here - apt-get -y install salt-minion=2019.2.3+ds-1 salt-common=2019.2.3+ds-1 python-dateutil python-m2crypto sqlite3 argon2 curl jq openssl >> $SETUPLOG 2>&1 + apt-get -y install salt-minion=2019.2.4+ds-1 salt-common=2019.2.4+ds-1 python-dateutil python-m2crypto sqlite3 argon2 curl jq openssl >> $SETUPLOG 2>&1 apt-mark hold salt-minion salt-common fi else @@ -1329,11 +1329,11 @@ EOF # Initialize the new repos apt-get update >> $SETUPLOG 2>&1 if [ $OSVER != "xenial" ]; then - apt-get -y install salt-minion=2019.2.3+ds-1 salt-common=2019.2.3+ds-1 python3-dateutil python3-m2crypto >> $SETUPLOG 2>&1 + apt-get -y install salt-minion=2019.2.4+ds-1 salt-common=2019.2.4+ds-1 python3-dateutil python3-m2crypto >> $SETUPLOG 2>&1 apt-mark hold salt-minion salt-common else # Need to add python packages here - apt-get -y install salt-minion=2019.2.3+ds-1 salt-common=2019.2.3+ds-1 python-dateutil python-m2crypto >> $SETUPLOG 2>&1 + apt-get -y install salt-minion=2019.2.4+ds-1 salt-common=2019.2.4+ds-1 python-dateutil python-m2crypto >> $SETUPLOG 2>&1 apt-mark hold salt-minion salt-common fi fi diff --git a/upgrade/so-update-functions b/upgrade/so-update-functions index 4f0e48f66..49dca0352 100644 --- a/upgrade/so-update-functions +++ b/upgrade/so-update-functions @@ -17,7 +17,7 @@ # Set the new SO Version -UPDATEVERSION=1.2.1 +UPDATEVERSION=1.2.2 BUILD=HH #Determine the current install version