CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-27 23:18:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

changes for script to auth to elastic

Browse Source
This commit is contained in:
m0duspwnens
2021-05-24 10:13:29 -04:00
parent de4fde4ee3
commit e2d5102a0e
17 changed files with 57 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
salt/utility/bin/crossthestreams
+3 -3
View File
@@ -8,7 +8,7 @@ echo -n "Waiting for ElasticSearch..."
COUNT=0
ELASTICSEARCH_CONNECTED="no"
while [[ "$COUNT" -le 30 ]]; do
curl -k --output /dev/null --silent --head --fail -L https://{{ ES }}:9200
{{ ELASTICCURL }} -k --output /dev/null --silent --head --fail -L https://{{ ES }}:9200
if [ $? -eq 0 ]; then
ELASTICSEARCH_CONNECTED="yes"
echo "connected!"
@@ -28,7 +28,7 @@ if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
fi
echo "Applying cross cluster search config..."
curl -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings \
{{ ELASTICCURL }} -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings \
-H 'Content-Type: application/json' \
-d "{\"persistent\": {\"search\": {\"remote\": {\"{{ MANAGER }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}"
@@ -36,7 +36,7 @@ echo "Applying cross cluster search config..."
{%- if TRUECLUSTER is sameas false %}
{%- if salt['pillar.get']('nodestab', {}) %}
{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
curl -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"{{ SN }}": {"skip_unavailable": "true", "seeds": ["{{ SN.split('_')|first }}:9300"]}}}}}'
{{ ELASTICCURL }} -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings -H'Content-Type: application/json' -d '{"persistent": {"search": {"remote": {"{{ SN }}": {"skip_unavailable": "true", "seeds": ["{{ SN.split('_')|first }}:9300"]}}}}}'
{%- endfor %}
{%- endif %}
{%- endif %}
salt/utility/bin/eval
+2 -2
View File
@@ -6,7 +6,7 @@ echo -n "Waiting for ElasticSearch..."
COUNT=0
ELASTICSEARCH_CONNECTED="no"
while [[ "$COUNT" -le 30 ]]; do
curl -k --output /dev/null --silent --head --fail -L https://{{ ES }}:9200
{{ ELASTICCURL }} -k --output /dev/null --silent --head --fail -L https://{{ ES }}:9200
if [ $? -eq 0 ]; then
ELASTICSEARCH_CONNECTED="yes"
echo "connected!"
@@ -26,6 +26,6 @@ if [ "$ELASTICSEARCH_CONNECTED" == "no" ]; then
fi
echo "Applying cross cluster search config..."
curl -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings \
{{ ELASTICCURL }} -s -k -XPUT -L https://{{ ES }}:9200/_cluster/settings \
-H 'Content-Type: application/json' \
-d "{\"persistent\": {\"search\": {\"remote\": {\"{{ grains.host }}\": {\"seeds\": [\"127.0.0.1:9300\"]}}}}}"
salt/utility/init.sls
+19 -4
View File
@@ -1,8 +1,11 @@
{% from 'allowed_states.map.jinja' import allowed_states %}
{% if sls in allowed_states %}
{% set ELASTICUSER = salt['pillar.get']('elasticsearch:auth:user', '' ) %}
{% set ELASTICPASS = salt['pillar.get']('elasticsearch:auth:pass', '' ) %}
# This state is for checking things
{% if grains['role'] in ['so-manager', 'so-managersearch', 'so-standalone'] %}
{% if grains['role'] in ['so-manager', 'so-managersearch', 'so-standalone'] %}
# Make sure Cross Cluster is good. Will need some logic once we have hot/warm
crossclusterson:
cmd.script:
@@ -11,9 +14,15 @@ crossclusterson:
- runas: socore
- source: salt://utility/bin/crossthestreams
- template: jinja
- defaults:
ELASTICCURL: "curl"
{% if salt['pillar.get']('elasticsearch:auth_enabled', False) %}
- context:
ELASTICCURL: "curl --user {{ELASTICUSER}}:{{ELASTICPASS}}"
{% endif %}
{% endif %}
{% if grains['role'] in ['so-eval', 'so-import'] %}
{% endif %}
{% if grains['role'] in ['so-eval', 'so-import'] %}
fixsearch:
cmd.script:
- shell: /bin/bash
@@ -21,7 +30,13 @@ fixsearch:
- runas: socore
- source: salt://utility/bin/eval
- template: jinja
{% endif %}
- defaults:
ELASTICCURL: "curl"
{% if salt['pillar.get']('elasticsearch:auth_enabled', False) %}
- context:
ELASTICCURL: "curl --user {{ELASTICUSER}}:{{ELASTICPASS}}"
{% endif %}
{% endif %}
{% else %}