From e5ecf0f4cbd1eb3906726ede4e0175df843e5820 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Wed, 25 Mar 2020 13:03:40 -0400 Subject: [PATCH] Fleet dedicated node - various fixes --- salt/common/init.sls | 3 +- salt/common/nginx/nginx.conf.so-fleet | 2 +- salt/fleet/event_enable-fleet.sls | 2 + salt/fleet/files/dedicated-index.html | 127 ++++++++++++++++++++++ salt/fleet/files/osquery-packages-sa.html | 107 ------------------ salt/fleet/files/osquery-packages.html | 4 +- salt/fleet/init.sls | 5 + salt/fleet/install_package.sls | 8 ++ salt/reactor/fleet.sls | 16 ++- setup/so-functions | 2 + 10 files changed, 164 insertions(+), 112 deletions(-) create mode 100644 salt/fleet/files/dedicated-index.html delete mode 100644 salt/fleet/files/osquery-packages-sa.html diff --git a/salt/common/init.sls b/salt/common/init.sls index 13c174265..8146f281b 100644 --- a/salt/common/init.sls +++ b/salt/common/init.sls @@ -2,6 +2,7 @@ {% set MASTER = salt['grains.get']('master') %} {% set GRAFANA = salt['pillar.get']('master:grafana', '0') %} {% set FLEETMASTER = salt['pillar.get']('static:fleet_master', False) %} +{% set FLEETNODE = salt['pillar.get']('static:fleet_node', False) %} # Add socore Group socoregroup: group.present: @@ -143,7 +144,7 @@ so-core: - port_bindings: - 80:80 - 443:443 - {%- if FLEETMASTER %} + {%- if FLEETMASTER or FLEETNODE %} - 8090:8090 {%- endif %} - watch: diff --git a/salt/common/nginx/nginx.conf.so-fleet b/salt/common/nginx/nginx.conf.so-fleet index 5665fcf4e..dd4b22d9b 100644 --- a/salt/common/nginx/nginx.conf.so-fleet +++ b/salt/common/nginx/nginx.conf.so-fleet @@ -65,7 +65,7 @@ http { server { listen 443 ssl http2 default_server; server_name _; - root /opt/socore/html; + root /opt/socore/html/packages; index index.html; ssl_certificate "/etc/pki/nginx/server.crt"; diff --git a/salt/fleet/event_enable-fleet.sls b/salt/fleet/event_enable-fleet.sls index 8c3426e0d..007f3690c 100644 --- a/salt/fleet/event_enable-fleet.sls +++ b/salt/fleet/event_enable-fleet.sls @@ -1,9 +1,11 @@ {% set ENROLLSECRET = salt['cmd.run']('docker exec so-fleet fleetctl get enroll-secret') %} +{%- set MAINIP = salt['pillar.get']('node:mainip') -%} so/fleet: event.send: - data: action: 'enablefleet' hostname: {{ grains.host }} + mainip: {{ MAINIP }} role: {{ grains.role }} enroll-secret: {{ ENROLLSECRET }} \ No newline at end of file diff --git a/salt/fleet/files/dedicated-index.html b/salt/fleet/files/dedicated-index.html new file mode 100644 index 000000000..d6fead8f9 --- /dev/null +++ b/salt/fleet/files/dedicated-index.html @@ -0,0 +1,127 @@ +{%- set PACKAGESTS = salt['pillar.get']('static:fleet_packages-timestamp:', 'N/A') -%} + + + + +Security Onion - Hybrid Hunter + + + + + + + +
+
+ Fleet + Osquery/Fleet Docs + Security Onion Solutions +
+ +
+

+

+

Security Onion - Dedicated Fleet Node

+

Osquery Packages

+
+
+

Notes

+
    +
  • These packages are customized for this specific Fleet install and will only be generated after the Fleet setup script has been run. If you want vanilla osquery packages, you can get them directly from osquery.io
    • +
  • Packages are not signed.
    • +
+
+

Downloads

+
+ Generated: {{ PACKAGESTS }} +
+
+ Packages: + +
+
+ Config Files: + +
+
+

Known Issues

+
    +
  • None
    • +
+

+
+
+ + diff --git a/salt/fleet/files/osquery-packages-sa.html b/salt/fleet/files/osquery-packages-sa.html deleted file mode 100644 index c35449522..000000000 --- a/salt/fleet/files/osquery-packages-sa.html +++ /dev/null @@ -1,107 +0,0 @@ - - - -Security Onion - Hybrid Hunter - - - - - - - - -
- Fleet - Fleet & Osquery Docs -
- -
- -

Osquery Packages


- -

Notes

- -

Downloads

- - -

Known Issues

- -

-
- - - - diff --git a/salt/fleet/files/osquery-packages.html b/salt/fleet/files/osquery-packages.html index c1843bf01..a64e6a2df 100644 --- a/salt/fleet/files/osquery-packages.html +++ b/salt/fleet/files/osquery-packages.html @@ -1,3 +1,4 @@ +{%- set PACKAGESTS = salt['pillar.get']('static:fleet_packages-timestamp:', 'N/A') -%} @@ -102,7 +103,7 @@ a {

Downloads

- Generated: N/A + Generated: {{ PACKAGESTS }}

Packages: @@ -110,6 +111,7 @@ a {
  • MSI (Windows)
  • DEB (Debian)
  • RPM (RPM)
    • +
  • PKG (MacOS)


    • diff --git a/salt/fleet/init.sls b/salt/fleet/init.sls index 15f55b594..52fc665bb 100644 --- a/salt/fleet/init.sls +++ b/salt/fleet/init.sls @@ -69,7 +69,12 @@ fleetsetupscripts: osquerypackageswebpage: file.managed: - name: /opt/so/conf/fleet/packages/index.html +{% if FLEETARCH == "so-fleet" %} + - source: salt://fleet/files/dedicated-index.html +{% else %} - source: salt://fleet/files/osquery-packages.html +{% endif %} + - template: jinja fleetdb: mysql_database.present: diff --git a/salt/fleet/install_package.sls b/salt/fleet/install_package.sls index 7a87a5f92..583970bcd 100644 --- a/salt/fleet/install_package.sls +++ b/salt/fleet/install_package.sls @@ -1,7 +1,15 @@ {%- set FLEETMASTER = salt['pillar.get']('static:fleet_master', False) -%} {%- set FLEETNODE = salt['pillar.get']('static:fleet_node', False) -%} +{%- set FLEETHOSTNAME = salt['pillar.get']('static:fleet_hostname', False) -%} +{%- set FLEETIP = salt['pillar.get']('static:fleet_ip', False) -%} {%- if FLEETMASTER or FLEETNODE %} + +{{ FLEETHOSTNAME }}: + host.present: + - ip: {{ FLEETIP }} + - clean: True + launcherpkg: pkg.installed: - sources: diff --git a/salt/reactor/fleet.sls b/salt/reactor/fleet.sls index 83a1d981c..c1d6bdd5c 100644 --- a/salt/reactor/fleet.sls +++ b/salt/reactor/fleet.sls @@ -12,6 +12,8 @@ def run(): HOSTNAME = data['data']['hostname'] ROLE = data['data']['role'] ESECRET = data['data']['enroll-secret'] + MAINIP = data['data']['mainip'] + STATICFILE = '/opt/so/saltstack/pillar/static.sls' AUTHFILE = '/opt/so/saltstack/pillar/auth.sls' @@ -27,10 +29,20 @@ def run(): line = re.sub(r'fleet_master: \S*', f"fleet_master: True", line.rstrip()) print(line) - # Update the enroll secret + # Update the enroll secret in the auth pillar for line in fileinput.input(AUTHFILE, inplace=True): line = re.sub(r'fleet_enroll-secret: \S*', f"fleet_enroll-secret: {ESECRET}", line.rstrip()) - print(line) + print(line) + + # Update the Fleet host in the static pillar + for line in fileinput.input(STATICFILE, inplace=True): + line = re.sub(r'fleet_hostname: \S*', f"fleet_hostname: {HOSTNAME}", line.rstrip()) + print(line) + + # Update the Fleet IP in the static pillar + for line in fileinput.input(STATICFILE, inplace=True): + line = re.sub(r'fleet_ip: \S*', f"fleet_ip: {MAINIP}", line.rstrip()) + print(line) if ACTION == 'genpackages': logging.info('so/fleet genpackages reactor') diff --git a/setup/so-functions b/setup/so-functions index d7cf4c387..7b1b34a55 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -781,6 +781,8 @@ master_static() { echo " fleet_master: False" >> /opt/so/saltstack/pillar/static.sls echo " fleet_node: False" >> /opt/so/saltstack/pillar/static.sls echo " fleet_packages-timestamp: N/A" >> /opt/so/saltstack/pillar/static.sls + echo " fleet_hostname: N/A" >> /opt/so/saltstack/pillar/static.sls + echo " fleet_ip: N/A" >> /opt/so/saltstack/pillar/static.sls echo " sensoronikey: $SENSORONIKEY" >> /opt/so/saltstack/pillar/static.sls if [[ $MASTERUPDATES == 'MASTER' ]]; then echo " masterupdate: 1" >> /opt/so/saltstack/pillar/static.sls