diff --git a/salt/fleet/init.sls b/salt/fleet/init.sls index f3a844ff3..9986d40a9 100644 --- a/salt/fleet/init.sls +++ b/salt/fleet/init.sls @@ -30,6 +30,16 @@ fleetlogdir: - user: 939 - group: 939 - makedirs: True + +fleetsetupscript: + file.managed: + - name: /opt/so/conf/fleet/so-fleet-setup.sh + - source: salt://fleet/so-fleet-setup.sh + +osquerypackageswebpage: + file.managed: + - name: /opt/so/conf/fleet/packages/index.html + - source: salt://fleet/osquery-packages.html fleetdb: mysql_database.present: diff --git a/salt/fleet/osquery-packages.html b/salt/fleet/osquery-packages.html new file mode 100644 index 000000000..c94ba89b9 --- /dev/null +++ b/salt/fleet/osquery-packages.html @@ -0,0 +1,113 @@ + + + +Security Onion - Hybrid Hunter + + + + + + + + +
+ Kibana + Grafana + Fleet + TheHive + Osquery Binaries + FAQ + Security Onion Solutions + Blog +
+ +
+ +

Osquery Packages


+ +

Notes

+ +

Downloads

+ + +

Known Issues

+ +

+
+ + + + diff --git a/salt/fleet/so-fleet-setup.sh b/salt/fleet/so-fleet-setup.sh new file mode 100644 index 000000000..64d7fe435 --- /dev/null +++ b/salt/fleet/so-fleet-setup.sh @@ -0,0 +1,35 @@ +#so-fleet-setup.sh $MasterIP $FleetEmail + +if [ ! "$(docker ps -q -f name=so-fleet)" ]; then + echo "so-fleet container not running... Exiting..." + exit 1 +fi + +initpw=$(date +%s | sha256sum | base64 | head -c 16 ; echo) + +docker exec so-fleet fleetctl config set --address https://$1:443 --tls-skip-verify +docker exec so-fleet fleetctl setup --email $2 --password $initpw + +docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/options.yaml +docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/MacOS/osquery.yaml +docker exec so-fleet fleetctl apply -f /packs/palantir/Fleet/Endpoints/Windows/osquery.yaml +docker exec so-fleet fleetctl apply -f /packs/hh/hhdefault.yml + +esecret=$(sudo docker exec so-fleet fleetctl get enroll-secret) + +#Concat fleet.crt & ca.crt - this is required for launcher connectivity +cat /etc/pki/fleet.crt /etc/pki/ca.crt > /etc/pki/fleet-launcher.crt + +#Create the output directory +mkdir /opt/so/conf/fleet/packages + +docker run \ + --mount type=bind,source=/opt/so/conf/fleet/packages,target=/output \ + --mount type=bind,source=/etc/pki/fleet-launcher.crt,target=/var/launcher/launcher.crt \ + defensivedepth/hh-launcher "$esecret" "$1":8080 + +#Update timestamp on packages webpage +sed -i "s@.*Generated.*@Generated: $(date '+%m%d%Y')@g" /opt/so/conf/fleet/packages/index.html + +echo "Fleet Setup Complete - Login here: https://$1" +echo "Your username is $2 and your password is $initpw" diff --git a/salt/ssl/init.sls b/salt/ssl/init.sls index a2d2b613f..841fc32ff 100644 --- a/salt/ssl/init.sls +++ b/salt/ssl/init.sls @@ -1,4 +1,5 @@ {% set master = salt['grains.get']('master') %} +{%- set masterip = salt['pillar.get']('static:masterip', '') -%} # Trust the CA @@ -109,6 +110,7 @@ fbcrtlink: x509.certificate_managed: - signing_private_key: /etc/pki/fleet.key - CN: {{ master }} + - subjectAltName: DNS:{{ master }},IP:{{ masterip }} - days_remaining: 0 - days_valid: 3650 - backup: True