diff --git a/salt/ca/trust.sls b/salt/ca/trust.sls index aec613f29..d138fec7a 100644 --- a/salt/ca/trust.sls +++ b/salt/ca/trust.sls @@ -14,6 +14,10 @@ ca_trust_legacy_anchor: file.absent: - name: /etc/pki/ca-trust/source/anchors/ca.crt +ca_trust_legacy_bundles: + file.absent: + - name: /opt/so/conf/ca + # clean removes blocklist entries that are no longer shipped ca_trust_blocklist: file.recurse: diff --git a/salt/idh/enabled.sls b/salt/idh/enabled.sls index 2a02d1f85..95e4976b2 100644 --- a/salt/idh/enabled.sls +++ b/salt/idh/enabled.sls @@ -6,9 +6,11 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - idh.config - idh.sostatus @@ -20,6 +22,7 @@ so-idh: - detach: True - network_mode: host - binds: + - {{ CATRUST.dir }} - /nsm/idh:/var/tmp:rw - /opt/so/conf/idh/http-skins:/opt/opencanary/http-skins:ro - /opt/so/conf/idh/opencanary.conf:/etc/opencanaryd/opencanary.conf:ro @@ -34,12 +37,13 @@ so-idh: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-idh'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-idh'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-idh'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-idh'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-idh'].ulimits %} @@ -47,6 +51,7 @@ so-idh: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: opencanary_config - require: - file: opencanary_config diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 42f71fcfe..35337e925 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -1267,7 +1267,6 @@ post_to_3.4.0() { } remove_frozen_ca_bundles() { - rm -rf /opt/so/conf/ca >> $SOUP_LOG 2>&1 rm -f /opt/so/saltstack/local/salt/elasticsearch/cacerts /opt/so/saltstack/local/salt/elasticsearch/tls-ca-bundle.pem >> $SOUP_LOG 2>&1 } diff --git a/salt/strelka/backend/enabled.sls b/salt/strelka/backend/enabled.sls index e62349f70..ee670a2b1 100644 --- a/salt/strelka/backend/enabled.sls +++ b/salt/strelka/backend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.backend.config - strelka.backend.sostatus @@ -17,6 +19,7 @@ strelka_backend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-backend:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.dir }} - /opt/so/conf/strelka/backend/:/etc/strelka/:ro - /opt/so/conf/strelka/rules/compiled/:/etc/yara/:ro {% if DOCKERMERGED.containers['so-strelka-backend'].custom_bind_mounts %} @@ -36,12 +39,14 @@ strelka_backend: - {{ XTRAHOST }} {% endfor %} {% endif %} - {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - environment: - {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + - REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt + - SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt + {% if DOCKERMERGED.containers['so-strelka-backend'].extra_env %} + {% for XTRAENV in DOCKERMERGED.containers['so-strelka-backend'].extra_env %} - {{ XTRAENV }} - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% if DOCKERMERGED.containers['so-strelka-backend'].ulimits %} - ulimits: {% for ULIMIT in DOCKERMERGED.containers['so-strelka-backend'].ulimits %} @@ -49,6 +54,7 @@ strelka_backend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: strelkasensorcompiledrules - file: backend_backend_config - file: backend_logging_config diff --git a/salt/strelka/coordinator/enabled.sls b/salt/strelka/coordinator/enabled.sls index 8393d7e68..01543c93a 100644 --- a/salt/strelka/coordinator/enabled.sls +++ b/salt/strelka/coordinator/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.coordinator.config - strelka.coordinator.sostatus @@ -39,6 +41,7 @@ strelka_coordinator: {% endfor %} {% endif %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/coord-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-coordinator'].custom_bind_mounts %} @@ -51,6 +54,9 @@ strelka_coordinator: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract + delete_so-strelka-coordinator_so-status.disabled: file.uncomment: - name: /opt/so/conf/so-status/so-status.conf diff --git a/salt/strelka/filestream/enabled.sls b/salt/strelka/filestream/enabled.sls index c01171565..60e741e5c 100644 --- a/salt/strelka/filestream/enabled.sls +++ b/salt/strelka/filestream/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.filestream.config - strelka.filestream.sostatus @@ -17,6 +19,7 @@ strelka_filestream: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/filestream/:/etc/strelka/:ro - /nsm/strelka:/nsm/strelka {% if DOCKERMERGED.containers['so-strelka-filestream'].custom_bind_mounts %} @@ -49,6 +52,7 @@ strelka_filestream: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: filestream_config delete_so-strelka-filestream_so-status.disabled: diff --git a/salt/strelka/frontend/enabled.sls b/salt/strelka/frontend/enabled.sls index f2d0eecd1..5d19961b5 100644 --- a/salt/strelka/frontend/enabled.sls +++ b/salt/strelka/frontend/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.frontend.config - strelka.frontend.sostatus @@ -17,6 +19,7 @@ strelka_frontend: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/frontend/:/etc/strelka/:ro - /nsm/strelka/log/:/var/log/strelka/:rw {% if DOCKERMERGED.containers['so-strelka-frontend'].custom_bind_mounts %} @@ -54,6 +57,7 @@ strelka_frontend: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: frontend_config delete_so-strelka-frontend_so-status.disabled: diff --git a/salt/strelka/gatekeeper/enabled.sls b/salt/strelka/gatekeeper/enabled.sls index 19d74a6d8..507e1fe02 100644 --- a/salt/strelka/gatekeeper/enabled.sls +++ b/salt/strelka/gatekeeper/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.gatekeeper.config - strelka.gatekeeper.sostatus @@ -33,6 +35,7 @@ strelka_gatekeeper: - {{ BINDING }} {% endfor %} - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /nsm/strelka/gk-redis-data:/data:rw {% if DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-gatekeeper'].custom_bind_mounts %} @@ -51,6 +54,8 @@ strelka_gatekeeper: - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }} {% endfor %} {% endif %} + - watch: + - cmd: ca_trust_extract delete_so-strelka-gatekeeper_so-status.disabled: file.uncomment: diff --git a/salt/strelka/manager/enabled.sls b/salt/strelka/manager/enabled.sls index 272767928..d0fb3d07d 100644 --- a/salt/strelka/manager/enabled.sls +++ b/salt/strelka/manager/enabled.sls @@ -7,8 +7,10 @@ {% if sls.split('.')[0] in allowed_states %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} include: + - ca.trust - strelka.manager.config - strelka.manager.sostatus @@ -17,6 +19,7 @@ strelka_manager: - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-strelka-manager:{{ GLOBALS.so_version }} - restart_policy: unless-stopped - binds: + - {{ CATRUST.pem }}:/etc/ssl/certs/ca-certificates.crt:ro - /opt/so/conf/strelka/manager/:/etc/strelka/:ro {% if DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} {% for BIND in DOCKERMERGED.containers['so-strelka-manager'].custom_bind_mounts %} @@ -48,6 +51,7 @@ strelka_manager: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: manager_config delete_so-strelka-manager_so-status.disabled: diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls index d9206798e..ede2c1d31 100644 --- a/salt/suricata/enabled.sls +++ b/salt/suricata/enabled.sls @@ -6,11 +6,13 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} {% from 'suricata/map.jinja' import SURICATAMERGED %} include: + - ca.trust - suricata.config - suricata.sostatus @@ -33,6 +35,7 @@ so-suricata: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /opt/so/conf/suricata/suricata.yaml:/etc/suricata/suricata.yaml:ro - /opt/so/conf/suricata/threshold.conf:/etc/suricata/threshold.conf:ro - /opt/so/conf/suricata/classification.config:/etc/suricata/classification.config:ro @@ -55,6 +58,7 @@ so-suricata: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: suriconfig - file: surithresholding - file: /opt/so/conf/suricata/bpf diff --git a/salt/tcpreplay/init.sls b/salt/tcpreplay/init.sls index f5b1b05d9..076f0f42c 100644 --- a/salt/tcpreplay/init.sls +++ b/salt/tcpreplay/init.sls @@ -2,6 +2,10 @@ {% if sls in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} + +include: + - ca.trust so-tcpreplay: docker_container.running: @@ -13,7 +17,10 @@ so-tcpreplay: - interactive: True - tty: True - binds: + - {{ CATRUST.dir }} - /opt/so/samples:/opt/so/samples:ro + - watch: + - cmd: ca_trust_extract {% else %} diff --git a/salt/zeek/enabled.sls b/salt/zeek/enabled.sls index ec8148e90..c4a191d89 100644 --- a/salt/zeek/enabled.sls +++ b/salt/zeek/enabled.sls @@ -6,10 +6,12 @@ {% from 'allowed_states.map.jinja' import allowed_states %} {% if sls.split('.')[0] in allowed_states %} {% from 'vars/globals.map.jinja' import GLOBALS %} +{% from 'ca/trust.map.jinja' import CATRUST %} {% from 'docker/docker.map.jinja' import DOCKERMERGED %} include: + - ca.trust - zeek.config - zeek.sostatus @@ -30,6 +32,7 @@ so-zeek: {% endfor %} {% endif %} - binds: + - {{ CATRUST.dir }} - /nsm/zeek/logs:/nsm/zeek/logs:rw - /nsm/zeek/spool:/nsm/zeek/spool:rw - /nsm/zeek/extracted:/nsm/zeek/extracted:rw @@ -63,6 +66,7 @@ so-zeek: {% endfor %} {% endif %} - watch: + - cmd: ca_trust_extract - file: /opt/so/conf/zeek/local.zeek - file: /opt/so/conf/zeek/node.cfg - file: /opt/so/conf/zeek/networks.cfg