Merge pull request #5353 from Security-Onion-Solutions/hotfix/2.3.70

2.3.70 WAZUH Hotfix sigs

HOTFIX

@@ -1 +1 @@
-
+CURATOR GRAFANA_DASH_ALLOW WAZUH

VERIFY_ISO.md

@@ -1,18 +1,18 @@
-### 2.3.70 ISO image built on 2021/08/17
+### 2.3.70-WAZUH ISO image built on 2021/08/23
 
 
 
 ### Download and Verify
 
-2.3.70 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-2.3.70.iso
+2.3.70-WAZUH ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-2.3.70-WAZUH.iso
 
-MD5: F048FABC7FD2D0E1A8B02381F115D1E0  
-SHA1: DF6D20FEF13CDC1B19309D2A1178D6E5D25FDA6F  
-SHA256: B193FFD7EE69958A8E257117149DCFB2125C5772FBFA6003AD80FD1CC129E571 
+MD5: CEDEF3C38089896C252F9E3C75F7CB15  
+SHA1: FB420115C72DABDEB87C8B27F26E862C94628057  
+SHA256: CC3E75A97163E9CD255DA0D9C3EB11922FA045651827F291025398943C1BC230 
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.70.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.70-WAZUH.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS  
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.70.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.70-WAZUH.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-2.3.70.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-2.3.70-WAZUH.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-2.3.70.iso.sig securityonion-2.3.70.iso
+gpg --verify securityonion-2.3.70-WAZUH.iso.sig securityonion-2.3.70-WAZUH.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Tue 17 Aug 2021 10:52:17 PM EDT using RSA key ID FE507013
+gpg: Signature made Mon 30 Aug 2021 06:13:14 PM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

salt/curator/init.sls

@@ -4,6 +4,7 @@
 {% set VERSION = salt['pillar.get']('global:soversion', 'HH1.2.2') %}
 {% set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
 {% set MANAGER = salt['grains.get']('master') %}
+{% set REMOVECURATORCRON = False %}
 {% if grains['role'] in ['so-eval', 'so-node', 'so-managersearch', 'so-heavynode', 'so-standalone', 'so-manager'] %}
   {% from 'elasticsearch/auth.map.jinja' import ELASTICAUTH with context %}
   {% from "curator/map.jinja" import CURATOROPTIONS with context %}
@@ -88,36 +89,6 @@ curdel:
     - group: 939
     - mode: 755
 
-so-curatorcloseddeletecron:
- cron.present:
-   - name: /usr/sbin/so-curator-closed-delete > /opt/so/log/curator/cron-closed-delete.log 2>&1
-   - user: root
-   - minute: '*'
-   - hour: '*'
-   - daymonth: '*'
-   - month: '*'
-   - dayweek: '*'
-
-so-curatorclosecron:
- cron.present:
-   - name: /usr/sbin/so-curator-close > /opt/so/log/curator/cron-close.log 2>&1
-   - user: root
-   - minute: '*'
-   - hour: '*'
-   - daymonth: '*'
-   - month: '*'
-   - dayweek: '*'
-
-so-curatordeletecron:
- cron.present:
-   - name: /usr/sbin/so-curator-delete > /opt/so/log/curator/cron-delete.log 2>&1
-   - user: root
-   - minute: '*'
-   - hour: '*'
-   - daymonth: '*'
-   - month: '*'
-   - dayweek: '*'
-
 so-curator:
   docker_container.{{ CURATOROPTIONS.status }}:
   {% if CURATOROPTIONS.status == 'running' %}
@@ -152,12 +123,77 @@ so-curator_so-status.disabled:
   file.comment:
     - name: /opt/so/conf/so-status/so-status.conf
     - regex: ^so-curator$
+
+      # need to remove cronjobs here since curator is disabled
+      {% set REMOVECURATORCRON = True %}    
     {% else %}
 delete_so-curator_so-status.disabled:
   file.uncomment:
     - name: /opt/so/conf/so-status/so-status.conf
     - regex: ^so-curator$
+
     {% endif %}
+
+  {% else %}
+delete_so-curator_so-status:
+  file.line:
+    - name: /opt/so/conf/so-status/so-status.conf
+    - match: ^so-curator$
+    - mode: delete
+
+    # need to remove cronjobs here since curator is disabled
+    {% set REMOVECURATORCRON = True %}
+
+  {% endif %}
+
+  {% if REMOVECURATORCRON %}
+so-curatorcloseddeletecron:
+ cron.absent:
+   - name: /usr/sbin/so-curator-closed-delete > /opt/so/log/curator/cron-closed-delete.log 2>&1
+   - user: root
+
+so-curatorclosecron:
+ cron.absent:
+   - name: /usr/sbin/so-curator-close > /opt/so/log/curator/cron-close.log 2>&1
+   - user: root
+
+so-curatordeletecron:
+ cron.absent:
+   - name: /usr/sbin/so-curator-delete > /opt/so/log/curator/cron-delete.log 2>&1
+   - user: root
+
+  {% else %}
+
+so-curatorcloseddeletecron:
+ cron.present:
+   - name: /usr/sbin/so-curator-closed-delete > /opt/so/log/curator/cron-closed-delete.log 2>&1
+   - user: root
+   - minute: '*'
+   - hour: '*'
+   - daymonth: '*'
+   - month: '*'
+   - dayweek: '*'
+
+so-curatorclosecron:
+ cron.present:
+   - name: /usr/sbin/so-curator-close > /opt/so/log/curator/cron-close.log 2>&1
+   - user: root
+   - minute: '*'
+   - hour: '*'
+   - daymonth: '*'
+   - month: '*'
+   - dayweek: '*'
+
+so-curatordeletecron:
+ cron.present:
+   - name: /usr/sbin/so-curator-delete > /opt/so/log/curator/cron-delete.log 2>&1
+   - user: root
+   - minute: '*'
+   - hour: '*'
+   - daymonth: '*'
+   - month: '*'
+   - dayweek: '*'
+
   {% endif %}
 
 # Begin Curator Cron Jobs

salt/curator/map.jinja

@@ -3,13 +3,13 @@
 {% set TRUECLUSTER = salt['pillar.get']('elasticsearch:true_cluster', False) %}
 {% do CURATOROPTIONS.update({'manage_sostatus': True}) %}
 
-# don't start the docker container if searchnode and true clustering is enabled or curator disabled via pillar or true cluster not enabled and manager
-{% if not ENABLED or (TRUECLUSTER and grains.id.split('_')|last == 'searchnode') or (not TRUECLUSTER and grains.id.split('_')|last == 'manager') %}
+# don't start the docker container if curator is disabled via pillar
+{% if not ENABLED or grains.id.split('_')|last == 'manager'%}
   {% do CURATOROPTIONS.update({'start': False}) %}
   {% do CURATOROPTIONS.update({'status': 'absent'}) %}
-  {% if (TRUECLUSTER and grains.id.split('_')|last == 'searchnode') or (not TRUECLUSTER and grains.id.split('_')|last == 'manager') %}
+  {% if grains.id.split('_')|last == 'manager' %}
     {% do CURATOROPTIONS.update({'manage_sostatus': False}) %}
-  {% endif %}%}
+  {% endif %}
 {% else %}
   {% do CURATOROPTIONS.update({'start': True}) %}
   {% do CURATOROPTIONS.update({'status': 'running'}) %}

salt/grafana/init.sls

@@ -12,16 +12,21 @@
 
 {% if grains['role'] in ['so-manager', 'so-managersearch', 'so-standalone'] or (grains.role == 'so-eval' and GRAFANA == 1) %}
 
+{% set ALLOWED_DASHBOARDS = ['overview', 'standalone', 'manager', 'managersearch', 'sensor', 'searchnode', 'heavynode', 'eval'] %}
 {% set DASHBOARDS = ['overview'] %}
 {% if grains.role == 'so-eval' %}
   {% do DASHBOARDS.append('eval') %}
 {% else %}
   {# Grab a unique listing of nodetypes that exists so that we create only the needed dashboards #}
   {% for dashboard in salt['cmd.shell']("ls /opt/so/saltstack/local/pillar/minions/|awk -F'_' {'print $2'}|awk -F'.' {'print $1'}").split() %}
-    {% do DASHBOARDS.append(dashboard) %}
+    {% if dashboard in ALLOWED_DASHBOARDS %}
+      {% do DASHBOARDS.append(dashboard) %}
+    {% endif %}
   {% endfor %}
 {% endif %}
 
+
+
 # Grafana all the things
 grafanadir:
   file.directory:

salt/telegraf/node_config.json.jinja

@@ -1,6 +1,6 @@
 {
-  "manint": "{{ salt['pillar.get']('host:mainint', '') }}",
 {%- if grains.role in  ['so-standalone', 'so-eval', 'so-sensor', 'so-heavynode', ] %}
-  "monint": "{{ salt['pillar.get']('sensor:interface', '') }}"
-{% endif -%}
+  "monint": "{{ salt['pillar.get']('sensor:interface', '') }}",
+{%- endif %}
+  "manint": "{{ salt['pillar.get']('host:mainint', '') }}"
 }

salt/top.sls

@@ -189,13 +189,13 @@ base:
     {%- if KIBANA %}
     - kibana
     {%- endif %}
-    - curator
     {%- if ELASTALERT %}
     - elastalert
     {%- endif %}
     {%- if FILEBEAT %}
     - filebeat
     {%- endif %}
+    - curator
     - utility
     - schedule
     {%- if FLEETMANAGER or FLEETNODE %}

setup/so-functions

@@ -2795,7 +2795,7 @@ update_sudoers() {
 update_packages() {
 	if [ "$OS" = 'centos' ]; then
 	    yum repolist >> /dev/null
-        yum -y update --exclude=salt* >> "$setup_log"
+        yum -y update --exclude=salt*,wazuh* >> "$setup_log"
 	else
 		retry 50 10 "apt-get -y update" >> "$setup_log" 2>&1 || exit 1
 		retry 50 10 "apt-get -y upgrade" >> "$setup_log" 2>&1 || exit 1