mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-11-01 18:18:16 +01:00
Mike Reeves
02394acf69
Mount the host trust store into zeek, suricata, tcpreplay, the strelka containers and idh, and restart them when it changes. Point the Python requests clients in strelka-backend and idh at it instead of certifi. Remove the frozen /opt/so/conf/ca bundles from every node in ca.trust rather than only on the manager in soup.
38 lines
1.1 KiB
YAML+Jinja
38 lines
1.1 KiB
YAML+Jinja
# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
|
|
# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
|
|
# https://securityonion.net/license; you may not use this file except in compliance with the
|
|
# Elastic License 2.0.
|
|
|
|
ca_trust_anchor:
|
|
file.managed:
|
|
- name: /etc/pki/ca-trust/source/anchors/so-intca.crt
|
|
- source: salt://ca/files/ca.crt
|
|
- show_changes: False
|
|
- makedirs: True
|
|
|
|
ca_trust_legacy_anchor:
|
|
file.absent:
|
|
- name: /etc/pki/ca-trust/source/anchors/ca.crt
|
|
|
|
ca_trust_legacy_bundles:
|
|
file.absent:
|
|
- name: /opt/so/conf/ca
|
|
|
|
# clean removes blocklist entries that are no longer shipped
|
|
ca_trust_blocklist:
|
|
file.recurse:
|
|
- name: /etc/pki/ca-trust/source/blocklist
|
|
- source: salt://ca/files/blocklist
|
|
- clean: True
|
|
- makedirs: True
|
|
- file_mode: '0644'
|
|
- dir_mode: '0755'
|
|
|
|
ca_trust_extract:
|
|
cmd.run:
|
|
- name: update-ca-trust extract
|
|
- onchanges:
|
|
- file: ca_trust_anchor
|
|
- file: ca_trust_legacy_anchor
|
|
- file: ca_trust_blocklist
|