mirror of
https://github.com/wazuh/wazuh-kubernetes.git
synced 2025-12-10 00:38:21 -06:00
First steps to remove configuration templates of Wazuh
This commit is contained in:
Carlos Bordon
parent
741772f3d9
commit
2cb1d5d708
@ -1,6 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||
cd $DIR
|
||||
|
||||
openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem
|
||||
@ -1,85 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
|
||||
cd $DIR
|
||||
|
||||
echo "Root CA"
|
||||
|
||||
openssl genrsa -out root-ca-key.pem 2048
|
||||
|
||||
openssl req -days 3650 -new -x509 -sha256 -key root-ca-key.pem -out root-ca.pem -subj "/C=US/L=California/O=Company/CN=root-ca"
|
||||
|
||||
echo "Admin cert"
|
||||
|
||||
echo "create: admin-key-temp.pem"
|
||||
|
||||
openssl genrsa -out admin-key-temp.pem 2048
|
||||
|
||||
echo "create: admin-key.pem"
|
||||
|
||||
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
|
||||
|
||||
echo "create: admin.csr"
|
||||
|
||||
openssl req -days 3650 -new -key admin-key.pem -out admin.csr -subj "/C=US/L=California/O=Company/CN=admin"
|
||||
|
||||
echo "create: admin.pem"
|
||||
|
||||
openssl x509 -req -days 3650 -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem
|
||||
|
||||
|
||||
echo "* Node cert"
|
||||
|
||||
echo "create: node-key-temp.pem"
|
||||
|
||||
openssl genrsa -out node-key-temp.pem 2048
|
||||
|
||||
echo "create: node-key.pem"
|
||||
|
||||
openssl pkcs8 -inform PEM -outform PEM -in node-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out node-key.pem
|
||||
|
||||
echo "create: node.csr"
|
||||
|
||||
openssl req -days 3650 -new -key node-key.pem -out node.csr -subj "/C=US/L=California/O=Company/CN=indexer"
|
||||
|
||||
echo "create: node.pem"
|
||||
|
||||
openssl x509 -req -days 3650 -in node.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out node.pem
|
||||
|
||||
echo "* dashboard cert"
|
||||
|
||||
echo "create: dashboard-key-temp.pem"
|
||||
|
||||
openssl genrsa -out dashboard-key-temp.pem 2048
|
||||
|
||||
echo "create: dashboard-key.pem"
|
||||
|
||||
openssl pkcs8 -inform PEM -outform PEM -in dashboard-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out dashboard-key.pem
|
||||
|
||||
echo "create: dashboard.csr"
|
||||
|
||||
openssl req -days 3650 -new -key dashboard-key.pem -out dashboard.csr -subj "/C=US/L=California/O=Company/CN=dashboard"
|
||||
|
||||
echo "create: dashboard.pem"
|
||||
|
||||
openssl x509 -req -days 3650 -in dashboard.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out dashboard.pem
|
||||
|
||||
|
||||
|
||||
echo "* Filebeat cert"
|
||||
|
||||
echo "create: filebeat-key-temp.pem"
|
||||
|
||||
openssl genrsa -out filebeat-key-temp.pem 2048
|
||||
|
||||
echo "create: filebeat-key.pem"
|
||||
|
||||
openssl pkcs8 -inform PEM -outform PEM -in filebeat-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out filebeat-key.pem
|
||||
|
||||
echo "create: filebeat.csr"
|
||||
|
||||
openssl req -days 3650 -new -key filebeat-key.pem -out filebeat.csr -subj "/C=US/L=California/O=Company/CN=filebeat"
|
||||
|
||||
echo "create: filebeat.pem"
|
||||
|
||||
openssl x509 -req -days 3650 -in filebeat.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out filebeat.pem
|
||||
14
wazuh/config.yml
Normal file
14
wazuh/config.yml
Normal file
@ -0,0 +1,14 @@
|
||||
nodes:
|
||||
# Wazuh indexer nodes
|
||||
indexer:
|
||||
- name: indexer
|
||||
ip: "127.0.0.1"
|
||||
|
||||
server:
|
||||
- name: filebeat
|
||||
ip: "127.0.0.1"
|
||||
|
||||
# Wazuh dashboard nodes
|
||||
dashboard:
|
||||
- name: dashboard
|
||||
ip: "127.0.0.1"
|
||||
@ -38,27 +38,23 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
subPath: opensearch_dashboards.yml
|
||||
readOnly: false
|
||||
- name: dashboard-certs
|
||||
mountPath: /usr/share/wazuh-dashboard/certs/cert.pem
|
||||
mountPath: /usr/share/wazuh-dashboard/config/certs/dashboard.pem
|
||||
readOnly: true
|
||||
subPath: cert.pem
|
||||
subPath: dashboard.pem
|
||||
- name: dashboard-certs
|
||||
mountPath: /usr/share/wazuh-dashboard/certs/key.pem
|
||||
mountPath: /usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
|
||||
readOnly: true
|
||||
subPath: key.pem
|
||||
subPath: dashboard-key.pem
|
||||
- name: dashboard-certs
|
||||
mountPath: /usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
mountPath: /usr/share/wazuh-dashboard/config/certs/root-ca.pem
|
||||
subPath: root-ca.pem
|
||||
readOnly: true
|
||||
ports:
|
||||
- containerPort: 5601
|
||||
- containerPort: 443
|
||||
name: dashboard
|
||||
env:
|
||||
- name: INDEXER_URL
|
||||
- name: OPENSEARCH_HOSTS
|
||||
value: 'https://indexer:9200'
|
||||
- name: INDEXER_USERNAME
|
||||
valueFrom:
|
||||
@ -83,11 +79,11 @@ spec:
|
||||
- name: SERVER_SSL_ENABLED
|
||||
value: "true"
|
||||
- name: SERVER_SSL_CERTIFICATE
|
||||
value: /usr/share/wazuh-dashboard/certs/cert.pem
|
||||
value: /usr/share/wazuh-dashboard/config/certs/dashboard.pem
|
||||
- name: SERVER_SSL_KEY
|
||||
value: /usr/share/wazuh-dashboard/certs/key.pem
|
||||
value: /usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
|
||||
- name: WAZUH_API_URL
|
||||
value: https://wazuh-manager-master-0.wazuh-cluster
|
||||
value: https://wazuh-manager-master-0.wazuh
|
||||
- name: API_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
|
||||
@ -27,4 +27,4 @@ spec:
|
||||
ports:
|
||||
- name: dashboard
|
||||
port: 443
|
||||
targetPort: 5601
|
||||
targetPort: 443
|
||||
|
||||
@ -1,17 +0,0 @@
|
||||
|
||||
server.host: 0.0.0.0
|
||||
server.port: 5601
|
||||
opensearch.hosts: https://indexer:9200
|
||||
opensearch.ssl.verificationMode: none
|
||||
opensearch.requestHeadersAllowlist: [ authorization,securitytenant ]
|
||||
opensearch_security.multitenancy.enabled: false
|
||||
opensearch_security.readonly_mode.roles: ["kibana_read_only"]
|
||||
server.ssl.enabled: true
|
||||
server.ssl.key: "/usr/share/wazuh-dashboard/certs/key.pem"
|
||||
server.ssl.certificate: "/usr/share/wazuh-dashboard/certs/cert.pem"
|
||||
opensearch.ssl.certificateAuthorities: ["/usr/share/wazuh-dashboard/certs/root-ca.pem"]
|
||||
uiSettings.overrides.defaultRoute: /app/wz-home
|
||||
# Session expiration settings
|
||||
opensearch_security.cookie.ttl: 900000
|
||||
opensearch_security.session.ttl: 900000
|
||||
opensearch_security.session.keepalive: true
|
||||
@ -32,10 +32,6 @@ spec:
|
||||
secret:
|
||||
secretName: indexer-certs
|
||||
defaultMode: 0600
|
||||
- name: indexer-conf
|
||||
configMap:
|
||||
name: indexer-conf
|
||||
defaultMode: 0600
|
||||
initContainers:
|
||||
- name: volume-mount-hack
|
||||
image: busybox
|
||||
@ -69,16 +65,22 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1564Mi
|
||||
env:
|
||||
- name: bootstrap.memory_lock
|
||||
value: "true"
|
||||
- name: cluster.name
|
||||
value: wazuh
|
||||
- name: network.host
|
||||
value: "0.0.0.0"
|
||||
- name: node.name
|
||||
value: wazuh-indexer-0
|
||||
- name: cluster.initial_cluster_manager_nodes
|
||||
value: wazuh-indexer-0
|
||||
- name: plugins.security.allow_default_init_securityindex
|
||||
value: "true"
|
||||
- name: NODES_DN
|
||||
value: CN=wazuh-indexer-0,OU=Wazuh,O=Wazuh,L=California,C=US
|
||||
- name: OPENSEARCH_JAVA_OPTS
|
||||
value: '-Xms1g -Xmx1g -Dlog4j2.formatMsgNoLookups=true'
|
||||
- name: CLUSTER_NAME
|
||||
value: wazuh
|
||||
- name: NETWORK_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: DISCOVERY_SERVICE
|
||||
value: wazuh-indexer
|
||||
- name: KUBERNETES_NAMESPACE
|
||||
@ -96,12 +98,12 @@ spec:
|
||||
- name: wazuh-indexer
|
||||
mountPath: /var/lib/wazuh-indexer
|
||||
- name: indexer-certs
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/node-key.pem
|
||||
subPath: node-key.pem
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/indexer-key.pem
|
||||
subPath: indexer-key.pem
|
||||
readOnly: true
|
||||
- name: indexer-certs
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/node.pem
|
||||
subPath: node.pem
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/indexer.pem
|
||||
subPath: indexer.pem
|
||||
readOnly: true
|
||||
- name: indexer-certs
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
@ -115,14 +117,6 @@ spec:
|
||||
mountPath: /usr/share/wazuh-indexer/config/certs/admin-key.pem
|
||||
subPath: admin-key.pem
|
||||
readOnly: true
|
||||
- name: indexer-conf
|
||||
mountPath: /usr/share/wazuh-indexer/config/opensearch.yml
|
||||
subPath: opensearch.yml
|
||||
readOnly: true
|
||||
- name: indexer-conf
|
||||
mountPath: /usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
|
||||
subPath: internal_users.yml
|
||||
readOnly: true
|
||||
ports:
|
||||
- containerPort: 9200
|
||||
name: indexer-rest
|
||||
|
||||
@ -1,56 +0,0 @@
|
||||
---
|
||||
# This is the internal user database
|
||||
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
|
||||
|
||||
_meta:
|
||||
type: "internalusers"
|
||||
config_version: 2
|
||||
|
||||
# Define your internal users here
|
||||
|
||||
## Demo users
|
||||
|
||||
admin:
|
||||
hash: "$2y$12$K/SpwjtB.wOHJ/Nc6GVRDuc1h0rM1DfvziFRNPtk27P.c4yDr9njO"
|
||||
reserved: true
|
||||
backend_roles:
|
||||
- "admin"
|
||||
description: "Demo admin user"
|
||||
|
||||
kibanaserver:
|
||||
hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
|
||||
reserved: true
|
||||
description: "Demo kibanaserver user"
|
||||
|
||||
kibanaro:
|
||||
hash: "$2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "kibanauser"
|
||||
- "readall"
|
||||
attributes:
|
||||
attribute1: "value1"
|
||||
attribute2: "value2"
|
||||
attribute3: "value3"
|
||||
description: "Demo kibanaro user"
|
||||
|
||||
logstash:
|
||||
hash: "$2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "logstash"
|
||||
description: "Demo logstash user"
|
||||
|
||||
readall:
|
||||
hash: "$2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "readall"
|
||||
description: "Demo readall user"
|
||||
|
||||
snapshotrestore:
|
||||
hash: "$2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W"
|
||||
reserved: false
|
||||
backend_roles:
|
||||
- "snapshotrestore"
|
||||
description: "Demo snapshotrestore user"
|
||||
@ -1,30 +0,0 @@
|
||||
cluster.name: ${CLUSTER_NAME}
|
||||
node.name: ${NODE_NAME}
|
||||
network.host: ${NETWORK_HOST}
|
||||
discovery.seed_hosts: wazuh-indexer-0.wazuh-indexer
|
||||
cluster.initial_cluster_manager_nodes:
|
||||
- wazuh-indexer-0
|
||||
|
||||
node.max_local_storage_nodes: "3"
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/node.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/node-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/config/certs/node.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/config/certs/node-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/config/certs/root-ca.pem
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.transport.resolve_hostname: false
|
||||
plugins.security.authcz.admin_dn:
|
||||
- CN=admin,O=Company,L=California,C=US
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.nodes_dn:
|
||||
- CN=indexer,O=Company,L=California,C=US
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
cluster.routing.allocation.disk.threshold_enabled: false
|
||||
@ -14,33 +14,20 @@ namespace: wazuh
|
||||
secretGenerator:
|
||||
- name: indexer-certs
|
||||
files:
|
||||
- certs/indexer_cluster/root-ca.pem
|
||||
- certs/indexer_cluster/node.pem
|
||||
- certs/indexer_cluster/node-key.pem
|
||||
- certs/indexer_cluster/dashboard.pem
|
||||
- certs/indexer_cluster/dashboard-key.pem
|
||||
- certs/indexer_cluster/admin.pem
|
||||
- certs/indexer_cluster/admin-key.pem
|
||||
- certs/indexer_cluster/filebeat.pem
|
||||
- certs/indexer_cluster/filebeat-key.pem
|
||||
- wazuh-certificates/root-ca.pem
|
||||
- wazuh-certificates/indexer.pem
|
||||
- wazuh-certificates/indexer-key.pem
|
||||
- wazuh-certificates/dashboard.pem
|
||||
- wazuh-certificates/dashboard-key.pem
|
||||
- wazuh-certificates/admin.pem
|
||||
- wazuh-certificates/admin-key.pem
|
||||
- wazuh-certificates/filebeat.pem
|
||||
- wazuh-certificates/filebeat-key.pem
|
||||
- name: dashboard-certs
|
||||
files:
|
||||
- certs/dashboard_http/cert.pem
|
||||
- certs/dashboard_http/key.pem
|
||||
- certs/indexer_cluster/root-ca.pem
|
||||
|
||||
configMapGenerator:
|
||||
- name: indexer-conf
|
||||
files:
|
||||
- indexer_stack/wazuh-indexer/indexer_conf/opensearch.yml
|
||||
- indexer_stack/wazuh-indexer/indexer_conf/internal_users.yml
|
||||
- name: wazuh-conf
|
||||
files:
|
||||
- wazuh_managers/wazuh_conf/master.conf
|
||||
- wazuh_managers/wazuh_conf/worker.conf
|
||||
- name: dashboard-conf
|
||||
files:
|
||||
- indexer_stack/wazuh-dashboard/dashboard_conf/opensearch_dashboards.yml
|
||||
- wazuh-certificates/dashboard.pem
|
||||
- wazuh-certificates/dashboard-key.pem
|
||||
- wazuh-certificates/root-ca.pem
|
||||
|
||||
resources:
|
||||
- base/wazuh-ns.yaml
|
||||
|
||||
@ -12,5 +12,5 @@ kind: Secret
|
||||
metadata:
|
||||
name: indexer-cred
|
||||
data:
|
||||
username: YWRtaW4= # string "admin" base64 encoded
|
||||
password: U2VjcmV0UGFzc3dvcmQ= # string "SecretPassword" base64 encoded
|
||||
username: YWRtaW4= # string "admin" base64 encoded
|
||||
password: YWRtaW4= # string "admin" base64 encoded
|
||||
|
||||
@ -13,5 +13,5 @@ metadata:
|
||||
name: wazuh-api-cred
|
||||
namespace: wazuh
|
||||
data:
|
||||
username: d2F6dWgtd3Vp # string "wazuh-wui" base64 encoded
|
||||
username: d2F6dWgtd3Vp # string "wazuh-wui" base64 encoded
|
||||
password: TXlTM2NyMzdQNDUwci4qLQ== # string "MyS3cr37P450r.*-" base64 encoded
|
||||
|
||||
@ -28,9 +28,6 @@ spec:
|
||||
name: wazuh-manager-master
|
||||
spec:
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: wazuh-conf
|
||||
- name: filebeat-certs
|
||||
secret:
|
||||
secretName: indexer-certs
|
||||
@ -50,10 +47,6 @@ spec:
|
||||
capabilities:
|
||||
add: ["SYS_CHROOT"]
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /wazuh-config-mount/etc/ossec.conf
|
||||
subPath: master.conf
|
||||
readOnly: true
|
||||
- name: filebeat-certs
|
||||
mountPath: /etc/ssl/root-ca.pem
|
||||
readOnly: true
|
||||
|
||||
@ -38,9 +38,6 @@ spec:
|
||||
app: wazuh-manager
|
||||
node-type: worker
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: wazuh-conf
|
||||
- name: filebeat-certs
|
||||
secret:
|
||||
secretName: indexer-certs
|
||||
@ -57,10 +54,6 @@ spec:
|
||||
capabilities:
|
||||
add: ["SYS_CHROOT"]
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /wazuh-config-mount/etc/ossec.conf
|
||||
subPath: worker.conf
|
||||
readOnly: true
|
||||
- name: filebeat-certs
|
||||
mountPath: /etc/ssl/root-ca.pem
|
||||
readOnly: true
|
||||
|
||||
@ -1,324 +0,0 @@
|
||||
<!--
|
||||
Wazuh - Manager - Default configuration for ubuntu 16.04
|
||||
More info at: https://documentation.wazuh.com
|
||||
Mailing list: https://groups.google.com/forum/#!forum/wazuh
|
||||
|
||||
Customization: TCP on port 1514
|
||||
Customization: Cluster mode enabled, master node
|
||||
-->
|
||||
<ossec_config>
|
||||
<global>
|
||||
<jsonout_output>yes</jsonout_output>
|
||||
<alerts_log>yes</alerts_log>
|
||||
<logall>no</logall>
|
||||
<logall_json>no</logall_json>
|
||||
<email_notification>no</email_notification>
|
||||
<smtp_server>smtp.example.wazuh.com</smtp_server>
|
||||
<email_from>ossecm@example.wazuh.com</email_from>
|
||||
<email_to>recipient@example.wazuh.com</email_to>
|
||||
<email_maxperhour>12</email_maxperhour>
|
||||
<email_log_source>alerts.log</email_log_source>
|
||||
<queue_size>131072</queue_size>
|
||||
<agents_disconnection_time>20s</agents_disconnection_time>
|
||||
<agents_disconnection_alert_time>100s</agents_disconnection_alert_time>
|
||||
</global>
|
||||
|
||||
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
||||
<logging>
|
||||
<log_format>plain</log_format>
|
||||
</logging>
|
||||
|
||||
<remote>
|
||||
<connection>secure</connection>
|
||||
<port>1514</port>
|
||||
<protocol>tcp</protocol>
|
||||
<queue_size>131072</queue_size>
|
||||
</remote>
|
||||
|
||||
<!-- Policy monitoring -->
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_unixaudit>yes</check_unixaudit>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>/var/ossec/etc/rootcheck/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>/var/ossec/etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
||||
|
||||
<system_audit>/var/ossec/etc/rootcheck/system_audit_rcl.txt</system_audit>
|
||||
<system_audit>/var/ossec/etc/rootcheck/system_audit_ssh.txt</system_audit>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<wodle name="open-scap">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
</wodle>
|
||||
|
||||
<wodle name="cis-cat">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
|
||||
<java_path>wodles/java</java_path>
|
||||
<ciscat_path>wodles/ciscat</ciscat_path>
|
||||
</wodle>
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>yes</disabled>
|
||||
<run_daemon>yes</run_daemon>
|
||||
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
||||
<config_path>/etc/osquery/osquery.conf</config_path>
|
||||
<add_labels>yes</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>no</disabled>
|
||||
<interval>1h</interval>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<hardware>yes</hardware>
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<processes>yes</processes>
|
||||
</wodle>
|
||||
|
||||
<vulnerability-detection>
|
||||
<enabled>yes</enabled>
|
||||
<index-status>yes</index-status>
|
||||
<feed-update-interval>60m</feed-update-interval>
|
||||
</vulnerability-detection>
|
||||
|
||||
<indexer>
|
||||
<enabled>yes</enabled>
|
||||
<hosts>
|
||||
<host>https://indexer:9200</host>
|
||||
</hosts>
|
||||
<ssl>
|
||||
<certificate_authorities>
|
||||
<ca>/etc/ssl/root-ca.pem</ca>
|
||||
</certificate_authorities>
|
||||
<certificate>/etc/ssl/filebeat.pem</certificate>
|
||||
<key>/etc/ssl/filebeat.key</key>
|
||||
</ssl>
|
||||
</indexer>
|
||||
|
||||
<!-- File integrity monitoring -->
|
||||
<syscheck>
|
||||
<disabled>no</disabled>
|
||||
|
||||
<!-- Frequency that syscheck is executed default every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
|
||||
<!-- Generate alert when new file detected -->
|
||||
<alert_new_files>yes</alert_new_files>
|
||||
|
||||
<!-- Don't ignore files that change more than 'frequency' times -->
|
||||
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
|
||||
<directories check_all="yes">/bin,/sbin,/boot</directories>
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
<ignore>/etc/mtab</ignore>
|
||||
<ignore>/etc/hosts.deny</ignore>
|
||||
<ignore>/etc/mail/statistics</ignore>
|
||||
<ignore>/etc/random-seed</ignore>
|
||||
<ignore>/etc/random.seed</ignore>
|
||||
<ignore>/etc/adjtime</ignore>
|
||||
<ignore>/etc/httpd/logs</ignore>
|
||||
<ignore>/etc/utmpx</ignore>
|
||||
<ignore>/etc/wtmpx</ignore>
|
||||
<ignore>/etc/cups/certs</ignore>
|
||||
<ignore>/etc/dumpdates</ignore>
|
||||
<ignore>/etc/svc/volatile</ignore>
|
||||
<ignore>/sys/kernel/security</ignore>
|
||||
<ignore>/sys/kernel/debug</ignore>
|
||||
|
||||
<!-- Check the file, but never compute the diff -->
|
||||
<nodiff>/etc/ssl/private.key</nodiff>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
|
||||
<!-- Remove not monitored files -->
|
||||
<remove_old_diff>yes</remove_old_diff>
|
||||
|
||||
<!-- Allow the system to restart Auditd after installing the plugin -->
|
||||
<restart_audit>yes</restart_audit>
|
||||
</syscheck>
|
||||
|
||||
<!-- Active response -->
|
||||
<global>
|
||||
<white_list>127.0.0.1</white_list>
|
||||
<white_list>^localhost.localdomain$</white_list>
|
||||
<white_list>10.66.0.2</white_list>
|
||||
</global>
|
||||
|
||||
<command>
|
||||
<name>disable-account</name>
|
||||
<executable>disable-account.sh</executable>
|
||||
<expect>user</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>restart-ossec</name>
|
||||
<executable>restart-ossec.sh</executable>
|
||||
<expect></expect>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>firewall-drop</name>
|
||||
<executable>firewall-drop</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>host-deny</name>
|
||||
<executable>host-deny.sh</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>route-null</name>
|
||||
<executable>route-null.sh</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>win_route-null</name>
|
||||
<executable>route-null.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>win_route-null-2012</name>
|
||||
<executable>route-null-2012.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>netsh</name>
|
||||
<executable>netsh.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>netsh-win-2016</name>
|
||||
<executable>netsh-win-2016.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<!--
|
||||
<active-response>
|
||||
active-response options here
|
||||
</active-response>
|
||||
-->
|
||||
|
||||
<!-- Log analysis -->
|
||||
<localfile>
|
||||
<log_format>command</log_format>
|
||||
<command>df -P</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
||||
<alias>netstat listening ports</alias>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>last -n 20</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<ruleset>
|
||||
<!-- Default ruleset -->
|
||||
<decoder_dir>ruleset/decoders</decoder_dir>
|
||||
<rule_dir>ruleset/rules</rule_dir>
|
||||
<rule_exclude>0215-policy_rules.xml</rule_exclude>
|
||||
<list>etc/lists/audit-keys</list>
|
||||
<list>etc/lists/amazon/aws-sources</list>
|
||||
<list>etc/lists/amazon/aws-eventnames</list>
|
||||
<list>etc/lists/malicious-ioc/malicious-ip</list>
|
||||
<list>etc/lists/malicious-ioc/malicious-domains</list>
|
||||
<list>etc/lists/malicious-ioc/malware-hashes</list>
|
||||
|
||||
<!-- User-defined ruleset -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
</ruleset>
|
||||
|
||||
<!-- Configuration for ossec-authd
|
||||
To enable this service, run:
|
||||
wazuh-control enable auth
|
||||
-->
|
||||
<auth>
|
||||
<disabled>no</disabled>
|
||||
<port>1515</port>
|
||||
<use_source_ip>no</use_source_ip>
|
||||
<force>
|
||||
<enabled>yes</enabled>
|
||||
<key_mismatch>yes</key_mismatch>
|
||||
<disconnected_time enabled="yes">1h</disconnected_time>
|
||||
<after_registration_time>1h</after_registration_time>
|
||||
</force>
|
||||
<purge>no</purge>
|
||||
<use_password>yes</use_password>
|
||||
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
||||
<!-- <ssl_agent_ca></ssl_agent_ca> -->
|
||||
<ssl_verify_host>no</ssl_verify_host>
|
||||
<ssl_manager_cert>/var/ossec/etc/sslmanager.cert</ssl_manager_cert>
|
||||
<ssl_manager_key>/var/ossec/etc/sslmanager.key</ssl_manager_key>
|
||||
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
||||
</auth>
|
||||
|
||||
<cluster>
|
||||
<name>wazuh</name>
|
||||
<node_name>wazuh-manager-master</node_name>
|
||||
<node_type>master</node_type>
|
||||
<key>to_be_replaced_by_cluster_key</key>
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>wazuh-manager-master-0.wazuh-cluster.wazuh</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>no</disabled>
|
||||
</cluster>
|
||||
</ossec_config>
|
||||
|
||||
<ossec_config>
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/ossec/logs/active-responses.log</location>
|
||||
</localfile>
|
||||
|
||||
</ossec_config>
|
||||
@ -1,324 +0,0 @@
|
||||
<!--
|
||||
Wazuh - Manager - Default configuration for ubuntu 16.04
|
||||
More info at: https://documentation.wazuh.com
|
||||
Mailing list: https://groups.google.com/forum/#!forum/wazuh
|
||||
|
||||
Customization: TCP on port 1514
|
||||
Customization: Cluster mode enabled, worker node
|
||||
-->
|
||||
<ossec_config>
|
||||
<global>
|
||||
<jsonout_output>yes</jsonout_output>
|
||||
<alerts_log>yes</alerts_log>
|
||||
<logall>no</logall>
|
||||
<logall_json>no</logall_json>
|
||||
<email_notification>no</email_notification>
|
||||
<smtp_server>smtp.example.wazuh.com</smtp_server>
|
||||
<email_from>ossecm@example.wazuh.com</email_from>
|
||||
<email_to>recipient@example.wazuh.com</email_to>
|
||||
<email_maxperhour>12</email_maxperhour>
|
||||
<email_log_source>alerts.log</email_log_source>
|
||||
<queue_size>131072</queue_size>
|
||||
<agents_disconnection_time>20s</agents_disconnection_time>
|
||||
<agents_disconnection_alert_time>100s</agents_disconnection_alert_time>
|
||||
</global>
|
||||
|
||||
<!-- Choose between "plain", "json", or "plain,json" for the format of internal logs -->
|
||||
<logging>
|
||||
<log_format>plain</log_format>
|
||||
</logging>
|
||||
|
||||
<remote>
|
||||
<connection>secure</connection>
|
||||
<port>1514</port>
|
||||
<protocol>tcp</protocol>
|
||||
<queue_size>131072</queue_size>
|
||||
</remote>
|
||||
|
||||
<!-- Policy monitoring -->
|
||||
<rootcheck>
|
||||
<disabled>no</disabled>
|
||||
<check_unixaudit>yes</check_unixaudit>
|
||||
<check_files>yes</check_files>
|
||||
<check_trojans>yes</check_trojans>
|
||||
<check_dev>yes</check_dev>
|
||||
<check_sys>yes</check_sys>
|
||||
<check_pids>yes</check_pids>
|
||||
<check_ports>yes</check_ports>
|
||||
<check_if>yes</check_if>
|
||||
|
||||
<!-- Frequency that rootcheck is executed - every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<rootkit_files>/var/ossec/etc/rootcheck/rootkit_files.txt</rootkit_files>
|
||||
<rootkit_trojans>/var/ossec/etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
||||
|
||||
<system_audit>/var/ossec/etc/rootcheck/system_audit_rcl.txt</system_audit>
|
||||
<system_audit>/var/ossec/etc/rootcheck/system_audit_ssh.txt</system_audit>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
</rootcheck>
|
||||
|
||||
<wodle name="open-scap">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
</wodle>
|
||||
|
||||
<wodle name="cis-cat">
|
||||
<disabled>yes</disabled>
|
||||
<timeout>1800</timeout>
|
||||
<interval>1d</interval>
|
||||
<scan-on-start>yes</scan-on-start>
|
||||
|
||||
<java_path>wodles/java</java_path>
|
||||
<ciscat_path>wodles/ciscat</ciscat_path>
|
||||
</wodle>
|
||||
|
||||
<!-- Osquery integration -->
|
||||
<wodle name="osquery">
|
||||
<disabled>yes</disabled>
|
||||
<run_daemon>yes</run_daemon>
|
||||
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
||||
<config_path>/etc/osquery/osquery.conf</config_path>
|
||||
<add_labels>yes</add_labels>
|
||||
</wodle>
|
||||
|
||||
<!-- System inventory -->
|
||||
<wodle name="syscollector">
|
||||
<disabled>no</disabled>
|
||||
<interval>1h</interval>
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
<hardware>yes</hardware>
|
||||
<os>yes</os>
|
||||
<network>yes</network>
|
||||
<packages>yes</packages>
|
||||
<ports all="yes">yes</ports>
|
||||
<processes>yes</processes>
|
||||
</wodle>
|
||||
|
||||
<vulnerability-detection>
|
||||
<enabled>yes</enabled>
|
||||
<index-status>yes</index-status>
|
||||
<feed-update-interval>60m</feed-update-interval>
|
||||
</vulnerability-detection>
|
||||
|
||||
<indexer>
|
||||
<enabled>yes</enabled>
|
||||
<hosts>
|
||||
<host>https://indexer:9200</host>
|
||||
</hosts>
|
||||
<ssl>
|
||||
<certificate_authorities>
|
||||
<ca>/etc/ssl/root-ca.pem</ca>
|
||||
</certificate_authorities>
|
||||
<certificate>/etc/ssl/filebeat.pem</certificate>
|
||||
<key>/etc/ssl/filebeat.key</key>
|
||||
</ssl>
|
||||
</indexer>
|
||||
|
||||
<!-- File integrity monitoring -->
|
||||
<syscheck>
|
||||
<disabled>no</disabled>
|
||||
|
||||
<!-- Frequency that syscheck is executed default every 12 hours -->
|
||||
<frequency>43200</frequency>
|
||||
|
||||
<scan_on_start>yes</scan_on_start>
|
||||
|
||||
<!-- Generate alert when new file detected -->
|
||||
<alert_new_files>yes</alert_new_files>
|
||||
|
||||
<!-- Don't ignore files that change more than 'frequency' times -->
|
||||
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
||||
|
||||
<!-- Directories to check (perform all possible verifications) -->
|
||||
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
|
||||
<directories check_all="yes">/bin,/sbin,/boot</directories>
|
||||
|
||||
<!-- Files/directories to ignore -->
|
||||
<ignore>/etc/mtab</ignore>
|
||||
<ignore>/etc/hosts.deny</ignore>
|
||||
<ignore>/etc/mail/statistics</ignore>
|
||||
<ignore>/etc/random-seed</ignore>
|
||||
<ignore>/etc/random.seed</ignore>
|
||||
<ignore>/etc/adjtime</ignore>
|
||||
<ignore>/etc/httpd/logs</ignore>
|
||||
<ignore>/etc/utmpx</ignore>
|
||||
<ignore>/etc/wtmpx</ignore>
|
||||
<ignore>/etc/cups/certs</ignore>
|
||||
<ignore>/etc/dumpdates</ignore>
|
||||
<ignore>/etc/svc/volatile</ignore>
|
||||
<ignore>/sys/kernel/security</ignore>
|
||||
<ignore>/sys/kernel/debug</ignore>
|
||||
|
||||
<!-- Check the file, but never compute the diff -->
|
||||
<nodiff>/etc/ssl/private.key</nodiff>
|
||||
|
||||
<skip_nfs>yes</skip_nfs>
|
||||
|
||||
<!-- Remove not monitored files -->
|
||||
<remove_old_diff>yes</remove_old_diff>
|
||||
|
||||
<!-- Allow the system to restart Auditd after installing the plugin -->
|
||||
<restart_audit>yes</restart_audit>
|
||||
</syscheck>
|
||||
|
||||
<!-- Active response -->
|
||||
<global>
|
||||
<white_list>127.0.0.1</white_list>
|
||||
<white_list>^localhost.localdomain$</white_list>
|
||||
<white_list>10.66.0.2</white_list>
|
||||
</global>
|
||||
|
||||
<command>
|
||||
<name>disable-account</name>
|
||||
<executable>disable-account.sh</executable>
|
||||
<expect>user</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>restart-ossec</name>
|
||||
<executable>restart-ossec.sh</executable>
|
||||
<expect></expect>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>firewall-drop</name>
|
||||
<executable>firewall-drop</executable>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>host-deny</name>
|
||||
<executable>host-deny.sh</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>route-null</name>
|
||||
<executable>route-null.sh</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>win_route-null</name>
|
||||
<executable>route-null.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>win_route-null-2012</name>
|
||||
<executable>route-null-2012.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>netsh</name>
|
||||
<executable>netsh.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<command>
|
||||
<name>netsh-win-2016</name>
|
||||
<executable>netsh-win-2016.cmd</executable>
|
||||
<expect>srcip</expect>
|
||||
<timeout_allowed>yes</timeout_allowed>
|
||||
</command>
|
||||
|
||||
<!--
|
||||
<active-response>
|
||||
active-response options here
|
||||
</active-response>
|
||||
-->
|
||||
|
||||
<!-- Log analysis -->
|
||||
<localfile>
|
||||
<log_format>command</log_format>
|
||||
<command>df -P</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>netstat -tulpn | sed 's/\([[:alnum:]]\+\)\ \+[[:digit:]]\+\ \+[[:digit:]]\+\ \+\(.*\):\([[:digit:]]*\)\ \+\([0-9\.\:\*]\+\).\+\ \([[:digit:]]*\/[[:alnum:]\-]*\).*/\1 \2 == \3 == \4 \5/' | sort -k 4 -g | sed 's/ == \(.*\) ==/:\1/' | sed 1,2d</command>
|
||||
<alias>netstat listening ports</alias>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<localfile>
|
||||
<log_format>full_command</log_format>
|
||||
<command>last -n 20</command>
|
||||
<frequency>360</frequency>
|
||||
</localfile>
|
||||
|
||||
<ruleset>
|
||||
<!-- Default ruleset -->
|
||||
<decoder_dir>ruleset/decoders</decoder_dir>
|
||||
<rule_dir>ruleset/rules</rule_dir>
|
||||
<rule_exclude>0215-policy_rules.xml</rule_exclude>
|
||||
<list>etc/lists/audit-keys</list>
|
||||
<list>etc/lists/amazon/aws-sources</list>
|
||||
<list>etc/lists/amazon/aws-eventnames</list>
|
||||
<list>etc/lists/malicious-ioc/malicious-ip</list>
|
||||
<list>etc/lists/malicious-ioc/malicious-domains</list>
|
||||
<list>etc/lists/malicious-ioc/malware-hashes</list>
|
||||
|
||||
<!-- User-defined ruleset -->
|
||||
<decoder_dir>etc/decoders</decoder_dir>
|
||||
<rule_dir>etc/rules</rule_dir>
|
||||
</ruleset>
|
||||
|
||||
<!-- Configuration for ossec-authd
|
||||
To enable this service, run:
|
||||
wazuh-control enable auth
|
||||
-->
|
||||
<auth>
|
||||
<disabled>no</disabled>
|
||||
<port>1515</port>
|
||||
<use_source_ip>no</use_source_ip>
|
||||
<force>
|
||||
<enabled>yes</enabled>
|
||||
<key_mismatch>yes</key_mismatch>
|
||||
<disconnected_time enabled="yes">1h</disconnected_time>
|
||||
<after_registration_time>1h</after_registration_time>
|
||||
</force>
|
||||
<purge>no</purge>
|
||||
<use_password>yes</use_password>
|
||||
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
||||
<!-- <ssl_agent_ca></ssl_agent_ca> -->
|
||||
<ssl_verify_host>no</ssl_verify_host>
|
||||
<ssl_manager_cert>/var/ossec/etc/sslmanager.cert</ssl_manager_cert>
|
||||
<ssl_manager_key>/var/ossec/etc/sslmanager.key</ssl_manager_key>
|
||||
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
||||
</auth>
|
||||
|
||||
<cluster>
|
||||
<name>wazuh</name>
|
||||
<node_name>to_be_replaced_by_hostname</node_name>
|
||||
<node_type>worker</node_type>
|
||||
<key>to_be_replaced_by_cluster_key</key>
|
||||
<port>1516</port>
|
||||
<bind_addr>0.0.0.0</bind_addr>
|
||||
<nodes>
|
||||
<node>wazuh-manager-master-0.wazuh-cluster.wazuh</node>
|
||||
</nodes>
|
||||
<hidden>no</hidden>
|
||||
<disabled>no</disabled>
|
||||
</cluster>
|
||||
</ossec_config>
|
||||
|
||||
<ossec_config>
|
||||
<localfile>
|
||||
<log_format>syslog</log_format>
|
||||
<location>/var/ossec/logs/active-responses.log</location>
|
||||
</localfile>
|
||||
|
||||
</ossec_config>
|
||||
Loading…
x
Reference in New Issue
Block a user