davidcr01
commented
1 year ago Update Report
Context
To solve this issue, some requirements have been satisfied:
- Have a Windows agent. In my case, a Windows Server 2016 provided by
vagrant. - Installed the
pywinrmpackage in my machine. - Configured the Ansible hosts with the following content:
[windows] <ip_address>
[windows:vars] ansible_user=vagrant ansible_password=vagrant ansible_connection=winrm ansible_winrm_server_cert_validation=ignore ansible_ssh_port=5986
- Downloaded the [WinRM configuration script](https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) and executed in the Windows system.
## Development
### Variables
Some new variables have been added to perform this issue, regarding the third task of the issue:
- In `roles/wazuh/vars/repo.yml`:
```yaml
wazuh_winagent_sha512_url: "https://packages.wazuh.com/4.x/checksums/wazuh/{{ wazuh_agent_version }}/wazuh-agent-{{ wazuh_agent_version }}-1.msi.sha512"- In
roles/wazuh/vars/repo_pre-release.yml:wazuh_winagent_sha512_url: "https://packages-dev.wazuh.com/pre-release/checksums/wazuh/{{ wazuh_agent_version }}/wazuh-agent-{{ wazuh_agent_version }}-1.msi.sha512"
New tasks
New tasks have been added to the Windows.yml file. These tasks replace the MD5 verification with the SHA512 verification. Now, the checksum is not hardcoded, but obtained by a downloaded file.
- name: Windows | Download SHA512 checksum file
win_get_url:
url: "{{ wazuh_winagent_sha512_url }}"
dest: "{{ wazuh_winagent_config.download_dir }}"
when:
- wazuh_winagent_config.check_sha512
- name: Extract checksum from SHA512 file
win_shell: Get-Content "{{ wazuh_winagent_config.download_dir }}{{ wazuh_winagent_package_name }}.sha512" | ForEach-Object { $_.Split(' ')[0] }
register: extracted_checksum
when:
- wazuh_winagent_config.check_sha512
- name: Windows | Verify the Wazuh Agent installer
win_stat:
path: "{{ wazuh_winagent_config.download_dir }}{{ wazuh_winagent_package_name }}"
get_checksum: true
checksum_algorithm: sha512
register: wazuh_agent_status
failed_when:
- wazuh_agent_status.stat.checksum != extracted_checksum.stdout_lines[0]
when:
- wazuh_winagent_config.check_sha512
Description
Currently, the Windows agent deployment provides a MD5 check. To update the MD5 checksum we need the package. This causes delays in the
wazuh-ansibletag because we need to update it with the correct value and is error-prone.To avoid this, we need to change the MD5 with the SHA512 that is available in the
packages.wazuh.comandpackages-dev.wazuh.comdepending on the repo used to install the package. e.g.:And perform the check using that file.
Tasks
check_md5andmd5variables and its related Ansible tasks.check_sha512(boolean, default: true) in theroles/wazuh/ansible-wazuh-agent/defaults/main.ymlfile.roles/wazuh/vars/repo.ymlandroles/wazuh/vars/repo_pre-release.ymlfiles.Validation