search

wazuh / wazuh-dashboard-plugins

Plugins for Wazuh Dashboard
https://wazuh.com/
GNU General Public License v2.0
432 stars 177 forks source link

Wazuh dashboard prints IPv6 link-local addresses instead of other (most preferrable IP addresses) #5705

Open fernandogont opened 1 year ago

fernandogont commented 1 year ago
Wazuh Elastic Rev Security
4.4.5-1 7.x 4xxx Basic
Browser
Chrome

Description When listing agents in the wazuh-dashboard, in a lot of cases the dashboard will list the link-local IPv6 address of the node.

IPv6 link-local addresses are the most meaningless addresses of a host, since they are only valid on a local subnet, and must be used/accompanied with the corresponding interface index for the link-local address to be meaningful.

Preconditions

Wazuh agent has IPv6 support.

Steps to reproduce

Expected Result

Wazuh dashboard should probably order the host addresses, and list/show the address with the highest priority. Priorities could be, for example,:

  1. IPv6 global addresses
  2. IPv4 public addresses
  3. IPv6 ULAs
  4. IPv4 private addresses
  5. IPv6 link-local addresses
  6. IPv4 link-local addresses

If a system has multiple addresses, the dashboard should show one with the highest priority in the sample list above.

Actual Result

Wazuh dashboard quite often shows the IPv6 link-local address of the host.

sempervictus commented 1 year ago

Thanks for linking this @vikman90 - just to clarify a bit, is the determination to show the agent's address as IPv6 happening in Kibana, or is this specifically the task to deal with the visual representation of that selected address? All for getting the aesthetics worked out, just want to make sure the functional aspect of agent/framework interactions is not lost in the churn given that rules and scripts can depend on that address being IPv4.

vikman90 commented 1 year ago

@sempervictus The determination of the agent's IP must happen in each agent.

The agent sends its IP address within the notify (keepalive-like) message. The manager is limited to storing it in the database (schema_global.sql). Later, Wazuh Dashboard (Kibana) runs the GET /agents API endpoint to retrieve the list of agents.

The agent can inventory its network interfaces and determine which one is the default or the one that connects to the manager.

Best regards.