f-galland
commented
8 months ago .deb Package content validation:
Tests were run using pkgdiff:
pkgdiff wazuh-indexer_4.7.1-1_amd64.deb wazuh-indexer_4.9.0_amd64.debClosed AlexRuiz7 closed 8 months ago
f-galland
commented
8 months ago .deb Package content validation:Tests were run using pkgdiff:
pkgdiff wazuh-indexer_4.7.1-1_amd64.deb wazuh-indexer_4.9.0_amd64.deb.rpm Packages validation:Tests were run using pkgdiff:
pkgdiff wazuh-indexer-4.7.1-1.x86_64.rpm wazuh-indexer-4.9.0-1.x86_64.rpm.deb package install:Errors are thrown during installation on Ubuntu 22.04:
/usr/lib/tmpfiles.d/wazuh-indexer.conf:1: Failed to resolve user 'wazuh-indexer': No such process
Processing triggers for libc-bin (2.35-0ubuntu3.1) ...
Processing triggers for man-db (2.10.2-1) ...
needrestart is being skipped since dpkg has failedStep 2, section on deploying certificates from the step-by-step installation guide fails 🔴
root@pkg-tests-ubuntu2204:~# mkdir /etc/wazuh-indexer/certs
tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
chmod 500 /etc/wazuh-indexer/certs
chmod 400 /etc/wazuh-indexer/certs/*
chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
chown: invalid user: ‘wazuh-indexer:wazuh-indexer’The service cannot be started due to lack of a wazuh-indexer user's credentials:
Jan 08 10:45:41 pkg-tests-ubuntu2204 systemd[34965]: wazuh-indexer.service: Failed to determine user credentials: No such process
Jan 08 10:45:41 pkg-tests-ubuntu2204 systemd[34965]: wazuh-indexer.service: Failed at step USER spawning /usr/share/wazuh-indexer/bin/systemd-entrypoint: No such process.rpm package install:After following the steps of the step-by-step installation guide:
[root@alma8 ~]# rpm -i wazuh-indexer-4.9.0-1.x86_64.rpm
warning: %post(wazuh-indexer-4.9.0-1.x86_64) scriptlet failed, exit status 255
[/usr/lib/tmpfiles.d/wazuh-indexer.conf:1] Line references path below legacy directory /var/run/, updating /var/run/wazuh-indexer → /run/wazuh-indexer; please update the tmpfiles.d/ drop-in file accordingly.Wazuh indexer installed service 🟢
[root@alma8 ~]# systemctl status wazuh-indexer
● wazuh-indexer.service - wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2024-01-08 09:52:09 -03; 6s ago
Docs: https://documentation.wazuh.com
Main PID: 33388 (java)
Tasks: 67 (limit: 23148)
Memory: 1.3G
CGroup: /system.slice/wazuh-indexer.service
└─33388 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch >
Jan 08 09:52:01 alma8 systemd[1]: Starting wazuh-indexer...
Jan 08 09:52:02 alma8 systemd-entrypoint[33388]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 08 09:52:02 alma8 systemd-entrypoint[33388]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.OpenSearch (file:/usr/share/wazuh-indexer/lib/opense>
Jan 08 09:52:02 alma8 systemd-entrypoint[33388]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.OpenSearch
Jan 08 09:52:02 alma8 systemd-entrypoint[33388]: WARNING: System::setSecurityManager will be removed in a future release
Jan 08 09:52:03 alma8 systemd-entrypoint[33388]: WARNING: A terminally deprecated method in java.lang.System has been called
Jan 08 09:52:03 alma8 systemd-entrypoint[33388]: WARNING: System::setSecurityManager has been called by org.opensearch.bootstrap.Security (file:/usr/share/wazuh-indexer/lib/opensear>
Jan 08 09:52:03 alma8 systemd-entrypoint[33388]: WARNING: Please consider reporting this to the maintainers of org.opensearch.bootstrap.Security
Jan 08 09:52:03 alma8 systemd-entrypoint[33388]: WARNING: System::setSecurityManager will be removed in a future release
Jan 08 09:52:09 alma8 systemd[1]: Started wazuh-indexer.Wazuh Indexer templates created 🔴
[root@alma8 ~]# curl -u admin:admin -k https://127.0.0.1:9200/_cat/templates?pretty
ss4o_metrics_template [ss4o_metrics-*-*] 1 1 []
ss4o_traces_template [ss4o_traces-*-*] 1 1 []Wazuh indexer configuration 🟢
network.host: "127.0.0.1"
node.name: "node-1"
cluster.initial_master_nodes:
- "node-1"
#- "node-2"
#- "node-3"
cluster.name: "wazuh-cluster"
#discovery.seed_hosts:
# - "node-1-ip"
# - "node-2-ip"
# - "node-3-ip"
node.max_local_storage_nodes: "3"
path.data: /var/lib/wazuh-indexer
path.logs: /var/log/wazuh-indexer
plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.authcz.admin_dn:
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.nodes_dn:
- "CN=node-1,OU=Wazuh,O=Wazuh,L=California,C=US"
#- "CN=node-2,OU=Wazuh,O=Wazuh,L=California,C=US"
#- "CN=node-3,OU=Wazuh,O=Wazuh,L=California,C=US"
plugins.security.restapi.roles_enabled:
- "all_access"
- "security_rest_api_access"
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-model", ".plugins-ml-task", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".opendistro-asynchronous-search-response*", ".replication-metadata-store"]
### Option to allow Filebeat-oss 7.10.2 to work ###
compatibility.override_main_response_version: true
Wazuh indexer cluster node communication and configuration 🟢
[root@alma8 ~]# curl -u admin:admin -k https://127.0.0.1:9200/_cluster/state/nodes?pretty
{
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "Ahnojj7_SbeTuvhiIpUV5Q",
"nodes" : {
"6jzqfpZNSEGBna7qUkWHnQ" : {
"name" : "node-1",
"ephemeral_id" : "YfFLp7I7RXK7xkZLQqnb_A",
"transport_address" : "127.0.0.1:9300",
"attributes" : {
"shard_indexing_pressure_enabled" : "true"
}
}
}
}
Wazuh indexer cluster status 🟢
[root@alma8 ~]# curl -k -u admin:admin https://127.0.0.1:9200
{
"name" : "node-1",
"cluster_name" : "wazuh-cluster",
"cluster_uuid" : "Ahnojj7_SbeTuvhiIpUV5Q",
"version" : {
"number" : "7.10.2",
"build_type" : "rpm",
"build_hash" : "7fe12a1cf2b73a0e100f91ecc7d987221d91842a",
"build_date" : "2024-01-04T19:04:53.211432Z",
"build_snapshot" : false,
"lucene_version" : "9.7.0",
"minimum_wire_compatibility_version" : "7.10.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project: https://opensearch.org/"
}
Wazuh indexer packages uninstallation procedure 🟢
[root@alma8 ~]# yum remove wazuh-indexer
Dependencies resolved.
======================================================================================================================================================================================
Package Architecture Version Repository Size
======================================================================================================================================================================================
Removing:
wazuh-indexer x86_64 4.9.0-1 @@commandline 980 M
Transaction Summary
======================================================================================================================================================================================
Remove 1 Package
Freed space: 980 M
Is this ok [y/N]: y
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Running scriptlet: wazuh-indexer-4.9.0-1.x86_64 1/1
Stop existing wazuh-indexer.service
Erasing : wazuh-indexer-4.9.0-1.x86_64 1/1
warning: file /var/run/wazuh-indexer: remove failed: No such file or directory
warning: /var/lib/wazuh-indexer/rca_enabled.conf saved as /var/lib/wazuh-indexer/rca_enabled.conf.rpmsave
warning: /var/lib/wazuh-indexer/performance_analyzer_enabled.conf saved as /var/lib/wazuh-indexer/performance_analyzer_enabled.conf.rpmsave
warning: /etc/wazuh-indexer/opensearch.yml saved as /etc/wazuh-indexer/opensearch.yml.rpmsave
Running scriptlet: wazuh-indexer-4.9.0-1.x86_64 1/1
Verifying : wazuh-indexer-4.9.0-1.x86_64 1/1
Removed:
wazuh-indexer-4.9.0-1.x86_64
Complete!
AlexRuiz7
commented
8 months ago Issues than open from this testing:
Current testing iteration of wazuh-indexer@4.9.0 packages concluded with errors. We'll work on these issues and open a new testing iteration.
Description
We have developed tools to generate packages of
wazuh-indexerfrom a given commit of this repository. In order to verify that these packages are worthy, we need to validate their contents and test them.Use previous tests as a guideline.
Tasks
For assembled RPM and DEB packages generated using our tools, we need to:
wazuh-indexer(4.7.0).wazuh-indexermust work without errors.Test requirements and restrictions
During the packages' validation step, download and extract the fork (4.9.0) and pre-fork (4.7.0) packages for the same distribution (deb / rpm), and compare its contents. An example of this procedure can be seen here.
If you find differences in their contents, note them as follows:
It is not required to verify the content of the files themselves, but do check important configuration files as
/etc/wazuh-indexer/jvm.optionsand/etc/wazuh-indexer/opensearch.yml.For the packages' testing step, download and install the fork (4.9.0) and pre-fork packages (4.7.0) and test that:
wazuh-indexerupgrades from 4.7.0 to 4.9.0 successfully, meaning there are no errors in the logs, the service is active, and the cluster is in green state (see the notes below for more information).wazuh-indexerand all its contents are removed from the system.wazuh-indexerinstalls, meaning there are no errors in the logs, the service is active, and the cluster is in green state (see the notes below for more information).Legend
Notes
/var/log/wazuh-indexer/wazuh-cluster.logjournalctl -xeu wazuh-indexersystemctl status wazuh-indexercurl -X PUT "https://<WAZUH_INDEXER_IP>:9200/_cluster/health" -u <username>:<password>yum localinstall <path-to-package>ordpkg -i <path-to-package>).