davidcr01
commented
2 months ago Update Report
Development
The fix would consist in managing two different cases:
- The master node has been installed and it has changed the passwords, so the worker node needs to change the API password before getting the token.
- The master node and the worker node are being installed simultaneously. In this case, if the manager cluster is not started, when the worker nodes try to get the TOKEN, the API returns an
Wazuh Cluster Error. In this case, the worker node does not have to change the API password, but it has to retry the API fetch waiting for the manager cluster to be started.
The strategy is to use the "${server_node_types[pos]}" variable, which contains which type of node is installing the assistant. The pos variable along the installation. In this way, we can identify which manager node is being installed.
Then, if the credentials are incorrect, they are changed. In other cases, if the API returns the cluster error, the assistant will retry to fetch the TOKEN with the default credentials, as they are changed long after.
Testing
Testing the first case, the worker needs to change the credentials:
root@ip-172-31-84-56:/home/ubuntu# bash wazuh-install.sh -ws server-2 -o
11/09/2024 10:36:03 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0
11/09/2024 10:36:03 INFO: Verbose logging redirected to /var/log/wazuh-install.log
11/09/2024 10:36:07 INFO: Verifying that your system meets the recommended minimum hardware requirements.
11/09/2024 10:36:12 INFO: Wazuh development repository added.
11/09/2024 10:36:12 INFO: --- Wazuh server ---
11/09/2024 10:36:12 INFO: Starting the Wazuh manager installation.
11/09/2024 10:36:57 INFO: Wazuh manager installation finished.
11/09/2024 10:36:57 INFO: Wazuh manager vulnerability detection configuration finished.
11/09/2024 10:36:57 INFO: Starting service wazuh-manager.
11/09/2024 10:37:13 INFO: wazuh-manager service started.
11/09/2024 10:37:13 INFO: Checking Wazuh API connection
+ api_password=wazuh-wui
+ token_command='curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"'
++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"'
+++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
+ TOKEN='{"title": "Unauthorized", "detail": "Invalid credentials"}'
+ [[ {"title": "Unauthorized", "detail": "Invalid credentials"} =~ Invalid credentials ]]
+ [[ worker == \w\o\r\k\e\r ]]
++ tar -axf /home/ubuntu/wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O
++ grep -P ''\''wazuh-wui'\''' -A 1
++ sed 's/'\''//g'
++ awk 'NR==2 { print $2 }'
+ api_password='X?YG+2cj?1mzUoRA2aF+3c.PZpSE1lZJ'
+ token_command='curl -k -s -X POST -u "wazuh-wui:X?YG+2cj?1mzUoRA2aF+3c.PZpSE1lZJ" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"'
++ eval 'curl -k -s -X POST -u "wazuh-wui:X?YG+2cj?1mzUoRA2aF+3c.PZpSE1lZJ" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"'
+++ curl -k -s -X POST -u 'wazuh-wui:X?YG+2cj?1mzUoRA2aF+3c.PZpSE1lZJ' 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
+ TOKEN=eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUxMDM0LCJleHAiOjE3MjYwNTE5MzQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AaF5U-5y5urMuyHyl9JVr7yDlShhCvZdYJ00sB1ZbVDNa7Akrtv4OGAQyuDzgMhuL5PiTw1ipuTOYixhq6kURW3wAdkiOv2ltYMk3E9mYQVQfehrQYVJujNEoY908F9xUi6wGSMbgTW0JfArANoCH5p5j2yCQm-FqXtmy86rFBo2Axio
+ max_attempts=5
+ attempt=0
+ seconds=3
+ [[ -z eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUxMDM0LCJleHAiOjE3MjYwNTE5MzQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AaF5U-5y5urMuyHyl9JVr7yDlShhCvZdYJ00sB1ZbVDNa7Akrtv4OGAQyuDzgMhuL5PiTw1ipuTOYixhq6kURW3wAdkiOv2ltYMk3E9mYQVQfehrQYVJujNEoY908F9xUi6wGSMbgTW0JfArANoCH5p5j2yCQm-FqXtmy86rFBo2Axio ]]
+ [[ eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUxMDM0LCJleHAiOjE3MjYwNTE5MzQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AaF5U-5y5urMuyHyl9JVr7yDlShhCvZdYJ00sB1ZbVDNa7Akrtv4OGAQyuDzgMhuL5PiTw1ipuTOYixhq6kURW3wAdkiOv2ltYMk3E9mYQVQfehrQYVJujNEoY908F9xUi6wGSMbgTW0JfArANoCH5p5j2yCQm-FqXtmy86rFBo2Axio =~ Wazuh Cluster Error ]]
+ set +x
11/09/2024 10:37:14 INFO: Wazuh API connection successful
11/09/2024 10:37:14 INFO: Starting Filebeat installation.
11/09/2024 10:37:25 INFO: Filebeat installation finished.
11/09/2024 10:37:26 INFO: Filebeat post-install configuration finished.
11/09/2024 10:37:28 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password.
11/09/2024 10:37:46 INFO: Starting service filebeat.
11/09/2024 10:37:47 INFO: filebeat service started.
11/09/2024 10:37:47 INFO: Checking Filebeat connection
11/09/2024 10:37:47 INFO: Filebeat connection successful
11/09/2024 10:37:47 INFO: Installation finished.
root@ip-172-31-84-56:/home/ubuntu# Testing the second case, the worker does not need to change the credentials, but needs to retry:
-
Master node:
root@ip-172-31-87-247:/home/ubuntu# bash wazuh-install.sh -ws server-1 -o 11/09/2024 11:21:43 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0 11/09/2024 11:21:43 INFO: Verbose logging redirected to /var/log/wazuh-install.log 11/09/2024 11:21:51 INFO: --- Removing existing Wazuh installation --- 11/09/2024 11:21:51 INFO: Removing Wazuh manager. 11/09/2024 11:22:01 INFO: Wazuh manager removed. 11/09/2024 11:22:01 INFO: Removing Filebeat. 11/09/2024 11:22:06 INFO: Filebeat removed. 11/09/2024 11:22:06 INFO: Installation cleaned. 11/09/2024 11:22:06 INFO: Verifying that your system meets the recommended minimum hardware requirements. 11/09/2024 11:22:12 INFO: Wazuh development repository added. 11/09/2024 11:22:12 INFO: --- Wazuh server --- 11/09/2024 11:22:12 INFO: Starting the Wazuh manager installation. 11/09/2024 11:23:00 INFO: Wazuh manager installation finished. 11/09/2024 11:23:00 INFO: Wazuh manager vulnerability detection configuration finished. 11/09/2024 11:23:00 INFO: Starting service wazuh-manager. 11/09/2024 11:23:16 INFO: wazuh-manager service started. 11/09/2024 11:23:16 INFO: Checking Wazuh API connection -
api_password=wazuh-wui
-
token_command='curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN=eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUzNzk3LCJleHAiOjE3MjYwNTQ2OTcsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AFFoEU00Lf9LYQ0Dbg5kryNmmB33tZp0cTA_WzxeBKW1HaoHuhB007poQrLilub48eKmLBcgMqD89I4qOc4Im2apAGzVHR69H5ghJT0Thhcj0fOESBi-buxGZV79aQuUn63gKqM2a-p2z41gtHskGBoJJ-c7OakL7rHytGDdRWhdSVDR
-
[[ eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUzNzk3LCJleHAiOjE3MjYwNTQ2OTcsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AFFoEU00Lf9LYQ0Dbg5kryNmmB33tZp0cTA_WzxeBKW1HaoHuhB007poQrLilub48eKmLBcgMqD89I4qOc4Im2apAGzVHR69H5ghJT0Thhcj0fOESBi-buxGZV79aQuUn63gKqM2a-p2z41gtHskGBoJJ-c7OakL7rHytGDdRWhdSVDR =~ Invalid credentials ]]
-
set +x 11/09/2024 11:23:17 INFO: Wazuh API connection successful 11/09/2024 11:23:17 INFO: Starting Filebeat installation. 11/09/2024 11:23:29 INFO: Filebeat installation finished. 11/09/2024 11:23:31 INFO: Filebeat post-install configuration finished. 11/09/2024 11:23:33 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password. 11/09/2024 11:23:56 INFO: Starting service filebeat. 11/09/2024 11:23:57 INFO: filebeat service started. 11/09/2024 11:23:57 INFO: Checking Filebeat connection 11/09/2024 11:23:57 INFO: Filebeat connection successful 11/09/2024 11:23:57 INFO: Installation finished.
-
Worker node:
root@ip-172-31-84-56:/home/ubuntu# bash wazuh-install.sh -ws server-2 -o 11/09/2024 11:21:35 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0 11/09/2024 11:21:35 INFO: Verbose logging redirected to /var/log/wazuh-install.log 11/09/2024 11:21:41 INFO: --- Removing existing Wazuh installation --- 11/09/2024 11:21:41 INFO: Removing Wazuh manager. 11/09/2024 11:21:53 INFO: Wazuh manager removed. 11/09/2024 11:21:53 INFO: Removing Filebeat. 11/09/2024 11:21:57 INFO: Filebeat removed. 11/09/2024 11:21:58 INFO: Installation cleaned. 11/09/2024 11:21:58 INFO: Verifying that your system meets the recommended minimum hardware requirements. 11/09/2024 11:22:03 INFO: Wazuh development repository added. 11/09/2024 11:22:04 INFO: --- Wazuh server --- 11/09/2024 11:22:04 INFO: Starting the Wazuh manager installation. 11/09/2024 11:22:49 INFO: Wazuh manager installation finished. 11/09/2024 11:22:50 INFO: Wazuh manager vulnerability detection configuration finished. 11/09/2024 11:22:50 INFO: Starting service wazuh-manager. 11/09/2024 11:23:04 INFO: wazuh-manager service started. 11/09/2024 11:23:04 INFO: Checking Wazuh API connection -
api_password=wazuh-wui
-
token_command='curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN='{"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023}' -
[[ {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} =~ Invalid credentials ]] -
max_attempts=15
-
attempt=0
-
seconds=5
-
[[ -z {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} ]] -
[[ {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} =~ Wazuh Cluster Error ]] -
[[ 0 -lt 15 ]]
-
attempt=1
-
common_logger 'Attempt 1: Trying to get Wazuh API token'
-
now='11/09/2024 11:23:04'
-
'[' -n 'Attempt 1: Trying to get Wazuh API token' ']'
-
'[' -n 'Attempt 1: Trying to get Wazuh API token' ']'
-
case ${1} in
-
message='Attempt 1: Trying to get Wazuh API token'
-
printf '%s\n' '11/09/2024 11:23:04 INFO: Attempt 1: Trying to get Wazuh API token'
-
tee -a /var/log/wazuh-install.log 11/09/2024 11:23:04 INFO: Attempt 1: Trying to get Wazuh API token
-
sleep 5 ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN='{"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023}' -
[[ -z {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} ]] -
[[ {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} =~ Wazuh Cluster Error ]] -
[[ 1 -lt 15 ]]
-
attempt=2
-
common_logger 'Attempt 2: Trying to get Wazuh API token'
-
now='11/09/2024 11:23:09'
-
'[' -n 'Attempt 2: Trying to get Wazuh API token' ']'
-
'[' -n 'Attempt 2: Trying to get Wazuh API token' ']'
-
case ${1} in
-
message='Attempt 2: Trying to get Wazuh API token'
-
printf '%s\n' '11/09/2024 11:23:09 INFO: Attempt 2: Trying to get Wazuh API token'
-
tee -a /var/log/wazuh-install.log 11/09/2024 11:23:09 INFO: Attempt 2: Trying to get Wazuh API token
-
sleep 5 ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN='{"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023}' -
[[ -z {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} ]] -
[[ {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} =~ Wazuh Cluster Error ]] -
[[ 2 -lt 15 ]]
-
attempt=3
-
common_logger 'Attempt 3: Trying to get Wazuh API token'
-
now='11/09/2024 11:23:14'
-
'[' -n 'Attempt 3: Trying to get Wazuh API token' ']'
-
'[' -n 'Attempt 3: Trying to get Wazuh API token' ']'
-
case ${1} in
-
message='Attempt 3: Trying to get Wazuh API token'
-
printf '%s\n' '11/09/2024 11:23:14 INFO: Attempt 3: Trying to get Wazuh API token'
-
tee -a /var/log/wazuh-install.log 11/09/2024 11:23:14 INFO: Attempt 3: Trying to get Wazuh API token
-
sleep 5 ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN='{"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023}' -
[[ -z {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} ]] -
[[ {"title": "Wazuh Cluster Error", "detail": "Worker node is not connected to master", "remediation": "Check the cluster.log located at WAZUH_HOME/logs/cluster.log file to see if there are connection errors. Restart the
wazuh-managerservice.", "error": 3023} =~ Wazuh Cluster Error ]] -
[[ 3 -lt 15 ]]
-
attempt=4
-
common_logger 'Attempt 4: Trying to get Wazuh API token'
-
now='11/09/2024 11:23:19'
-
'[' -n 'Attempt 4: Trying to get Wazuh API token' ']'
-
'[' -n 'Attempt 4: Trying to get Wazuh API token' ']'
-
case ${1} in
-
message='Attempt 4: Trying to get Wazuh API token'
-
printf '%s\n' '11/09/2024 11:23:19 INFO: Attempt 4: Trying to get Wazuh API token'
-
tee -a /var/log/wazuh-install.log 11/09/2024 11:23:19 INFO: Attempt 4: Trying to get Wazuh API token
-
sleep 5 ++ eval 'curl -k -s -X POST -u "wazuh-wui:wazuh-wui" https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true -d '\''{"user_name":"wzread"}'\'' -H "content-type:application/json"' +++ curl -k -s -X POST -u wazuh-wui:wazuh-wui 'https://127.0.0.1:55000/security/user/authenticate/run_as?raw=true' -d '{"user_name":"wzread"}' -H content-type:application/json
-
TOKEN=eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUzODA0LCJleHAiOjE3MjYwNTQ3MDQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AWC5dePgbsrQpMvLf4U8Ldc9IkkVSxVhzcL4CjLPw5GkCH7eh6DPNDQowlIAqADo-ckfr9junBITGDAPt6QmL7WcASS__r5N-zpk9ApHe-P8aWXkv0rn1l0Flm77rLeyEh2m-HRz2Rd4i5Jc8pw2OCKT7yu21d0KOD10tqHqmPW8H-xw
-
[[ -z eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUzODA0LCJleHAiOjE3MjYwNTQ3MDQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AWC5dePgbsrQpMvLf4U8Ldc9IkkVSxVhzcL4CjLPw5GkCH7eh6DPNDQowlIAqADo-ckfr9junBITGDAPt6QmL7WcASS__r5N-zpk9ApHe-P8aWXkv0rn1l0Flm77rLeyEh2m-HRz2Rd4i5Jc8pw2OCKT7yu21d0KOD10tqHqmPW8H-xw ]]
-
[[ eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJ3YXp1aCIsImF1ZCI6IldhenVoIEFQSSBSRVNUIiwibmJmIjoxNzI2MDUzODA0LCJleHAiOjE3MjYwNTQ3MDQsInN1YiI6IndhenVoLXd1aSIsInJ1bl9hcyI6dHJ1ZSwicmJhY19yb2xlcyI6W10sInJiYWNfbW9kZSI6IndoaXRlIiwiaGFzaF9hdXRoX2NvbnRleHQiOiI2ZTUxZGExOTNjMTFhYTVhYmQ0NDgxNTgxNjViZjJmNyJ9.AWC5dePgbsrQpMvLf4U8Ldc9IkkVSxVhzcL4CjLPw5GkCH7eh6DPNDQowlIAqADo-ckfr9junBITGDAPt6QmL7WcASS__r5N-zpk9ApHe-P8aWXkv0rn1l0Flm77rLeyEh2m-HRz2Rd4i5Jc8pw2OCKT7yu21d0KOD10tqHqmPW8H-xw =~ Wazuh Cluster Error ]]
-
set +x 11/09/2024 11:23:24 INFO: Wazuh API connection successful 11/09/2024 11:23:24 INFO: Starting Filebeat installation. 11/09/2024 11:23:36 INFO: Filebeat installation finished. 11/09/2024 11:23:37 INFO: Filebeat post-install configuration finished. 11/09/2024 11:23:38 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password. 11/09/2024 11:23:58 INFO: Starting service filebeat. 11/09/2024 11:23:58 INFO: filebeat service started. 11/09/2024 11:23:58 INFO: Checking Filebeat connection 11/09/2024 11:23:58 INFO: Filebeat connection successful 11/09/2024 11:23:58 INFO: Installation finished.
[!NOTE] Notice that the worker node retries to get the token until the
Wazuh Cluster Erroris not being generated, and also it is using the default credentialswazuh-wui:wazuh-wui
After finishing the installation, the Wazuh UI loads correctly:
Testing AIO :heavy_check_mark:
The AIO installation finished successfully:
AIO installation log
```console root@ip-172-31-84-56:/home/ubuntu# bash wazuh-install.sh -a -v 11/09/2024 12:08:01 DEBUG: Checking root permissions. 11/09/2024 12:08:01 DEBUG: Checking sudo package. 11/09/2024 12:08:01 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0 11/09/2024 12:08:01 INFO: Verbose logging redirected to /var/log/wazuh-install.log 11/09/2024 12:08:01 DEBUG: APT package manager will be used. 11/09/2024 12:08:01 DEBUG: Checking system distribution. 11/09/2024 12:08:01 DEBUG: Detected distribution name: ubuntu 11/09/2024 12:08:01 DEBUG: Detected distribution version: 22 11/09/2024 12:08:01 DEBUG: Installing check dependencies. Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease Get:2 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease [128 kB] Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease Get:5 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [1988 kB] Fetched 2116 kB in 0s (5222 kB/s) Reading package lists... 11/09/2024 12:08:05 DEBUG: Checking Wazuh installation. 11/09/2024 12:08:06 DEBUG: Checking system architecture. 11/09/2024 12:08:06 INFO: Verifying that your system meets the recommended minimum hardware requirements. 11/09/2024 12:08:06 DEBUG: CPU cores detected: 4 11/09/2024 12:08:06 DEBUG: Free RAM memory detected: 7847 11/09/2024 12:08:06 INFO: Wazuh web interface port will be 443. 11/09/2024 12:08:06 DEBUG: Checking ports availability. Hit:1 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy InRelease Hit:2 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-updates InRelease Hit:3 http://us-east-1.ec2.archive.ubuntu.com/ubuntu jammy-backports InRelease Hit:4 http://security.ubuntu.com/ubuntu jammy-security InRelease Reading package lists... 11/09/2024 12:08:08 DEBUG: Installing prerequisites dependencies. 11/09/2024 12:08:11 DEBUG: Checking curl tool version. 11/09/2024 12:08:11 DEBUG: Adding the Wazuh repository. gpg: keyring '/usr/share/keyrings/wazuh.gpg' created gpg: key 96B3EE5F29111145: public key "Wazuh.com (Wazuh Signing Key)Testing distributed - single node :heavy_check_mark:
The distributed installation finished successfully:
Description
While working on #20, I found a problem when checking the Wazuh manager service, specifically when executing the
manager_checkServicecommand. This new check was added in https://github.com/wazuh/wazuh-packages/pull/3059, and improved in #28 and #44.Now, I encountered that this check fails when performing a distributed installation, specifically when installing a Wazuh manager cluster. This is causing the GHA migration is failing:
The problem is that the Wazuh worker node fails with the
Invalid credentialsresponse of the Wazuh API when obtaining a token:However, in the Wazuh manager master node, this is not reproduced:
Investigation
To understand what is happening, we must take into account that:
The execution order of the functions when installing the Wazuh manager on a distributed installation (this means installing the Wazuh manager with the
-wsoption, not the-aoption) is the following:As you can see, among other things, the Wazuh manager master node is checking the Wazuh manager service (and it passes correctly), and it changes the passwords long after, including the API password.
Then, when the Wazuh manager worker node performs its installation, the API credentials are not the default ones anymore, because the Wazuh manager master node has changed them. Thus, when the worker node tries to get the token with the default credentials, it fails:
If we use the password specified in the wazuh-passwords.txt file, the TOKEN is fetched correctly:
Tasks