wazuh / wazuh-installation-assistant

Wazuh - Installation assistant
https://wazuh.com/
GNU General Public License v2.0
0 stars 1 forks source link

Create a GHA workflow to build Wazuh assistant for packages-dev.internal.wazuh.com #55

Open c-bordon opened 1 week ago

c-bordon commented 1 week ago
Objective
https://github.com/wazuh/wazuh-packages/issues/2904

Description

Because of the Wazuh packages redesign tier 2 objective we need to migrate the Wazuh installation assistant-related files from the wazuh-packages repository to this one. The Wazuh installation assistant, Wazuh password tool, and Wazuh certificates tool are created in pre-release with the publish_unattended pipeline.

Tasks

[!IMPORTANT] The Wazuh installation scripts must have this format wazuh-install.sh, wazuh-certs-tool.sh, and wazuh-passwords-tool.sh Stage package, for example: wazuh-install.sh For development package must have commit associate, for example: wazuh-install-f45asg.sh

Enaraque commented 4 days ago

Update report

The process of building the different files has been implemented. The process for uploading the files to the S3 bucket and defining the directory where they will be stored is yet to be defined.

Enaraque commented 3 days ago

Update report

After deciding the names of the files to upload, their proper functionality has been tested. A new input DEVELOPMENT has been added to determine how to build the files. If this variable is activated, the files will be created with the commit hash added to the current name (e.g., wazuh-install-<hash>.sh) and with the development option (-d) enabled. If this option is not activated, the files will be built with the usual name.

To verify that the files were built correctly, an artifact has been created to check the construction of the files. When the development option is added, the files are built with the hash in the name.

$ ls -la
total 536
drwx------@  5 enriquearaqueespinosa  staff     160 Sep 18 18:45 .
drwxrwxrwx@ 51 enriquearaqueespinosa  staff    1632 Sep 18 18:45 ..
-rw-r--r--@  1 enriquearaqueespinosa  staff   36475 Sep 18 16:44 wazuh-certs-tool-379769d234200b0d23b55befdfb4f976870a8b7d.sh
-rw-r--r--@  1 enriquearaqueespinosa  staff  192228 Sep 18 16:44 wazuh-install-379769d234200b0d23b55befdfb4f976870a8b7d.sh
-rw-r--r--@  1 enriquearaqueespinosa  staff   44178 Sep 18 16:44 wazuh-passwords-tool-379769d234200b0d23b55befdfb4f976870a8b7d.sh

Next steps

Having the path where the artifacts need to be uploaded, the only thing left is to add the steps to upload the files to S3 and tests that the files are build correctly.

Enaraque commented 2 days ago

Update report

The necessary steps to upload the files to S3 have been added. The only thing left is to test that they were built correctly.

jnasselle commented 2 days ago

Update

Please consider the next information, because our package generation script needs an undocumented mandatory input field and behaviors.

Specs:

run-name: Build Installation Assistant ${{ inputs.id }}
Enaraque commented 1 day ago

Update report

The file name for the Installation Assistant files has been changed so that, if it is not stage, a shorter commit hash is used to make the file name more readable. The workflow_call event and the id imput have also been added.

Testing

Files execution testing

Once these changes were made, the three files were tested.

Installtion Assistant AIO ```console [root@vagrant vagrant]# bash wazuh-install-a4d81c1.sh -a 20/09/2024 15:04:12 INFO: Starting Wazuh installation assistant. Wazuh version: 4.9.0 20/09/2024 15:04:12 INFO: Verbose logging redirected to /var/log/wazuh-install.log 20/09/2024 15:04:12 INFO: Verifying that your system meets the recommended minimum hardware requirements. 20/09/2024 15:04:12 INFO: Wazuh web interface port will be 443. 20/09/2024 15:04:13 INFO: Wazuh repository added. 20/09/2024 15:04:13 INFO: --- Configuration files --- 20/09/2024 15:04:13 INFO: Generating configuration files. 20/09/2024 15:04:13 INFO: Generating the root certificate. 20/09/2024 15:04:13 INFO: Generating Admin certificates. 20/09/2024 15:04:13 INFO: Generating Wazuh indexer certificates. 20/09/2024 15:04:13 INFO: Generating Filebeat certificates. 20/09/2024 15:04:13 INFO: Generating Wazuh dashboard certificates. 20/09/2024 15:04:13 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation. 20/09/2024 15:04:13 INFO: --- Wazuh indexer --- 20/09/2024 15:04:13 INFO: Starting Wazuh indexer installation. 20/09/2024 15:04:43 INFO: Wazuh indexer installation finished. 20/09/2024 15:04:43 INFO: Wazuh indexer post-install configuration finished. 20/09/2024 15:04:43 INFO: Starting service wazuh-indexer. 20/09/2024 15:05:23 INFO: wazuh-indexer service started. 20/09/2024 15:05:23 INFO: Initializing Wazuh indexer cluster security settings. 20/09/2024 15:05:36 INFO: Wazuh indexer cluster security configuration initialized. 20/09/2024 15:05:36 INFO: Wazuh indexer cluster initialized. 20/09/2024 15:05:36 INFO: --- Wazuh server --- 20/09/2024 15:05:36 INFO: Starting the Wazuh manager installation. 20/09/2024 15:05:59 INFO: Wazuh manager installation finished. 20/09/2024 15:05:59 INFO: Wazuh manager vulnerability detection configuration finished. 20/09/2024 15:05:59 INFO: Starting service wazuh-manager. 20/09/2024 15:06:13 INFO: wazuh-manager service started. 20/09/2024 15:06:13 INFO: Checking Wazuh API connection 20/09/2024 15:06:14 INFO: Wazuh API connection successful 20/09/2024 15:06:14 INFO: Starting Filebeat installation. 20/09/2024 15:06:14 INFO: Another process is using YUM. Waiting for it to release the lock. Next retry in 30 seconds (1/10) 20/09/2024 15:06:58 INFO: Filebeat installation finished. 20/09/2024 15:06:59 INFO: Filebeat post-install configuration finished. 20/09/2024 15:06:59 INFO: Starting service filebeat. 20/09/2024 15:06:59 INFO: filebeat service started. 20/09/2024 15:06:59 INFO: Checking Filebeat connection 20/09/2024 15:06:59 INFO: Filebeat connection successful 20/09/2024 15:06:59 INFO: --- Wazuh dashboard --- 20/09/2024 15:06:59 INFO: Starting Wazuh dashboard installation. 20/09/2024 15:07:42 INFO: Wazuh dashboard installation finished. 20/09/2024 15:07:42 INFO: Wazuh dashboard post-install configuration finished. 20/09/2024 15:07:42 INFO: Starting service wazuh-dashboard. 20/09/2024 15:07:42 INFO: wazuh-dashboard service started. 20/09/2024 15:07:43 INFO: Updating the internal users. 20/09/2024 15:07:56 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder. 20/09/2024 15:08:12 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password. 20/09/2024 15:08:49 INFO: Initializing Wazuh dashboard web application. 20/09/2024 15:08:50 INFO: Wazuh dashboard web application initialized. 20/09/2024 15:08:50 INFO: --- Summary --- 20/09/2024 15:08:50 INFO: You can access the web interface https://:443 User: admin Password: xxxxx 20/09/2024 15:08:50 INFO: Installation finished. ``` ![image](https://github.com/user-attachments/assets/f19c3611-4a7b-4abb-b1cd-46d5d406a1ae)
Wazuh-password-tool ```console [root@vagrant vagrant]# bash wazuh-passwords-tool-a4d81c1.sh -a -A -au wazuh -ap xxxx 20/09/2024 15:11:46 INFO: Updating the internal users. 20/09/2024 15:11:58 INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder. 20/09/2024 15:12:14 INFO: The filebeat.yml file has been updated to use the Filebeat Keystore username and password. 20/09/2024 15:12:45 INFO: The password for user admin is 7OBjgPlCERBP?6pDoiiCC7TO*r7*M*sA 20/09/2024 15:12:45 INFO: The password for user anomalyadmin is UG4GvWwsbBHfK9.8IrRHULkTNMgFBrto 20/09/2024 15:12:45 INFO: The password for user kibanaserver is TBU0pH9SehUnTi.KWl?0lQ7a4MOY?BX? 20/09/2024 15:12:45 INFO: The password for user kibanaro is IF.gpl+M3a+*qDZu5.6o9oG*FA?JImgt 20/09/2024 15:12:45 INFO: The password for user logstash is q*?ldM.*hUA0BUdbQWPJAxntq953rfyQ 20/09/2024 15:12:45 INFO: The password for user readall is GMHgSmAEH9ikktX*3S+9FehJ*fP5sC?Y 20/09/2024 15:12:45 INFO: The password for user snapshotrestore is iXT5?*6inj5f6nrjuYXmzZgUAHGBA2LR 20/09/2024 15:12:45 WARNING: Wazuh indexer passwords changed. Remember to update the password in the Wazuh dashboard, Wazuh server, and Filebeat nodes if necessary, and restart the services. 20/09/2024 15:12:47 INFO: The password for Wazuh API user wazuh is n.VqwSYSn10JrJAkyMWYngAmPhh39T*r 20/09/2024 15:12:47 INFO: The password for Wazuh API user wazuh-wui is ?xsrhzi2NbS+OsSJqXXF4ZP*I79qdOhZ 20/09/2024 15:12:47 INFO: Updated wazuh-wui user password in wazuh dashboard. Remember to restart the service. ```
wazuh-cets-tool ```console [root@vagrant vagrant]# bash wazuh-certs-tool-a4d81c1.sh -A -v 20/09/2024 15:14:57 INFO: Verbose logging redirected to /home/vagrant/wazuh-certificates-tool.log 20/09/2024 15:14:57 DEBUG: Reading configuration file. 20/09/2024 15:14:57 DEBUG: Checking if 127.0.0.1 is private. 20/09/2024 15:14:57 DEBUG: Checking if 127.0.0.1 is private. 20/09/2024 15:14:57 DEBUG: Checking if 127.0.0.1 is private. 20/09/2024 15:14:57 DEBUG: Checking if the root CA exists. 20/09/2024 15:14:57 INFO: Generating the root certificate. 20/09/2024 15:14:57 INFO: Generating Admin certificates. 20/09/2024 15:14:57 DEBUG: Generating Admin private key. 20/09/2024 15:14:57 DEBUG: Converting Admin private key to PKCS8 format. 20/09/2024 15:14:57 DEBUG: Generating Admin CSR. 20/09/2024 15:14:57 DEBUG: Creating Admin certificate. 20/09/2024 15:14:57 INFO: Admin certificates created. 20/09/2024 15:14:57 INFO: Generating Wazuh indexer certificates. 20/09/2024 15:14:57 DEBUG: Creating the certificates for node-1 indexer node. 20/09/2024 15:14:57 DEBUG: Generating certificate configuration. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh indexer tmp key pair. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh indexer certificates. 20/09/2024 15:14:57 INFO: Wazuh indexer certificates created. 20/09/2024 15:14:57 INFO: Generating Filebeat certificates. 20/09/2024 15:14:57 DEBUG: Generating the certificates for wazuh-1 server node. 20/09/2024 15:14:57 DEBUG: Generating certificate configuration. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh server tmp key pair. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh server certificates. 20/09/2024 15:14:57 INFO: Wazuh Filebeat certificates created. 20/09/2024 15:14:57 INFO: Generating Wazuh dashboard certificates. 20/09/2024 15:14:57 DEBUG: Generating certificate configuration. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh dashboard tmp key pair. 20/09/2024 15:14:57 DEBUG: Creating the Wazuh dashboard certificates. 20/09/2024 15:14:57 INFO: Wazuh dashboard certificates created. 20/09/2024 15:14:57 DEBUG: Cleaning certificate files. ```

Workflow testing

The workflow has been tested with the is stage option and without it. This was done to verify that the files are generated correctly and to check whether the corresponding commit hash is added to the files uploaded to S3 for the workflow without theis stage option.