c-bordon
commented
9 months ago Update report
I was carrying out several tests, and unfortunately, the only valid character for the DNS definition is - or lower case. For this reason, I chose to try wazuhindexer. but despite having made the changes the error persists:
The Service "wazuh.indexer" is invalid: metadata.name: Invalid value: "wazuh.indexer": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?')
cbordon@cbordon-MS-7C88:~/Documents/wazuh/repositorios/wazuh-kubernetes$ wazuh/certs/indexer_cluster/generate_certs.sh
Root CA
Admin cert
create: admin-key-temp.pem
create: admin-key.pem
create: admin.csr
Ignoring -days without -x509; not generating a certificate
create: admin.pem
Certificate request self-signature ok
subject=C = US, L = California, O = Company, CN = admin
* Node cert
create: node-key-temp.pem
create: node-key.pem
create: node.csr
Ignoring -days without -x509; not generating a certificate
create: node.pem
Certificate request self-signature ok
subject=C = US, L = California, O = Company, CN = *.wazuhindexer
* dashboard cert
create: dashboard-key-temp.pem
create: dashboard-key.pem
create: dashboard.csr
Ignoring -days without -x509; not generating a certificate
create: dashboard.pem
Certificate request self-signature ok
subject=C = US, L = California, O = Company, CN = dashboard
* Filebeat cert
create: filebeat-key-temp.pem
create: filebeat-key.pem
create: filebeat.csr
Ignoring -days without -x509; not generating a certificate
create: filebeat.pem
Certificate request self-signature ok
subject=C = US, L = California, O = Company, CN = filebeatcbordon@cbordon-MS-7C88:~/Documents/wazuh/repositorios/wazuh-kubernetes$ kubectl get svc -n wazuh
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard LoadBalancer 10.98.203.141 <pending> 443:30521/TCP 5m32s
indexer LoadBalancer 10.111.57.161 <pending> 9200:31635/TCP 5m32s
wazuh LoadBalancer 10.110.36.37 <pending> 1515:31159/TCP,55000:30298/TCP 5m32s
wazuh-cluster ClusterIP None <none> 1516/TCP 5m32s
wazuh-workers LoadBalancer 10.103.73.82 <pending> 1514:30860/TCP 5m32s
wazuhindexer ClusterIP None <none> 9300/TCP 5m32s
cbordon@cbordon-MS-7C88:~/Documents/wazuh/repositorios/wazuh-kubernetes$ kubectl get pods -n wazuh
NAME READY STATUS RESTARTS AGE
wazuh-dashboard-689b897f8b-f2qqv 1/1 Running 0 64s
wazuh-indexer-0 1/1 Running 0 64s
wazuh-manager-master-0 1/1 Running 0 64s
wazuh-manager-worker-0 1/1 Running 0 64sroot@wazuh-manager-master-0:/# curl -u "admin:SecretPassword" --cert "/etc/ssl/filebeat.pem" --key "/etc/ssl/filebeat.key" --cacert "/etc/ssl/root-ca.pem" "https://wazuhindexer:9200"
curl: (60) SSL: certificate subject name '*.wazuhindexer' does not match target host name 'wazuhindexer'
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
root@wazuh-manager-master-0:/# curl -u "admin:SecretPassword" --cert "/etc/ssl/filebeat.pem" --key "/etc/ssl/filebeat.key" --cacert "/etc/ssl/root-ca.pem" "https://wazuh-indexer-0.wazuhindexer:9200"
curl: (6) Could not resolve host: wazuh-indexer-0.wazuhindexer
root@wazuh-manager-master-0:/# curl -u "admin:SecretPassword" --cert "/etc/ssl/filebeat.pem" --key "/etc/ssl/filebeat.key" --cacert "/etc/ssl/root-ca.pem" "https://wazuh-indexer-0:9200"
curl: (6) Could not resolve host: wazuh-indexer-0
root@wazuh-manager-master-0:/# curl -u "admin:SecretPassword" --cert "/etc/ssl/filebeat.pem" --key "/etc/ssl/filebeat.key" --cacert "/etc/ssl/root-ca.pem" "https://wazuh-indexer-0.wazuhindexer:9200"
curl: (6) Could not resolve host: wazuh-indexer-0.wazuhindexer
root@wazuh-manager-master-0:/#
vcerenu
The connection between Wazuh manager and Wazuh indexer was recently added for the deployment of the new Vulnerability Detection, which uses the cURL libraries to make the connection.
When performing a connection test with cURL we obtained the following error:
This error is generated when the character "-" is found within the CN using a wildcard to be able to generate the connection from any Wazuh indexer node that is created within the K8S cluster.
We have carried out tests with names without "-" and the results have been satisfactory:
We will proceed to modify the name of the Wazuh indexer service so that we do not have this error.
It should be noted that the problem only occurs when the CN of the certificate contains a wildcard and among the remaining characters there is a "-"