davidcr01
commented
1 year ago Update Report
Research
First, it is necessary to list all the available or possible operative systems to adapt the OVA:
- Amazon Linux 2: Middle of 2025
- Ubuntu 20.04 LTS: April 2025
- Ubuntu 22.04: April 2027
- RHEL 8: May 2029 Other supported systems have been discarded because their EOL has reached.
After talking with the team, Ubuntu systems, and RHEL systems seems to be not good for the OVA as they tend to have problems or complex systems to deploy the OVA.
With this, it seems that currently, the best option to deploy the OVA is in Amazon Linux 2. It would not have many problems due to it is RPM-based, as CentOS 7 is.
Development
As a first approach, the following workaround is to change the OS specified in the Vagrantfile, changing centos/7 to bento/amazonlinux-2 and check the results of the OVA generation.
The generate_ova.sh scripts executes the following tasks:
provision.sh :green_circle:
systemConfig - steps.sh :green_circle:
HellopreInstall - steps.sh :green_circle:
Install Wazuh (AIO) :green_circle:
``` 16/03/2023 09:53:25 INFO: Starting Wazuh installation assistant. Wazuh version: 4.5.0 16/03/2023 09:53:25 INFO: Verbose logging redirected to /var/log/wazuh-install.log 16/03/2023 09:53:27 DEBUG: Adding the Wazuh repository. [wazuh] gpgcheck=1 gpgkey=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH enabled=1 name=EL-${releasever} - Wazuh baseurl=https://packages-dev.wazuh.com/staging/yum/ protect=1 16/03/2023 09:53:28 INFO: Wazuh development repository added. 16/03/2023 09:53:28 INFO: --- Configuration files --- 16/03/2023 09:53:28 INFO: Generating configuration files. 16/03/2023 09:53:28 DEBUG: Creating the root certificate. Generating a 2048 bit RSA private key ........................+++ ...................+++ writing new private key to '/tmp/wazuh-certificates//root-ca.key' ----- Generating RSA private key, 2048 bit long modulus ..............................+++ .......................+++ e is 65537 (0x10001) Signature ok subject=/C=US/L=California/O=Wazuh/OU=Wazuh/CN=admin Getting CA Private Key 16/03/2023 09:53:28 DEBUG: Creating the Wazuh indexer certificates. Generating a 2048 bit RSA private key ......................................................................+++ ...................................+++ writing new private key to '/tmp/wazuh-certificates//wazuh-indexer-key.pem' ----- Signature ok subject=/C=US/L=California/O=Wazuh/OU=Wazuh/CN=wazuh-indexer Getting CA Private Key 16/03/2023 09:53:28 DEBUG: Creating the Wazuh server certificates. Generating a 2048 bit RSA private key .+++ ...................................+++ writing new private key to '/tmp/wazuh-certificates//wazuh-server-key.pem' ----- Signature ok subject=/C=US/L=California/O=Wazuh/OU=Wazuh/CN=wazuh-server Getting CA Private Key 16/03/2023 09:53:28 DEBUG: Creating the Wazuh dashboard certificates. Generating a 2048 bit RSA private key ....................+++ ...................+++ writing new private key to '/tmp/wazuh-certificates//wazuh-dashboard-key.pem' ----- Signature ok subject=/C=US/L=California/O=Wazuh/OU=Wazuh/CN=wazuh-dashboard Getting CA Private Key 16/03/2023 09:53:28 DEBUG: Generating random passwords. 16/03/2023 09:53:28 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation. 16/03/2023 09:53:28 INFO: --- Wazuh indexer --- 16/03/2023 09:53:28 INFO: Starting Wazuh indexer installation. Complementos cargados:dkms-build-requires, langpacks, priorities, update-motd Resolviendo dependencias --> Ejecutando prueba de transacción ---> Paquete wazuh-indexer.x86_64 0:4.5.0-40500 debe ser instalado --> Resolución de dependencias finalizada Dependencias resueltas ================================================================================ Package Arquitectura Versión Repositorio Tamaño ================================================================================ Instalando: wazuh-indexer x86_64 4.5.0-40500 wazuh 497 M Resumen de la transacción ================================================================================ Instalar 1 Paquete Tamaño total de la descarga: 497 M Tamaño instalado: 747 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Instalando : wazuh-indexer-4.5.0-40500.x86_64 1/1 Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore Comprobando : wazuh-indexer-4.5.0-40500.x86_64 1/1 Instalado: wazuh-indexer.x86_64 0:4.5.0-40500 ¡Listo! 16/03/2023 09:56:44 INFO: Wazuh indexer installation finished. 16/03/2023 09:56:44 DEBUG: Configuring Wazuh indexer. 16/03/2023 09:56:44 INFO: Wazuh indexer post-install configuration finished. 16/03/2023 09:56:44 INFO: Starting service wazuh-indexer. Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service. 16/03/2023 09:56:50 INFO: wazuh-indexer service started. 16/03/2023 09:56:50 INFO: Initializing Wazuh indexer cluster security settings. ************************************************************************** ** This tool will be deprecated in the next major release of OpenSearch ** ** https://github.com/opensearch-project/security/issues/1755 ** ************************************************************************** Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.4.1 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index does not exists, attempt to create it ... done (0-all replicas) Populate config from /etc/wazuh-indexer/opensearch-security/ Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml SUCC: Configuration for 'config' created or updated Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml SUCC: Configuration for 'roles' created or updated Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml SUCC: Configuration for 'rolesmapping' created or updated Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml SUCC: Configuration for 'internalusers' created or updated Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml SUCC: Configuration for 'actiongroups' created or updated Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml SUCC: Configuration for 'tenants' created or updated Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml SUCC: Configuration for 'nodesdn' created or updated Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml SUCC: Configuration for 'whitelist' created or updated Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml SUCC: Configuration for 'audit' created or updated Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml SUCC: Configuration for 'allowlist' created or updated SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null Done with success 16/03/2023 09:57:00 INFO: Wazuh indexer cluster initialized. 16/03/2023 09:57:00 INFO: --- Wazuh server --- 16/03/2023 09:57:00 INFO: Starting the Wazuh manager installation. Complementos cargados:dkms-build-requires, langpacks, priorities, update-motd Resolviendo dependencias --> Ejecutando prueba de transacción ---> Paquete wazuh-manager.x86_64 0:4.5.0-40500 debe ser instalado --> Resolución de dependencias finalizada Dependencias resueltas ================================================================================ Package Arquitectura Versión Repositorio Tamaño ================================================================================ Instalando: wazuh-manager x86_64 4.5.0-40500 wazuh 117 M Resumen de la transacción ================================================================================ Instalar 1 Paquete Tamaño total de la descarga: 117 M Tamaño instalado: 444 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Instalando : wazuh-manager-4.5.0-40500.x86_64 1/1 Comprobando : wazuh-manager-4.5.0-40500.x86_64 1/1 Instalado: wazuh-manager.x86_64 0:4.5.0-40500 ¡Listo! 16/03/2023 09:57:50 INFO: Wazuh manager installation finished. 16/03/2023 09:57:50 INFO: Starting service wazuh-manager. Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service. 16/03/2023 09:57:59 INFO: wazuh-manager service started. 16/03/2023 09:57:59 INFO: Starting Filebeat installation. 16/03/2023 09:58:10 INFO: Filebeat installation finished. wazuh/ wazuh/module.yml wazuh/archives/ wazuh/archives/config/ wazuh/archives/config/archives.yml wazuh/archives/ingest/ wazuh/archives/ingest/pipeline.json wazuh/archives/manifest.yml wazuh/alerts/ wazuh/alerts/config/ wazuh/alerts/config/alerts.yml wazuh/alerts/ingest/ wazuh/alerts/ingest/pipeline.json wazuh/alerts/manifest.yml wazuh/_meta/ wazuh/_meta/config.yml wazuh/_meta/fields.yml wazuh/_meta/docs.asciidoc Created filebeat keystore Successfully updated the keystore Successfully updated the keystore 16/03/2023 09:58:12 INFO: Filebeat post-install configuration finished. 16/03/2023 09:58:12 INFO: Starting service filebeat. Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service. 16/03/2023 09:58:12 INFO: filebeat service started. 16/03/2023 09:58:12 INFO: --- Wazuh dashboard --- 16/03/2023 09:58:12 INFO: Starting Wazuh dashboard installation. Complementos cargados:dkms-build-requires, langpacks, priorities, update-motd Bloqueo existente en /var/run/yum.pid: otra copia se encuentra en ejecución como pid 14915. Another app is currently holding the yum lock; waiting for it to exit... La otra aplicación es: yum Memoria : 142 M RSS (357 MB VSZ) Iniciado: Thu Mar 16 09:58:11 2023 - 00:01 atrás Estado : Ejecutando, pid: 14915 Resolviendo dependencias --> Ejecutando prueba de transacción ---> Paquete wazuh-dashboard.x86_64 0:4.5.0-40500 debe ser instalado --> Resolución de dependencias finalizada Dependencias resueltas ================================================================================ Package Arquitectura Versión Repositorio Tamaño ================================================================================ Instalando: wazuh-dashboard x86_64 4.5.0-40500 wazuh 327 M Resumen de la transacción ================================================================================ Instalar 1 Paquete Tamaño total de la descarga: 327 M Tamaño instalado: 1.1 G Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Instalando : wazuh-dashboard-4.5.0-40500.x86_64 1/1 Comprobando : wazuh-dashboard-4.5.0-40500.x86_64 1/1 Instalado: wazuh-dashboard.x86_64 0:4.5.0-40500 ¡Listo! 16/03/2023 10:00:41 INFO: Wazuh dashboard installation finished. 16/03/2023 10:00:41 DEBUG: Wazuh dashboard certificate setup finished. 16/03/2023 10:00:41 INFO: Wazuh dashboard post-install configuration finished. 16/03/2023 10:00:41 INFO: Starting service wazuh-dashboard. Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service to /etc/systemd/system/wazuh-dashboard.service. 16/03/2023 10:00:41 INFO: wazuh-dashboard service started. 16/03/2023 10:00:41 DEBUG: Setting Wazuh indexer cluster passwords. 16/03/2023 10:00:42 DEBUG: Creating password backup. ************************************************************************** ** This tool will be deprecated in the next major release of OpenSearch ** ** https://github.com/opensearch-project/security/issues/1755 ** ************************************************************************** Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.4.1 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Will retrieve '/config' into /etc/wazuh-indexer/backup/config.yml SUCC: Configuration for 'config' stored in /etc/wazuh-indexer/backup/config.yml Will retrieve '/roles' into /etc/wazuh-indexer/backup/roles.yml SUCC: Configuration for 'roles' stored in /etc/wazuh-indexer/backup/roles.yml Will retrieve '/rolesmapping' into /etc/wazuh-indexer/backup/roles_mapping.yml SUCC: Configuration for 'rolesmapping' stored in /etc/wazuh-indexer/backup/roles_mapping.yml Will retrieve '/internalusers' into /etc/wazuh-indexer/backup/internal_users.yml SUCC: Configuration for 'internalusers' stored in /etc/wazuh-indexer/backup/internal_users.yml Will retrieve '/actiongroups' into /etc/wazuh-indexer/backup/action_groups.yml SUCC: Configuration for 'actiongroups' stored in /etc/wazuh-indexer/backup/action_groups.yml Will retrieve '/tenants' into /etc/wazuh-indexer/backup/tenants.yml SUCC: Configuration for 'tenants' stored in /etc/wazuh-indexer/backup/tenants.yml Will retrieve '/nodesdn' into /etc/wazuh-indexer/backup/nodes_dn.yml SUCC: Configuration for 'nodesdn' stored in /etc/wazuh-indexer/backup/nodes_dn.yml Will retrieve '/whitelist' into /etc/wazuh-indexer/backup/whitelist.yml SUCC: Configuration for 'whitelist' stored in /etc/wazuh-indexer/backup/whitelist.yml Will retrieve '/allowlist' into /etc/wazuh-indexer/backup/allowlist.yml SUCC: Configuration for 'allowlist' stored in /etc/wazuh-indexer/backup/allowlist.yml Will retrieve '/audit' into /etc/wazuh-indexer/backup/audit.yml SUCC: Configuration for 'audit' stored in /etc/wazuh-indexer/backup/audit.yml 16/03/2023 10:00:44 DEBUG: Password backup created in /etc/wazuh-indexer/backup. 16/03/2023 10:00:44 DEBUG: Generating password hashes. 16/03/2023 10:00:46 DEBUG: Password hashes generated. 16/03/2023 10:00:46 DEBUG: Creating password backup. mkdir: no se puede crear el directorio «/etc/wazuh-indexer/backup»: File exists ************************************************************************** ** This tool will be deprecated in the next major release of OpenSearch ** ** https://github.com/opensearch-project/security/issues/1755 ** ************************************************************************** Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.4.1 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Will retrieve '/config' into /etc/wazuh-indexer/backup/config.yml SUCC: Configuration for 'config' stored in /etc/wazuh-indexer/backup/config.yml Will retrieve '/roles' into /etc/wazuh-indexer/backup/roles.yml SUCC: Configuration for 'roles' stored in /etc/wazuh-indexer/backup/roles.yml Will retrieve '/rolesmapping' into /etc/wazuh-indexer/backup/roles_mapping.yml SUCC: Configuration for 'rolesmapping' stored in /etc/wazuh-indexer/backup/roles_mapping.yml Will retrieve '/internalusers' into /etc/wazuh-indexer/backup/internal_users.yml SUCC: Configuration for 'internalusers' stored in /etc/wazuh-indexer/backup/internal_users.yml Will retrieve '/actiongroups' into /etc/wazuh-indexer/backup/action_groups.yml SUCC: Configuration for 'actiongroups' stored in /etc/wazuh-indexer/backup/action_groups.yml Will retrieve '/tenants' into /etc/wazuh-indexer/backup/tenants.yml SUCC: Configuration for 'tenants' stored in /etc/wazuh-indexer/backup/tenants.yml Will retrieve '/nodesdn' into /etc/wazuh-indexer/backup/nodes_dn.yml SUCC: Configuration for 'nodesdn' stored in /etc/wazuh-indexer/backup/nodes_dn.yml Will retrieve '/whitelist' into /etc/wazuh-indexer/backup/whitelist.yml SUCC: Configuration for 'whitelist' stored in /etc/wazuh-indexer/backup/whitelist.yml Will retrieve '/allowlist' into /etc/wazuh-indexer/backup/allowlist.yml SUCC: Configuration for 'allowlist' stored in /etc/wazuh-indexer/backup/allowlist.yml Will retrieve '/audit' into /etc/wazuh-indexer/backup/audit.yml SUCC: Configuration for 'audit' stored in /etc/wazuh-indexer/backup/audit.yml 16/03/2023 10:00:47 DEBUG: Password backup created in /etc/wazuh-indexer/backup. Successfully updated the keystore 16/03/2023 10:00:48 DEBUG: filebeat started. 16/03/2023 10:00:48 DEBUG: wazuh-dashboard started. 16/03/2023 10:00:48 DEBUG: Loading new passwords changes. ************************************************************************** ** This tool will be deprecated in the next major release of OpenSearch ** ** https://github.com/opensearch-project/security/issues/1755 ** ************************************************************************** Security Admin v7 Will connect to 127.0.0.1:9200 ... done Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US" OpenSearch Version: 2.4.1 Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ... Clustername: wazuh-cluster Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 .opendistro_security index already exists, so we do not need to create one. Populate config from /home/vagrant Force type: internalusers Will update '/internalusers' with /etc/wazuh-indexer/backup/internal_users.yml SUCC: Configuration for 'internalusers' created or updated SUCC: Expected 1 config types for node {"updated_config_types":["internalusers"],"updated_config_size":1,"message":null} is 1 (["internalusers"]) due to: null Done with success 16/03/2023 10:00:49 DEBUG: Passwords changed. 16/03/2023 10:00:49 INFO: Initializing Wazuh dashboard web application. 16/03/2023 10:01:00 INFO: Wazuh dashboard web application initialized. 16/03/2023 10:01:00 INFO: Installation finished. ```Clean :green_circle:
``` + systemctl stop wazuh-dashboard filebeat wazuh-indexer wazuh-manager + systemctl enable wazuh-manager + clean + rm -f /securityadmin_demo.sh + yum clean all Complementos cargados:dkms-build-requires, langpacks, priorities, update-motd Limpiando repositorios: amzn2-core amzn2extra-docker wazuh Cleaning up everything Maybe you want: rm -rf /var/cache/yum, to also free up space taken by orphaned data from disabled or removed repos ```
postProvision.sh :red_circle:
This stage fails because it tries to remove the `/root/anaconda-ks.cfg` and `/root/original-ks.cfg` files that do not exist in Amazon Linux 2. These files are the kickstart files installation. Deleting the related lines no errors are generated. ``` + CURRENT_PATH=/tmp/assets + ASSETS_PATH=/tmp/assets + CUSTOM_PATH=/tmp/assets/custom + SYSTEM_USER=wazuh-user + systemctl stop wazuh-manager wazuh-indexer filebeat wazuh-dashboard + mv /tmp/assets/custom/removeVagrant.service /etc/systemd/system/ + sed -i s/USER/wazuh-user/g /etc/systemd/system/removeVagrant.service + mv /tmp/assets/custom/removeVagrant.sh /home/wazuh-user/ + sed -i s/USER/wazuh-user/g /home/wazuh-user/removeVagrant.sh + chmod 755 /home/wazuh-user/removeVagrant.sh + systemctl daemon-reload + systemctl enable removeVagrant.service Created symlink from /etc/systemd/system/multi-user.target.wants/removeVagrant.service to /etc/systemd/system/removeVagrant.service. + rm -rf /tmp/assets/custom /tmp/assets/postProvision.sh /tmp/assets/steps.sh /tmp/assets/.gitignore + find /var/log/ -type f -exec bash -c 'cat /dev/null > {}' ';' + find /var/ossec/logs/ -type f -exec bash -c 'cat /dev/null > {}' ';' ```After importing the OVA, the system crashes when login into it. This is an unexpected behavior that must be investigated and solved. This problem does not occur if the OVA is generated by using CentOS 7 as the system base.
c-bordon
vcerenu
pro-akim
teddytpc1
It is necessary to research and choose a new operating system to use in the OVA package once CentOS 7 reaches its EOL, so that we can make the pertinent changes and carry out the necessary testing.
Currently CentOS 7 EOL is set for June 30, 2024.
Regards, Raúl.
Resolution (edit)
Research
The research of this issue is in https://github.com/wazuh/wazuh-packages/issues/1575#issuecomment-1471720669.
Extra configuration
FIPS mode should be enabled for the OVA following this documentation: https://aws.amazon.com/blogs/publicsector/enabling-fips-mode-amazon-linux-2/ This was manually tested with an EC2 instance with Amazon Linux 2. FIPS mode was configured and Wazuh installed with the assistant. Everything works fine.
Testing
The testing of this issue is in https://github.com/wazuh/wazuh-packages/issues/1575#issuecomment-1480942295.
Generation of OVA
The generation of the OVA is described in https://github.com/wazuh/wazuh-packages/issues/1575#issuecomment-1486405552. It includes the generation of the base Vagrant box for the OVA.