Closed jnasselle closed 7 months ago
Doing a little more research, the AMI used to build the OVA and the vagrantbox used to build locally contain the file /etc/redhat-release
AMI: ami-0f463cf5ed41502eb Vagrantbox: https://packages-dev.wazuh.com/vms/ova/amazonlinux-2.box
The new versions of the Vagrant Box
and the AMI
are created without the /etc/redhat-release
file, I still can't test the OVA because I don't have the necessary packages:
New versions:
AMI: ami-0d4bd55523ee67aa4 Vagrantbox: https://packages-dev.wazuh.com/vms/ova/amznlinux-2.box
A test of the construction of the OVA was carried out with the new Vagrantbox using version 4.7.2 of Wazuh and the result was correct:
[root@wazuh-server ~]# ls -la /etc/r*
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc0.d -> rc.d/rc0.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc1.d -> rc.d/rc1.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc2.d -> rc.d/rc2.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc3.d -> rc.d/rc3.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc4.d -> rc.d/rc4.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc5.d -> rc.d/rc5.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc6.d -> rc.d/rc6.d
lrwxrwxrwx 1 root root 13 Apr 11 2023 /etc/rc.local -> rc.d/rc.local
-rw-r--r-- 1 root root 1787 Jul 26 2018 /etc/request-key.conf
-rw-r--r-- 1 root root 64 Jan 10 11:52 /etc/resolv.conf
-rw-r--r-- 1 root root 1634 Nov 27 2018 /etc/rpc
-rw-r--r-- 1 root root 458 Jun 1 2023 /etc/rsyncd.conf
-rw-r--r-- 1 root root 3232 Feb 7 2023 /etc/rsyslog.conf
-rw-r--r-- 1 root root 966 Sep 22 2022 /etc/rwtab
[root@wazuh-server ~]# ls -la /var/ossec/ruleset/sca/
total 10156
drwxr-x--- 2 root wazuh 4096 Jan 10 14:39 .
drwxr-x--- 5 root wazuh 46 Jan 10 14:39 ..
-rw-r----- 1 root wazuh 207513 Jan 5 22:07 cis_amazon_linux_1.yml.disabled
-rw-r----- 1 root wazuh 236403 Jan 5 22:07 cis_amazon_linux_2.yml
-rw-r----- 1 root wazuh 47977 Jan 5 22:07 cis_apache_24.yml.disabled
-rw-r----- 1 root wazuh 33522 Jan 5 22:07 cis_apple_macOS_10.11.yml.disabled
-rw-r----- 1 root wazuh 30577 Jan 5 22:07 cis_apple_macOS_10.12.yml.disabled
-rw-r----- 1 root wazuh 30101 Jan 5 22:07 cis_apple_macOS_10.13.yml.disabled
-rw-r----- 1 root wazuh 61211 Jan 5 22:07 cis_apple_macOS_10.14.yml.disabled
-rw-r----- 1 root wazuh 65229 Jan 5 22:07 cis_apple_macOS_10.15.yml.disabled
-rw-r----- 1 root wazuh 77375 Jan 5 22:07 cis_apple_macOS_11.1.yml.disabled
-rw-r----- 1 root wazuh 90803 Jan 5 22:07 cis_apple_macOS_12.0.yml.disabled
-rw-r----- 1 root wazuh 181718 Jan 5 22:07 cis_apple_macOS_13.x.yml.disabled
-rw-r----- 1 root wazuh 150869 Jan 5 22:07 cis_apple_macOS_14.0.yml.disabled
-rw-r----- 1 root wazuh 209419 Jan 5 22:07 cis_centos6_linux.yml.disabled
-rw-r----- 1 root wazuh 262843 Jan 5 22:07 cis_centos7_linux.yml.disabled
-rw-r----- 1 root wazuh 232169 Jan 5 22:07 cis_centos8_linux.yml.disabled
-rw-r----- 1 root wazuh 240527 Jan 5 22:07 cis_debian10.yml.disabled
-rw-r----- 1 root wazuh 381099 Jan 5 22:07 cis_debian11.yml.disabled
-rw-r----- 1 root wazuh 342660 Jan 5 22:07 cis_debian12.yml.disabled
-rw-r----- 1 root wazuh 179167 Jan 5 22:07 cis_debian7.yml.disabled
-rw-r----- 1 root wazuh 207081 Jan 5 22:07 cis_debian8.yml.disabled
-rw-r----- 1 root wazuh 206116 Jan 5 22:07 cis_debian9.yml.disabled
-rw-r----- 1 root wazuh 64290 Jan 5 22:07 cis_iis_10.yml.disabled
-rw-r----- 1 root wazuh 19741 Jan 5 22:07 cis_mongodb_36.yml.disabled
-rw-r----- 1 root wazuh 21621 Jan 5 22:07 cis_mysql5-6_community.yml.disabled
-rw-r----- 1 root wazuh 27694 Jan 5 22:07 cis_mysql5-6_enterprise.yml.disabled
-rw-r----- 1 root wazuh 69550 Jan 5 22:07 cis_nginx_1.yml.disabled
-rw-r----- 1 root wazuh 206980 Jan 5 22:07 cis_oracle_database_19c.yml.disabled
-rw-r----- 1 root wazuh 50578 Jan 5 22:07 cis_postgre-sql-13.yml.disabled
-rw-r----- 1 root wazuh 56850 Jan 5 22:07 cis_rhel5_linux.yml.disabled
-rw-r----- 1 root wazuh 210236 Jan 5 22:07 cis_rhel6_linux.yml.disabled
-rw-r----- 1 root wazuh 256642 Jan 5 22:07 cis_rhel7_linux.yml.disabled
-rw-r----- 1 root wazuh 233313 Jan 5 22:07 cis_rhel8_linux.yml.disabled
-rw-r----- 1 root wazuh 277254 Jan 5 22:07 cis_rhel9_linux.yml.disabled
-rw-r----- 1 root wazuh 60607 Jan 5 22:07 cis_sles11_linux.yml.disabled
-rw-r----- 1 root wazuh 62673 Jan 5 22:07 cis_sles12_linux.yml.disabled
-rw-r----- 1 root wazuh 180651 Jan 5 22:07 cis_sles15_linux.yml.disabled
-rw-r----- 1 root wazuh 80376 Jan 5 22:07 cis_solaris11.4.yml.disabled
-rw-r----- 1 root wazuh 63879 Jan 5 22:07 cis_solaris11.yml.disabled
-rw-r----- 1 root wazuh 35019 Jan 5 22:07 cis_sqlserver_2012.yml.disabled
-rw-r----- 1 root wazuh 34992 Jan 5 22:07 cis_sqlserver_2014.yml.disabled
-rw-r----- 1 root wazuh 34943 Jan 5 22:07 cis_sqlserver_2016.yml.disabled
-rw-r----- 1 root wazuh 35289 Jan 5 22:07 cis_sqlserver_2017.yml.disabled
-rw-r----- 1 root wazuh 33837 Jan 5 22:07 cis_sqlserver_2019.yml.disabled
-rw-r----- 1 root wazuh 206630 Jan 5 22:07 cis_ubuntu14-04.yml.disabled
-rw-r----- 1 root wazuh 206755 Jan 5 22:07 cis_ubuntu16-04.yml.disabled
-rw-r----- 1 root wazuh 246118 Jan 5 22:07 cis_ubuntu18-04.yml.disabled
-rw-r----- 1 root wazuh 396861 Jan 5 22:07 cis_ubuntu20-04.yml.disabled
-rw-r----- 1 root wazuh 328521 Jan 5 22:07 cis_ubuntu22-04.yml.disabled
-rw-r----- 1 root wazuh 678759 Jan 5 22:07 cis_win10_enterprise.yml.disabled
-rw-r----- 1 root wazuh 681902 Jan 5 22:07 cis_win11_enterprise.yml.disabled
-rw-r----- 1 root wazuh 396896 Jan 5 22:07 cis_win2012r2.yml.disabled
-rw-r----- 1 root wazuh 454594 Jan 5 22:07 cis_win2016.yml.disabled
-rw-r----- 1 root wazuh 453939 Jan 5 22:07 cis_win2019.yml.disabled
-rw-r----- 1 root wazuh 627420 Jan 5 22:07 cis_win2022.yml.disabled
-rw-r----- 1 root wazuh 19044 Jan 5 22:07 sca_unix_audit.yml.disabled
-rw-r----- 1 root wazuh 6792 Jan 5 22:07 web_vulnerabilities.yml.disabled
A test of the construction of the OVA was carried out with the new AMI using version 4.7.2 of Wazuh and the result was correct:
[root@wazuh-server ~]# ls -la /etc/r*
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc0.d -> rc.d/rc0.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc1.d -> rc.d/rc1.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc2.d -> rc.d/rc2.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc3.d -> rc.d/rc3.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc4.d -> rc.d/rc4.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc5.d -> rc.d/rc5.d
lrwxrwxrwx 1 root root 10 Mar 8 2023 /etc/rc6.d -> rc.d/rc6.d
lrwxrwxrwx 1 root root 13 Apr 11 2023 /etc/rc.local -> rc.d/rc.local
-rw-r--r-- 1 root root 1787 Jul 26 2018 /etc/request-key.conf
-rw-r--r-- 1 root root 64 Jan 11 12:45 /etc/resolv.conf
-rw-r--r-- 1 root root 1634 Nov 27 2018 /etc/rpc
-rw-r--r-- 1 root root 458 Jun 1 2023 /etc/rsyncd.conf
-rw-r--r-- 1 root root 3232 Feb 7 2023 /etc/rsyslog.conf
-rw-r--r-- 1 root root 966 Sep 22 2022 /etc/rwtab
[root@wazuh-server ~]# ls -la /var/ossec/ruleset/sca/
total 10156
drwxr-x--- 2 root wazuh 4096 Jan 10 17:58 .
drwxr-x--- 5 root wazuh 46 Jan 10 17:58 ..
-rw-r----- 1 root wazuh 207513 Jan 5 22:07 cis_amazon_linux_1.yml.disabled
-rw-r----- 1 root wazuh 236403 Jan 5 22:07 cis_amazon_linux_2.yml
-rw-r----- 1 root wazuh 47977 Jan 5 22:07 cis_apache_24.yml.disabled
-rw-r----- 1 root wazuh 33522 Jan 5 22:07 cis_apple_macOS_10.11.yml.disabled
-rw-r----- 1 root wazuh 30577 Jan 5 22:07 cis_apple_macOS_10.12.yml.disabled
-rw-r----- 1 root wazuh 30101 Jan 5 22:07 cis_apple_macOS_10.13.yml.disabled
-rw-r----- 1 root wazuh 61211 Jan 5 22:07 cis_apple_macOS_10.14.yml.disabled
-rw-r----- 1 root wazuh 65229 Jan 5 22:07 cis_apple_macOS_10.15.yml.disabled
-rw-r----- 1 root wazuh 77375 Jan 5 22:07 cis_apple_macOS_11.1.yml.disabled
-rw-r----- 1 root wazuh 90803 Jan 5 22:07 cis_apple_macOS_12.0.yml.disabled
-rw-r----- 1 root wazuh 181718 Jan 5 22:07 cis_apple_macOS_13.x.yml.disabled
-rw-r----- 1 root wazuh 150869 Jan 5 22:07 cis_apple_macOS_14.0.yml.disabled
-rw-r----- 1 root wazuh 209419 Jan 5 22:07 cis_centos6_linux.yml.disabled
-rw-r----- 1 root wazuh 262843 Jan 5 22:07 cis_centos7_linux.yml.disabled
-rw-r----- 1 root wazuh 232169 Jan 5 22:07 cis_centos8_linux.yml.disabled
-rw-r----- 1 root wazuh 240527 Jan 5 22:07 cis_debian10.yml.disabled
-rw-r----- 1 root wazuh 381099 Jan 5 22:07 cis_debian11.yml.disabled
-rw-r----- 1 root wazuh 342660 Jan 5 22:07 cis_debian12.yml.disabled
-rw-r----- 1 root wazuh 179167 Jan 5 22:07 cis_debian7.yml.disabled
-rw-r----- 1 root wazuh 207081 Jan 5 22:07 cis_debian8.yml.disabled
-rw-r----- 1 root wazuh 206116 Jan 5 22:07 cis_debian9.yml.disabled
-rw-r----- 1 root wazuh 64290 Jan 5 22:07 cis_iis_10.yml.disabled
-rw-r----- 1 root wazuh 19741 Jan 5 22:07 cis_mongodb_36.yml.disabled
-rw-r----- 1 root wazuh 21621 Jan 5 22:07 cis_mysql5-6_community.yml.disabled
-rw-r----- 1 root wazuh 27694 Jan 5 22:07 cis_mysql5-6_enterprise.yml.disabled
-rw-r----- 1 root wazuh 69550 Jan 5 22:07 cis_nginx_1.yml.disabled
-rw-r----- 1 root wazuh 206980 Jan 5 22:07 cis_oracle_database_19c.yml.disabled
-rw-r----- 1 root wazuh 50578 Jan 5 22:07 cis_postgre-sql-13.yml.disabled
-rw-r----- 1 root wazuh 56850 Jan 5 22:07 cis_rhel5_linux.yml.disabled
-rw-r----- 1 root wazuh 210236 Jan 5 22:07 cis_rhel6_linux.yml.disabled
-rw-r----- 1 root wazuh 256642 Jan 5 22:07 cis_rhel7_linux.yml.disabled
-rw-r----- 1 root wazuh 233313 Jan 5 22:07 cis_rhel8_linux.yml.disabled
-rw-r----- 1 root wazuh 277254 Jan 5 22:07 cis_rhel9_linux.yml.disabled
-rw-r----- 1 root wazuh 60607 Jan 5 22:07 cis_sles11_linux.yml.disabled
-rw-r----- 1 root wazuh 62673 Jan 5 22:07 cis_sles12_linux.yml.disabled
-rw-r----- 1 root wazuh 180651 Jan 5 22:07 cis_sles15_linux.yml.disabled
-rw-r----- 1 root wazuh 80376 Jan 5 22:07 cis_solaris11.4.yml.disabled
-rw-r----- 1 root wazuh 63879 Jan 5 22:07 cis_solaris11.yml.disabled
-rw-r----- 1 root wazuh 35019 Jan 5 22:07 cis_sqlserver_2012.yml.disabled
-rw-r----- 1 root wazuh 34992 Jan 5 22:07 cis_sqlserver_2014.yml.disabled
-rw-r----- 1 root wazuh 34943 Jan 5 22:07 cis_sqlserver_2016.yml.disabled
-rw-r----- 1 root wazuh 35289 Jan 5 22:07 cis_sqlserver_2017.yml.disabled
-rw-r----- 1 root wazuh 33837 Jan 5 22:07 cis_sqlserver_2019.yml.disabled
-rw-r----- 1 root wazuh 206630 Jan 5 22:07 cis_ubuntu14-04.yml.disabled
-rw-r----- 1 root wazuh 206755 Jan 5 22:07 cis_ubuntu16-04.yml.disabled
-rw-r----- 1 root wazuh 246118 Jan 5 22:07 cis_ubuntu18-04.yml.disabled
-rw-r----- 1 root wazuh 396861 Jan 5 22:07 cis_ubuntu20-04.yml.disabled
-rw-r----- 1 root wazuh 328521 Jan 5 22:07 cis_ubuntu22-04.yml.disabled
-rw-r----- 1 root wazuh 678759 Jan 5 22:07 cis_win10_enterprise.yml.disabled
-rw-r----- 1 root wazuh 681902 Jan 5 22:07 cis_win11_enterprise.yml.disabled
-rw-r----- 1 root wazuh 396896 Jan 5 22:07 cis_win2012r2.yml.disabled
-rw-r----- 1 root wazuh 454594 Jan 5 22:07 cis_win2016.yml.disabled
-rw-r----- 1 root wazuh 453939 Jan 5 22:07 cis_win2019.yml.disabled
-rw-r----- 1 root wazuh 627420 Jan 5 22:07 cis_win2022.yml.disabled
-rw-r----- 1 root wazuh 19044 Jan 5 22:07 sca_unix_audit.yml.disabled
-rw-r----- 1 root wazuh 6792 Jan 5 22:07 web_vulnerabilities.yml.disabled
OVA: https://packages-dev.wazuh.com/trash/vm/wazuh-4.7.2.ova
OVA Build: https://ci.wazuh.info/view/Packages/job/Packages_Builder_OVA/328/console
Description
It was found that Wazuh OVA has the wrong SCA policy enabled, using
cis_rhel9_linux.yml
instead ofcis_amazon_linux_2.yaml
since it's running on Amazon Linux 2 This can be seen by listing the SCA policy files on a fresh-new OVAThe
/etc/os-release
file content:RCA
After unsuccessfully trying to reproduce it on an Amazon Linux 2 box and installing the Wazuh Manager or Wazuh Central Components, it was found that the reason for this is because the Wazuh OVA (both base OVA and final OVA) has a file
/etc/redhat-release
This causes wrong handling during RPM installation, leading to "detect" the OS as rhel
https://github.com/wazuh/wazuh-packages/blob/ab7ec2e03a87383da202b206df8e55433cea1107/rpms/SPECS/wazuh-manager.spec#L344-L351