Closed rauldpm closed 7 months ago
Related to the alternatives that @rauldpm mentioned, the behavior of the Wazuh cert tool is the first one. The cert tool creates the certificates for the nodes specified in the config.yml
, but if the configuration is wrong (incomplete), the certificates are not created. The problem is the debug generated in the process.
The problem was that the message was outside the condition that checks if there are nodes to generate the certificates. Moving the message inside the condition fixes the problem.
Before:
function cert_generateFilebeatcertificates() {
common_logger "Generating Filebeat certificates."
if [ ${#server_node_names[@]} -gt 0 ]; then
After:
function cert_generateFilebeatcertificates() {
if [ ${#server_node_names[@]} -gt 0 ]; then
common_logger "Generating Filebeat certificates."
root@ubuntu221:/home/vagrant# cat config.yml
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: "192.168.56.44"
root@ubuntu221:/home/vagrant# bash wazuh-certs-tool.sh -A
23/02/2024 12:50:27 INFO: Generating the root certificate.
23/02/2024 12:50:27 INFO: Generating Admin certificates.
23/02/2024 12:50:28 INFO: Admin certificates created.
23/02/2024 12:50:28 INFO: Generating Wazuh indexer certificates.
23/02/2024 12:50:28 INFO: Wazuh indexer certificates created.
root@ubuntu221:/home/vagrant# ls wazuh-certificates/
admin-key.pem admin.pem node-1-key.pem node-1.pem root-ca.key root-ca.pem
root@ubuntu221:/home/vagrant#
Only the indexer certificates are created and the output confirms it.
root@ubuntu221:/home/vagrant# cat config.yml
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: "192.168.56.44"
root@ubuntu221:/home/vagrant# bash wazuh-install.sh -g
23/02/2024 12:52:16 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
23/02/2024 12:52:16 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2024 12:52:49 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2024 12:52:49 INFO: --- Configuration files ---
23/02/2024 12:52:49 INFO: Generating configuration files.
23/02/2024 12:52:49 INFO: Generating the root certificate.
23/02/2024 12:52:50 INFO: Generating Admin certificates.
23/02/2024 12:52:50 INFO: Generating Wazuh indexer certificates.
23/02/2024 12:52:50 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
root@ubuntu221:/home/vagrant# tar -xvf wazuh-install-files.tar
wazuh-install-files/
wazuh-install-files/root-ca.key
wazuh-install-files/admin-key.pem
wazuh-install-files/wazuh-passwords.txt
wazuh-install-files/config.yml
wazuh-install-files/root-ca.pem
wazuh-install-files/admin.pem
wazuh-install-files/node-1-key.pem
wazuh-install-files/node-1.pem
root@ubuntu221:/home/vagrant#
Only the indexer certificates are created and the output confirms it.
root@ubuntu221:/home/vagrant# cat config.yml
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: "192.168.56.44"
- name: node-2
root@ubuntu221:/home/vagrant# bash wazuh-certs-tool.sh -A
23/02/2024 13:03:05 INFO: Generating the root certificate.
23/02/2024 13:03:06 INFO: Generating Admin certificates.
23/02/2024 13:03:06 INFO: Admin certificates created.
23/02/2024 13:03:06 INFO: Generating Wazuh indexer certificates.
23/02/2024 13:03:07 ERROR: Invalid IP or DNS
root@ubuntu221:/home/vagrant# ls wazuh-certificates/
ls: cannot access 'wazuh-certificates/': No such file or directory
root@ubuntu221:/home/vagrant#
No certificates are created and the output confirms it.
root@ubuntu221:/home/vagrant# cat config.yml
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: "192.168.56.44"
- name: node-2
root@ubuntu221:/home/vagrant# bash wazuh-install.sh -g
23/02/2024 13:04:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
23/02/2024 13:04:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2024 13:04:45 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2024 13:04:45 INFO: --- Configuration files ---
23/02/2024 13:04:45 INFO: Generating configuration files.
23/02/2024 13:04:46 INFO: Generating the root certificate.
23/02/2024 13:04:46 INFO: Generating Admin certificates.
23/02/2024 13:04:46 INFO: Generating Wazuh indexer certificates.
23/02/2024 13:04:47 ERROR: Invalid IP or DNS
root@ubuntu221:/home/vagrant# tar -xvf wazuh-install-files.tar
tar: wazuh-install-files.tar: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
root@ubuntu221:/home/vagrant#
No certificates are created and the output confirms it.
Description
In the tests of the issue https://github.com/wazuh/wazuh-packages/issues/2834, an unwanted behavior has been found when creating the Wazuh indexer certificates, since the script shows an output that does not correspond to the desired action.
If the
config.yml
file is configured only with Wazuh indexer and the-A
option ofwazuh-certs.tool.sh
is used, it displays messages indicating the creation of certificates for components not specified in theconfig.yml
file, although they are not finally createdAlthough the
-A
option is used to create all certificates and, effectively, an appropriate configuration is not being passed for this option, the behavior seen is not desired, instead, we should consider, in principle, the following optionsconfig.yml
file does not have the complete configuration when used with the-A
option, an error message should be displayedconfig.yml
and only shows the messages of the created certificates, omitting the components excluded from the configuration (taking the-A
option asread and create what you can
)Tasks