Closed vedrixNL closed 6 months ago
Hello.
The use of apt-key is being deprecated due to security concerns related to third-party repositories. The deprecation of apt-key is primarily driven by the potential security risks it poses. When adding OpenPGP keys to /etc/apt/trusted.gpg
or /etc/apt/trusted.gpg.d
using apt-key
, the key becomes unconditionally trusted by APT on all other repositories configured on the system, including official Debian/Ubuntu repositories. This could allow malicious third-party repositories to replace packages on the system, posing significant security threats. As a result, the transition away from apt-key is essential for enhancing system security.
This transition consists in using the gpg
command instead of the apt-key
command. We use this type of GPG installation in some installation steps in our documentation: https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/step-by-step.html#adding-the-wazuh-repository
So this is not a Debian 12 problem, but a generic APT problem. We are adding this issue to our project and fix is as soon as possible.
I had some issues configuring the Puppet agent in the Debian 12 machine. Everything was correct until the second puppet agent -t
failed:
Notice: Requesting catalog from puppet-master.com:8140 (172.31.39.200)
Notice: Catalog compiled by ip-172-31-39-200.ec2.internal
Error: Could not retrieve catalog from remote server: Error 403 on SERVER: Forbidden request: /puppet/v3/catalog/ip-172-31-32-136. (method :post). Please see the server logs for details.
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: Error 403 on SERVER: Forbidden request: /puppet/v3/report/ip-172-31-32-136. (method :put). Please see the server logs for details.
The 8140 port was available, the configuration was correct and the machines could see each other. I changed the Puppet agent to an Ubuntu 20 machine, and with the same configuration, everything was correct.
I made several workarounds to solve this issue:
apt::keyring
. Related: https://forge.puppet.com/modules/puppetlabs/apt/readme#add-gpg-keys. This alternative was discarded because the keyring
parameter is available since Puppet version 8.1.0file
resource to manage the wazuh.list
content. This alternative was discarded because the declaration of the file had a conflict with other existing declarations of the apt
module:Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: File[/etc/apt/sources.list.d/wazuh.list] is already declared at (file: /etc/puppetlabs/code/environments/production/modules/wazuh/manifests/repo.pp, line: 41); cannot redeclare (file: /etc/puppetlabs/code/environments/production/modules/apt/manifests/setting.pp, line: 68) (file: /etc/puppetlabs/code/environments/production/modules/apt/manifests/setting.pp, line: 68, column: 3) (file: /etc/puppetlabs/code/environments/production/modules/apt/manifests/source.pp, line: 129) on node ip-172-31-35-39.ec2.internal
:heavy_check_mark: Finally, the proposed workaround is to manage the GPG and the repository manually:
import-wazuh-key
function that imports the Wazuh key with the GPG tool.concat
tool, avoiding the file
tool, which manages dynamically the content of the wazuh.list
file.This last alternative is the longer and manual one, but it is the one that does not depend on a higher version of Puppet and can be used in older versions of Puppet (6 and 7).
After the development, the Wazuh puppet deployment has been tested in:
In the three tests, the deployment succeeded.
Ubuntu 20
Debian 11
Hi,
Using Wazuh Puppet module to maintain repository inside VM with Wazuh Agent running.
During apt update you see a warning of a deprecated use of apt-key.
W: https://packages.wazuh.com/4.x/apt/dists/stable/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.
Using Debian 12, latest version of Wazuh Puppet Module. Any change that Wazuh will solve the way of storing trusted.gpg keys in the correct way or is it missing debian 12 support?
Appreciate the help and effort!