Wazuh

curl -sSL https://get.docker.com/ | sh

systemctl start docker

curl -L "https://github.com/docker/compose/releases/download/v2.12.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

chmod +x /usr/local/bin/docker-compose

docker-compose --version

git clone https://github.com/wazuh/wazuh-docker.git -b v4.7.3

cd /etc/docker/wazuh-docker/single-node

vim /etc/docker/wazuh-docker/single-node/generate-indexer-certs.yml

# Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
version: '3'
services:
generator:
image: wazuh/wazuh-certs-generator:0.0.1
hostname: wazuh-certs-generator
volumes:
- ./config/wazuh_indexer_ssl_certs/:/certificates/
- ./config/certs.yml:/config/certs.yml

environment:
  - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS

docker-compose -f generate-indexer-certs.yml run --rm generator

docker-compose up -d

docker-compose down

docker run --rm -ti wazuh/wazuh-indexer:4.7.3 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh

vi config/wazuh_indexer/internal_users.yml

vi docker-compose.yml 

docker-compose up -d

docker ps 

docker exec -it single-node-wazuh.indexer-1 bash

export INSTALLATION_DIR=/usr/share/wazuh-indexer
CACERT=$INSTALLATION_DIR/certs/root-ca.pem
KEY=$INSTALLATION_DIR/certs/admin-key.pem
CERT=$INSTALLATION_DIR/certs/admin.pem
export JAVA_HOME=/usr/share/wazuh-indexer/jdk

bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9200 -icl

exit

vi /wazuh-docker/single-node/config/wazuh_dashboard/wazuh.yml

vi docker-compose.yml

apt install nginx

docker stop single-node-wazuh.dashboard-1
docker rm single-node-wazuh.dashboard-1
docker-compose down

vim docker-compose.yml

docker-compose up -d

sudo unlink /etc/nginx/sites-enabled/default

openssl pkcs12 -in /etc/ssl/certs/wazuh.pfx -nocerts -out /etc/ssl/private/wazuh.key

 openssl rsa -in /etc/ssl/private/wazuh.key -out /etc/ssl/private/wazuh.pem

vim /etc/nginx/sites-available/wazuh

server {
    # Redirect HTTP to HTTPS
    listen 80;
    server_name soc.yrk.local;
location / {    return 301 https://$host$request_uri;}
}
server {
#This config is for HTTPS setup
listen 443 ssl;
server_name soc.yrk.local;
#SSL Cert Location
#SSLCertificateFile /chemin/vers/certificat/en .pem  pour le certificat lui meme
ssl_certificate /etc/ssl/certs/wazuh.crt;
#SSLCertificateFile /chemin/vers/certificat/en .pem pourla clé privée
ssl_certificate_key /etc/ssl/private/wazuh.pem;
#Disable NGINX current version reporting on error pages
server_tokens off;
#Force strong TLS
ssl_protocols      TLSv1.3;
ssl_prefer_server_ciphers   on;
#Disable weak ciphers
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
#Increase Upload Size
client_max_body_size 12M;
location / {
proxy_pass https://127.0.0.1:5601;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

ln -s /etc/nginx/sites-available/wazuh /etc/nginx/sites-enabled/wazuh

nginx -t

service nginx restart

docker exec -it -u 0 single-node-wazuh.indexer-1 /bin/bash

vim opensearch-security/config.yml

chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/ldapcacert.pem

# This is the main Open Distro Security configuration file where authentication
# and authorization is defined.
#
# You need to configure at least one authentication domain in the authc of this file.
# An authentication domain is responsible for extracting the user credentials from
# the request and for validating them against an authentication backend like Active Directory for example.
#
# If more than one authentication domain is configured the first one which succeeds wins.
# If all authentication domains fail then the request is unauthenticated.
# In this case an exception is thrown and/or the HTTP status is set to 401.
#
# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect
# the roles from a given backend for the authenticated user.
#
# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both.
#        http_enabled: true
#        transport_enabled: true
#
# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to
# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated.
# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "anonymous"
# and one role named "anonymous_backendrole".
# If you enable anonymous authentication all HTTP authenticators will not challenge.
#
#
# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert"
# first and the challenging one last.
# Because it's not possible to challenge a client with two different authentication methods (for example
# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation
# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request.
#
# Default value of the challenge flag is true.
#
#
# HTTP
#   basic (challenging)
#   proxy (not challenging, needs xff)
#   kerberos (challenging)
#   clientcert (not challenging, needs https)
#   jwt (not challenging)
#   host (not challenging) #DEPRECATED, will be removed in a future version.
#                          host based authentication is configurable in roles_mapping

# Authc
#   internal
#   noop
#   ldap

# Authz
#   ldap
#   noop

_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
    # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
    # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
    #filtered_alias_mode: warn
    #do_not_fail_on_forbidden: false
    #kibana:
    # Kibana multitenancy
    #multitenancy_enabled: true
    #server_username: kibanaserver
    #index: '.kibana'
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
        #internalProxies: '.*' # trust all internal proxies, regex pattern
        #remoteIpHeader:  'x-forwarded-for'
        ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
        ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
        ###### and here https://tools.ietf.org/html/rfc7239
        ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve

    authc:
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: internal
      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
          type: ldap
          config:
            enable_ssl: true
            pemtrustedcas_filepath: /usr/share/wazuh-indexer/opensearch-security/ldapcacert.pem
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: false
            hosts:
            - ad1.yrk.local:636
            bind_dn: 'cn=bind,ou=sys,ou=informatique,ou=users,dc=yrk,dc=local'
            password: 'your_user_password'
            userbase: 'DC=yrk,DC=local'
            usersearch: '(sAMAccountName={0})'
            username_attribute: cn

    authz:
      ldap:
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          type: ldap
          config:
            enable_ssl: true
            pemtrustedcas_filepath: /usr/share/wazuh-indexer/opensearch-security/ldapcacert.pem
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: false
            hosts:
            - ad1.yrk.local:636
            bind_dn: 'cn=bind,ou=sys,ou=informatique,ou=users,dc=yrk,dc=local'
            password: 'your_user_password'
            userbase: 'DC=yrk,DC=local'
            usersearch: '(uid={0})'
            #username_attribute: uid
            username_attribute: 'sAMAccountName'
            rolesearch_enabled: true
            rolebase: 'DC=yrk,DC=local'
            rolesearch: '(member={0})'
            userroleattribute: null
            userrolename: 'memberOf'
            rolename: cn
            resolve_nested_roles: false
            skip_users:
            - kibanaserver
            - admin

export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/opensearch-security/config.yml -icl -key /usr/shar    e/wazuh-indexer/certs/admin-key.pem -cert /usr/share/wazuh-indexer/certs/admin.pem -cacert /usr/share/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

vim opensearch-security/roles_mapping.yml

all_access:
  reserved: false
  backend_roles:
  - "admin"
  - "Sys"
  description: "Maps admin to all_access"

export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /usr/share/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /usr/shar    e/wazuh-indexer/certs/admin-key.pem -cert /usr/share/wazuh-indexer/certs/admin.pem -cacert /usr/share/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv

docker exec -it -u 0 single-node-wazuh.dashboard-1 /bin/bash

vim data/wazuh/config/wazuh.yml