Wazuh certificates script output mentions components not specified in the config.yml file when used with the -A option

[rauldpm]

Description

In the tests of the issue #2834, an unwanted behavior has been found when creating the Wazuh indexer certificates, since the script shows an output that does not correspond to the desired action.

If the config.yml file is configured only with Wazuh indexer and the -A option of wazuh-certs.tool.sh is used, it displays messages indicating the creation of certificates for components not specified in the config.yml file, although they are not finally created

root@debian11:/home/vagrant# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-certs-tool.sh
root@debian11:/home/vagrant# curl -sO https://packages-dev.wazuh.com/4.8/config.yml
root@debian11:/home/vagrant# nano config.yml 
root@debian11:/home/vagrant# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "192.168.56.44"
root@debian11:/home/vagrant# bash ./wazuh-certs-tool.sh -A
20/02/2024 19:12:44 INFO: Generating the root certificate.
20/02/2024 19:12:44 INFO: Generating Admin certificates.
20/02/2024 19:12:44 INFO: Admin certificates created.
20/02/2024 19:12:44 INFO: Generating Wazuh indexer certificates.
20/02/2024 19:12:44 INFO: Wazuh indexer certificates created.
20/02/2024 19:12:44 INFO: Generating Filebeat certificates.
20/02/2024 19:12:44 INFO: Generating Wazuh dashboard certificates.
root@debian11:/home/vagrant# tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
./
./admin.pem
./admin-key.pem
./root-ca.pem
./root-ca.key
./node-1-key.pem
./node-1.pem

Although the -A option is used to create all certificates and, effectively, an appropriate configuration is not being passed for this option, the behavior seen is not desired, instead, we should consider, in principle, the following options

1. The script analyzes the configuration file and if the config.yml file does not have the complete configuration when used with the -A option, an error message should be displayed
2. The script ingests the config.yml and only shows the messages of the created certificates, omitting the components excluded from the configuration (taking the -A option as read and create what you can)

Tasks

• Fix the output of the certificate script to match the certificates that have been created

[davidcr01]

Update Report

Alternatives

Related to the alternatives that @rauldpm mentioned, the behavior of the Wazuh cert tool is the first one. The cert tool creates the certificates for the nodes specified in the config.yml, but if the configuration is wrong (incomplete), the certificates are not created. The problem is the debug generated in the process.

Development

The problem was that the message was outside the condition that checks if there are nodes to generate the certificates. Moving the message inside the condition fixes the problem.

Before:

function cert_generateFilebeatcertificates() {

    common_logger "Generating Filebeat certificates."
    if [ ${#server_node_names[@]} -gt 0 ]; then

After:

function cert_generateFilebeatcertificates() {

    if [ ${#server_node_names[@]} -gt 0 ]; then
    common_logger "Generating Filebeat certificates."

Testing

1. 🟢 Testing the reported case:

root@ubuntu221:/home/vagrant# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "192.168.56.44"

root@ubuntu221:/home/vagrant# bash wazuh-certs-tool.sh -A
23/02/2024 12:50:27 INFO: Generating the root certificate.
23/02/2024 12:50:27 INFO: Generating Admin certificates.
23/02/2024 12:50:28 INFO: Admin certificates created.
23/02/2024 12:50:28 INFO: Generating Wazuh indexer certificates.
23/02/2024 12:50:28 INFO: Wazuh indexer certificates created.

root@ubuntu221:/home/vagrant# ls wazuh-certificates/
admin-key.pem  admin.pem  node-1-key.pem  node-1.pem  root-ca.key  root-ca.pem
root@ubuntu221:/home/vagrant# 

Only the indexer certificates are created and the output confirms it.

2. 🟢 Testing the reported case with the Installation Assistant:

root@ubuntu221:/home/vagrant# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "192.168.56.44"

root@ubuntu221:/home/vagrant# bash wazuh-install.sh -g
23/02/2024 12:52:16 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
23/02/2024 12:52:16 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2024 12:52:49 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2024 12:52:49 INFO: --- Configuration files ---
23/02/2024 12:52:49 INFO: Generating configuration files.
23/02/2024 12:52:49 INFO: Generating the root certificate.
23/02/2024 12:52:50 INFO: Generating Admin certificates.
23/02/2024 12:52:50 INFO: Generating Wazuh indexer certificates.
23/02/2024 12:52:50 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.

root@ubuntu221:/home/vagrant# tar -xvf wazuh-install-files.tar 
wazuh-install-files/
wazuh-install-files/root-ca.key
wazuh-install-files/admin-key.pem
wazuh-install-files/wazuh-passwords.txt
wazuh-install-files/config.yml
wazuh-install-files/root-ca.pem
wazuh-install-files/admin.pem
wazuh-install-files/node-1-key.pem
wazuh-install-files/node-1.pem
root@ubuntu221:/home/vagrant# 

Only the indexer certificates are created and the output confirms it.

3. 🟢 Testing the reported case with the Cert tool - uncomplete configuration:

root@ubuntu221:/home/vagrant# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "192.168.56.44"
    - name: node-2
   
root@ubuntu221:/home/vagrant# bash wazuh-certs-tool.sh -A
23/02/2024 13:03:05 INFO: Generating the root certificate.
23/02/2024 13:03:06 INFO: Generating Admin certificates.
23/02/2024 13:03:06 INFO: Admin certificates created.
23/02/2024 13:03:06 INFO: Generating Wazuh indexer certificates.
23/02/2024 13:03:07 ERROR: Invalid IP or DNS 

root@ubuntu221:/home/vagrant# ls wazuh-certificates/
ls: cannot access 'wazuh-certificates/': No such file or directory
root@ubuntu221:/home/vagrant# 

No certificates are created and the output confirms it.

4. 🟢 Testing the reported case with the Installation Assistant - uncomplete configuration:

root@ubuntu221:/home/vagrant# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "192.168.56.44"
    - name: node-2
    
root@ubuntu221:/home/vagrant# bash wazuh-install.sh -g
23/02/2024 13:04:28 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
23/02/2024 13:04:28 INFO: Verbose logging redirected to /var/log/wazuh-install.log
23/02/2024 13:04:45 INFO: Verifying that your system meets the recommended minimum hardware requirements.
23/02/2024 13:04:45 INFO: --- Configuration files ---
23/02/2024 13:04:45 INFO: Generating configuration files.
23/02/2024 13:04:46 INFO: Generating the root certificate.
23/02/2024 13:04:46 INFO: Generating Admin certificates.
23/02/2024 13:04:46 INFO: Generating Wazuh indexer certificates.
23/02/2024 13:04:47 ERROR: Invalid IP or DNS 

root@ubuntu221:/home/vagrant# tar -xvf wazuh-install-files.tar 
tar: wazuh-install-files.tar: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now
root@ubuntu221:/home/vagrant# 

No certificates are created and the output confirms it.