Improved agent Windows config. and secondary fixes #205

rshad · 2020-01-23T11:57:35Z

Hi all!

This PR adds new improvements for the agent configuration in Windows and some fixes to the templates.

Originally some of these changes were added by @JPLachance in #189. But as we do not have write access to his fork branch coveord:feature/improved-agent-configuration, then we ended up applying the merge with wazuh:devel branch in local and brought the source fork branch into a local branch in wazuh:wazuh-puppet called feature-improved-agent-windows-config.

Tasks

Merge wazuh:devel into the source branch of the user.
Discard the unnecessary changes. Improve the agent configurability and fix minor issues #189 (comment)
Push changes to the user branch locally and create a new upstream branch as a copy of it.
Adapt puppet manifests and templates to the default ossec.conf of wazuh 3.11.2.
Verify the changes on
- Windows
- Centos
- Ubuntu

Thanks, @JPLachance for contributing.

Kr,

Rshad

* Make the logging log_format configurable * Remove some duplication between the Agent configuration on Linux and Windows * Improve the Windows Agent configuration based on https://github.com/wazuh/wazuh/blob/v3.10.2/src/win32/ossec.conf * Make the generated ossec.conf file a little bit more readable by fixing ident in fragments * Remove the duplication in fragments/_sca.erb * The SCA config now applies for Windows Agents too * Improve the Windows agent syscheck configuration based on https://github.com/wazuh/wazuh/blob/v3.10.2/src/win32/ossec.conf * Make the cis cat wodle use variable from params_agent.pp * Make the open-scap wodle use variable from params_agent.pp * Make the osquery wodle use variable from params_agent.pp * Make the syscollector wodle use variable from params_agent.pp

…gent-configuration

jm404

Hi @rshad, changes look good. Please provide ossec.conf diffs so we can ensure it's rendering properly.

Best regards,

Jose

rshad · 2020-01-24T16:35:13Z

Hi all!

In this PR and as we mentioned before, we made the required changes to adapt the changes we picked up from the PR #189 and we also improved and parameterized almost all the configuration related to Wazuh agent for Windows OS. We also added some small improvements.

Tasks

Parameterize the following templates related to wazuh-agent installation on Windows.
- activeresponse. new template
- rootcheck.
Adapt the following templates to be equal to the default config wazuh 3.11.2.
- os-query
- cis-cat .
- syscollector
- sca
- agent.conf
Secondary changes and fixes for syntax errors errors which were not detected before.

Kr,

Rshad

rshad · 2020-01-24T16:52:36Z

Hi all!

Here I attach the default installation of wazuh 3.11.2 for each of CentOS, Ubuntu and Windows OSs.

Note: For some of the configuration files I reordered some config. parts so I could make the difference comparison correctly.

Kr,

Rshad

config_files.zip

rshad · 2020-01-27T13:19:43Z

ossec.conf result files after the last changes.

config_files.zip

…eck in syscheck template

jm404

Please check requested changes

manifests/params_agent.pp

manifests/manager.pp

rshad · 2020-01-28T15:57:54Z

Hi all!

We also re-configured for both, the agent and the manager, the related configuration to the variables whodata and realtime, specifying a different variable of them for each of the default two lists of directories in syscheck. The template was changed so realtime and whodata will not appear in final ossec.conf if they got assigned the value no.

      $ossec_syscheck_whodata_directories_1 = 'no'
      $ossec_syscheck_realtime_directories_1 = 'no'
      $ossec_syscheck_whodata_directories_2 = 'no'
      $ossec_syscheck_realtime_directories_2 = 'no'

wazuh-puppet/templates/fragments/_syscheck.erb

Lines 124 to 129 in 7264a35

    
             <%- if @ossec_syscheck_directories_1 -%> 
        
             <directories check_all="yes" <%- if @ossec_syscheck_whodata_directories_1 == 'yes' -%>whodata="<%=@ossec_syscheck_whodata_directories_1%>"<%- end -%> <%- if @ossec_syscheck_realtime_directories_1 == 'yes'  -%> realtime="<%=@ossec_syscheck_realtime_directories_1%>"<%- end -%>><%=@ossec_syscheck_directories_1%></directories> 
        
             <%- end -%> 
        
             <%- if @ossec_syscheck_directories_2 -%> 
        
             <directories check_all="yes" <%- if @ossec_syscheck_whodata_directories_2 == 'yes'  -%>whodata="<%=@ossec_syscheck_whodata_directories_2%>"<%- end -%> <%- if @ossec_syscheck_realtime_directories_2 == 'yes' -%> realtime="<%=@ossec_syscheck_realtime_directories_2%>"<%- end -%>><%=@ossec_syscheck_directories_2%></directories> 
        
             <%- end -%>

Kr,

Rshad

rshad · 2020-01-28T16:42:53Z

Fixed Puppet linting errors and warnings.

jm404

LGTM

JPLachance and others added 2 commits December 17, 2019 14:21

Merge remote-tracking branch 'upstream/devel' into feature/improved-a…

eed538c

…gent-configuration

rshad force-pushed the feature-improved-agent-windows-config branch from af91972 to eed538c Compare January 23, 2020 13:16

rshad requested a review from jm404 January 23, 2020 13:38

rshad self-assigned this Jan 23, 2020

rshad added the enhancement label Jan 23, 2020

rshad mentioned this pull request Jan 23, 2020

Improve the agent configurability and fix minor issues #189

Closed

rshad requested a review from manuasir January 23, 2020 13:57

rshad force-pushed the feature-improved-agent-windows-config branch 3 times, most recently from 62b7320 to 3ed0661 Compare January 23, 2020 15:04

Spaces and Indentation + parameters re-merge

fbe0893

rshad force-pushed the feature-improved-agent-windows-config branch from 3ed0661 to fbe0893 Compare January 23, 2020 15:52

rshad added 4 commits January 23, 2020 18:27

Change sca template's variables names

9cb558c

Parameterize sca template for Windows

919ed1f

Fix variable name in _syscheck template

fc07cf5

Parametrize active response for wazuh-agent

7087ffd

rshad force-pushed the feature-improved-agent-windows-config branch 5 times, most recently from e66cc00 to 90773f3 Compare January 23, 2020 18:29

Windows: Enable wodles and Add their parameters

d7d230c

rshad force-pushed the feature-improved-agent-windows-config branch from 90773f3 to d7d230c Compare January 23, 2020 18:36

Adapt _rootcheck template for Windows

76468f1

jm404 added the wazuhci/runtests label Jan 24, 2020

jm404 suggested changes Jan 24, 2020

View reviewed changes

Parameterize rootcheck config for Windows

3534320

rshad force-pushed the feature-improved-agent-windows-config branch from 74f6ee1 to 3534320 Compare January 24, 2020 11:49

Set agent.conf.erb to empty as the default config

6e85a08

rshad added 3 commits January 24, 2020 16:51

Disable manager email notification

9f87eb8

Correct variable name in activerespnse temp.

9fdf9ac

Change log_format to syslog for /var/log/mailing

c9e4ab3

rshad requested review from jm404 and xr09 January 24, 2020 16:37

rshad changed the title ~~Improved agent windows config~~ Improved agent Windows agent config. and secondary fixes Jan 24, 2020

rshad changed the title ~~Improved agent Windows agent config. and secondary fixes~~ Improved agent Windows config. and secondary fixes Jan 24, 2020

rshad added 5 commits January 25, 2020 19:00

Fix skip_nfs variable name in sca temp.

535c66c

Remove /var/log/messages as logfile

a03635e

Adapt logfiles list

504e5e3

Set email_notification to 'no' by default

9b06b9f

Fix variables names in agent active-respone temp.

841ab20

rshad added this to the Sprint - 106 milestone Jan 27, 2020

Add whodata/realtime vars for default lists of dirs + Cconditional ch…

18a66fb

…eck in syscheck template

rshad force-pushed the feature-improved-agent-windows-config branch from 9d77ef8 to 18a66fb Compare January 28, 2020 14:46

jm404 suggested changes Jan 28, 2020

View reviewed changes

manifests/params_agent.pp Outdated Show resolved Hide resolved

manifests/manager.pp Outdated Show resolved Hide resolved

Change double quote as a var. value to the be part of temp.

7264a35

rshad requested a review from jm404 January 28, 2020 15:50

rshad force-pushed the feature-improved-agent-windows-config branch 2 times, most recently from d2a0ab8 to f362a36 Compare January 28, 2020 17:15

Fix puppet lint

616cf3a

rshad force-pushed the feature-improved-agent-windows-config branch from f362a36 to 616cf3a Compare January 28, 2020 17:20

jm404 approved these changes Jan 28, 2020

View reviewed changes

jm404 merged commit afb4d63 into devel Jan 28, 2020

jm404 deleted the feature-improved-agent-windows-config branch January 28, 2020 17:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improved agent Windows config. and secondary fixes #205

Improved agent Windows config. and secondary fixes #205

rshad commented Jan 23, 2020 •

edited

Loading

jm404 left a comment

rshad commented Jan 24, 2020 •

edited

Loading

rshad commented Jan 24, 2020 •

edited

Loading

rshad commented Jan 27, 2020

jm404 left a comment

rshad commented Jan 28, 2020

rshad commented Jan 28, 2020

jm404 left a comment

Improved agent Windows config. and secondary fixes #205

Improved agent Windows config. and secondary fixes #205

Conversation

rshad commented Jan 23, 2020 • edited Loading

Tasks

jm404 left a comment

Choose a reason for hiding this comment

rshad commented Jan 24, 2020 • edited Loading

rshad commented Jan 24, 2020 • edited Loading

rshad commented Jan 27, 2020

jm404 left a comment

Choose a reason for hiding this comment

rshad commented Jan 28, 2020

rshad commented Jan 28, 2020

jm404 left a comment

Choose a reason for hiding this comment

rshad commented Jan 23, 2020 •

edited

Loading

rshad commented Jan 24, 2020 •

edited

Loading

rshad commented Jan 24, 2020 •

edited

Loading