Wazuh agent installation on Alpine Linux System

[Deblintrake09]

Target version	Related issue	Related PR
4.4.0	wazuh/wazuh#4592	wazuh/wazuh#14726

Description

This change aims to allow for the correct APK package on Alpine Linux. This testing aims to verify the correct compilation and installation on Wazuh agent as well as the correct installation using the install.sh script. Also, the behavior of the agent on an Alpine OS should be checked, by looking at the basic functions.

Proposed checks

• Compile and install Wazuh agent

  Steps to reproduce

  1. Install Dependencies

  apk --update add openssl openssl-dev libgcc make gcc g++ cmake curl automake linux-headers autoconf libtool procps python3 gettext-dev
  

  2. Download Repository

  wget https://codeload.github.com/wazuh/wazuh/zip/refs/heads/4592-wazuh-agent-package-for-alpine-linux
  

  3. Build Package

  make deps TARGET=agent EXTERNAL_SRC_ONLY=yes -j$(nproc)
  make TARGET=agent -j$(nproc) DEBUG=1
  

  4. Execute install.sh installation script

  cd 4592-wazuh-agent-package-for-alpine-linux
  ./install.sh
  
  5. Check agent works properly
  </details>
  
  

• Check the agent works properly

  • Check SCA generates alerts in manager
  • Check FIM detects file creation green_circle
  • Check syscheck detects file creation
  • Check rootcheck generates alerts
  • Check Logcollector works correctly

Expected results

The agent's package is built and installed successfully.

Configurations

The testing should be done with the default configuration to check the default behavior of the agent.

[Deblintrake09]

Review data

Tester	PR commit
@Deblintrake09	601c862

Testing environment

OS	OS version	Deployment	Image/AMI	Notes
ALPINE	3.16.2	LOCAL | VBox	3.16.2 Standard ISO

Tested packages

wazuh-manager	wazuh-agent
4.3.8 manager	-

Status

• In progress
• Pending Review
• QA team leader approved (@damarisg)
• QA manager approved (@jmv74211)
• Development team leader approved (@chemamartinez)

Conclusion 🟡

Building the agent on Alpine Linux was successful. The agent works correctly. Syscollector is not collecting packages but it is a known issue, caused by a difference in package format for Alpine. - Issue wazuh/wazuh#13703

Note: No upgrade possible, no other branch compiles on alpine.

[Deblintrake09]

Task Results

Fresh Install

Build and install the wazuh-agent 🟢

• Install dependencies

apk --update add openssl openssl-dev libgcc make gcc g++ cmake curl automake linux-headers autoconf libtool procps python3 gettext-dev
(41/46) Installing openssl-dev (1.0.2u-r0)
(42/46) Installing libproc (3.3.15-r0)
(43/46) Installing procps (3.3.15-r0)
(44/46) Installing libffi (3.2.1-r4)
(45/46) Installing gdbm (1.13-r1)
(46/46) Installing python3 (3.6.9-r1)
Executing busybox-1.28.4-r3.trigger
Executing ca-certificates-20191127-r2.trigger
OK: 460 MiB in 129 packages

• Download the repository

# wget https://codeload.github.com/wazuh/wazuh/zip/refs/heads/4592-wazuh-agent-package-for-alpine-linux
--2022-09-19 18:41:52--  https://codeload.github.com/wazuh/wazuh/zip/refs/heads/4592-wazuh-agent-package-for-alpine-linux
Resolving codeload.github.com... 20.201.28.149
Connecting to codeload.github.com|20.201.28.149|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/zip]
Saving to: '4592-wazuh-agent-package-for-alpine-linux'

4592-wazuh-agent-package-for-alpin     [        <=>                                                     ]  10.23M  5.72MB/s    in 1.8s    

2022-09-19 18:41:55 (5.72 MB/s) - '4592-wazuh-agent-package-for-alpine-linux' saved [10731107

• Build the package

# cd wazuh-4592-wazuh-agent-package-for-alpine-linux/
# cd src/
# make deps TARGET=agent EXTERNAL_SRC_ONLY=yes -j$(nproc)
curl -so external/popt.tar.gz https://packages.wazuh.com/deps/17/libraries/sources/popt.tar.gz
cd external && gunzip popt.tar.gz
cd external && tar -xf popt.tar
rm external/popt.tar
curl -so external/rpm.tar.gz https://packages.wazuh.com/deps/17/libraries/sources/rpm.tar.gz
cd external && gunzip rpm.tar.gz
cd external && tar -xf rpm.tar
rm external/rpm.tar

# make TARGET=agent -j$(nproc) DEBUG=1

• Install the agent using the install script
  

• Check agent's version
  

• Start the agent and check status
  

• Check agent is registered in manager

# /var/ossec/bin/agent_control -l

Wazuh agent_control. List of available agents:
   ID: 005, Name: wazuh.test.org, IP: any, Active

Check the agent works properly 🟡

Check syscollector reports information to manager 🟡

• Check agent's database in manager

SELECT * FROM sys_osinfo;
0|2022/09/21 16:32:27|wazuh.test.org|x86_64|Alpine Linux|||||||alpine|Linux|5.15.68-0-lts|#1-Alpine SMP Fri, 16 Sep 2022 06:29:31 +0000||1663777947890832252||0|7995a11b888a28e1462180bb8bf084895ad79dc0

SELECT * FROM sys_hwinfo;
0|2022/09/21 16:32:27|0|11th Gen Intel(R) Core(TM) i7-1165G7 @ 2.80GHz|1|1690.0|2030088|1749520|14|16c2bd5ff2ec515b1df96229a2ee21f8257b4160

SELECT * FROM sys_netaddr;
0|eth0|ipv6|fe80::a00:27ff:fe08:a746|ffff:ffff:ffff:ffff::||b79580cf4a33c6cac822e2872b6e0f77d6327dd1|64ea3c3fa800c90926f34fc90dd9402393f71e00
0|eth0|ipv4|10.0.2.15|255.255.255.0|10.0.2.15|61c257dab306609ebddb2c05137ec86f76af751a|e499c93734efd5b7664bdd6f17a40f56b178b82d

SELECT * FROM sys_netiface;
0|2022/09/21 16:32:27|eth0||ethernet|up|1500|08:00:27:08:a7:46|70310|156145|5113946|220677190|0|0|0|0|701a384e71a390f3eaf96f74ed089a1bd60ed250|d4aa8b01955e438235d586585492f3f5edceec1b

SELECT * FROM sys_ports;
0|2022/09/21 14:32:25|tcp|0.0.0.0|22|0.0.0.0|0|0|0|11312|listening|0||88055b4e22a4c1bcd07cd1526ab0dc98bc99271e|b00e04f7f423d177a6a4ad36800597688cd66d83
0|2022/09/21 14:32:25|tcp6|::|22|::|0|0|0|11314|listening|0||81924e528264f5eeee424cf3e0a9571fd375bc24|b423cd1ff182fcacf60a67e211aad8be01c97e9e

SELECT * FROM sys_processes;
0|2022/09/21 16:32:27|8515|vi|T|1996|0|0|vi|requirements.txt|root|root|root|root|root|root|root|20|0|411|1644|1|0|1663766518|8515|1974|1|8515|1025|0|21c5a8d9bae6de0fff0e2ccd9df358c6656f2259
0|2022/09/21 16:32:27|8583|kworker/u2:1-ev|I|2|0|0|||root|root|root|root|root|root|root|20|0|0|0|0|0|1663766518|0|0|1|8583|0|0|005e87c388e29ca9b23e23e600ca00fcd14dac31
0|2022/09/21 16:32:27|8592|kworker/u2:0-ev|I|2|0|0|||root|root|root|root|root|root|root|20|0|0|0|0|0|1663766518|0|0|1|8592|0|0|4f3eb9a19fae07006aa35f55ddb3e671e2ecb3ed

sqlite> SELECT * FROM sys_programs;

Conclusion: Syscollector works but does not report installed packages.

Check SCA generates alerts in manager 🟢

• Check alerts.log for SCA alerts

cat /var/ossec/logs/alerts/alerts.log

** Alert 1663770754.137966: - sca,gdpr_IV_35.7.d,pci_dss_2.2,nist_800_53_CM.1,tsc_CC7.1,tsc_CC7.2,
2022 Sep 21 14:32:34 (wazuh.test.org) any->sca
Rule: 19005 (level 9) -> 'SCA summary: System audit for Unix based systems: Score less than 30% (18)'
{"type":"summary","scan_id":2009818547,"name":"System audit for Unix based systems","policy_id":"unix_audit","file":"sca_unix_audit.yml","description":"Guidance for establishing a secure configuration for Unix based systems.","references":"https://www.ssh.com/ssh/","passed":2,"failed":9,"invalid":12,"total_checks":23,"score":18.181818008422852,"start_time":1663770743,"end_time":1663770743,"hash":"f9fb3c8eb07f4146995de8f7078993935e28e1cdabb99ef7f491483d70ef0a1a","hash_file":"8d4524a39127e669952077f0a8039bb90d228732c62ad4ee44d74dc706d31e5f","force_alert":"1"}
sca.type: summary
sca.scan_id: 2009818547
sca.policy: System audit for Unix based systems
sca.description: Guidance for establishing a secure configuration for Unix based systems.
sca.policy_id: unix_audit
sca.passed: 2
sca.failed: 9
sca.invalid: 12
sca.total_checks: 23
sca.score: 18
sca.file: sca_unix_audit.yml

Check FIM detects file creation 🟢

• Add test directory to monitor

 <directories realtime="yes">/testdir</directories>

• Restart Agent
• Add/delete file to check realtime monitoring

# touch /testdir/testfile_realtime.txt

{"timestamp":"2022-09-21T17:41:48.245+0000","rule":{"level":5,"description":"File added to the system.","id":"554","firedtimes":1,"mail":false,"groups":["ossec","syscheck","syscheck_entry_added","syscheck_file"],"pci_dss":["11.5"],"gpg13":["4.11"],"gdpr":["II_5.1.f"],"hipaa":["164.312.c.1","164.312.c.2"],"nist_800_53":["SI.7"],"tsc":["PI1.4","PI1.5","CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782108.150062","full_log":"File '/testdir/testfile_realtime.txt' added\nMode: realtime\n","syscheck":{"path":"/testdir/testfile_realtime.txt","mode":"realtime","size_after":"0","perm_after":"rw-r--r--","uid_after":"0","gid_after":"0","md5_after":"d41d8cd98f00b204e9800998ecf8427e","sha1_after":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256_after":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","uname_after":"root","gname_after":"root","mtime_after":"2022-09-21T18:42:12","inode_after":261426,"event":"added"},"decoder":{"name":"syscheck_new_entry"},"location":"syscheck"}

# touch /testdir/testfile_realtime.txt

{"timestamp":"2022-09-21T17:42:25.240+0000","rule":{"level":7,"description":"Integrity checksum changed.","id":"550","mitre":{"id":["T1565.001"],"tactic":["Impact"],"technique":["Stored Data Manipulation"]},"firedtimes":1,"mail":false,"groups":["ossec","syscheck","syscheck_entry_modified","syscheck_file"],"pci_dss":["11.5"],"gpg13":["4.11"],"gdpr":["II_5.1.f"],"hipaa":["164.312.c.1","164.312.c.2"],"nist_800_53":["SI.7"],"tsc":["PI1.4","PI1.5","CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782145.150762","full_log":"File '/testdir/testfile_realtime.txt' modified\nMode: realtime\nChanged attributes: mtime\nOld modification time was: '1663785732', now it is '1663785769'\n","syscheck":{"path":"/testdir/testfile_realtime.txt","mode":"realtime","size_after":"0","perm_after":"rw-r--r--","uid_after":"0","gid_after":"0","md5_after":"d41d8cd98f00b204e9800998ecf8427e","sha1_after":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256_after":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","uname_after":"root","gname_after":"root","mtime_before":"2022-09-21T18:42:12","mtime_after":"2022-09-21T18:42:49","inode_after":261426,"changed_attributes":["mtime"],"event":"modified"},"decoder":{"name":"syscheck_integrity_changed"},"location":"syscheck"}
":"File deleted.","id":"553","mitre":{"id":["T1070.004","T1485"],"tactic":["Defense Evasion","Impact"],"technique":["File Deletion","Data Destruction"]},"firedtimes":1,"mail":false,"groups":["ossec","syscheck","syscheck_entry_deleted","syscheck_file"],"pci_dss":["11.5"],"gpg13":["4.11"],"gdpr":["II_5.1.f"],"hipaa":["164.312.c.1","164.312.c.2"],"nist_800_53":["SI.7"],"tsc":["PI1.4","PI1.5","CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782442.151560","full_log":"File '/testdir/testfile_realtime.txt' deleted\nMode: realtime\n","syscheck":{"path":"/testdir/testfile_realtime.txt","mode":"realtime","size_after":"0","perm_after":"rw-r--r--","uid_after":"0","gid_after":"0","md5_after":"d41d8cd98f00b204e9800998ecf8427e","sha1_after":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256_after":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","uname_after":"root","gname_after":"root","mtime_after":"2022-09-21T18:42:49","inode_after":261426,"event":"deleted"},"decoder":{"name":"syscheck_deleted"},"location":"syscheck"}

Check rootcheck generates alerts 🟢

• Start Agent and wait for rootcheck scan
• Check rootcheck alerts

{"timestamp":"2022-09-21T17:41:31.449+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":23,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782091.148513","full_log":"Trojaned version of file '/usr/sbin/sendmail' detected. Signature used: 'bash|fuck' (Generic).","decoder":{"name":"rootcheck"},"data":{"title":"Trojaned version of file detected.","file":"/usr/sbin/sendmail"},"location":"rootcheck"}
{"timestamp":"2022-09-21T17:41:32.040+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":24,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782092.148879","full_log":"Trojaned version of file '/sbin/syslogd' detected. Signature used: 'bash|/usr/lib/pt07|/dev/[^cln]]|syslogs\\.h|proc\\.h' (Generic).","decoder":{"name":"rootcheck"},"data":{"title":"Trojaned version of file detected.","file":"/sbin/syslogd"},"location":"rootcheck"}
{"timestamp":"2022-09-21T17:41:32.056+0000","rule":{"level":7,"description":"Host-based anomaly detection event (rootcheck).","id":"510","firedtimes":25,"mail":false,"groups":["ossec","rootcheck"],"pci_dss":["10.6.1"],"gdpr":["IV_35.7.d"]},"agent":{"id":"005","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE08:A746"},"manager":{"name":"c3"},"id":"1663782092.149276","full_log":"Trojaned version of file '/usr/bin/killall' detected. Signature used: '/dev/[^t%]|proc\\.h|bash|tmp' (Generic).","decoder":{"name":"rootcheck"},"data":{"title":"Trojaned version of file detected.","file":"/usr/bin/killall"},"location":"rootcheck"}

Check Logcollector works correctly 🟢

• Start the agent
• Push log message to /var/log/messages

  Sep 29 15:15:15 localhost sshd[25474]: Accepted password for fake-user from 192.168.255.255 port 49765 ssh2
  Sep 29 15:15:15 localhost sshd[25474]: invalid user fake-user2 from 192.168.255.255 port 69696 ssh2

• Check manager's alerts

 {"timestamp":"2022-09-29T19:30:10.202+0000","rule":{"level":3,"description":"sshd: authentication success.","id":"5715","mitre":{"id":["T1078","T1021"],"tactic":["Defense Evasion","Persistence","Privilege Escalation","Initial Access","Lateral Movement"],"technique":["Valid Accounts","Remote Services"]},"firedtimes":1,"mail":false,"groups":["syslog","sshd","authentication_success"],"gdpr":["IV_32.2"],"gpg13":["7.1","7.2"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7"],"pci_dss":["10.2.5"],"tsc":["CC6.8","CC7.2","CC7.3"]},"agent":{"id":"001","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE7D:164F"},"manager":{"name":"c3"},"id":"1664479810.570493","full_log":"Sep 29 15:15:15 test-wazuh sshd[25474]: Accepted password for fake-user from 192.168.255.255 port 49765 ssh2","predecoder":{"program_name":"sshd","timestamp":"Sep 29 15:15:15","hostname":"test-wazuh"},"decoder":{"parent":"sshd","name":"sshd"},"data":{"srcip":"192.168.255.255","srcport":"49765","dstuser":"fake-user"},"location":"/var/log/messages"}
 {"timestamp":"2022-09-29T19:33:20.374+0000","rule":{"level":5,"description":"sshd: Attempt to login using a non-existent user","id":"5710","mitre":{"id":["T1110.001","T1021.004","T1078"],"tactic":["Credential Access","Lateral Movement","Defense Evasion","Persistence","Privilege Escalation","Initial Access"],"technique":["Password Guessing","SSH","Valid Accounts"]},"firedtimes":1,"mail":false,"groups":["syslog","sshd","authentication_failed","invalid_login"],"gdpr":["IV_35.7.d","IV_32.2"],"gpg13":["7.1"],"hipaa":["164.312.b"],"nist_800_53":["AU.14","AC.7","AU.6"],"pci_dss":["10.2.4","10.2.5","10.6.1"],"tsc":["CC6.1","CC6.8","CC7.2","CC7.3"]},"agent":{"id":"001","name":"wazuh.test.org","ip":"FE80:0000:0000:0000:0A00:27FF:FE7D:164F"},"manager":{"name":"c3"},"id":"1664480000.571509","full_log":"Sep 29 15:15:15 test-wazuh sshd[25474]: Invalid user fake-user2 from 192.168.255.255 port 69696 ssh2","predecoder":{"program_name":"sshd","timestamp":"Sep 29 15:15:15","hostname":"test-wazuh"},"decoder":{"parent":"sshd","name":"sshd"},"data":{"srcip":"192.168.255.255","srcport":"69696","srcuser":"fake-user2"},"location":"/var/log/messages"}