Windows agent enrollment configuration block overindented

[Rebits]

Wazuh version	Component	Install type	Install method	Platform
4.4.0-0	Install	Agent	Packages	Windows Server 2016

Description

Using deployment variables in Windows agent installation, the enrollment configuration block provisioned is over-indented.

Steps to reproduce

• Download the Wazuh Windows agent package
• Install Windows agent using enrollment deployment variables, for example: ./wazuh-agent-4.3.9-1.msi /q WAZUH_REGISTRATION_SERVER="10.0.0.2"
• Check enrollment configuration

    <enrollment>
      	<enabled>yes</enabled>
        <manager_address>10.0.0.2</manager_address>
    </enrollment>

Expected

    <enrollment>
      <enabled>yes</enabled>
      <manager_address>10.0.0.2</manager_address>
    </enrollment>

[davidcr01]

Update Report

Analysis

It seems that the problem is in the src/win32/InstallerScripts.vbs file, in the following lines:

wazuh/src/win32/InstallerScripts.vbs

Lines 155 to 202 in 48e49b1

	If WAZUH_REGISTRATION_SERVER <> "" or WAZUH_REGISTRATION_PORT <> "" or WAZUH_REGISTRATION_PASSWORD <> "" or WAZUH_REGISTRATION_CA <> "" or WAZUH_REGISTRATION_CERTIFICATE <> "" or WAZUH_REGISTRATION_KEY <> "" or WAZUH_AGENT_NAME <> "" or WAZUH_AGENT_GROUP <> "" or ENROLLMENT_DELAY <> "" Then
	enrollment_list = " <enrollment>" & vbCrLf
	enrollment_list = enrollment_list & " <enabled>yes</enabled>" & vbCrLf
	enrollment_list = enrollment_list & " </enrollment>" & vbCrLf
	enrollment_list = enrollment_list & " </client>" & vbCrLf
	strText = Replace(strText, " </client>", enrollment_list)
	If WAZUH_REGISTRATION_SERVER <> "" Then
	strText = Replace(strText, " </enrollment>", " <manager_address>" & WAZUH_REGISTRATION_SERVER & "</manager_address>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_REGISTRATION_PORT <> "" Then
	strText = Replace(strText, " </enrollment>", " <port>" & WAZUH_REGISTRATION_PORT & "</port>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_REGISTRATION_PASSWORD <> "" Then
	Set objFile = objFSO.CreateTextFile(home_dir & "authd.pass", ForWriting)
	objFile.WriteLine WAZUH_REGISTRATION_PASSWORD
	objFile.Close
	strText = Replace(strText, " </enrollment>", " <authorization_pass_path>authd.pass</authorization_pass_path>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_REGISTRATION_CA <> "" Then
	strText = Replace(strText, " </enrollment>", " <server_ca_path>" & WAZUH_REGISTRATION_CA & "</server_ca_path>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_REGISTRATION_CERTIFICATE <> "" Then
	strText = Replace(strText, " </enrollment>", " <agent_certificate_path>" & WAZUH_REGISTRATION_CERTIFICATE & "</agent_certificate_path>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_REGISTRATION_KEY <> "" Then
	strText = Replace(strText, " </enrollment>", " <agent_key_path>" & WAZUH_REGISTRATION_KEY & "</agent_key_path>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_AGENT_NAME <> "" Then
	strText = Replace(strText, " </enrollment>", " <agent_name>" & WAZUH_AGENT_NAME & "</agent_name>"& vbCrLf &" </enrollment>")
	End If
	If WAZUH_AGENT_GROUP <> "" Then
	strText = Replace(strText, " </enrollment>", " <groups>" & WAZUH_AGENT_GROUP & "</groups>"& vbCrLf &" </enrollment>")
	End If
	If ENROLLMENT_DELAY <> "" Then
	strText = Replace(strText, " </enrollment>", " <delay_after_enrollment>" & ENROLLMENT_DELAY & "</delay_after_enrollment>"& vbCrLf &" </enrollment>")
	End If
	End If

It can be observed that the enrollment tag contains 4 spaces of separator, whereas the contained subtags contain 8 spaces (should be 4+2 spaces)

"    <enrollment>" 
"....<>"
"        <enabled>yes</enabled>"
"        <manager_address>"
"........<>"

Development

To fix this, the solution is just to remove two spaces of the enrollment subtags (manager_address, port, authorization_pass_path, server_ca_path, agent_certificate_path, agent_key_path, agent_name, groups, delay_after_enrollment)

To check this, it's necessary to create a Windows package and check if the Windows agent enrollment configuration is not overidented.

To proceed, I followed the documentation steps: https://documentation.wazuh.com/current/development/packaging/generate-windows-package.html

After pushing the changes, I generated the compiled Windows agent with the following command:

sudo ./generate_compiled_windows_agent.sh -b 15324-windows-agent-enrollment-configuration-block-overindented -s /tmp -r myrevision

And copied it to the Windows system, in the same path where the generate_wazuh_msi.ps1 script is located (wazuh-packages/windows).

I generated the .msi file with the command ./generate_wazuh_msi.ps1 -OPTIONAL_REVISION my.revision -SIGN no -WIX_TOOLS_PATH C:\WiX_Toolset_v3.11\bin

⚠️ Note: make sure the binaries of the Wix Toolset are located in a path without spaces.

Finally, by running the Powershell with Administrator permissions, I executed the ./wazuh-agent-4.5.0-my.revision.msi /q WAZUH_REGISTRATION_SERVER="10.0.0.2" command.

✔️ With this, it is confirmed that the enrollment block configuration is not overindented anymore: