Merge branch '3.10.2_7.3.2'

wazuh · Oct 2, 2019 · d384c73 · d384c73
2 parents 867936d + af115d7
commit d384c73
Show file tree

Hide file tree

Showing 16 changed files with 305 additions and 301 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,22 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [v3.10.2_7.3.2]
+
+### Added
+
+- Update to Wazuh v3.10.2
+
+### Changed
+
+- Moved molecule folder to Wazuh QA Repository [manuasir](https://github.com/manuasir) [#120ed16](https://github.com/wazuh/wazuh-ansible/commit/120ed163b6f131315848938beca65c1f1cad7f1b)
+
+- Refactored XPack Security configuration tasks [@jm404](https://github.com/jm404) [#246](https://github.com/wazuh/wazuh-ansible/pull/246)
+
+### Fixed
+
+- Fixed ES bootstrap password configuration [@jm404](https://github.com/jm404) [#b8803de](https://github.com/wazuh/wazuh-ansible/commit/b8803de85fb71edf090b0c076d4fe3684cd7cb36)
+
 ## [v3.10.0_7.3.2]
 
 ### Added

diff --git a/VERSION b/VERSION
@@ -1,2 +1,2 @@
-WAZUH-ANSIBLE_VERSION="v3.10.0"
-REVISION="31000"
+WAZUH-ANSIBLE_VERSION="v3.10.2"
+REVISION="31020"
diff --git a/playbooks/wazuh-elastic_stack-distributed.yml b/playbooks/wazuh-elastic_stack-distributed.yml
@@ -17,23 +17,26 @@
       elasticsearch_xpack_security: true
       node_certs_generator: true
       elasticsearch_xpack_security_password: elastic_pass
+      single_node: false
 
   vars:
     instances:
-      - name: node-1       # Important: must be equal to elasticsearch_node_name.                    
+      node1:
+        name: node-1       # Important: must be equal to elasticsearch_node_name.                    
         ip: <node-1 IP>   # When unzipping, the node will search for its node name folder to get the cert.
-
-      - name: node-2
+      node2:
+        name: node-2
         ip: <node-2 IP>
-
-      - name: node-3
+      node3:
+        name: node-3
         ip: <node-3 IP>
 
 - hosts: <node-2 IP>
   roles:
     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch
       elasticsearch_network_host: <node-2 IP>
       elasticsearch_node_name: node-2
+      single_node: false
       elasticsearch_xpack_security: true
       elasticsearch_master_candidate: true
       elasticsearch_discovery_nodes:
@@ -46,6 +49,7 @@
     - role: /etc/ansible/roles/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch 
       elasticsearch_network_host: <node-3 IP>
       elasticsearch_node_name: node-3
+      single_node: false
       elasticsearch_xpack_security: true
       elasticsearch_master_candidate: true
       elasticsearch_discovery_nodes:

diff --git a/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml b/roles/elastic-stack/ansible-elasticsearch/defaults/main.yml
@@ -19,16 +19,18 @@ elasticsearch_xpack_security_user: elastic
 elasticsearch_xpack_security_password: elastic_pass
 
 node_certs_generator: false
-node_certs_generator_ip: 172.16.0.161
 node_certs_source: /usr/share/elasticsearch
 node_certs_destination: /etc/elasticsearch/certs
 
-# Rsync
-rsync_path: /usr/bin/rsync
-rsync_user: vagrant
-rsync_extra_parameters: -avg -e 'ssh -o StrictHostKeyChecking=no' --rsync-path='sudo rsync'
 
 
+# CA generation
+master_certs_path: /es_certs
+generate_CA: true
+ca_key_name: ""
+ca_cert_name: ""
+ca_password: ""
+
 
 
 
diff --git a/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml b/roles/elastic-stack/ansible-elasticsearch/tasks/main.yml
@@ -63,140 +63,10 @@
 - import_tasks: "RMRedHat.yml"
   when: ansible_os_family == "RedHat"
 
-- name: Check if certificate exists locally
-  stat:
-    path: "{{ node_certs_destination }}/{{ elasticsearch_node_name }}.crt"
-  register: certificate_file_exists
+- import_tasks: "xpack_security.yml"
   when:
     - elasticsearch_xpack_security
 
-- name: Write the instances.yml file in the selected node (force = no)
-  template:
-    src: instances.yml.j2
-    dest: "{{ node_certs_source }}/instances.yml"
-    force: no
-  register: instances_file_exists
-  tags:
-    - config
-    - xpack-security
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-
-- name: Update instances.yml status after generation
-  stat:
-    path: "{{ node_certs_source }}/instances.yml"
-  register: instances_file_exists
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-
-- name: Check if the certificates ZIP file exists
-  stat:
-    path: "{{ node_certs_source }}/certs.zip"
-  register: xpack_certs_zip
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-
-- name: Generating certificates for Elasticsearch security
-  command: >-
-     "/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in
-     {{ node_certs_source }}/instances.yml --out {{ node_certs_source }}/certs.zip"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - not xpack_certs_zip.stat.exists
-    - not certificate_file_exists.stat.exists
-  register: certs_file_generated
-  tags: xpack-security
-
-- name: Unzip generated certs.zip
-  unarchive:
-    src: "{{ node_certs_source }}/certs.zip"
-    dest: "{{ node_certs_source }}/"
-    remote_src: yes
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-    - certs_file_generated is defined
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Copy key & certificate files in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/{{ elasticsearch_node_name }}/"
-    dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Copy ca certificate file in generator node (locally)
-  synchronize:
-    src: "{{ node_certs_source }}/ca/"
-    dest: "{{ node_certs_destination }}/"
-  delegate_to: "{{ node_certs_generator_ip }}"
-  register: check_certs_permissions
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Importing key & certificate files from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/{{ elasticsearch_node_name }}/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-  tags: xpack-security
-
-- name: Importing ca certificate file from generator node
-  command: >-
-    {{ rsync_path }} {{ rsync_extra_parameters }} {{ rsync_user }}@{{ node_certs_generator_ip }}:
-    {{ node_certs_source }}/ca/ {{ node_certs_destination }}/
-  when:
-    - not node_certs_generator
-    - elasticsearch_xpack_security
-    - not certificate_file_exists.stat.exists
-  register: check_certs_permissions
-  tags: xpack-security
-
-- name: Ensuring certificates folder owner
-  file:
-    path: "{{ node_certs_destination }}/"
-    state: directory
-    recurse: yes
-    owner: elasticsearch
-    group: elasticsearch
-  when:
-    - check_certs_permissions is defined
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Ensuring certificates folder owner
-  file:
-    path: "{{ node_certs_destination }}/"
-    mode: '0770'
-    recurse: yes
-  when:
-    - check_certs_permissions is defined
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
-- name: Remove generated certs file
-  file:
-    state: absent
-    path: "{{ node_certs_source }}/certs.zip*"
-  when:
-    - node_certs_generator
-    - elasticsearch_xpack_security
-  tags: xpack-security
-
 - name: Configure Elasticsearch.
   template:
     src: elasticsearch.yml.j2
@@ -207,13 +77,6 @@
   notify: restart elasticsearch
   tags: configure
 
-- name: Set elasticsearch bootstrap password
-  shell: |
-     set -o pipefail
-     "echo '{{ elasticsearch_xpack_security_password }}' | {{ node_certs_source }}/bin/elasticsearch-keystore add -xf 'bootstrap.password'"
-  when:
-    - elasticsearch_xpack_security
-
 - name: Trusty | set MAX_LOCKED_MEMORY=unlimited in Elasticsearch in /etc/security/limits.conf
   lineinfile:
     path: /etc/security/limits.conf
@@ -236,53 +99,21 @@
     - ansible_distribution == "Ubuntu"
     - ansible_distribution_major_version | int == 14
 
-- name: Distribution != one of [ centos 6.*,  trusty ] | Reload systemd
-  systemd: daemon_reload=true
-  ignore_errors: true
-  when:
-    - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
-    - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
-    - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
-    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
-
 - name: Ensure Elasticsearch started and enabled
   service:
     name: elasticsearch
     enabled: true
     state: started
+  tags:
+    - configure
+    - init
 
 - name: Make sure Elasticsearch is running before proceeding
   wait_for: host={{ elasticsearch_network_host }} port={{ elasticsearch_http_port }} delay=3 timeout=400
   tags:
     - configure
     - init
 
-- name: Check for Wazuh Alerts template (http)
-  uri:
-    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
-    method: GET
-    status_code: 200, 404
-  when:
-    - elasticsearch_bootstrap_node or single_node
-    - not elasticsearch_xpack_security
-  poll: 30
-  register: wazuh_alerts_template_exits
-  until: wazuh_alerts_template_exits is succeeded
-  tags: init
-
-- name: Installing Wazuh Alerts template (http)
-  uri:
-    url: "http://{{ elasticsearch_network_host }}:{{ elasticsearch_http_port }}/_template/wazuh"
-    method: PUT
-    status_code: 200
-    body_format: json
-    body: "{{ lookup('template','wazuh-elastic7-template-alerts.json.j2') }}"
-  when:
-    - wazuh_alerts_template_exits.status is defined
-    - wazuh_alerts_template_exits.status != 200
-    - not elasticsearch_xpack_security
-  tags: init
-
 - import_tasks: "RMRedHat.yml"
   when: ansible_os_family == "RedHat"