mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 12:17:13 +00:00
Prageeth Panicker
bf37d5e7b3
Tor: use the shared tor block (bond 0.5, enabled when svc-net-tor is in the node's groups, tor pinned on in both variants) so a node serves one network, onion on a Tor node and clearnet otherwise. SPOT and sizing: WAZUH_INDEXER_URL replaces four hand-built copies of the indexer URL, and the indexer heap is half of mem_limit instead of a hardcoded 1g (unchanged for the current 2g limit). Fixes: bcrypt_hash rejects secrets over 72 bytes; the Keycloak group-removal helper uses the same resolver as the add helper and checks every response (the realm is no longer URL-encoded, matching the add helper), and a failed cleanup fails an otherwise passing test; the swarm certs generator removes a stale container before each attempt; vm.max_map_count is set before the early handler flush; securityadmin failed_when now needs rc 0 and the success marker. The regenerated role README also picks up generator drift (mailu to stalwart).
252 lines
7.1 KiB
Django/Jinja
252 lines
7.1 KiB
Django/Jinja
<ossec_config>
|
|
<global>
|
|
<jsonout_output>yes</jsonout_output>
|
|
<alerts_log>yes</alerts_log>
|
|
<logall>no</logall>
|
|
<logall_json>no</logall_json>
|
|
<email_notification>no</email_notification>
|
|
<agents_disconnection_time>10m</agents_disconnection_time>
|
|
<agents_disconnection_alert_time>0</agents_disconnection_alert_time>
|
|
</global>
|
|
|
|
<alerts>
|
|
<log_alert_level>3</log_alert_level>
|
|
<email_alert_level>12</email_alert_level>
|
|
</alerts>
|
|
|
|
<logging>
|
|
<log_format>plain</log_format>
|
|
</logging>
|
|
|
|
<remote>
|
|
<connection>secure</connection>
|
|
<port>{{ lookup('config', application_id, 'services.manager.ports.internal.agent_events') }}</port>
|
|
<protocol>tcp</protocol>
|
|
<queue_size>131072</queue_size>
|
|
</remote>
|
|
|
|
<rootcheck>
|
|
<disabled>no</disabled>
|
|
<check_files>yes</check_files>
|
|
<check_trojans>yes</check_trojans>
|
|
<check_dev>yes</check_dev>
|
|
<check_sys>yes</check_sys>
|
|
<check_pids>yes</check_pids>
|
|
<check_ports>yes</check_ports>
|
|
<check_if>yes</check_if>
|
|
<frequency>43200</frequency>
|
|
<rootkit_files>etc/rootcheck/rootkit_files.txt</rootkit_files>
|
|
<rootkit_trojans>etc/rootcheck/rootkit_trojans.txt</rootkit_trojans>
|
|
<skip_nfs>yes</skip_nfs>
|
|
</rootcheck>
|
|
|
|
<wodle name="cis-cat">
|
|
<disabled>yes</disabled>
|
|
<timeout>1800</timeout>
|
|
<interval>1d</interval>
|
|
<scan-on-start>yes</scan-on-start>
|
|
<java_path>wodles/java</java_path>
|
|
<ciscat_path>wodles/ciscat</ciscat_path>
|
|
</wodle>
|
|
|
|
<wodle name="osquery">
|
|
<disabled>yes</disabled>
|
|
<run_daemon>yes</run_daemon>
|
|
<log_path>/var/log/osquery/osqueryd.results.log</log_path>
|
|
<config_path>/etc/osquery/osquery.conf</config_path>
|
|
<add_labels>yes</add_labels>
|
|
</wodle>
|
|
|
|
<wodle name="syscollector">
|
|
<disabled>no</disabled>
|
|
<interval>1h</interval>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<hardware>yes</hardware>
|
|
<os>yes</os>
|
|
<network>yes</network>
|
|
<packages>yes</packages>
|
|
<ports all="yes">yes</ports>
|
|
<processes>yes</processes>
|
|
<synchronization>
|
|
<max_eps>10</max_eps>
|
|
</synchronization>
|
|
</wodle>
|
|
|
|
<sca>
|
|
<enabled>yes</enabled>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<interval>12h</interval>
|
|
<skip_nfs>yes</skip_nfs>
|
|
</sca>
|
|
|
|
<vulnerability-detection>
|
|
<enabled>yes</enabled>
|
|
<index-status>yes</index-status>
|
|
<feed-update-interval>60m</feed-update-interval>
|
|
</vulnerability-detection>
|
|
|
|
<indexer>
|
|
<enabled>yes</enabled>
|
|
<hosts>
|
|
<host>{{ WAZUH_INDEXER_URL }}</host>
|
|
</hosts>
|
|
<ssl>
|
|
<certificate_authorities>
|
|
<ca>{{ lookup('volume', application_id, 'root_ca_manager_pem').target }}</ca>
|
|
</certificate_authorities>
|
|
<certificate>{{ lookup('volume', application_id, 'manager_filebeat_pem').target }}</certificate>
|
|
<key>{{ lookup('volume', application_id, 'manager_filebeat_key_pem').target }}</key>
|
|
</ssl>
|
|
</indexer>
|
|
|
|
<syscheck>
|
|
<disabled>no</disabled>
|
|
<frequency>43200</frequency>
|
|
<scan_on_start>yes</scan_on_start>
|
|
<alert_new_files>yes</alert_new_files>
|
|
<auto_ignore frequency="10" timeframe="3600">no</auto_ignore>
|
|
<directories>/etc,/usr/bin,/usr/sbin</directories>
|
|
<directories>/bin,/sbin,/boot</directories>
|
|
<ignore>/etc/mtab</ignore>
|
|
<ignore>/etc/hosts.deny</ignore>
|
|
<ignore>/etc/mail/statistics</ignore>
|
|
<ignore>/etc/random-seed</ignore>
|
|
<ignore>/etc/random.seed</ignore>
|
|
<ignore>/etc/adjtime</ignore>
|
|
<ignore>/etc/httpd/logs</ignore>
|
|
<ignore>/etc/utmpx</ignore>
|
|
<ignore>/etc/wtmpx</ignore>
|
|
<ignore>/etc/cups/certs</ignore>
|
|
<ignore>/etc/dumpdates</ignore>
|
|
<ignore>/etc/svc/volatile</ignore>
|
|
<ignore type="sregex">.log$|.swp$</ignore>
|
|
<nodiff>/etc/ssl/private.key</nodiff>
|
|
<skip_nfs>yes</skip_nfs>
|
|
<skip_dev>yes</skip_dev>
|
|
<skip_proc>yes</skip_proc>
|
|
<skip_sys>yes</skip_sys>
|
|
<process_priority>10</process_priority>
|
|
<max_eps>100</max_eps>
|
|
<synchronization>
|
|
<enabled>yes</enabled>
|
|
<interval>5m</interval>
|
|
<max_interval>1h</max_interval>
|
|
<max_eps>10</max_eps>
|
|
</synchronization>
|
|
</syscheck>
|
|
|
|
<global>
|
|
<white_list>127.0.0.1</white_list>
|
|
<white_list>^localhost.localdomain$</white_list>
|
|
</global>
|
|
|
|
<command>
|
|
<name>disable-account</name>
|
|
<executable>disable-account</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>restart-wazuh</name>
|
|
<executable>restart-wazuh</executable>
|
|
</command>
|
|
|
|
<command>
|
|
<name>firewall-drop</name>
|
|
<executable>firewall-drop</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>host-deny</name>
|
|
<executable>host-deny</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>route-null</name>
|
|
<executable>route-null</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>win_route-null</name>
|
|
<executable>route-null.exe</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<command>
|
|
<name>netsh</name>
|
|
<executable>netsh.exe</executable>
|
|
<timeout_allowed>yes</timeout_allowed>
|
|
</command>
|
|
|
|
<localfile>
|
|
<log_format>command</log_format>
|
|
<command>df -P</command>
|
|
<frequency>360</frequency>
|
|
</localfile>
|
|
|
|
<localfile>
|
|
<log_format>full_command</log_format>
|
|
<command>last -n 20</command>
|
|
<frequency>360</frequency>
|
|
</localfile>
|
|
|
|
<ruleset>
|
|
<decoder_dir>ruleset/decoders</decoder_dir>
|
|
<rule_dir>ruleset/rules</rule_dir>
|
|
<rule_exclude>0215-policy_rules.xml</rule_exclude>
|
|
<list>etc/lists/audit-keys</list>
|
|
<list>etc/lists/amazon/aws-eventnames</list>
|
|
<list>etc/lists/security-eventchannel</list>
|
|
<list>etc/lists/malicious-ioc/malicious-ip</list>
|
|
<list>etc/lists/malicious-ioc/malicious-domains</list>
|
|
<list>etc/lists/malicious-ioc/malware-hashes</list>
|
|
<decoder_dir>etc/decoders</decoder_dir>
|
|
<rule_dir>etc/rules</rule_dir>
|
|
</ruleset>
|
|
|
|
<rule_test>
|
|
<enabled>yes</enabled>
|
|
<threads>1</threads>
|
|
<max_sessions>64</max_sessions>
|
|
<session_timeout>15m</session_timeout>
|
|
</rule_test>
|
|
|
|
<auth>
|
|
<disabled>no</disabled>
|
|
<port>{{ lookup('config', application_id, 'services.manager.ports.internal.agent_registration') }}</port>
|
|
<use_source_ip>no</use_source_ip>
|
|
<purge>yes</purge>
|
|
<use_password>no</use_password>
|
|
<ciphers>HIGH:!ADH:!EXP:!MD5:!RC4:!3DES:!CAMELLIA:@STRENGTH</ciphers>
|
|
<ssl_verify_host>no</ssl_verify_host>
|
|
<ssl_manager_cert>etc/sslmanager.cert</ssl_manager_cert>
|
|
<ssl_manager_key>etc/sslmanager.key</ssl_manager_key>
|
|
<ssl_auto_negotiate>no</ssl_auto_negotiate>
|
|
</auth>
|
|
|
|
<cluster>
|
|
<name>wazuh</name>
|
|
<node_name>node01</node_name>
|
|
<node_type>master</node_type>
|
|
<key>{{ WAZUH_CLUSTER_KEY }}</key>
|
|
<port>1516</port>
|
|
<bind_addr>0.0.0.0</bind_addr>
|
|
<nodes>
|
|
<node>{{ WAZUH_MANAGER_CONTAINER }}</node>
|
|
</nodes>
|
|
<hidden>no</hidden>
|
|
<disabled>yes</disabled>
|
|
</cluster>
|
|
|
|
</ossec_config>
|
|
|
|
<ossec_config>
|
|
<localfile>
|
|
<log_format>syslog</log_format>
|
|
<location>/var/ossec/logs/active-responses.log</location>
|
|
</localfile>
|
|
</ossec_config>
|