###### tags: `docker` `ELK` `PFSense` `WAZUH` # Развертывание ELK, pfelk с помощью docker ![](https://i.imgur.com/9EHgUur.png) Машина ELK (debian10): > https://docs.docker.com/engine/install/debian/#install-using-the-repository `apt update -y && apt full-upgrade -y` ``` sudo apt-get update sudo apt-get install \ ca-certificates \ curl \ gnupg \ lsb-release curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg sudo apt-get update sudo apt-get install docker-ce docker-ce-cli containerd.io ``` https://docs.docker.com/compose/install/ https://github.com/deviantony/docker-elk ``` docker-compose build docker-compose up -d > Сбрасываем пароли для пользователя elastic, logstash_internal and kibana_system users: docker-compose exec elasticsearch bin/elasticsearch-reset-password --batch --user elastic docker-compose exec elasticsearch bin/elasticsearch-reset-password --batch --user logstash_internal docker-compose exec elasticsearch bin/elasticsearch-reset-password --batch --user kibana_system ``` Запишем новые пароли в файл окружения (в той же папке делаем): nano .env curl -X GET "http://localhost:9200" -u elastic:<password_elastic> По умолчанию включен триал лицензия, меняем на basic: ![](https://i.imgur.com/oBQSNgq.png) Добавляем расширение Filebeat в Elastic: docker-compose -f docker-compose.yml -f extensions/filebeat/filebeat-compose.yml up -d ## Configuring Filebeat Конфиг записан в [`config/filebeat.yml`](./config/filebeat.yml). Можно модифицировать [Configuration reference][filebeat-config]. Любые изменения нужно подтвердить перезагрузкой: ```console $ docker-compose -f docker-compose.yml -f extensions/filebeat/filebeat-compose.yml restart filebeat ``` Добавим в кибане сбор с Windows (в поиске вбить Windows вверху): ![](https://i.imgur.com/iPi4vtB.png) _______________ # Развертывание WAZUH `https://documentation.wazuh.com/current/installation-guide/open-distro/all-in-one-deployment/all-in-one.html` Ставим необходимые зависимости: `apt install curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg -y` Добавляем GPG-ключ: `curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -` Репозиторий: `echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list` `apt-get update` ``` apt-get install wazuh-manager systemctl daemon-reload systemctl enable wazuh-manager systemctl start wazuh-manager systemctl status wazuh-manager ``` Устанавливаем эластик: ``` apt install elasticsearch-oss opendistroforelasticsearch curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/7.x/elasticsearch_all_in_one.yml ``` Добавляем роли и пользователей для использования Wazuh в Kibana: ``` curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles.yml curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles_mapping.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles_mapping.yml curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/internal_users.yml ``` Удаляем демо-серты: `rm /etc/elasticsearch/esnode-key.pem /etc/elasticsearch/esnode.pem /etc/elasticsearch/kirk-key.pem /etc/elasticsearch/kirk.pem /etc/elasticsearch/root-ca.pem -f` Генерируем и создаем новые: ``` curl -so ~/wazuh-cert-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/wazuh-cert-tool.sh curl -so ~/instances.yml https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/instances_aio.yml bash ~/wazuh-cert-tool.sh mkdir /etc/elasticsearch/certs/ mv ~/certs/elasticsearch* /etc/elasticsearch/certs/ mv ~/certs/admin* /etc/elasticsearch/certs/ cp ~/certs/root-ca* /etc/elasticsearch/certs/ ``` systemctl daemon-reload systemctl enable elasticsearch systemctl start elasticsearch Запускаем эластик securityadmin скрипт для загрузки новых сертов и запуска эластика: `export JAVA_HOME=/usr/share/elasticsearch/jdk/ && /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -nhnv -cacert /etc/elasticsearch/certs/root-ca.pem -cert /etc/elasticsearch/certs/admin.pem -key /etc/elasticsearch/certs/admin-key.pem` Проверим что установка успешно завершена: `curl -XGET https://localhost:9200 -u admin:admin -k` ![](https://i.imgur.com/rnhz6Ob.png) Удалим скрипт, который негативно влияет на ресурсы: `/usr/share/elasticsearch/bin/elasticsearch-plugin remove opendistro-performance-analyzer` `systemctl restart elasticsearch` Ставим filebeat и все что нужно Wazuh к нему: ``` apt-get install filebeat -y curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/resources/4.2/open-distro/filebeat/7.x/filebeat_all_in_one.yml curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.2/extensions/elasticsearch/7.x/wazuh-template.json chmod go+r /etc/filebeat/wazuh-template.json curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module mkdir /etc/filebeat/certs cp ~/certs/root-ca.pem /etc/filebeat/certs/ mv ~/certs/filebeat* /etc/filebeat/certs/ systemctl daemon-reload systemctl enable filebeat systemctl start filebeat ``` Проверяем что filebeat корректно установлен: `filebeat test output` ![](https://i.imgur.com/sliLWsS.png) Аналогично ставим Кибану: `apt-get install opendistroforelasticsearch-kibana -y` ``` curl -so /etc/kibana/kibana.yml https://packages.wazuh.com/resources/4.2/open-distro/kibana/7.x/kibana_all_in_one.yml mkdir /usr/share/kibana/data chown -R kibana:kibana /usr/share/kibana/data cd /usr/share/kibana sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.5_7.10.2-1.zip mkdir /etc/kibana/certs cp ~/certs/root-ca.pem /etc/kibana/certs/ mv ~/certs/kibana* /etc/kibana/certs/ chown kibana:kibana /etc/kibana/certs/* setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node systemctl daemon-reload systemctl enable kibana systemctl start kibana ``` URL: https://<wazuh_server_ip> user: admin password: admin Агента добавляем таким образом: https://documentation.wazuh.com/current/user-manual/agent-enrollment/via-agent-configuration/windows-endpoint.html Правим в конфиге адрес сервере Wazuh, потом cmd: net start wazuh В результате агент успешно добавлен: ![](https://i.imgur.com/X4U24ha.png)