Merge pull request #59 from wazuh/feature-cfansible-blog

Deploying a Wazuh environment in AWS using Ansible

production_ansible/01_create_stack.yml

@@ -0,0 +1,88 @@
+---
+    - hosts: localhost
+      vars:
+        user_region: "<region>"
+        user_KeyPair: "<KeyPairName>"
+        user_AvZone: "<AvailabilityZone>"
+        user_ssh_key_path: "<user_ssh_key_path>"
+        user_stack_name: wazuh-prod-env
+      tasks:
+        - name: Create a cloudformation stack
+          cloudformation:
+            stack_name: "{{ user_stack_name }}"
+            state: "present"
+            region: "{{ user_region }}"
+            template: "templates/wazuh_template.yml"
+            template_parameters:
+              KeyPairName: "{{ user_KeyPair }}"
+              AvailabilityZone: "{{ user_AvZone }}"
+
+        - cloudformation_info:
+            stack_name: "{{ user_stack_name }}"
+            region: "{{ user_region }}"
+          register: stack_info
+
+        - set_fact:
+            user_ssh_key_path: "{{ user_ssh_key_path }}"
+
+        - set_fact:
+            addresses: "{{ stack_info | json_query('cloudformation.*.stack_outputs') | list }}"
+
+        - set_fact:
+              elastic_nodes:
+                  - PublicIP: "{{ addresses.0.ElasticBootstrapIp }}"
+                    PrivateIP: "{{ addresses.0.ElasticBootstrapIpPrivate }}"
+                  - PublicIP: "{{ addresses.0.ElasticMasterBIp }}"
+                    PrivateIP: "{{ addresses.0.ElasticMasterBIpPrivate }}"
+                  - PublicIP: "{{ addresses.0.ElasticMasterCIp }}"
+                    PrivateIP: "{{ addresses.0.ElasticMasterCIpPrivate }}"
+              kibana_nodes:
+                  - PublicIP: "{{ addresses.0.KibanaInstanceIp }}"
+                    PrivateIP: "{{ addresses.0.KibanaInstanceIpPrivate }}"
+              wazuh_master_nodes:
+                  - PublicIP: "{{ addresses.0.WazuhMasterInstanceIp }}"
+                    PrivateIP: "{{ addresses.0.WazuhMasterInstanceIpPrivate }}"
+              wazuh_worker_nodes:
+                  - PublicIP: "{{ addresses.0.WazuhWorkerInstanceIp }}"
+                    PrivateIP: "{{ addresses.0.WazuhWorkerInstanceIpPrivate }}"
+
+    - hosts: localhost
+      vars:
+        elastic_user: admin
+        elastic_password: admin_pass
+        ssh_key_path_private: "{{ hostvars['localhost']['user_ssh_key_path'] }}"
+        elastic_version: 7.6.2
+        wazuh_version: 3.12.3-1
+        wazuh_api_admin_username: foo
+        wazuh_api_admin_password: bar
+        wazuh_api_password: bar
+      tasks:
+        - name: Rendering hosts file with the output IPs
+          template:
+            src: "templates/ansible_hosts.j2"
+            dest: "wazuh_hostfile"
+            mode: '664'
+            force: yes
+
+        - name: Clean destination folder for wazuh-ansible repository
+          file:
+            path: "/tmp/wazuh-ansible"
+            state: absent
+
+        - name: Create destination folder for wazuh-ansible repository
+          file:
+            path: "/tmp/wazuh-ansible"
+            state: directory
+            mode: '0777'
+
+        - name: Cloning https://github.com/wazuh/wazuh-ansible
+          git:
+            repo: "https://github.com/wazuh/wazuh-ansible.git"
+            dest: "/tmp/wazuh-ansible"
+
+        - name: Ensure permissions on wazuh-ansible repo folder
+          file:
+            path: "/tmp/wazuh-ansible"
+            state: directory
+            mode: '0777'
+            recurse: yes

production_ansible/02_provision_instances.yml

@@ -0,0 +1,39 @@
+---
+    - hosts: elasticsearch[0]
+      roles:
+        - role: "/tmp/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch"
+      become: yes
+      become_user: root
+
+    - hosts: elasticsearch[1:]
+      strategy: free
+      roles:
+        - role: "/tmp/wazuh-ansible/roles/elastic-stack/ansible-elasticsearch"
+      become: yes
+      become_user: root
+
+    - hosts: masters
+      strategy: free
+      roles:
+        - role: "/tmp/wazuh-ansible/roles/wazuh/ansible-wazuh-manager"
+        - role: "/tmp/wazuh-ansible/roles/wazuh/ansible-filebeat"
+      become: yes
+      become_user: root
+
+    - hosts: workers
+      strategy: free
+      roles:
+        - role: "/tmp/wazuh-ansible/roles/wazuh/ansible-wazuh-manager"
+        - role: "/tmp/wazuh-ansible/roles/wazuh/ansible-filebeat"
+      become: yes
+      become_user: root
+
+    - hosts: kibana
+      strategy: free
+      roles:
+        - role: "/tmp/wazuh-ansible/roles/elastic-stack/ansible-kibana"
+      become: yes
+      become_user: root
+
+
+

production_ansible/ansible.cfg

@@ -0,0 +1,2 @@
+[defaults]
+hash_behaviour = merge

production_ansible/requirements.txt

@@ -0,0 +1,4 @@
+ansible==2.9.5
+requests==2.22.0
+botocore==1.17.5
+boto3==1.14.5

production_ansible/templates/ansible_hosts.j2

@@ -0,0 +1,224 @@
+
+elasticsearch:
+    hosts:
+{% for instance in elastic_nodes %}
+{% if loop.index == 1 %}
+        {{ instance.PublicIP }}:
+            private_ip: {{ instance.PrivateIP }}
+            elasticsearch_network_host: {{ instance.PrivateIP }}
+            elasticsearch_reachable_host: {{ instance.PrivateIP }}
+            elasticsearch_cluster_nodes:
+{% for instance in elastic_nodes %}
+                - "{{ instance.PrivateIP }}"
+{% endfor %}
+            elasticsearch_node_name: node-1
+            elasticsearch_bootstrap_node: true
+            node_certs_generator: true
+            instances:
+{% for instance in elastic_nodes %}
+                node{{ loop.index }}:
+                    name: node-{{ loop.index }}
+                    ip: {{ instance.PrivateIP }}
+{% endfor %}
+                node{{ (elastic_nodes | length) + 1 }}:
+                    name: node-{{ (elastic_nodes | length) + 1 }}
+                    ip: {{ wazuh_master_nodes.0.PrivateIP }}
+{% for instance in wazuh_worker_nodes %}
+                node{{ loop.index+(elastic_nodes | length) + 1 }}:
+                    name: node-{{ loop.index+(elastic_nodes | length) + 1 }}
+                    ip: {{ instance.PrivateIP }}
+{% endfor %}
+{% for instance in kibana_nodes %}
+                node{{ loop.index + (wazuh_worker_nodes | length) + (elastic_nodes | length) + 1 }}:
+                    name: node-{{ loop.index + (wazuh_worker_nodes | length) + (elastic_nodes | length) + 1 }}
+                    ip: {{ instance.PrivateIP }}
+{% endfor %}
+{% else %}
+        {{ instance.PublicIP }}:
+            private_ip: {{ instance.PrivateIP }}
+            elasticsearch_network_host: {{ instance.PrivateIP }}
+            elasticsearch_reachable_host: {{ instance.PrivateIP }}
+            elasticsearch_node_name: node-{{ loop.index }}
+            elasticsearch_discovery_nodes:
+{% for instance in elastic_nodes %}
+                - "{{ instance.PrivateIP }}"
+{% endfor %}
+{% if loop.index == (elastic_nodes | length) %}
+            node_certs_generator_ip: {{ elastic_nodes.0.PrivateIP }}
+            elasticsearch_xpack_users:
+                {{ elastic_user }}:
+                    password: '{{ elastic_password }}'
+                    roles: '["superuser"]'
+{% endif %}
+{% endif %}
+{% endfor %}
+    vars:
+        ansible_ssh_user: ec2-user
+        ansible_ssh_private_key_file: {{ ssh_key_path_private }}
+        ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+        elastic_stack_version: {{ elastic_version }}
+        single_node: false
+        elasticsearch_node_master: true
+        elasticsearch_xpack_security: true
+        elasticsearch_xpack_security_user: {{ elastic_user }}
+        elasticsearch_xpack_security_password: {{ elastic_password }}
+
+
+masters:
+    hosts:
+{% for instance in wazuh_master_nodes %}
+        {{ instance.PublicIP }}:
+            private_ip: {{ instance.PrivateIP }}
+            wazuh_api_user:
+                - "{{ wazuh_api_admin_username }}:{{ wazuh_api_password }}"
+            filebeat_node_name: node-{{ (elastic_nodes | length) + 1 }}
+{% endfor %}
+    vars:
+        shared_agent_config:
+          - type: os
+            type_value: Linux
+            syscheck:
+              frequency: 43200
+              scan_on_start: 'yes'
+              alert_new_files: 'yes'
+              ignore:
+                - /etc/mtab
+                - /etc/mnttab
+                - /etc/hosts.deny
+                - /etc/mail/statistics
+                - /etc/svc/volatile
+              no_diff:
+                - /etc/ssl/private.key
+            rootcheck:
+              frequency: 43200
+              cis_distribution_filename: null
+            localfiles:
+              - format: 'syslog'
+                location: '/var/log/messages'
+              - format: 'syslog'
+                location: '/var/log/secure'
+              - format: 'syslog'
+                location: '/var/log/maillog'
+              - format: 'apache'
+                location: '/var/log/httpd/error_log'
+              - format: 'apache'
+                location: '/var/log/httpd/access_log'
+              - format: 'apache'
+                location: '/var/ossec/logs/active-responses.log'
+          - type: os
+            type_value: Windows
+            syscheck:
+              frequency: 43200
+              scan_on_start: 'yes'
+              auto_ignore: 'no'
+              alert_new_files: 'yes'
+              windows_registry:
+                - key: 'HKEY_LOCAL_MACHINE\Software\Classes\batfile'
+                  arch: 'both'
+                - key: 'HKEY_LOCAL_MACHINE\Software\Classes\Folder'
+            localfiles:
+              - location: 'Security'
+                format: 'eventchannel'
+              - location: 'System'
+                format: 'eventlog'
+
+        ansible_ssh_user: ec2-user
+        ansible_ssh_private_key_file: {{ ssh_key_path_private }}
+        ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+        wazuh_manager_version: {{ wazuh_version }}
+        wazuh_manager_config:
+          connection:
+            - type: 'secure'
+              port: '1514'
+              protocol: 'tcp'
+              queue_size: 131072
+          api:
+            port: "55000"
+            https: 'yes'
+          cluster:
+            disable: 'no'
+            name: 'wazuh'
+            node_name: 'master'
+            node_type: 'master'
+            key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
+            port: '1516'
+            bind_addr: '0.0.0.0'
+            nodes:
+              - '{{ wazuh_master_nodes.0.PrivateIP }}'
+            hidden: 'no'
+        filebeat_version: {{ elastic_version }}
+        filebeat_xpack_security: true
+        elasticsearch_xpack_security_user: {{ elastic_user }}
+        elasticsearch_xpack_security_password: {{ elastic_password }}
+        filebeat_output_elasticsearch_hosts:
+{% for instance in elastic_nodes %}
+                - "{{ instance.PrivateIP }}"
+{% endfor %}
+
+workers:
+    hosts:
+{% for instance in wazuh_worker_nodes %}
+        {{ instance.PublicIP }}:
+            private_ip: {{ instance.PrivateIP }}
+            filebeat_node_name : node-{{ loop.index+(elastic_nodes | length) + 1 }}
+            wazuh_manager_config:
+                connection:
+                    - type: 'secure'
+                      port: '1514'
+                      protocol: 'tcp'
+                      queue_size: 131072
+                api:
+                    port: "55000"
+                    https: 'yes'
+                cluster:
+                    disable: 'no'
+                    name: 'wazuh'
+                    node_name: 'worker_0{{ loop.index }}'
+                    node_type: 'worker'
+                    key: 'ugdtAnd7Pi9myP7CVts4qZaZQEQcRYZa'
+                    port: '1516'
+                    bind_addr: '0.0.0.0'
+                    nodes:
+                        - '{{ wazuh_master_nodes.0.PrivateIP }}'
+                    hidden: 'no'
+{% endfor %}
+    vars:
+        ansible_ssh_user: ec2-user
+        ansible_ssh_private_key_file: {{ ssh_key_path_private }}
+        ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+        wazuh_manager_version: {{ wazuh_version }}
+        filebeat_version: {{ elastic_version }}
+        filebeat_xpack_security: true
+        elasticsearch_xpack_security_user: {{ elastic_user }}
+        elasticsearch_xpack_security_password: {{ elastic_password }}
+        filebeat_output_elasticsearch_hosts:
+{% for instance in elastic_nodes %}
+                - "{{ instance.PrivateIP }}"
+{% endfor %}
+
+kibana:
+    hosts:
+{% for instance in kibana_nodes %}
+        {{ instance.PublicIP }}:
+            private_ip: {{ instance.PrivateIP }}
+            elasticsearch_network_host: {{ elastic_nodes.0.PrivateIP }}
+            kibana_node_name: node-{{ (elastic_nodes | length) + (wazuh_worker_nodes | length) + 2 }}
+            elasticsearch_xpack_security: true
+            elasticsearch_xpack_security_user: {{ elastic_user }}
+            elasticsearch_xpack_security_password: {{ elastic_password }}
+
+{% endfor %}
+    vars:
+        ansible_ssh_user: ec2-user
+        ansible_ssh_private_key_file: {{ ssh_key_path_private }}
+        ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
+        elastic_stack_version: {{ elastic_version }}
+        wazuh_version: {{ wazuh_version[:-2] }}
+        kibana_xpack_security: true
+        node_options: "--max-old-space-size=2048"
+        wazuh_api_credentials:
+            - id: default
+              url: https://{{ wazuh_master_nodes.0.PrivateIP }}
+              port: 55000
+              user: {{ wazuh_api_admin_username }}
+              password: {{ wazuh_api_password }}