Skip to content

Commit 5514216

Browse files
oneswigoneswig
committed
Updates on Wazuh text
1 parent c641a1f commit 5514216

3 files changed

Lines changed: 62 additions & 29 deletions

File tree

‎source/include/wazuh_ansible.rst‎

Lines changed: 53 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,94 @@
1-
One of methods for deploying and maintaining Wazuh is with the use of the official Ansible playbooks, integrated into a Kayobe Config.
1+
One method for deploying and maintaining Wazuh is the `official
2+
Ansible playbooks <https://github.com/wazuh/wazuh-ansible>`_. These
3+
can be integrated into |kayobe_config| as a custom playbook.
24

35
Configuring Wazuh Manager
46
-------------------------
57

6-
Wazuh manager can easily be configured by editing the ``wazuh-manager.yml`` groups vars file found at ``etc/kayobe/inventory/group_vars/wazuh-master/``.
7-
This file gives you control over various important aspects of the Wazuh manager.
8-
Most notably;
8+
Wazuh Manager is configured by editing the ``wazuh-manager.yml``
9+
groups vars file found at
10+
``etc/kayobe/inventory/group_vars/wazuh-manager/``. This file
11+
controls various aspects of Wazuh Manager configuration.
12+
Most notably:
913

1014
*domain_name*:
11-
the domain used by Search Guard CE when generating certificates.
15+
The domain used by Search Guard CE when generating certificates.
1216

1317
*wazuh_manager_ip*:
14-
the IP address that the wazuh manager shall reside on for communicating with the agents.
18+
The IP address that the Wazuh Manager shall reside on for communicating with the agents.
1519

1620
*wazuh_manager_connection*:
17-
used to define port and protocol for the manager to be listening on.
21+
Used to define port and protocol for the manager to be listening on.
1822

1923
*wazuh_manager_authd*:
20-
connection settings for the daemon responsible for registering new agents.
24+
Connection settings for the daemon responsible for registering new agents.
2125

22-
Running ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-manager.yml`` will deploy these changes.
26+
Running ``kayobe playbook run
27+
$KAYOBE_CONFIG_PATH/ansible/wazuh-manager.yml`` will deploy these
28+
changes.
2329

2430
Secrets
2531
-------
2632

27-
Wazuh requires that secrets or passwords are set for itself and the services it communiticates with.
28-
The playbook ``etc/kayobe/ansible/wazuh-secrets.yml`` automates the creation of these secrets which can then be encrypted with Ansible Vault.
33+
Wazuh requires that secrets or passwords are set for itself and the services with which it communiticates.
34+
The playbook ``etc/kayobe/ansible/wazuh-secrets.yml`` automates the creation of these secrets, which should then be encrypted with Ansible Vault.
2935

3036
To update the secrets you can execute the following two commands
3137

32-
.. code-block:: console
38+
.. code-block:: shell
3339
:substitutions:
3440
35-
kayobe# kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-secrets.yml -e wazuh_user_pass=$(uuidgen) -e wazuh_admin_pass=$(uuidgen)
36-
kayobe# ansible-vault encrypt --vault-password-file |vault_password_file_path| $KAYOBE_CONFIG_PATH/inventory/group_vars/wazuh-master/wazuh-secrets.yml
41+
kayobe# kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-secrets.yml \
42+
-e wazuh_user_pass=$(uuidgen) \
43+
-e wazuh_admin_pass=$(uuidgen)
44+
kayobe# ansible-vault encrypt --vault-password-file |vault_password_file_path| \
45+
$KAYOBE_CONFIG_PATH/inventory/group_vars/wazuh-manager/wazuh-secrets.yml
3746
38-
Once generated you can run ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-manager.yml`` which shall copy the secrets into place.
47+
Once generated, run ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-manager.yml`` which copies the secrets into place.
3948

40-
.. note:: If you need to view the secrets it is recommended you use ``ansible-vault view --vault-password-file ~/vault.password``
49+
.. note:: Use ``ansible-vault`` to view the secrets:
50+
51+
``ansible-vault view --vault-password-file ~/vault.password $KAYOBE_CONFIG_PATH/inventory/group_vars/wazuh-manager/wazuh-secrets.yml``
4152

4253
Adding a New Agent
4354
------------------
44-
When adding a new host it should be automically picked up by the ``wazuh-agent:children`` group in ``etc/kayobe/inventory/groups`` as it would be included in the ``overcloud`` member.
55+
The Wazuh Agent is deployed to all hosts in the ``wazuh-agent``
56+
inventory group, comprising the ``seed`` group (containing |seed_name|)
57+
plus the ``overcloud`` group (containing all hosts in the
58+
OpenStack control plane).
4559

4660
.. code-block:: ini
4761
4862
[wazuh-agent:children]
4963
seed
5064
overcloud
5165
52-
Running the follow playbook ``kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-agent.yml`` will deploy the agent to the new host.
53-
This should automatically be registered and accessible within the Wazuh manager dashboard.
66+
The following playbook deploys the Wazuh Agent to all hosts in the
67+
``wazuh-agent`` group:
68+
69+
.. code-block:: shell
70+
71+
kayobe playbook run $KAYOBE_CONFIG_PATH/ansible/wazuh-agent.yml
5472
55-
The playbook ``wazuh-agent.yml`` can be setup as a hook within kayobe, which will automatically run either pre or post a given kayobe command.
56-
See `here <https://docs.openstack.org/kayobe/wallaby/custom-ansible-playbooks.html#hooks>`_ for more details.
73+
The hosts running Wazuh Agent should automatically be registered
74+
and visible within the Wazuh Manager dashboard.
75+
76+
.. note:: It is good practice to use a `Kayobe deploy hook
77+
<https://docs.openstack.org/kayobe/wallaby/custom-ansible-playbooks.html#hooks>`_
78+
to automate deployment and configuration of the Wazuh Agent
79+
following a run of ``kayobe overcloud host configure``.
5780

5881
Accessing Wazuh Manager
5982
-----------------------
6083

61-
To access the Wazuh manager dashboard, navigate to the ip address of the |wazuh_master_name| (|wazuh_master_url|).
84+
To access the Wazuh Manager dashboard, navigate to the ip address
85+
of |wazuh_manager_name| (|wazuh_manager_url|).
86+
87+
You can login to the dashboard with the username ``admin``. The
88+
password for ``admin`` is defined in the secret
89+
``opendistro_admin_password`` which can be found within
90+
``etc/kayobe/inventory/group_vars/wazuh-manager/wazuh-secrets.yml``.
6291

63-
You can login to the dashboard with the username ``admin`` and the password for ``opendistro_admin_password`` which can be found within ``etc/kayobe/inventory/group_vars/wazuh-master/wazuh-secrets.yml``.
92+
.. note:: Use ``ansible-vault`` to view Wazuh secrets:
6493

65-
.. note:: If you need to view the secrets it is recommended you use ``ansible-vault view --vault-password-file ~/vault.password``
94+
``ansible-vault view --vault-password-file ~/vault.password $KAYOBE_CONFIG_PATH/inventory/group_vars/wazuh-manager/wazuh-secrets.yml``

‎source/vars.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,6 @@
4848
.. |tempest_recipes| replace:: https://github.com/acme-openstack/tempest-recipes.git
4949
.. |tls_setup| replace:: TLS is implemented using a wildcard certificate available for ``*.acme.example``.
5050
.. |vault_password_file_path| replace:: ~/vault-password
51-
.. |wazuh_master_url| replace:: https://|wazuh_master_ip|
52-
.. |wazuh_master_ip| replace:: 172.168.0.10:5601
53-
.. |wazuh_master_name| replace:: wazuh-master01
51+
.. |wazuh_manager_url| replace:: https://172.168.0.10:5601
52+
.. |wazuh_manager_ip| replace:: 172.168.0.10:5601
53+
.. |wazuh_manager_name| replace:: wazuh-manager01

‎source/wazuh.rst‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,11 @@ Wazuh Security Platform
66

77
.. ifconfig:: deployment['wazuh']
88

9-
The |project_name| deployment uses Wazuh as security platform to detect intruders within your network.
9+
The |project_name| deployment uses `Wazuh <https://wazuh.com>`_ as security monitoring platform. Among other things, Wazuh monitors for:
10+
11+
* Security-related system events.
12+
* Known vulnerabilities (CVEs) in versions of installed software.
13+
* Misconfigurations in system security.
1014

1115
.. ifconfig:: deployment['wazuh_managed']
1216

@@ -21,4 +25,4 @@ Wazuh Security Platform
2125
Wazuh deployment via Ansible
2226
============================
2327

24-
.. include:: include/wazuh_ansible.rst
28+
.. include:: include/wazuh_ansible.rst

0 commit comments

Comments
 (0)