gadmin/vagrant
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ajout wazuh

Browse Source
This commit is contained in:
sio user 2025-01-31 10:39:08 +01:00
parent 884cd7ae9a
commit 6c816d3ceb
12 changed files with 1152 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docker/Vagrantfile vendored
View File

@ -12,7 +12,7 @@ Vagrant.configure("2") do |config|
# Every Vagrant development environment requires a box. You can search for
# boxes at https://vagrantcloud.com/search.
config.vm.box = "debian/bullseye64"
config.vm.box = "debian/bookworm64"
config.vm.hostname = "docker"
# Disable automatic box update checking. If you disable this, then

10
k3s-awx/Vagrantfile vendored
View File

@ -12,7 +12,7 @@ Vagrant.configure("2") do |config|
# Every Vagrant development environment requires a box. You can search for
# boxes at https://vagrantcloud.com/search.
config.vm.box = "debian/bullseye64"
config.vm.box = "debian/bookworm64"
config.vm.hostname = "k3s-awx"
# Disable automatic box update checking. If you disable this, then
@ -33,12 +33,12 @@ Vagrant.configure("2") do |config|
# Create a private network, which allows host-only access to the machine
# using a specific IP.
config.vm.network "private_network", ip: "192.168.56.10"
# config.vm.network "private_network", ip: "192.168.56.10"
# Create a public network, which generally matched to bridged network.
# Bridged networks make the machine appear as another physical device on
# your network.
# config.vm.network "public_network"
config.vm.network "public_network"
# Share an additional folder to the guest VM. The first argument is
# the path on the host to the actual folder. The second argument is
@ -55,7 +55,8 @@ Vagrant.configure("2") do |config|
# vb.gui = true
#
# # Customize the amount of memory on the VM:
vb.memory = "3072"
vb.memory = "6144"
vb.cpus = 2
end
#
# View the documentation for the provider you are using for more
@ -65,6 +66,7 @@ Vagrant.configure("2") do |config|
# Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
# documentation for more information about their specific syntax and use.
config.vm.provision "shell", inline: <<-SHELL
timdatectl set-timezone Europe/Paris
apt-get update
apt-get install -y curl vim git make
SHELL

48
wazuh/README.md Normal file
View File

@ -0,0 +1,48 @@
# Serveur kea DHCP HA avec serveur Stork
## Présentation
Cette `Vagrantfile` permet d'installer :
* un serveur DHCP **kea1** en mode HA (primary)
* un serveur DHCP **kea2** en mode HA (secondary)
* un serveur de suivi/administration web **stork** pour kea
La Vagrantfile utilise les playbooks ansible suivants :
* **provision/setup-stork.yml** qui:
* installe les dépots ISC pour stork
* installe les paquets **postgresql**, **postgresql-contrib**, **stork-server**
* crée la base de données stork et genère le fichiers de configuration de **stork-server**
* relance le service **isc-stork-server**
* **provision/setup-kea.yml** qui:
* installe les dépots ISC pour kea
* installe les paquets **isc-kea-dhcp4-server**, **isc-kea-ctrl-agent**, **isc-kea-hooks**
* installe les dépots ISC pour stork
* installe le paquet **stork-agent**
* genére les fichiers de configuration pour chacun des services
* relance les services
* enregistre (`stork-agent register`) le serveur auprès du serveur stork
## Les services et ports
* serveur **stork** :
* service **stork-server:8080**
* serveur **kea1** et **kea2** :
* service **isc-kea-dhcp4-server:8000** (utilisé par la HA)
* service **kea-ctrl-agent:8001**
* service **isc-stork-agent:8080**
## Utilisation de la Vagrantfile
````shell
vagrant up stork
vagrant up kea1
vagrant up kea2
````
On peut alors se connecter au serveur **stork** avec un navigateur : http://adresse:8080
(admin/admin)
Une fois connecté, on doit autoriser chacun des deux serveurs **kea1** et **kea2** inscrits

59
wazuh/Vagrantfile vendored Normal file
View File

@ -0,0 +1,59 @@
# -*- mode: ruby -*-
# vi: set ft=ruby :
Vagrant.configure("2") do |config|
# Base VM OS configuration.
config.vm.box = "debian/bookworm64"
config.ssh.insert_key = false
config.vm.synced_folder '.', '/vagrant', disabled: true
# General VirtualBox VM configuration.
config.vm.provider :virtualbox do |v|
v.memory = 1024
v.cpus = 1
v.linked_clone = true
v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
v.customize ["modifyvm", :id, "--ioapic", "on"]
end
# wazuh.
config.vm.define "wazuh" do |wazuh|
wazuh.vm.hostname = "wazuh"
wazuh.vm.network :private_network, ip: "192.168.56.5"
wazuh.vm.provider :virtualbox do |v|
v.customize ["modifyvm", :id, "--memory", 4024]
v.cpus = 2
end
wazuh.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
wazuh.vm.provision "ansible" do |ansible|
ansible.extra_vars = {
wazuh_db_name: "wazuh",
wazuh_db_user: "wazuh-server",
wazuh_db_passwd: "wazuh-passwd",
}
ansible.playbook = "provision/setup-wazuh.yml"
end
end
# wazuh-cli.
config.vm.define "wazucli" do |wazucli|
wazucli.vm.hostname = "wazu-cli"
wazucli.vm.network :private_network, ip: "192.168.56.2"
wazucli.vm.provider :virtualbox do |v|
v.customize ["modifyvm", :id, "--memory", 1024]
end
wazucli.vm.provision "shell",
inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget"
wazucli.vm.provision "ansible" do |ansible|
ansible.extra_vars = {
srv_name: "wazu-cli",
srv_ip: "192.168.56.2",
}
ansible.playbook = "provision/setup-wazu-cli.yml"
end
end
end

46
wazuh/provision/agent.env.j2 Normal file
View File

@ -0,0 +1,46 @@
### the IP or hostname to listen on for incoming Stork server connections
STORK_AGENT_HOST={{ srv_ip }}
### the TCP port to listen on for incoming Stork server connections
# STORK_AGENT_PORT=8080
### listen for commands from the Stork server only, but not for Prometheus requests
STORK_AGENT_LISTEN_STORK_ONLY=true
### listen for Prometheus requests only, but not for commands from the Stork server
STORK_AGENT_LISTEN_PROMETHEUS_ONLY=false
### settings for exporting stats to Prometheus
### the IP or hostname on which the agent exports Kea statistics to Prometheus
# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS=
### the port on which the agent exports Kea statistics to Prometheus
# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT=
### how often the agent collects stats from Kea, in seconds
# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_INTERVAL=
## enable or disable collecting per-subnet stats from Kea
# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true
### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus
# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS=
### the port on which the agent exports BIND 9 statistics to Prometheus
# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT=
### how often the agent collects stats from BIND 9, in seconds
# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_INTERVAL=
### Stork Server URL used by the agent to send REST commands to the server during agent registration
STORK_AGENT_SERVER_URL=http://192.168.56.5:8080
### skip TLS certificate verification when the Stork Agent connects
### to Kea over TLS and Kea uses self-signed certificates
STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true
### Logging parameters
### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR
# STORK_LOG_LEVEL=DEBUG
### disable output colorization
# CLICOLOR=false
### path to the hook directory
# STORK_AGENT_HOOK_DIRECTORY=

62
wazuh/provision/ca.cnf.j2 Normal file
View File

@ -0,0 +1,62 @@
// This is an example of a configuration for Control-Agent (CA) listening
// for incoming HTTP traffic. This is necessary for handling API commands,
// in particular lease update commands needed for HA setup.
{
"Control-agent":
{
// We need to specify where the agent should listen to incoming HTTP
// queries.
"http-host": "{{ srv_ip }}",
// This specifies the port CA will listen on.
"http-port": 8000,
"control-sockets":
{
// This is how the Agent can communicate with the DHCPv4 server.
"dhcp4":
{
"comment": "socket to DHCPv4 server",
"socket-type": "unix",
"socket-name": "/tmp/kea4-ctrl-socket"
},
// Location of the DHCPv6 command channel socket.
"dhcp6":
{
"socket-type": "unix",
"socket-name": "/tmp/kea6-ctrl-socket"
},
// Location of the D2 command channel socket.
"d2":
{
"socket-type": "unix",
"socket-name": "/tmp/kea-ddns-ctrl-socket",
"user-context": { "in-use": false }
}
},
// Similar to other Kea components, CA also uses logging.
"loggers": [
{
"name": "kea-ctrl-agent",
"output-options": [
{
"output": "/var/log/kea-ctrl-agent.log",
// Several additional parameters are possible in addition
// to the typical output. Flush determines whether logger
// flushes output to a file. Maxsize determines maximum
// filesize before the file is rotated. maxver
// specifies the maximum number of rotated files being
// kept.
"flush": true,
"maxsize": 204800,
"maxver": 4,
// We use pattern to specify custom log message layout
"pattern": "%d{%y.%m.%d %H:%M:%S.%q} %-5p [%c/%i] %m\n"
}
],
"severity": "INFO",
"debuglevel": 0 // debug level only applies when severity is set to DEBUG.
}
]
}
}

105
wazuh/provision/kea-ctrl-agent.conf Normal file
View File

@ -0,0 +1,105 @@
// This is a basic configuration for the Kea Control Agent.
//
// This is just a very basic configuration. Kea comes with large suite (over 30)
// of configuration examples and extensive Kea User's Guide. Please refer to
// those materials to get better understanding of what this software is able to
// do. Comments in this configuration file sometimes refer to sections for more
// details. These are section numbers in Kea User's Guide. The version matching
// your software should come with your Kea package, but it is also available
// in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
// the stable version is https://kea.readthedocs.io/).
//
// This configuration file contains only Control Agent's configuration.
// If configurations for other Kea services are also included in this file they
// are ignored by the Control Agent.
{
// This is a basic configuration for the Kea Control Agent.
// RESTful interface to be available at http://127.0.0.1:8000/
"Control-agent": {
"http-host": "127.0.0.1",
// If enabling HA and multi-threading, the 8000 port is used by the HA
// hook library http listener. When using HA hook library with
// multi-threading to function, make sure the port used by dedicated
// listener is different (e.g. 8001) than the one used by CA. Note
// the commands should still be sent via CA. The dedicated listener
// is specifically for HA updates only.
"http-port": 8000,
// Specify location of the files to which the Control Agent
// should connect to forward commands to the DHCPv4, DHCPv6
// and D2 servers via unix domain sockets.
"control-sockets": {
"dhcp4": {
"socket-type": "unix",
"socket-name": "/run/kea/kea4-ctrl-socket"
},
"dhcp6": {
"socket-type": "unix",
"socket-name": "/run/kea/kea6-ctrl-socket"
},
"d2": {
"socket-type": "unix",
"socket-name": "/run/kea/kea-ddns-ctrl-socket"
}
},
// Specify hooks libraries that are attached to the Control Agent.
// Such hooks libraries should support 'control_command_receive'
// hook point. This is currently commented out because it has to
// point to the existing hooks library. Otherwise the Control
// Agent will fail to start.
"hooks-libraries": [
// {
// "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/control-agent-commands.so",
// "parameters": {
// "param1": "foo"
// }
// }
],
// Logging configuration starts here. Kea uses different loggers to log various
// activities. For details (e.g. names of loggers), see Chapter 18.
"loggers": [
{
// This specifies the logging for Control Agent daemon.
"name": "kea-ctrl-agent",
"output_options": [
{
// Specifies the output file. There are several special values
// supported:
// - stdout (prints on standard output)
// - stderr (prints on standard error)
// - syslog (logs to syslog)
// - syslog:name (logs to syslog using specified name)
// Any other value is considered a name of the file
"output": "stdout",
// Shorter log pattern suitable for use with systemd,
// avoids redundant information
"pattern": "%-5p %m\n"
// This governs whether the log output is flushed to disk after
// every write.
// "flush": false,
// This specifies the maximum size of the file before it is
// rotated.
// "maxsize": 1048576,
// This specifies the maximum number of rotated files to keep.
// "maxver": 8
}
],
// This specifies the severity of log messages to keep. Supported values
// are: FATAL, ERROR, WARN, INFO, DEBUG
"severity": "INFO",
// If DEBUG level is specified, this value is used. 0 is least verbose,
// 99 is most verbose. Be cautious, Kea can generate lots and lots
// of logs if told to do so.
"debuglevel": 0
}
]
}
}

98
wazuh/provision/kea-ctrl-agent.conf.j2 Normal file
View File

@ -0,0 +1,98 @@
// This is a basic configuration for the Kea Control Agent.
//
// This is just a very basic configuration. Kea comes with large suite (over 30)
// of configuration examples and extensive Kea User's Guide. Please refer to
// those materials to get better understanding of what this software is able to
// do. Comments in this configuration file sometimes refer to sections for more
// details. These are section numbers in Kea User's Guide. The version matching
// your software should come with your Kea package, but it is also available
// in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
// the stable version is https://kea.readthedocs.io/).
//
// This configuration file contains only Control Agent's configuration.
// If configurations for other Kea services are also included in this file they
// are ignored by the Control Agent.
{
// This is a basic configuration for the Kea Control Agent.
// RESTful interface to be available at http://127.0.0.1:8000/
"Control-agent": {
"http-host": "{{ srv_ip }}",
// If enabling HA and multi-threading, the 8000 port is used by the HA
// hook library http listener. When using HA hook library with
// multi-threading to function, make sure the port used by dedicated
// listener is different (e.g. 8001) than the one used by CA. Note
// the commands should still be sent via CA. The dedicated listener
// is specifically for HA updates only.
"http-port": 8001,
// Specify location of the files to which the Control Agent
// should connect to forward commands to the DHCPv4, DHCPv6
// and D2 servers via unix domain sockets.
"control-sockets": {
"dhcp4": {
"socket-type": "unix",
"socket-name": "/run/kea/kea4-ctrl-socket"
}
},
// Specify hooks libraries that are attached to the Control Agent.
// Such hooks libraries should support 'control_command_receive'
// hook point. This is currently commented out because it has to
// point to the existing hooks library. Otherwise the Control
// Agent will fail to start.
"hooks-libraries": [
// {
// "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/control-agent-commands.so",
// "parameters": {
// "param1": "foo"
// }
// }
],
// Logging configuration starts here. Kea uses different loggers to log various
// activities. For details (e.g. names of loggers), see Chapter 18.
"loggers": [
{
// This specifies the logging for Control Agent daemon.
"name": "kea-ctrl-agent",
"output-options": [
{
// Specifies the output file. There are several special values
// supported:
// - stdout (prints on standard output)
// - stderr (prints on standard error)
// - syslog (logs to syslog)
// - syslog:name (logs to syslog using specified name)
// Any other value is considered a name of the file
"output": "stdout",
// Shorter log pattern suitable for use with systemd,
// avoids redundant information
"pattern": "%-5p %m\n"
// This governs whether the log output is flushed to disk after
// every write.
// "flush": false,
// This specifies the maximum size of the file before it is
// rotated.
// "maxsize": 1048576,
// This specifies the maximum number of rotated files to keep.
// "maxver": 8
}
],
// This specifies the severity of log messages to keep. Supported values
// are: FATAL, ERROR, WARN, INFO, DEBUG
"severity": "INFO",
// If DEBUG level is specified, this value is used. 0 is least verbose,
// 99 is most verbose. Be cautious, Kea can generate lots and lots
// of logs if told to do so.
"debuglevel": 0
}
]
}
}

534
wazuh/provision/kea-dhcp4.conf.j2 Normal file
View File

@ -0,0 +1,534 @@
// This is a basic configuration for the Kea DHCPv4 server. Subnet declarations
// are mostly commented out and no interfaces are listed. Therefore, the servers
// will not listen or respond to any queries.
// The basic configuration must be extended to specify interfaces on which
// the servers should listen. There are a number of example options defined.
// These probably don't make any sense in your network. Make sure you at least
// update the following, before running this example in your network:
// - change the network interface names
// - change the subnets to match your actual network
// - change the option values to match your network
//
// This is just a very basic configuration. Kea comes with large suite (over 30)
// of configuration examples and extensive Kea User's Guide. Please refer to
// those materials to get better understanding of what this software is able to
// do. Comments in this configuration file sometimes refer to sections for more
// details. These are section numbers in Kea User's Guide. The version matching
// your software should come with your Kea package, but it is also available
// in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
// the stable version is https://kea.readthedocs.io/).
//
// This configuration file contains only DHCPv4 server's configuration.
// If configurations for other Kea services are also included in this file they
// are ignored by the DHCPv4 server.
{
// DHCPv4 configuration starts here. This section will be read by DHCPv4 server
// and will be ignored by other components.
"Dhcp4": {
// Add names of your network interfaces to listen on.
"interfaces-config": {
// See section 8.2.4 for more details. You probably want to add just
// interface name (e.g. "eth0" or specific IPv4 address on that
// interface name (e.g. "eth0/192.0.2.1").
"interfaces": [ "eth1" ]
// Kea DHCPv4 server by default listens using raw sockets. This ensures
// all packets, including those sent by directly connected clients
// that don't have IPv4 address yet, are received. However, if your
// traffic is always relayed, it is often better to use regular
// UDP sockets. If you want to do that, uncomment this line:
// "dhcp-socket-type": "udp"
},
// Kea supports control channel, which is a way to receive management
// commands while the server is running. This is a Unix domain socket that
// receives commands formatted in JSON, e.g. config-set (which sets new
// configuration), config-reload (which tells Kea to reload its
// configuration from file), statistic-get (to retrieve statistics) and many
// more. For detailed description, see Sections 8.8, 16 and 15.
"control-socket": {
"socket-type": "unix",
"socket-name": "/run/kea/kea4-ctrl-socket"
},
// Use Memfile lease database backend to store leases in a CSV file.
// Depending on how Kea was compiled, it may also support SQL databases
// (MySQL and/or PostgreSQL). Those database backends require more
// parameters, like name, host and possibly user and password.
// There are dedicated examples for each backend. See Section 7.2.2 "Lease
// Storage" for details.
"lease-database": {
// Memfile is the simplest and easiest backend to use. It's an in-memory
// C++ database that stores its state in CSV file.
"type": "memfile",
"lfc-interval": 3600
},
// Kea allows storing host reservations in a database. If your network is
// small or you have few reservations, it's probably easier to keep them
// in the configuration file. If your network is large, it's usually better
// to use database for it. To enable it, uncomment the following:
// "hosts-database": {
// "type": "mysql",
// "name": "kea",
// "user": "kea",
// "password": "kea",
// "host": "localhost",
// "port": 3306
// },
// See Section 7.2.3 "Hosts storage" for details.
// Setup reclamation of the expired leases and leases affinity.
// Expired leases will be reclaimed every 10 seconds. Every 25
// seconds reclaimed leases, which have expired more than 3600
// seconds ago, will be removed. The limits for leases reclamation
// are 100 leases or 250 ms for a single cycle. A warning message
// will be logged if there are still expired leases in the
// database after 5 consecutive reclamation cycles.
"expired-leases-processing": {
"reclaim-timer-wait-time": 10,
"flush-reclaimed-timer-wait-time": 25,
"hold-reclaimed-time": 3600,
"max-reclaim-leases": 100,
"max-reclaim-time": 250,
"unwarned-reclaim-cycles": 5
},
// Global timers specified here apply to all subnets, unless there are
// subnet specific values defined in particular subnets.
"renew-timer": 900,
"rebind-timer": 1800,
"valid-lifetime": 3600,
// Many additional parameters can be specified here:
// - option definitions (if you want to define vendor options, your own
// custom options or perhaps handle standard options
// that Kea does not support out of the box yet)
// - client classes
// - hooks
// - ddns information (how the DHCPv4 component can reach a DDNS daemon)
//
// Some of them have examples below, but there are other parameters.
// Consult Kea User's Guide to find out about them.
// These are global options. They are going to be sent when a client
// requests them, unless overwritten with values in more specific scopes.
// The scope hierarchy is:
// - global (most generic, can be overwritten by class, subnet or host)
// - class (can be overwritten by subnet or host)
// - subnet (can be overwritten by host)
// - host (most specific, overwrites any other scopes)
//
// Not all of those options make sense. Please configure only those that
// are actually useful in your network.
//
// For a complete list of options currently supported by Kea, see
// Section 7.2.8 "Standard DHCPv4 Options". Kea also supports
// vendor options (see Section 7.2.10) and allows users to define their
// own custom options (see Section 7.2.9).
"option-data": [
// When specifying options, you typically need to specify
// one of (name or code) and data. The full option specification
// covers name, code, space, csv-format and data.
// space defaults to "dhcp4" which is usually correct, unless you
// use encapsulate options. csv-format defaults to "true", so
// this is also correct, unless you want to specify the whole
// option value as long hex string. For example, to specify
// domain-name-servers you could do this:
// {
// "name": "domain-name-servers",
// "code": 6,
// "csv-format": "true",
// "space": "dhcp4",
// "data": "192.0.2.1, 192.0.2.2"
// }
// but it's a lot of writing, so it's easier to do this instead:
{
"name": "domain-name-servers",
"data": "192.0.2.1, 192.0.2.2"
},
// Typically people prefer to refer to options by their names, so they
// don't need to remember the code names. However, some people like
// to use numerical values. For example, option "domain-name" uses
// option code 15, so you can reference to it either by
// "name": "domain-name" or "code": 15.
{
"code": 15,
"data": "example.org"
},
// Domain search is also a popular option. It tells the client to
// attempt to resolve names within those specified domains. For
// example, name "foo" would be attempted to be resolved as
// foo.mydomain.example.com and if it fails, then as foo.example.com
{
"name": "domain-search",
"data": "mydomain.example.com, example.com"
},
// String options that have a comma in their values need to have
// it escaped (i.e. each comma is preceded by two backslashes).
// That's because commas are reserved for separating fields in
// compound options. At the same time, we need to be conformant
// with JSON spec, that does not allow "\,". Therefore the
// slightly uncommon double backslashes notation is needed.
// Legal JSON escapes are \ followed by "\/bfnrt character
// or \u followed by 4 hexadecimal numbers (currently Kea
// supports only \u0000 to \u00ff code points).
// CSV processing translates '\\' into '\' and '\,' into ','
// only so for instance '\x' is translated into '\x'. But
// as it works on a JSON string value each of these '\'
// characters must be doubled on JSON input.
{
"name": "boot-file-name",
"data": "EST5EDT4\\,M3.2.0/02:00\\,M11.1.0/02:00"
},
// Options that take integer values can either be specified in
// dec or hex format. Hex format could be either plain (e.g. abcd)
// or prefixed with 0x (e.g. 0xabcd).
{
"name": "default-ip-ttl",
"data": "0xf0"
}
// Note that Kea provides some of the options on its own. In particular,
// it sends IP Address lease type (code 51, based on valid-lifetime
// parameter, Subnet mask (code 1, based on subnet definition), Renewal
// time (code 58, based on renew-timer parameter), Rebind time (code 59,
// based on rebind-timer parameter).
],
// Other global parameters that can be defined here are option definitions
// (this is useful if you want to use vendor options, your own custom
// options or perhaps handle options that Kea does not handle out of the box
// yet).
// You can also define classes. If classes are defined, incoming packets
// may be assigned to specific classes. A client class can represent any
// group of devices that share some common characteristic, e.g. Windows
// devices, iphones, broken printers that require special options, etc.
// Based on the class information, you can then allow or reject clients
// to use certain subnets, add special options for them or change values
// of some fixed fields.
"client-classes": [
{
// This specifies a name of this class. It's useful if you need to
// reference this class.
"name": "voip",
// This is a test. It is an expression that is being evaluated on
// each incoming packet. It is supposed to evaluate to either
// true or false. If it's true, the packet is added to specified
// class. See Section 12 for a list of available expressions. There
// are several dozens. Section 8.2.14 for more details for DHCPv4
// classification and Section 9.2.19 for DHCPv6.
"test": "substring(option[60].hex,0,6) == 'Aastra'",
// If a client belongs to this class, you can define extra behavior.
// For example, certain fields in DHCPv4 packet will be set to
// certain values.
"next-server": "192.0.2.254",
"server-hostname": "hal9000",
"boot-file-name": "/dev/null"
// You can also define option values here if you want devices from
// this class to receive special options.
}
],
// Another thing possible here are hooks. Kea supports a powerful mechanism
// that allows loading external libraries that can extract information and
// even influence how the server processes packets. Those libraries include
// additional forensic logging capabilities, ability to reserve hosts in
// more flexible ways, and even add extra commands. For a list of available
// hook libraries, see https://gitlab.isc.org/isc-projects/kea/wikis/Hooks-available.
"hooks-libraries": [
// The lease_cmds library must be loaded because HA makes use of it to
// deliver lease updates to the server as well as synchronize the
// lease database after failure.
{
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_lease_cmds.so"
},
{
// The HA hooks library should be loaded.
"library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_ha.so",
"parameters": {
// Each server should have the same HA configuration, except for the
// "this-server-name" parameter.
"high-availability": [ {
// This parameter points to this server instance. The respective
// HA peers must have this parameter set to their own names.
"this-server-name": "{{ srv_name }}",
// The HA mode is set to hot-standby. In this mode, the active server handles
// all the traffic. The standby takes over if the primary becomes unavailable.
"mode": "hot-standby",
// Heartbeat is to be sent every 10 seconds if no other control
// commands are transmitted.
"heartbeat-delay": 10000,
// Maximum time for partner's response to a heartbeat, after which
// failure detection is started. This is specified in milliseconds.
// If we don't hear from the partner in 60 seconds, it's time to
// start worrying.
"max-response-delay": 60000,
// The following parameters control how the server detects the
// partner's failure. The ACK delay sets the threshold for the
// 'secs' field of the received discovers. This is specified in
// milliseconds.
"max-ack-delay": 5000,
// This specifies the number of clients which send messages to
// the partner but appear to not receive any response.
"max-unacked-clients": 5,
// This specifies the maximum timeout (in milliseconds) for the server
// to complete sync. If you have a large deployment (high tens or
// hundreds of thousands of clients), you may need to increase it
// further. The default value is 60000ms (60 seconds).
"sync-timeout": 60000,
"peers": [
// This is the configuration of this server instance.
{
"name": "kea1",
// This specifies the URL of our server instance. The
// Control Agent must run along with our DHCPv4 server
// instance and the "http-host" and "http-port" must be
// set to the corresponding values.
"url": "http://192.168.56.2:8000/",
// This server is primary. The other one must be
// secondary.
"role": "primary"
},
// This is the configuration of our HA peer.
{
"name": "kea2",
// Specifies the URL on which the partner's control
// channel can be reached. The Control Agent is required
// to run on the partner's machine with "http-host" and
// "http-port" values set to the corresponding values.
"url": "http://192.168.56.3:8000/",
// The partner is a secondary. Our is primary.
"role": "standby"
}
]
} ]
}
}
],
// // Forensic Logging library generates forensic type of audit trail
// // of all devices serviced by Kea, including their identifiers
// // (like MAC address), their location in the network, times
// // when they were active etc.
// "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_legal_log.so",
// "parameters": {
// "path": "/var/lib/kea",
// "base-name": "kea-forensic4"
// }
// },
// {
// // Flexible identifier (flex-id). Kea software provides a way to
// // handle host reservations that include addresses, prefixes,
// // options, client classes and other features. The reservation can
// // be based on hardware address, DUID, circuit-id or client-id in
// // DHCPv4 and using hardware address or DUID in DHCPv6. However,
// // there are sometimes scenario where the reservation is more
// // complex, e.g. uses other options that mentioned above, uses part
// // of specific options or perhaps even a combination of several
// // options and fields to uniquely identify a client. Those scenarios
// // are addressed by the Flexible Identifiers hook application.
// "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_flex_id.so",
// "parameters": {
// "identifier-expression": "relay4[2].hex"
// }
// }
// ],
// Below an example of a simple IPv4 subnet declaration. Uncomment to enable
// it. This is a list, denoted with [ ], of structures, each denoted with
// { }. Each structure describes a single subnet and may have several
// parameters. One of those parameters is "pools" that is also a list of
// structures.
"subnet4": [
{
// This defines the whole subnet. Kea will use this information to
// determine where the clients are connected. This is the whole
// subnet in your network. This is mandatory parameter for each
// subnet.
"id": 1,
"subnet": "192.168.56.0/24",
"interface" : "eth1",
// Pools define the actual part of your subnet that is governed
// by Kea. Technically this is optional parameter, but it's
// almost always needed for DHCP to do its job. If you omit it,
// clients won't be able to get addresses, unless there are
// host reservations defined for them.
"pools": [ { "pool": "192.168.56.120 - 192.168.56.130" } ],
// These are options that are subnet specific. In most cases,
// you need to define at least routers option, as without this
// option your clients will not be able to reach their default
// gateway and will not have Internet connectivity.
"option-data": [
{
// For each IPv4 subnet you most likely need to specify at
// least one router.
"name": "routers",
"data": "192.168.56.1"
}
],
// Kea offers host reservations mechanism. Kea supports reservations
// by several different types of identifiers: hw-address
// (hardware/MAC address of the client), duid (DUID inserted by the
// client), client-id (client identifier inserted by the client) and
// circuit-id (circuit identifier inserted by the relay agent).
//
// Kea also support flexible identifier (flex-id), which lets you
// specify an expression that is evaluated for each incoming packet.
// Resulting value is then used for as an identifier.
//
// Note that reservations are subnet-specific in Kea. This is
// different than ISC DHCP. Keep that in mind when migrating
// your configurations.
"reservations": [
// This is a reservation for a specific hardware/MAC address.
// It's a rather simple reservation: just an address and nothing
// else.
{
"hw-address": "1a:1b:1c:1d:1e:1f",
"ip-address": "192.168.56.201"
},
// This is a reservation for a specific client-id. It also shows
// the this client will get a reserved hostname. A hostname can
// be defined for any identifier type, not just client-id.
{
"client-id": "01:11:22:33:44:55:66",
"ip-address": "192.168.56.202",
"hostname": "special-snowflake"
},
// The third reservation is based on DUID. This reservation defines
// a special option values for this particular client. If the
// domain-name-servers option would have been defined on a global,
// subnet or class level, the host specific values take preference.
{
"duid": "01:02:03:04:05",
"ip-address": "192.168.56.203",
"option-data": [ {
"name": "domain-name-servers",
"data": "10.1.1.202, 10.1.1.203"
} ]
},
// The fourth reservation is based on circuit-id. This is an option
// inserted by the relay agent that forwards the packet from client
// to the server. In this example the host is also assigned vendor
// specific options.
//
// When using reservations, it is useful to configure
// reservations-global, reservations-in-subnet,
// reservations-out-of-pool (subnet specific parameters)
// and host-reservation-identifiers (global parameter).
{
"client-id": "01:12:23:34:45:56:67",
"ip-address": "192.168.56.204",
"option-data": [
{
"name": "vivso-suboptions",
"data": "4491"
},
{
"name": "tftp-servers",
"space": "vendor-4491",
"data": "10.1.1.202, 10.1.1.203"
}
]
},
// This reservation is for a client that needs specific DHCPv4
// fields to be set. Three supported fields are next-server,
// server-hostname and boot-file-name
{
"client-id": "01:0a:0b:0c:0d:0e:0f",
"ip-address": "192.168.56.205",
"next-server": "192.168.56.206",
"server-hostname": "hal9000",
"boot-file-name": "/dev/null"
},
// This reservation is using flexible identifier. Instead of
// relying on specific field, sysadmin can define an expression
// similar to what is used for client classification,
// e.g. substring(relay[0].option[17],0,6). Then, based on the
// value of that expression for incoming packet, the reservation
// is matched. Expression can be specified either as hex or
// plain text using single quotes.
//
// Note: flexible identifier requires flex_id hook library to be
// loaded to work.
{
"flex-id": "'s0mEVaLue'",
"ip-address": "192.168.56.207"
}
// You can add more reservations here.
]
// You can add more subnets there.
}
],
// There are many, many more parameters that DHCPv4 server is able to use.
// They were not added here to not overwhelm people with too much
// information at once.
// Logging configuration starts here. Kea uses different loggers to log various
// activities. For details (e.g. names of loggers), see Chapter 18.
"loggers": [
{
// This section affects kea-dhcp4, which is the base logger for DHCPv4
// component. It tells DHCPv4 server to write all log messages (on
// severity INFO or more) to a file.
"name": "kea-dhcp4",
"output_options": [
{
// Specifies the output file. There are several special values
// supported:
// - stdout (prints on standard output)
// - stderr (prints on standard error)
// - syslog (logs to syslog)
// - syslog:name (logs to syslog using specified name)
// Any other value is considered a name of the file
"output": "stdout",
// Shorter log pattern suitable for use with systemd,
// avoids redundant information
"pattern": "%-5p %m\n",
// This governs whether the log output is flushed to disk after
// every write.
// "flush": false,
// This specifies the maximum size of the file before it is
// rotated.
// "maxsize": 1048576,
// This specifies the maximum number of rotated files to keep.
// "maxver": 8
}
],
// This specifies the severity of log messages to keep. Supported values
// are: FATAL, ERROR, WARN, INFO, DEBUG
"severity": "INFO",
// If DEBUG level is specified, this value is used. 0 is least verbose,
// 99 is most verbose. Be cautious, Kea can generate lots and lots
// of logs if told to do so.
"debuglevel": 0
}
]
}
}

53
wazuh/provision/server.env.j2 Normal file
View File

@ -0,0 +1,53 @@
### database settings
### the address of a PostgreSQL database
# STORK_DATABASE_HOST=
### the port of a PostgreSQL database
# STORK_DATABASE_PORT=
### the name of a database
STORK_DATABASE_NAME={{ stork_db_name }}
### the username for connecting to the database
STORK_DATABASE_USER_NAME={{ stork_db_user }}
### the SSL mode for connecting to the database
### possible values: disable, require, verify-ca, or verify-full
# STORK_DATABASE_SSLMODE=
### the location of the SSL certificate used by the server to connect to the database
# STORK_DATABASE_SSLCERT=
### the location of the SSL key used by the server to connect to the database
# STORK_DATABASE_SSLKEY=
### the location of the root certificate file used to verify the database server's certificate
# STORK_DATABASE_SSLROOTCERT=
### the password for the username connecting to the database
### empty password is set to avoid prompting a user for database password
STORK_DATABASE_PASSWORD={{ stork_db_passwd}}
### REST API settings
### the IP address on which the server listens
# STORK_REST_HOST=
### the port number on which the server listens
# STORK_REST_PORT=
### the file with a certificate to use for secure connections
# STORK_REST_TLS_CERTIFICATE=
### the file with a private key to use for secure connections
# STORK_REST_TLS_PRIVATE_KEY=
### the certificate authority file used for mutual TLS authentication
# STORK_REST_TLS_CA_CERTIFICATE=
### the directory with static files served in the UI
STORK_REST_STATIC_FILES_DIR=/usr/share/stork/www
### the base URL of the UI - to be used only if the UI is served from a subdirectory
# STORK_REST_BASE_URL=
### enable Prometheus /metrics HTTP endpoint for exporting metrics from
### the server to Prometheus. It is recommended to secure this endpoint
### (e.g. using HTTP proxy).
# STORK_SERVER_ENABLE_METRICS=true
### Logging parameters
### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR
# STORK_LOG_LEVEL=DEBUG
### disable output colorization
# CLICOLOR=false
### path to the hook directory
# STORK_SERVER_HOOK_DIRECTORY=

93
wazuh/provision/setup-kea.yml Normal file
View File

@ -0,0 +1,93 @@
---
- hosts: all
become: true
tasks:
- name: Preparation
ansible.builtin.shell: curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-2-6/setup.deb.sh' | sudo -E bash
- name: Update apt
ansible.builtin.apt:
update_cache: yes
- name: Installation isc-kea-dhcp4
ansible.builtin.apt:
name: isc-kea-dhcp4-server
state: present
- name: Installation isc-kea-ctrl-agent
ansible.builtin.apt:
name: isc-kea-ctrl-agent
state: present
- name: Installation isc-kea-hooks
ansible.builtin.apt:
name: isc-kea-hooks
state: present
- name: Generation du fichier de configuration kea-ctrl-agent
ansible.builtin.template:
src: kea-ctrl-agent.conf.j2
dest: /etc/kea/kea-ctrl-agent.conf
backup: yes
notify:
- relance isc-kea-ctrl-agent
- name: Generation du fichier de configuration kea-dhcp4.conf
ansible.builtin.template:
src: kea-dhcp4.conf.j2
dest: /etc/kea/kea-dhcp4.conf
backup: yes
notify:
- relance isc-kea-dhcp4-server
# - name: change adresse IP dans /etc/kea/kea-ctrl-agent.conf
# ansible.builtin.replace:
# path: /etc/kea/kea-ctrl-agent.conf
# regexp: '"http-host": "127.0.0.1",'
# replace: '"http-host": "{{ srv_ip }}",'
# backup: yes
#
- name: Preparation depot stork agent
ansible.builtin.shell: curl -1sLf 'https://dl.cloudsmith.io/public/isc/stork/cfg/setup/bash.deb.sh' | sudo bash
- name: Update apt
ansible.builtin.apt:
update_cache: yes
- name: Installation isc-stork-agent
ansible.builtin.apt:
name: isc-stork-agent
state: present
- name: Generation du fichier agent.env pour stork-agent
ansible.builtin.template:
src: agent.env.j2
dest: /etc/stork/agent.env
backup: yes
notify:
- relance isc-stork-agent
- name: Preparation stork agent
ansible.builtin.shell: sudo su stork-agent -s /bin/sh -c "stork-agent register --non-interactive --agent-host {{ srv_ip }} --server-url http://192.168.56.5:8080"
handlers:
- name: relance isc-kea-ctrl-agent
ansible.builtin.service:
name: isc-kea-ctrl-agent
state: restarted
enabled: yes
- name: relance isc-stork-agent
ansible.builtin.service:
name: isc-stork-agent
state: restarted
enabled: yes
- name: relance isc-kea-dhcp4-server
ansible.builtin.service:
name: isc-kea-dhcp4-server
state: restarted
enabled: yes

47
wazuh/provision/setup-stork.yml Normal file
View File

@ -0,0 +1,47 @@
---
- hosts: all
become: true
tasks:
- name: Preparation depots
ansible.builtin.shell: curl -1sLf 'https://dl.cloudsmith.io/public/isc/stork/cfg/setup/bash.deb.sh' | sudo bash
- name: Update apt
ansible.builtin.apt:
update_cache: yes
- name: Installation isc-stork-server postgresql et postgresql-contrib
ansible.builtin.apt:
pkg:
- isc-stork-server
- postgresql
- postgresql-contrib
# - name: Lance la commande de création de la base de donnees stork
# ansible.builtin.shell: sudo postgresql-setup --initdb
- name : lancement postgres
ansible.builtin.service:
name: postgresql
state: restarted
enabled: yes
- name: Lance la commande de création de la base de donnees stork
ansible.builtin.shell: su postgres --command "stork-tool db-create --db-name {{ stork_db_name }} --db-user {{ stork_db_user }} --db-password {{ stork_db_passwd }}"
- name: Generation du fichier de configuration server.env
ansible.builtin.template:
src: server.env.j2
dest: /etc/stork/server.env
notify:
- Restart isc-stork-server.service
handlers:
- name: Restart isc-stork-server.service
ansible.builtin.service:
name: isc-stork-server.service
state: restarted
enabled: yes