doc ...

README.md

@@ -1,6 +1,6 @@
 # vagrant
 
-le 2024-12-14 21h30 - ps
+le 2025-02-02 11h30 - ps
 
 Ce dépôt héberge des **Vagrantfile** dont : 
   * **dns** : Vagrantfile pour 2 serveurs **Bind9** (1 maitre et un esclave), tests **goss** chainés  
@@ -12,8 +12,7 @@ Ce dépôt héberge des **Vagrantfile** dont :
   * **docker-traefik-nextcloud**
   * **docker-traefik-nextcloud-ss-tls**
   * **docker-traefik-nginx**
-  * **docker-elk**
-  * **devstack**
+  * **devstack** : Vagrantfile pour Openstack devstack
   * **dvlpt** : Vagrantfile pour VM Debian 11 LAMP + phpmyadmin
   * **glpi** : Vagrantfile pour VM Debian 11 GLPI 10.0.7
   * **guacamole** : Vagrantfile pour Apache Guacamole dockerise sans frontal
@@ -22,11 +21,11 @@ Ce dépôt héberge des **Vagrantfile** dont :
   * **kea-dhcp-ha** : Vagrantfile pour serveur DHCP kea - HA avec serveur stork - machines **kea1**, **kea2** et **stork** 
   * **lldap** : Vagrantfile pour serveur LDAP en mode service **lldap**
   * **lldap2** : Vagrantfile pour serveur LDAP en mode service **lldap** - integration pour Proxmox
-  * **minione**
+  * **minione** : Vagrantfile pour Opennebula All In One
   * **netbox** : Vagrantfile pour Netbox dockerisée
   * **rundeck** : Vagrantfile + playbook pour installation avec Mariadb
   * **samba-ad-dc** : Vagrantfile + playbook pour **Samba 4.17 ad-dc** sur **Debian 12 Bookworm**
-
+  * **wazuh** : Vagrantfile + playbook pour serveur **wazuh** 4.10 et client Debian
   * **wp-lb** : Wordpress web1 et web2, lb HaProxy, nfs, db Mariadb - Vagrantfile + playbooks
   * **zabbix** : Vagrantfile pour VM Debian 12 **zabbix7** Srv et VM Debian 12 **web1** apache, zabbix agent2
 

auth/README.md

@@ -1,8 +1,12 @@
-# Authelia - on outil d'authentification centralisée 2FA
+# Authelia - un outil d'authentification centralisée 2FA
 
 
 ## Mise en oeuvre
 
-sur une machine disposant de docker et de git :
+
+  * lancer la Vagrantfile  avec : 'vagrant up'
+  * se connecter avec : 'vagrant ssh' 
+  puis  sur une machine disposant de docker et de git :
 ````shell
+cd 
 ````

docker/Vagrantfile

@@ -12,7 +12,7 @@ Vagrant.configure("2") do |config|
 
   # Every Vagrant development environment requires a box. You can search for
   # boxes at https://vagrantcloud.com/search.
-  config.vm.box = "debian/bullseye64"
+  config.vm.box = "debian/bookworm64"
   config.vm.hostname = "docker"
 
   # Disable automatic box update checking. If you disable this, then

k3s-awx/Vagrantfile

@@ -12,7 +12,7 @@ Vagrant.configure("2") do |config|
 
   # Every Vagrant development environment requires a box. You can search for
   # boxes at https://vagrantcloud.com/search.
-  config.vm.box = "debian/bullseye64"
+  config.vm.box = "debian/bookworm64"
   config.vm.hostname = "k3s-awx"
 
   # Disable automatic box update checking. If you disable this, then
@@ -33,12 +33,12 @@ Vagrant.configure("2") do |config|
 
   # Create a private network, which allows host-only access to the machine
   # using a specific IP.
-  config.vm.network "private_network", ip: "192.168.56.10"
+#  config.vm.network "private_network", ip: "192.168.56.10"
 
   # Create a public network, which generally matched to bridged network.
   # Bridged networks make the machine appear as another physical device on
   # your network.
-  # config.vm.network "public_network"
+   config.vm.network "public_network"
 
   # Share an additional folder to the guest VM. The first argument is
   # the path on the host to the actual folder. The second argument is
@@ -55,7 +55,8 @@ Vagrant.configure("2") do |config|
   #   vb.gui = true
   #
   #   # Customize the amount of memory on the VM:
-     vb.memory = "3072"
+     vb.memory = "6144"
+     vb.cpus = 2
    end
   #
   # View the documentation for the provider you are using for more
@@ -65,6 +66,7 @@ Vagrant.configure("2") do |config|
   # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
   # documentation for more information about their specific syntax and use.
    config.vm.provision "shell", inline: <<-SHELL
+     timdatectl set-timezone Europe/Paris
      apt-get update
      apt-get install -y curl vim git make
    SHELL

wazuh/README.md

@@ -0,0 +1,38 @@
+# Serveur Wazuh All in One et machine wazuh-agent debian 12 
+
+## Présentation
+
+Cette `Vagrantfile` permet d'installer :
+  * un serveur Wazuh **wazuh** All-In-One ( indexer + manager + Dashboard) - Ubuntu 24.04
+  * un serveur Linux  **wazuh-cli** ( wazuh-agent ) - Debian 12.9
+
+La Vagrantfile utilise les playbooks ansible suivants :
+  * **provision/setup-wazuh.yml** qui:
+    * coupe le service **unattended-upgrades**
+    * recupère le script **wazuh-install.sh** et le lance 
+  * **provision/setup-wazuh-cli.yml** qui:
+    * installe les dépots pour wazuh
+    * installe le paquet **wazuh-agent** en enregistrant la machine **wazuh-cli**
+    * relance le service **wazuh-agent**
+
+## Utilisation de la Vagrantfile
+
+L'installation du serveur **wazuh** est assez longue ( ~ 15 minutes ). 
+  
+````shell
+   vagrant up wazuh
+   vagrant up wazuhcli
+```` 
+
+Le mot de passe du compte **admin** se trouve dans le fichier `wazuh-install-files/wazuh-passwords.txt`, lui-même contenu dans le ficher `wazuh-install-files.tar` à extraire avec la commande :
+
+````shell
+   sudo tar xvf wazuh-install-file.tar
+```` 
+On peut alors se connecter au serveur **wazuh** avec un navigateur : http://adresse
+(admin/mdp)
+
+Une fois connecté, on doit autoriser chacun des deux serveurs **kea1** et **kea2** inscrits
+
+
+

wazuh/Vagrantfile

@@ -0,0 +1,60 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure("2") do |config|
+  # Base VM OS configuration.
+  config.vm.box = "debian/bookworm64"
+  config.ssh.insert_key = false
+  config.vm.synced_folder '.', '/vagrant', disabled: true
+
+  # General VirtualBox VM configuration.
+  config.vm.provider :virtualbox do |v|
+    v.memory = 1024
+    v.cpus = 1
+    v.linked_clone = true
+    v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
+    v.customize ["modifyvm", :id, "--ioapic", "on"]
+    v.check_guest_additions = false
+  end
+
+  # wazuh.
+  config.vm.define "wazuh" do |wazuh|
+    wazuh.vm.box = "alvistack/ubuntu-24.04"
+    wazuh.vm.hostname = "wazuh"
+    wazuh.vm.network :private_network, ip: "192.168.56.5"
+    wazuh.vm.provider :virtualbox do |v|
+      v.customize ["modifyvm", :id, "--memory", 4100]
+      v.cpus = 2
+    end
+    wazuh.vm.provision "shell",
+      inline: "sudo apt-get update ; sudo apt-get install -y vim curl wget gnupg"
+    wazuh.vm.provision "ansible" do |ansible|
+      ansible.extra_vars = {
+        wazuh_db_name: "wazuh",
+        wazuh_db_user: "wazuh-server",
+        wazuh_db_passwd: "wazuh-passwd",
+      }
+      ansible.playbook = "provision/setup-wazuh.yml"
+    end
+  end
+
+  # wazuh-cli.
+  config.vm.define "wazuhcli" do |wazucli|
+    wazucli.vm.hostname = "wazuh-cli"
+    wazucli.vm.network :private_network, ip: "192.168.56.2"
+    wazucli.vm.provider :virtualbox do |v|
+      v.customize ["modifyvm", :id, "--memory", 1024]
+    end
+    wazucli.vm.provision "shell",
+      inline: "timedatectl set-timezone Europe/Paris ; apt-get update ; apt-get install -y vim curl wget gnupg"
+    wazucli.vm.provision "ansible" do |ansible|
+      ansible.extra_vars = {
+        srv_ip: "192.168.56.5",
+      }
+      ansible.playbook = "provision/setup-wazuh-cli.yml"
+    end
+  end
+
+
+end
+

wazuh/provision/kea-ctrl-agent.conf

@@ -0,0 +1,105 @@
+// This is a basic configuration for the Kea Control Agent.
+//
+// This is just a very basic configuration. Kea comes with large suite (over 30)
+// of configuration examples and extensive Kea User's Guide. Please refer to
+// those materials to get better understanding of what this software is able to
+// do. Comments in this configuration file sometimes refer to sections for more
+// details. These are section numbers in Kea User's Guide. The version matching
+// your software should come with your Kea package, but it is also available
+// in ISC's Knowledgebase (https://kea.readthedocs.io; the direct link for
+// the stable version is https://kea.readthedocs.io/).
+//
+// This configuration file contains only Control Agent's configuration.
+// If configurations for other Kea services are also included in this file they
+// are ignored by the Control Agent.
+{
+
+// This is a basic configuration for the Kea Control Agent.
+// RESTful interface to be available at http://127.0.0.1:8000/
+"Control-agent": {
+    "http-host": "127.0.0.1",
+    // If enabling HA and multi-threading, the 8000 port is used by the HA
+    // hook library http listener. When using HA hook library with
+    // multi-threading to function, make sure the port used by dedicated
+    // listener is different (e.g. 8001) than the one used by CA. Note
+    // the commands should still be sent via CA. The dedicated listener
+    // is specifically for HA updates only.
+    "http-port": 8000,
+
+    // Specify location of the files to which the Control Agent
+    // should connect to forward commands to the DHCPv4, DHCPv6
+    // and D2 servers via unix domain sockets.
+    "control-sockets": {
+        "dhcp4": {
+            "socket-type": "unix",
+            "socket-name": "/run/kea/kea4-ctrl-socket"
+        },
+        "dhcp6": {
+            "socket-type": "unix",
+            "socket-name": "/run/kea/kea6-ctrl-socket"
+        },
+        "d2": {
+            "socket-type": "unix",
+            "socket-name": "/run/kea/kea-ddns-ctrl-socket"
+        }
+    },
+
+    // Specify hooks libraries that are attached to the Control Agent.
+    // Such hooks libraries should support 'control_command_receive'
+    // hook point. This is currently commented out because it has to
+    // point to the existing hooks library. Otherwise the Control
+    // Agent will fail to start.
+    "hooks-libraries": [
+//  {
+//      "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/control-agent-commands.so",
+//      "parameters": {
+//          "param1": "foo"
+//      }
+//  }
+    ],
+
+// Logging configuration starts here. Kea uses different loggers to log various
+// activities. For details (e.g. names of loggers), see Chapter 18.
+    "loggers": [
+    {
+        // This specifies the logging for Control Agent daemon.
+        "name": "kea-ctrl-agent",
+        "output_options": [
+            {
+                // Specifies the output file. There are several special values
+                // supported:
+                // - stdout (prints on standard output)
+                // - stderr (prints on standard error)
+                // - syslog (logs to syslog)
+                // - syslog:name (logs to syslog using specified name)
+                // Any other value is considered a name of the file
+                "output": "stdout",
+
+                // Shorter log pattern suitable for use with systemd,
+                // avoids redundant information
+                "pattern": "%-5p %m\n"
+
+                // This governs whether the log output is flushed to disk after
+                // every write.
+                // "flush": false,
+
+                // This specifies the maximum size of the file before it is
+                // rotated.
+                // "maxsize": 1048576,
+
+                // This specifies the maximum number of rotated files to keep.
+                // "maxver": 8
+            }
+        ],
+        // This specifies the severity of log messages to keep. Supported values
+        // are: FATAL, ERROR, WARN, INFO, DEBUG
+        "severity": "INFO",
+
+        // If DEBUG level is specified, this value is used. 0 is least verbose,
+        // 99 is most verbose. Be cautious, Kea can generate lots and lots
+        // of logs if told to do so.
+        "debuglevel": 0
+    }
+  ]
+}
+}

wazuh/provision/setup-wazuh-cli.yml

@@ -0,0 +1,25 @@
+---
+- hosts: all
+  become: true
+  tasks:
+  - name: Recup clefs depot  
+    ansible.builtin.shell: curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
+
+  - name: Ajoute depot   
+    ansible.builtin.shell: echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
+  
+  - name: Update apt
+    ansible.builtin.apt:
+      update_cache: yes
+
+  - name: Installation wazuh-agent et liaison wazuh-server
+    ansible.builtin.shell: "WAZUH_MANAGER={{ srv_ip }} apt-get install wazuh-agent"
+
+  - name: Relance wazuh-agent
+    ansible.builtin.systemd:
+      name: wazuh-agent
+      state: restarted
+      enabled: true
+      daemon_reload: true
+  
+

wazuh/provision/setup-wazuh.yml

@@ -0,0 +1,14 @@
+---
+- hosts: all
+  become: true
+  tasks:
+  - name: Arrete service unattended-upgrades 
+    ansible.builtin.service: 
+      name: unattended-upgrades
+      state: stopped
+
+  - name: Recup script install et lance wazuh-installl.sh en mode AIO - 15 min
+    ansible.builtin.shell: 
+      cmd: curl -s -O https://packages.wazuh.com/4.10/wazuh-install.sh && bash wazuh-install.sh -a
+
+