diff --git a/security/wazuh-agent/+POST_DEINSTALL.post b/security/wazuh-agent/+POST_DEINSTALL.post new file mode 100644 index 000000000..6e1f1bc55 --- /dev/null +++ b/security/wazuh-agent/+POST_DEINSTALL.post @@ -0,0 +1 @@ +rm /var/ossec/active-response/bin/opnsense-fw diff --git a/security/wazuh-agent/+POST_INSTALL.post b/security/wazuh-agent/+POST_INSTALL.post new file mode 100644 index 000000000..374cc76f4 --- /dev/null +++ b/security/wazuh-agent/+POST_INSTALL.post @@ -0,0 +1,5 @@ +echo -n 'reload filter to register alias: ' +/usr/local/sbin/configctl filter reload +cp /usr/local/opnsense/scripts/wazuh/opnsense-fw /var/ossec/active-response/bin/opnsense-fw +chmod 750 /var/ossec/active-response/bin/opnsense-fw +chown root:wazuh /var/ossec/active-response/bin/opnsense-fw diff --git a/security/wazuh-agent/Makefile b/security/wazuh-agent/Makefile new file mode 100644 index 000000000..b9b8f19ed --- /dev/null +++ b/security/wazuh-agent/Makefile @@ -0,0 +1,8 @@ +PLUGIN_NAME= wazuh-agent +PLUGIN_VERSION= 1.0.0 +#PLUGIN_REVISION= 1 +PLUGIN_COMMENT= Agent for the opensource security platform Wazuh +PLUGIN_MAINTAINER= ad@opnsense.org +PLUGIN_TIER= 3 + +.include "../../Mk/plugins.mk" diff --git a/security/wazuh-agent/pkg-descr b/security/wazuh-agent/pkg-descr new file mode 100644 index 000000000..34fe48113 --- /dev/null +++ b/security/wazuh-agent/pkg-descr @@ -0,0 +1,3 @@ +Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. + +Using this plugin you can integrate your OPNsense firewall into the Wazuh solution. diff --git a/security/wazuh-agent/src/etc/inc/plugins.inc.d/wazuhagent.inc b/security/wazuh-agent/src/etc/inc/plugins.inc.d/wazuhagent.inc new file mode 100644 index 000000000..0907f052d --- /dev/null +++ b/security/wazuh-agent/src/etc/inc/plugins.inc.d/wazuhagent.inc @@ -0,0 +1,61 @@ +general->enabled == '1') { + $service = [ + 'description' => gettext('Wazuh Agent'), + 'configd' => [ + 'restart' => ['wazuh_agent restart'], + 'start' => ['wazuh_agent start'], + 'stop' => ['wazuh_agent stop'], + ], + 'name' => 'wazuh-agentd', + ]; + $services[] = $service; + } + + return $services; +} + +function wazuhagent_firewall($fw) +{ + global $config; + $defaults = ['block' => ['type' => 'block', 'log' => !isset($config['syslog']['nologdefaultblock'])]]; + if ((new \OPNsense\WazuhAgent\WazuhAgent())->general->enabled == '1') { + //$fw->registerFilterRule(); + $fw->registerFilterRule( + 1, + ['from' => '<__wazuh_agent_drop>', 'descr' => 'Wazuh agent blocklist', '#ref' => 'ui/wazuhagent/'], + $defaults['block'] + ); + } +} diff --git a/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/Api/ServiceController.php b/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/Api/ServiceController.php new file mode 100644 index 000000000..166a192ef --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/Api/ServiceController.php @@ -0,0 +1,44 @@ +view->formSettings = $this->getForm("settings"); + // choose template + $this->view->pick('OPNsense/WazuhAgent/index'); + } +} \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/forms/settings.xml b/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/forms/settings.xml new file mode 100644 index 000000000..8be2d81fb --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/controllers/OPNsense/WazuhAgent/forms/settings.xml @@ -0,0 +1,122 @@ +
+ + header + + + + agent.general.enabled + + checkbox + Enable Wazuh Agent + + + agent.general.server_address + + text + Specifies the IP address or the hostname of the Wazuh manager. + + + agent.logcollector.syslog_programs + + select_multiple + Choose which applications to forward to Wazuh. + + + agent.logcollector.suricata_eve_log + + checkbox + Send events from the intrusion detection engine to Wazuh (Suricata EVE log) + + + agent.logcollector.remote_commands + + checkbox + true + + Enable remote commands from the log collector, disabling this will ignore command and full_command log sources + and prevents Wazuh manager from running arbitrary commands on this node. + + + + agent.general.debug_level + true + + dropdown + + Debug level for this agents services. + + + + header + + true + + + agent.active_response.enabled + + checkbox + Enable Active response + + + agent.active_response.fw_alias_ignore + + dropdown + + Select an alias from which the items should be ignored when dropping ip addresses using the opnsense-fw + active-response action. + + + + agent.active_response.remote_commands + + checkbox + true + + Toggles whether Command Module should accept commands defined in the shared configuration or not. + + + + header + + true + + + agent.auth.password + + password + Password to use in authd.pass file. + + + header + + true + + + agent.rootcheck.enabled + + checkbox + Enable policy monitoring and anomaly detection + + + header + + true + + + agent.syscollector.enabled + + checkbox + Enable syscollector + + + header + + true + + + agent.syscheck.enabled + + checkbox + Enable file integrity monitoring + +
\ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/Firewall/static_aliases/wazuh_agent.json b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/Firewall/static_aliases/wazuh_agent.json new file mode 100644 index 000000000..ecf704abc --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/Firewall/static_aliases/wazuh_agent.json @@ -0,0 +1,9 @@ +{ + "__wazuh_agent_drop": { + "enabled": "1", + "name": "__wazuh_agent_drop", + "type": "external", + "description": "Wazuh Agent blocklist (internal)", + "content": "" + } +} \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/ACL/ACL.xml b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/ACL/ACL.xml new file mode 100644 index 000000000..0108ea9cb --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/ACL/ACL.xml @@ -0,0 +1,9 @@ + + + Services: Wazuh Agent + + ui/wazuh_agent/* + api/wazuh_agent/* + + + \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/Menu/Menu.xml b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/Menu/Menu.xml new file mode 100644 index 000000000..02191e604 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/Menu/Menu.xml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/WazuhAgent.php b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/WazuhAgent.php new file mode 100644 index 000000000..add9f8114 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/models/OPNsense/WazuhAgent/WazuhAgent.php @@ -0,0 +1,40 @@ + + //OPNsense/WazuhAgent + 1.0.0 + + Wazuh Agent + + + + + 1 + Y + + + Y + Y + + + 0 + Y + + no debug + first level of debug + full debugging + + + + + + + + + + 1 + Y + + + N + Y + filterlog,openvpn,unbound,audit,sshd + syslog list applications + /tmp/syslog_applications.json + 20 + Y + Specify valid source applications. + + + 1 + Y + + + + + 1 + Y + + + + + 1 + Y + + + + + 1 + Y + + + + + 1 + Y + + + 1 + Y + + + + + OPNsense.Firewall.Alias + aliases.alias + name + + /[network|host]/ + + + + N + + + + \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/mvc/app/views/OPNsense/WazuhAgent/index.volt b/security/wazuh-agent/src/opnsense/mvc/app/views/OPNsense/WazuhAgent/index.volt new file mode 100644 index 000000000..4830c677d --- /dev/null +++ b/security/wazuh-agent/src/opnsense/mvc/app/views/OPNsense/WazuhAgent/index.volt @@ -0,0 +1,76 @@ +{# + +OPNsense® is Copyright © 2023 by Deciso B.V. +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, +are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, +this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, +this list of conditions and the following disclaimer in the documentation +and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, +OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +#} + + + + +
+
+ {{ partial("layout_partials/base_form",['fields':formSettings,'id':'frm_settings'])}} +
+
+ +
+
+
+
+ +

+
+
+
diff --git a/security/wazuh-agent/src/opnsense/scripts/syslog/logformats/wazuhagent.py b/security/wazuh-agent/src/opnsense/scripts/syslog/logformats/wazuhagent.py new file mode 100644 index 000000000..198256291 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/scripts/syslog/logformats/wazuhagent.py @@ -0,0 +1,51 @@ +""" + Copyright (c) 2023 Ad Schellevis + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +""" +import re +import datetime +from . import NewBaseLogFormat +ossec_timeformat = r'^(\d{4}/\d{1,2}/\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}).*' + +class OssecLogFormat(NewBaseLogFormat): + def __init__(self, filename): + super().__init__(filename) + self._priority = 100 + + def match(self, line): + return self._filename.find('wazuhagent') > -1 and re.match(ossec_timeformat, line) is not None + + @property + def timestamp(self): + tmp = re.match(ossec_timeformat, self._line) + grp = tmp.group(1) + return datetime.datetime.strptime(grp, "%Y/%m/%d %H:%M:%S").isoformat() + + @property + def process_name(self): + return self._line[19:].strip().split(':', 1)[0] + + @property + def line(self): + return self._line[19:].strip().split(':', 1)[-1] \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/scripts/wazuh/opnsense-fw b/security/wazuh-agent/src/opnsense/scripts/wazuh/opnsense-fw new file mode 100755 index 000000000..f2b349a25 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/scripts/wazuh/opnsense-fw @@ -0,0 +1,160 @@ +#!/usr/local/bin/python3 + +""" + Copyright (c) 2023 Ad Schellevis + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +""" + +import argparse +import datetime +import json +import os +import sys +import subprocess +import ipaddress +from select import select +from configparser import ConfigParser + + +def send_log(line): + with open('/var/ossec/logs/active-responses.log', 'a') as handle: + handle.write( + str(datetime.datetime.now().strftime('%Y/%m/%d %H:%M:%S')) + + " " + + os.path.basename(__file__) + + ": " + + line + + "\n" + ) + + +def read_data(filename): + payload = [] + with open(filename, 'rb') as fin: + while True: + rlist, _, _ = select([fin], [], [], 0.5) + if not rlist: + break + line = fin.readline() + if line == b'': + break + payload.append(line) + + return b''.join(payload) + + +def main(params): + send_log('Started') + skip_alias='' + if os.path.isfile('/var/ossec/etc/opnsense-fw.conf'): + cnf = ConfigParser() + cnf.read('/var/ossec/etc/opnsense-fw.conf') + skip_alias = cnf.get('general', 'skip_alias') if cnf.has_option('general', 'skip_alias') else '' + else: + send_log('Skip configuration') + + event=None + try: + event=json.loads(read_data(params.input)) + except ValueError: + pass + if event is None: + send_log('Decoding JSON has failed, invalid input format') + return -1 + else: + send_log('Received : %s' % json.dumps(event)) + + command=event.get('command', None) + srcip=event + for token in ['parameters', 'alert', 'data', 'srcip']: + if type(srcip) is dict and token in srcip: + srcip = srcip[token] + else: + srcip = None + break + + if srcip is None: + send_log('srcip not found') + return -1 + + try: + ipaddress.ip_address(srcip) + except ValueError: + send_log('Unable to process even, invalid srcip (%s)' % srcip) + return -1 + + if skip_alias != '' and command == 'add': + sp = subprocess.run(['/sbin/pfctl', '-t', skip_alias, '-Ttest', srcip], capture_output=True, text=True) + if sp.stderr.strip().find("1/1") == 0: + send_log('Skip event %s in alias %s' % (srcip, skip_alias)) + return 0 + + if command == 'add': + # return rule id for timeout list + try: + print(json.dumps({ + "version": 1, + "origin": { + "name": sys.argv[0], + "module":"active-response" + }, + "command": "check_keys", + "parameters":{ + "keys": [event['parameters']['alert']['rule']['id']] + } + })) + sys.stdout.flush() + except KeyError: + pass + # When attached to stdin we're likely running inside the agent, in which case we will read a second event which + # may abort the first one. + if params.input == '/dev/stdin': + timeout_event = None + try: + timeout_event=json.loads(read_data(params.input)) + except ValueError: + pass + if timeout_event: + send_log('Received : %s' % json.dumps(timeout_event)) + if timeout_event.get('command') == 'abort': + send_log('Aborted') + return 0 + elif timeout_event.get('command') != 'continue': + send_log('Invalid command') + return -1 + # add to table and kill active sessions for this ip as well + subprocess.run(['/sbin/pfctl', '-t', '__wazuh_agent_drop', '-T', 'add', srcip], capture_output=True) + subprocess.run(['/sbin/pfctl', '-k', srcip], capture_output=True) + elif command == 'delete': + subprocess.run(['/sbin/pfctl', '-t', '__wazuh_agent_drop', '-T', 'delete', srcip], capture_output=True) + + send_log('Active response executed (%s %s)' % (command, srcip)) + + return 0 + + +if __name__ == '__main__': + parser = argparse.ArgumentParser() + parser.add_argument('-input', help='read message from', default='/dev/stdin') + sys.exit(main(parser.parse_args())) diff --git a/security/wazuh-agent/src/opnsense/scripts/wazuh/setup.php b/security/wazuh-agent/src/opnsense/scripts/wazuh/setup.php new file mode 100755 index 000000000..e294fd723 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/scripts/wazuh/setup.php @@ -0,0 +1,61 @@ +#!/usr/local/bin/php +auth->password)) { + $fhandle = fopen($authd_pass, 'a+'); + if (flock($fhandle, LOCK_EX)) { + chown($authd_pass, 'root'); + chgrp($authd_pass, 'wazuh'); + chmod($authd_pass, 0640); + fseek($fhandle, 0); + ftruncate($fhandle, 0); + fwrite($fhandle, (string)$mdl->auth->password); + flock($fhandle, LOCK_UN); + } +} elseif (file_exists($authd_pass)) { + unlink($authd_pass); +} + +/*** + * Temporary solution to link log files so we can view at least the last items in the file easily for debug purposes + * It looks like ossec is not able to log to syslog directly, which means our log files live outside our normal bounds + **/ +mkdir("/var/log/wazuhagent/ossec/", 0700, true); +mkdir("/var/log/wazuhagent/activeresponses/", 0700, true); +@symlink("/var/ossec/logs/ossec.log", "/var/log/wazuhagent/ossec/ossec_99991231.log"); +@symlink( "/var/ossec/logs/active-responses.log", "/var/log/wazuhagent/activeresponses/activeresponses_99991231.log"); diff --git a/security/wazuh-agent/src/opnsense/service/conf/actions.d/actions_wazuh_agent.conf b/security/wazuh-agent/src/opnsense/service/conf/actions.d/actions_wazuh_agent.conf new file mode 100644 index 000000000..33c1e1c4a --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/conf/actions.d/actions_wazuh_agent.conf @@ -0,0 +1,25 @@ +[start] +command: + /usr/local/sbin/pluginctl -s syslog-ng restart; + /usr/local/etc/rc.d/wazuh-agent onestart +type:script +message:starting wazuh-agent + +[stop] +command:/usr/local/etc/rc.d/wazuh-agent onestop +type:script +message:stopping wazuh-agent + +[status] +command: + /usr/local/etc/rc.d/wazuh-agent status > /dev/null 2>&1 && echo "wazuh is running..." || echo "wazuh is not running..."; + exit 0 +type:script_output +message:get wazuh-agent status + +[restart] +command: + /usr/local/sbin/pluginctl -s syslog-ng restart; + /usr/local/etc/rc.d/wazuh-agent onerestart +type:script +message:restarting wazuh-agent diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/+TARGETS b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/+TARGETS new file mode 100644 index 000000000..268450b04 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/+TARGETS @@ -0,0 +1,6 @@ +ossec.conf:/var/ossec/etc/ossec.conf +local_internal_options.conf:/var/ossec/etc/local_internal_options.conf +rc.conf.d:/etc/rc.conf.d/wazuh_agent +syslog-ng-wazuh-agent.conf:/usr/local/etc/syslog-ng.conf.d/syslog-ng-wazuh-agent.conf +newsyslog.conf:/etc/newsyslog.conf.d/wazuh-agent.conf +opnsense-fw.conf:/var/ossec/etc/opnsense-fw.conf diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/local_internal_options.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/local_internal_options.conf new file mode 100644 index 000000000..2ed6e9dde --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/local_internal_options.conf @@ -0,0 +1,28 @@ +# local_internal_options.conf +# +# This file should be handled with care. It contains +# run time modifications that can affect the use +# of OSSEC. Only change it if you know what you +# are doing. Look first at ossec.conf +# for most of the things you want to change. +# +# This file will not be overwritten during upgrades. +logcollector.remote_commands={% if not helpers.empty('OPNsense.WazuhAgent.logcollector.remote_commands') %}1{% else %}0{% endif +%} +wazuh_command.remote_commandss={% if not helpers.empty('OPNsense.WazuhAgent.wazuh_command.remote_commands') %}1{% else %}0{% endif +%} + + +{% if not helpers.empty('OPNsense.WazuhAgent.general.debug_level') %} +windows.debug={{OPNsense.WazuhAgent.general.debug_level}} +syscheck.debug={{OPNsense.WazuhAgent.general.debug_level}} +remoted.debug={{OPNsense.WazuhAgent.general.debug_level}} +analysisd.debug={{OPNsense.WazuhAgent.general.debug_level}} +authd.debug={{OPNsense.WazuhAgent.general.debug_level}} +execd.debug={{OPNsense.WazuhAgent.general.debug_level}} +monitord.debug={{OPNsense.WazuhAgent.general.debug_level}} +logcollector.debug={{OPNsense.WazuhAgent.general.debug_level}} +integrator.debug={{OPNsense.WazuhAgent.general.debug_level}} +agent.debug={{OPNsense.WazuhAgent.general.debug_level}} +wazuh_db.debug={{OPNsense.WazuhAgent.general.debug_level}} +wazuh_modules.debug={{OPNsense.WazuhAgent.general.debug_level}} +wazuh_clusterd.debug={{OPNsense.WazuhAgent.general.debug_level}} +{% endif %} diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/newsyslog.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/newsyslog.conf new file mode 100644 index 000000000..558d19da0 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/newsyslog.conf @@ -0,0 +1,4 @@ +# logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] +{% if not helpers.empty('OPNsense.WazuhAgent.general.enabled') %} +/var/ossec/logs/opnsense_syslog.log root:wazuh 660 2 * $D0 Z /var/run/syslog-ng.pid +{% endif %} diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/opnsense-fw.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/opnsense-fw.conf new file mode 100644 index 000000000..073220f8f --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/opnsense-fw.conf @@ -0,0 +1,4 @@ +[general] +{% if not helpers.empty('OPNsense.WazuhAgent.wazuh_command.fw_alias_ignore') and helpers.getUUID(OPNsense.WazuhAgent.wazuh_command.fw_alias_ignore) %} +skip_alias={{helpers.getUUID(OPNsense.WazuhAgent.wazuh_command.fw_alias_ignore).name}} +{% endif %} \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec.conf new file mode 100644 index 000000000..1303029ae --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec.conf @@ -0,0 +1,22 @@ + + + +
{{OPNsense.WazuhAgent.general.server_address}}
+ + aes + + + + + no + 5000 + 500 + + +{% for sfilename in helpers.glob("OPNsense/WazuhAgent/ossec_config.d/*.conf") %}{% + include sfilename without context ++%} + +{% endfor %} + + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/000-rootcheck.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/000-rootcheck.conf new file mode 100644 index 000000000..e0f98ff46 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/000-rootcheck.conf @@ -0,0 +1,16 @@ + + + {% if not helpers.empty('OPNsense.WazuhAgent.rootcheck.enabled') %}no{% else %}yes{% endif %} + + + 43200 + + /var/ossec/etc/shared/rootkit_files.txt + /var/ossec/etc/shared/rootkit_trojans.txt + + /var/ossec/etc/shared/system_audit_rcl.txt + /var/ossec/etc/shared/system_audit_ssh.txt + /var/ossec/etc/shared/cis_debian_linux_rcl.txt + + yes + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/001-wodle_syscollector.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/001-wodle_syscollector.conf new file mode 100644 index 000000000..b3d32ce38 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/001-wodle_syscollector.conf @@ -0,0 +1,13 @@ + + {% if not helpers.empty('OPNsense.WazuhAgent.syscollector.enabled') %}no{% else %}yes{% endif %} + 1h + yes + yes + yes + yes + + + + 10 + + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/002-syscheck.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/002-syscheck.conf new file mode 100644 index 000000000..4285d50e0 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/002-syscheck.conf @@ -0,0 +1,55 @@ + + + {% if not helpers.empty('OPNsense.WazuhAgent.syscheck.enabled') %}no{% else %}yes{% endif %} + + + 43200 + + yes + + + /etc,/usr/bin,/usr/sbin + /bin,/sbin,/boot + + + /etc/mtab + /etc/hosts.deny + /etc/mail/statistics + /etc/random-seed + /etc/random.seed + /etc/adjtime + /etc/httpd/logs + /etc/utmpx + /etc/wtmpx + /etc/cups/certs + /etc/dumpdates + /etc/svc/volatile + /sys/kernel/security + /sys/kernel/debug + + + .log$|.swp$ + + + /etc/ssl/private.key + + yes + yes + yes + yes + + + 10 + + + 100 + + + + yes + 5m + 30 + 16384 + 10 + + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/003-localfile-generic.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/003-localfile-generic.conf new file mode 100644 index 000000000..6b337fca1 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/003-localfile-generic.conf @@ -0,0 +1,10 @@ + + + syslog + /var/ossec/logs/active-responses.log + + + + syslog + /var/ossec/logs/opnsense_syslog.log + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/004-localfile-suricata.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/004-localfile-suricata.conf new file mode 100644 index 000000000..ec0b9ffce --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/004-localfile-suricata.conf @@ -0,0 +1,9 @@ + +{% if not helpers.empty('OPNsense.WazuhAgent.logcollector.suricata_eve_log') %} + + json + /var/log/suricata/eve.json + +{% else %} + +{% endif %} \ No newline at end of file diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/005-active-response.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/005-active-response.conf new file mode 100644 index 000000000..6627c9eac --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/ossec_config.d/005-active-response.conf @@ -0,0 +1,4 @@ + + + {% if not helpers.empty('OPNsense.WazuhAgent.active_response.enabled') %}no{% else %}yes{% endif %} + diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/rc.conf.d b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/rc.conf.d new file mode 100644 index 000000000..c1e4bbe5c --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/rc.conf.d @@ -0,0 +1,2 @@ +wazuh_agent_setup="/usr/local/opnsense/scripts/wazuh/setup.php" +wazuh_agent_enable={% if not helpers.empty('OPNsense.WazuhAgent.general.enabled') %}"YES"{% else %}"NO"{% endif %} diff --git a/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/syslog-ng-wazuh-agent.conf b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/syslog-ng-wazuh-agent.conf new file mode 100644 index 000000000..649aa0221 --- /dev/null +++ b/security/wazuh-agent/src/opnsense/service/templates/OPNsense/WazuhAgent/syslog-ng-wazuh-agent.conf @@ -0,0 +1,27 @@ +####################################################################################################################### +# This syslog-ng output is a bit of a work-around. As Wazuh does only support RFC3164 format syslog data +# (https://github.com/wazuh/wazuh/issues/2038), we do need to flush our syslog output twice. +# +# Ideally we should then send it to a pipe, but that seems to be a feature +# currenty on the wishlist (https://github.com/wazuh/wazuh/issues/15178) +# +# So, we will flush relevant messages to /var/ossec/logs/opnsense_syslog.log, which newsyslog may rotate +# +####################################################################################################################### +{% if not helpers.empty('OPNsense.WazuhAgent.general.enabled') and not helpers.empty('OPNsense.WazuhAgent.logcollector.syslog_programs') %} +filter f_local_wazuhagent { +{% for prg in OPNsense.WazuhAgent.logcollector.syslog_programs.split(',') %} + program("{{prg}}") {% if loop.last %} ; {% else %} or {% endif +%} +{% endfor %} +}; + +destination d_local_wazuhagent { + file("/var/ossec/logs/opnsense_syslog.log"); +}; + +log { + source(s_all); + filter(f_local_wazuhagent); + destination(d_local_wazuhagent); +}; +{% endif %} \ No newline at end of file