Skip to content

Commit 6ef5811

Browse files
javimedjavimed
committed
Merge branch '4.13' into enhancement/idr359-update-vuln-detection
2 parents 1b6b80f + 9c52e66 commit 6ef5811

File tree

2 files changed

+131
-15
lines changed

2 files changed

+131
-15
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,15 @@ All notable changes to this project will be documented in this file.
33

44
## [v4.13.1]
55

6-
### Changed
7-
8-
- **Post-release**: Updated curl commands in the Upgrade guide. ([#8934](https://github.com/wazuh/wazuh-documentation/pull/8934))
9-
- **Post-release**: Added indexer connector configuration steps to vulnerability detection documentation and removed troubleshooting section. ([#8942](https://github.com/wazuh/wazuh-documentation/pull/8942))
10-
11-
126
### Added
137

148
- **Post-release**: Updated the Wazuh Amazon Machine Images (AMI) documentation. ([#8938](https://github.com/wazuh/wazuh-documentation/pull/8938))
159

10+
### Changed
11+
12+
- **Post-release**: Updated the upgrade guide for Wazuh central components. ([#8934](https://github.com/wazuh/wazuh-documentation/pull/8934)) ([#8941](https://github.com/wazuh/wazuh-documentation/pull/8941)) ([#8944](https://github.com/wazuh/wazuh-documentation/pull/8944))
13+
- **Post-release**: Added indexer connector configuration steps to vulnerability detection documentation and removed troubleshooting section. ([#8942](https://github.com/wazuh/wazuh-documentation/pull/8942))
14+
1615
## [v4.13.0]
1716

1817
### Added

‎source/upgrade-guide/upgrading-central-components.rst‎

Lines changed: 126 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,46 @@ Preparing the Wazuh indexer cluster for upgrade
7373

7474
Perform the following steps on any of the Wazuh indexer nodes replacing ``<WAZUH_INDEXER_IP_ADDRESS>``, ``<USERNAME>``, and ``<PASSWORD>``.
7575

76+
#. Backup the existing Wazuh indexer security configuration files:
77+
78+
.. code-block:: console
79+
80+
# /usr/share/wazuh-indexer/bin/indexer-security-init.sh --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"
81+
82+
.. code-block:: none
83+
:class: output
84+
85+
Security Admin v7
86+
Will connect to 127.0.0.1:9200 ... done
87+
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
88+
OpenSearch Version: 2.19.1
89+
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
90+
Clustername: wazuh-cluster
91+
Clusterstate: GREEN
92+
Number of nodes: 1
93+
Number of data nodes: 1
94+
.opendistro_security index already exists, so we do not need to create one.
95+
Will retrieve '/config' into /etc/wazuh-indexer/opensearch-security/config.yml
96+
SUCC: Configuration for 'config' stored in /etc/wazuh-indexer/opensearch-security/config.yml
97+
Will retrieve '/roles' into /etc/wazuh-indexer/opensearch-security/roles.yml
98+
SUCC: Configuration for 'roles' stored in /etc/wazuh-indexer/opensearch-security/roles.yml
99+
Will retrieve '/rolesmapping' into /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
100+
SUCC: Configuration for 'rolesmapping' stored in /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
101+
Will retrieve '/internalusers' into /etc/wazuh-indexer/opensearch-security/internal_users.yml
102+
SUCC: Configuration for 'internalusers' stored in /etc/wazuh-indexer/opensearch-security/internal_users.yml
103+
Will retrieve '/actiongroups' into /etc/wazuh-indexer/opensearch-security/action_groups.yml
104+
SUCC: Configuration for 'actiongroups' stored in /etc/wazuh-indexer/opensearch-security/action_groups.yml
105+
Will retrieve '/tenants' into /etc/wazuh-indexer/opensearch-security/tenants.yml
106+
SUCC: Configuration for 'tenants' stored in /etc/wazuh-indexer/opensearch-security/tenants.yml
107+
Will retrieve '/nodesdn' into /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
108+
SUCC: Configuration for 'nodesdn' stored in /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
109+
Will retrieve '/whitelist' into /etc/wazuh-indexer/opensearch-security/whitelist.yml
110+
SUCC: Configuration for 'whitelist' stored in /etc/wazuh-indexer/opensearch-security/whitelist.yml
111+
Will retrieve '/allowlist' into /etc/wazuh-indexer/opensearch-security/allowlist.yml
112+
SUCC: Configuration for 'allowlist' stored in /etc/wazuh-indexer/opensearch-security/allowlist.yml
113+
Will retrieve '/audit' into /etc/wazuh-indexer/opensearch-security/audit.yml
114+
SUCC: Configuration for 'audit' stored in /etc/wazuh-indexer/opensearch-security/audit.yml
115+
76116
#. Disable shard replication to prevent shard replicas from being created while Wazuh indexer nodes are being taken offline for the upgrade.
77117

78118
.. code-block:: bash
@@ -164,7 +204,7 @@ Perform the following steps on each Wazuh indexer node to upgrade them. Upgrade
164204
165205
# service wazuh-indexer stop
166206
167-
#. Backup the ``/etc/wazuh-indexer/jvm.options`` file to preserve your custom JVM settings. For example, create a copy of the file using the following command:
207+
#. Backup the ``/etc/wazuh-indexer/jvm.options`` file to preserve your custom JVM settings. Create a copy of the file using the following command:
168208

169209
.. code-block:: console
170210
@@ -205,6 +245,49 @@ Post-upgrade actions
205245

206246
Perform the following steps on any of the Wazuh indexer nodes replacing ``<WAZUH_INDEXER_IP_ADDRESS>``, ``<USERNAME>``, and ``<PASSWORD>``.
207247

248+
#. Run the ``indexer-security-init.sh`` script to apply the security configuration files from backup into the new Wazuh indexer:
249+
250+
.. code-block:: console
251+
252+
# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
253+
254+
.. code-block:: none
255+
:class: output
256+
257+
Security Admin v7
258+
Will connect to 127.0.0.1:9200 ... done
259+
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
260+
OpenSearch Version: 2.19.2
261+
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
262+
Clustername: wazuh-cluster
263+
Clusterstate: GREEN
264+
Number of nodes: 1
265+
Number of data nodes: 1
266+
.opendistro_security index already exists, so we do not need to create one.
267+
Populate config from /etc/wazuh-indexer/opensearch-security/
268+
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml
269+
SUCC: Configuration for 'config' created or updated
270+
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml
271+
SUCC: Configuration for 'roles' created or updated
272+
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
273+
SUCC: Configuration for 'rolesmapping' created or updated
274+
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml
275+
SUCC: Configuration for 'internalusers' created or updated
276+
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml
277+
SUCC: Configuration for 'actiongroups' created or updated
278+
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml
279+
SUCC: Configuration for 'tenants' created or updated
280+
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml
281+
SUCC: Configuration for 'nodesdn' created or updated
282+
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml
283+
SUCC: Configuration for 'whitelist' created or updated
284+
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml
285+
SUCC: Configuration for 'audit' created or updated
286+
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml
287+
SUCC: Configuration for 'allowlist' created or updated
288+
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","actiongroups","config","internalusers"]) due to: null
289+
Done with success
290+
208291
#. Check that the newly upgraded Wazuh indexer nodes are in the cluster.
209292

210293
.. code-block:: console
@@ -296,27 +379,57 @@ Upgrading the Wazuh manager
296379
#. Upgrade the Wazuh manager to the latest version:
297380

298381
.. tabs::
299-
382+
300383
.. group-tab:: Yum
301-
384+
302385
.. code-block:: console
303-
386+
304387
# yum upgrade wazuh-manager|WAZUH_MANAGER_RPM_PKG_INSTALL|
305-
388+
306389
.. group-tab:: APT
307-
390+
308391
.. code-block:: console
309-
392+
310393
# apt-get install wazuh-manager|WAZUH_MANAGER_DEB_PKG_INSTALL|
311-
394+
312395
.. warning::
313-
396+
314397
If the ``/var/ossec/etc/ossec.conf`` configuration file was modified, it will not be replaced by the upgrade. You will therefore have to add the settings of the new capabilities manually. More information can be found in the :doc:`/user-manual/index`.
315398

316399
#. Run the following command on the Wazuh manager node(s) to start the Wazuh manager service if you stopped it earlier:
317400

318401
.. include:: /_templates/common/start_manager.rst
319402

403+
Configuring CDB lists
404+
^^^^^^^^^^^^^^^^^^^^^
405+
406+
When upgrading from Wazuh 4.12.x or earlier, follow these steps to configure the newly added CDB lists.
407+
408+
#. Edit the ``/var/ossec/etc/ossec.conf`` file and update the ``<ruleset>`` block with the CDB lists highlighted below.
409+
410+
.. code-block:: xml
411+
:emphasize-lines: 9-11
412+
413+
<ruleset>
414+
<!-- Default ruleset -->
415+
<decoder_dir>ruleset/decoders</decoder_dir>
416+
<rule_dir>ruleset/rules</rule_dir>
417+
<rule_exclude>0215-policy_rules.xml</rule_exclude>
418+
<list>etc/lists/audit-keys</list>
419+
<list>etc/lists/amazon/aws-eventnames</list>
420+
<list>etc/lists/security-eventchannel</list>
421+
<list>etc/lists/malicious-ioc/malware-hashes</list>
422+
<list>etc/lists/malicious-ioc/malicious-ip</list>
423+
<list>etc/lists/malicious-ioc/malicious-domains</list>
424+
<!-- User-defined ruleset -->
425+
<decoder_dir>etc/decoders</decoder_dir>
426+
<rule_dir>etc/rules</rule_dir>
427+
</ruleset>
428+
429+
#. Restart the Wazuh manager to apply the configuration changes
430+
431+
.. include:: /_templates/common/start_manager.rst
432+
320433
.. _configuring_vulnerability_detection:
321434

322435
Configuring vulnerability detection
@@ -385,6 +498,10 @@ When upgrading from Wazuh version 4.7.x or earlier, follow these steps to config
385498
386499
If you have forgotten your Wazuh indexer password, refer to the :doc:`password management guide </user-manual/user-administration/password-management>` to reset it.
387500

501+
#. Restart the Wazuh manager to apply the configuration changes
502+
503+
.. include:: /_templates/common/start_manager.rst
504+
388505
.. _configuring_filebeat:
389506

390507
Configuring Filebeat

0 commit comments

Comments
 (0)