Reupload (purge)
This commit is contained in:
gauvainboiche
@@ -0,0 +1,358 @@
|
||||
# Lab 01 - Cybersecurity 3
|
||||
Analyse Forensique d’un poste Windows compromis
|
||||
|
||||
## Rapport d'Analyse Forensique
|
||||
Référence : RF-2026-047
|
||||
Auteur : Gauvain BOICHÉ
|
||||
Date du rapport : 3 août 2026
|
||||
Objet : Analyse forensique suite à suspicion d’intrusion sur un poste utilisateur
|
||||
|
||||
## 0. Mise en place (partie hors-rapport, explication de l'élève au correcteur)
|
||||
|
||||
*Afin de reproduire l'environnement d'analyse attendu, et en raison de l'indisponibilité de l'image Docker Sleuthkit originellement prévue, un environnement containerisé sur mesure a été déployé.*
|
||||
|
||||
Préparation du répertoire de travail et copie de l'image disque brute :
|
||||
|
||||
```bash
|
||||
mkdir -p ./cyberlab/data
|
||||
cp .\L01-ntfs1-gen2.E01 .\cyberlab\data\
|
||||
cd .\cyberlab\
|
||||
```
|
||||
|
||||
Création d'un `Dockerfile` basé sur Ubuntu 22.04 intégrant les outils forensiques nécessaires (Sleuth Kit, outils EWF et Autopsy) :
|
||||
|
||||
```dockerfile
|
||||
FROM ubuntu:22.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
sleuthkit \
|
||||
ewf-tools \
|
||||
autopsy \
|
||||
kpartx \
|
||||
python3 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /data
|
||||
|
||||
CMD ["bash"]
|
||||
```
|
||||
|
||||
Configuration du fichier de déploiement `docker-compose.yml` avec l'attribution des privilèges permettant le montage de systèmes de fichiers virtuels FUSE (partie générée à l'aide de l'IA Gemini 3.6 Raisonnement) :
|
||||
|
||||
```yaml
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
forensic-lab:
|
||||
build: .
|
||||
container_name: forensic_lab
|
||||
volumes:
|
||||
- ./data:/data
|
||||
devices:
|
||||
- "/dev/fuse:/dev/fuse"
|
||||
cap_add:
|
||||
- SYS_ADMIN
|
||||
security_opt:
|
||||
- apparmor:unconfined
|
||||
stdin_open: true
|
||||
tty: true
|
||||
```
|
||||
|
||||
Lancement du conteneur et connexion au terminal de l'environnement d'analyse :
|
||||
|
||||
```bash
|
||||
docker compose up -d --build
|
||||
docker exec -it forensic_lab bash
|
||||
```
|
||||
|
||||
Création du point de montage et chargement de l'image disque cible (`.E01`) via l'utilitaire `ewfmount` :
|
||||
|
||||
```bash
|
||||
mkdir -p /mnt/ewf
|
||||
ewfmount /data/L01-ntfs1-gen2.E01 /mnt/ewf
|
||||
```
|
||||
|
||||
## 1. Contexte de l’investigation
|
||||
|
||||
Le 2 août 2026 à 9h45, le SOC (Security Operation Center) a détecté une activité anormale sur le poste utilisateur WIN-DEV-07, appartenant à un développeur de l'équipe R&D. L’alerte provenait de l’EDR SentinelOne, signalant l'exécution d’un binaire suspect non reconnu par l’utilisateur légitime. Les présentes investigations visent à éclaircir la nature de cette compromission.
|
||||
|
||||
## 2. Objectifs de l’analyse
|
||||
|
||||
- Confirmer ou infirmer la compromission effective du poste de travail.
|
||||
- Identifier avec certitude les vecteurs d’attaque et le point d'entrée initial.
|
||||
- Déterminer l'étendue et le périmètre exact de l’intrusion sur le système de fichiers.
|
||||
- Relever la présence d'éventuels artefacts de persistance, de tentatives d'escalade de privilèges ou d'indicateurs de mouvements latéraux.
|
||||
- Formuler des mesures correctives et des préconisations de durcissement.
|
||||
|
||||
## 3. Méthodologie
|
||||
|
||||
Afin de mener à bien ces investigations, une chaîne de traitement logicielle spécialisée a été mobilisée. Les outils suivants ont été principalement utilisés :
|
||||
|
||||
| Outil | Utilisation principale |
|
||||
| :--- | :--- |
|
||||
| **Sleuth Kit (CLI)** | Extraction d'artefacts, génération de timelines (MACB) et exploration du système de fichiers brut. |
|
||||
| **Autopsy** | Analyse graphique du disque (.E01) et corrélation visuelle des preuves. |
|
||||
| **EWF-Tools** | Montage et interaction native avec les formats d'image forensique EnCase (.E01). |
|
||||
|
||||
*(Note : Volatility, FTK Imager et Wireshark, bien que pertinents dans une analyse globale, n'ont pas été sollicités dans ce rapport centré exclusivement sur l'analyse statique d'un système de fichiers).*
|
||||
|
||||
## 4. Sources analysées
|
||||
|
||||
### 4.1. Structure du volume disque
|
||||
|
||||
La première phase de l'investigation a consisté à interroger les métadonnées globales du système de fichiers afin d'en comprendre l'architecture et les spécificités via la commande `fsstat`. Le volume analysé est de type NTFS (Windows XP).
|
||||
|
||||
```text
|
||||
fsstat /mnt/ewf/ewf1
|
||||
FILE SYSTEM INFORMATION
|
||||
--------------------------------------------
|
||||
File System Type: NTFS
|
||||
Volume Serial Number: DA5048E85048CCC7
|
||||
OEM Name: NTFS
|
||||
Volume Name: NTFS1
|
||||
Version: Windows XP
|
||||
|
||||
METADATA INFORMATION
|
||||
--------------------------------------------
|
||||
First Cluster of MFT: 336298
|
||||
First Cluster of MFT Mirror: 504447
|
||||
Size of MFT Entries: 1024 bytes
|
||||
Size of Index Records: 4096 bytes
|
||||
Range: 0 - 96
|
||||
Root Directory: 5
|
||||
|
||||
CONTENT INFORMATION
|
||||
--------------------------------------------
|
||||
Sector Size: 512
|
||||
Cluster Size: 512
|
||||
Total Cluster Range: 0 - 1008894
|
||||
Total Sector Range: 0 - 1008894
|
||||
|
||||
$AttrDef Attribute Values:
|
||||
$STANDARD_INFORMATION (16) Size: 48-72 Flags: Resident
|
||||
$ATTRIBUTE_LIST (32) Size: No Limit Flags: Non-resident
|
||||
$FILE_NAME (48) Size: 68-578 Flags: Resident,Index
|
||||
$OBJECT_ID (64) Size: 0-256 Flags: Resident
|
||||
$SECURITY_DESCRIPTOR (80) Size: No Limit Flags: Non-resident
|
||||
$VOLUME_NAME (96) Size: 2-256 Flags: Resident
|
||||
$VOLUME_INFORMATION (112) Size: 12-12 Flags: Resident
|
||||
$DATA (128) Size: No Limit Flags:
|
||||
$INDEX_ROOT (144) Size: No Limit Flags: Resident
|
||||
$INDEX_ALLOCATION (160) Size: No Limit Flags: Non-resident
|
||||
$BITMAP (176) Size: No Limit Flags: Non-resident
|
||||
$REPARSE_POINT (192) Size: 0-16384 Flags: Non-resident
|
||||
$EA_INFORMATION (208) Size: 8-8 Flags: Resident
|
||||
$EA (224) Size: 0-65536 Flags:
|
||||
$LOGGED_UTILITY_STREAM (256) Size: 0-65536 Flags: Non-resident
|
||||
```
|
||||
|
||||
### 4.2. Analyse de l'arborescence à la racine du volume
|
||||
Le parcours de la racine du système de fichiers (`fls`) a immédiatement mis en évidence une structure inhabituelle. Plutôt qu'une arborescence système classique, le volume semble dédié au stockage de données protégées, avec la présence de dossiers spécifiques (RAW, Compressed, Encrypted) et de plusieurs certificats liés à la technologie EFS (Encrypting File System) stockés en clair.
|
||||
|
||||
```text
|
||||
fls -o 0 /mnt/ewf/ewf1
|
||||
r/r 4-128-4: $AttrDef
|
||||
r/r 8-128-2: $BadClus
|
||||
r/r 8-128-1: $BadClus:$Bad
|
||||
r/r 6-128-1: $Bitmap
|
||||
r/r 7-128-1: $Boot
|
||||
d/d 11-144-4: $Extend
|
||||
r/r 2-128-1: $LogFile
|
||||
r/r 0-128-1: $MFT
|
||||
r/r 1-128-1: $MFTMirr
|
||||
r/r 9-128-8: $Secure:$SDS
|
||||
r/r 9-144-11: $Secure:$SDH
|
||||
r/r 9-144-5: $Secure:$SII
|
||||
r/r 10-128-1: $UpCase
|
||||
r/r 3-128-3: $Volume
|
||||
d/d 28-144-8: Compressed
|
||||
r/r 46-128-1: EFS-key-info.txt
|
||||
r/r 43-128-4: EFS-key-no-password.pfx
|
||||
r/r 45-128-4: EFS-key-password-strong-protection.pfx
|
||||
r/r 44-128-4: EFS-key-password.pfx
|
||||
d/d 29-144-10: Encrypted
|
||||
d/d 27-144-7: RAW
|
||||
d/d 30-144-1: System Volume Information
|
||||
V/V 96: $OrphanFiles
|
||||
```
|
||||
|
||||
### 4.3. Extraction d'informations critiques et d'indices
|
||||
La présence du fichier `EFS-key-info.txt` à la racine (inode 46) constituait une compromission potentielle majeure. Son extraction a révélé le stockage en clair du mot de passe maître permettant de déverrouiller la clé EFS.
|
||||
|
||||
```text
|
||||
icat /mnt/ewf/ewf1 46
|
||||
> The password for the EFS key is "password" (no quotes).
|
||||
```
|
||||
|
||||
#### Récupération des artefacts cryptographiques et vérification de l'intégrité
|
||||
L'ensemble des fichiers de clés et de certificats (`.pfx`) présents à la racine ont été extraits vers l'environnement d'analyse. Des empreintes cryptographiques (SHA-256) ont été générées immédiatement afin de sceller ces preuves numériques.
|
||||
|
||||
```bash
|
||||
icat /mnt/ewf/ewf1 46 > /data/EFS-key-info.txt
|
||||
icat /mnt/ewf/ewf1 43 > /data/EFS-key-no-password.pfx
|
||||
icat /mnt/ewf/ewf1 44 > /data/EFS-key-password.pfx
|
||||
icat /mnt/ewf/ewf1 45 > /data/EFS-key-password-strong-protection.pfx
|
||||
|
||||
sha256sum /data/EFS-key*
|
||||
```
|
||||
|
||||
#### Inspection de la zone de stockage chiffrée
|
||||
L'inspection du dossier `Encrypted` (inode 29) a permis de lister les fichiers que l'utilisateur tentait de protéger. On y retrouve des documents de nature administrative, des normes de sécurité (NIST), et surtout, un fichier journal (`logfile1.txt`) qui pourrait contenir des traces d'activités système ou utilisateur.
|
||||
|
||||
```text
|
||||
> fls /mnt/ewf/ewf1 29
|
||||
r/r 41-128-1: 20076517123273.pdf
|
||||
r/r 49-128-7: logfile1.txt
|
||||
r/r 35-128-1: NISTSP800-88_rev1.pdf
|
||||
r/r 32-128-1: NIST_logo.jpg
|
||||
r/r 38-128-1: report02-3.pdf
|
||||
```
|
||||
|
||||
#### Extraction globale des preuves documentaires
|
||||
L'intégralité du contenu du dossier chiffré a été extraite et hachée cryptographiquement en vue d'une analyse ultérieure et pour garantir la traçabilité des éléments versés au dossier.
|
||||
|
||||
```bash
|
||||
icat /mnt/ewf/ewf1 49 > /data/logfile1.txt
|
||||
icat /mnt/ewf/ewf1 41 > /data/20076517123273.pdf
|
||||
icat /mnt/ewf/ewf1 35 > /data/NISTSP800-88_rev1.pdf
|
||||
icat /mnt/ewf/ewf1 32 > /data/NIST_logo.jpg
|
||||
icat /mnt/ewf/ewf1 38 > /data/report02-3.pdf
|
||||
```
|
||||
|
||||
```text
|
||||
> sha256sum /data/*.pdf /data/*.jpg /data/*.txt /data/*.pfx
|
||||
ef35e4c7ffb1befe4b605149a2dbd97e3fac67b809c387cab549a8de03c6930d /data/20076517123273.pdf
|
||||
8646b073ff05f8a6c0af300b49995cabfd557d8090964eb24af042618ad54ef6 /data/NISTSP800-88_rev1.pdf
|
||||
f0f97ac2e3b56e628b9f128d3972652596f340aac5834d24d8e45640221708ab /data/report02-3.pdf
|
||||
5d793e1cbbbcc9ca474aa4925870b6e2018e4ecdec19dc6837b74d2bb5bb43fc /data/NIST_logo.jpg
|
||||
89b04b0ed76d440379aa8914c3769c2d14e936e2d18a5de9525f6131c0298d07 /data/EFS-key-info.txt
|
||||
f8a03d238825e0cce7168fec663447ec821d781837987b2ce2694b702dea9890 /data/logfile1.txt
|
||||
bb939b30a08c51aee28c1d7ad1e31e8592059206cfa58a6bcdf1ef3e10292943 /data/EFS-key-no-password.pfx
|
||||
2d7297b6ee4708a169c3d5694b733df88f5c0ddfb98f3605452de8a602bae04d /data/EFS-key-password-strong-protection.pfx
|
||||
7c41ec33d24e704ace50d5b617100458dc2e1a12bd1b13fed46c1988d23debcc /data/EFS-key-password.pfx
|
||||
```
|
||||
|
||||
## 5. Chronologie des événements
|
||||
Afin de contextualiser l'apparition des clés de chiffrement et la manipulation du fichier de journalisation, une timeline globale a été générée en extrayant les métadonnées MACB (Modified, Accessed, Changed, Born) de l'ensemble du volume.
|
||||
|
||||
```bash
|
||||
fls -r -m / /mnt/ewf/ewf1 > /data/bodyfile.txt
|
||||
mactime -b /data/bodyfile.txt > /data/timeline.csv
|
||||
```
|
||||
|
||||
Un filtrage ciblé sur les événements liés au système de chiffrement (`EFS`) et au journal système (`logfile`) a produit le résultat suivant :
|
||||
```text
|
||||
> grep -e "EFS" -e "logfile" timeline.csv
|
||||
Mon Jan 05 2009 21:44:06 1730 ...b r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
112 ...b r/rrwxrwxrwx 0 0 43-48-2 /EFS-key-no-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:09 1730 m.c. r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
112 mac. r/rrwxrwxrwx 0 0 43-48-2 /EFS-key-no-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:36 1730 .a.. r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
Mon Jan 05 2009 21:44:42 1730 ...b r/rrwxrwxrwx 0 0 44-128-4 /EFS-key-password.pfx
|
||||
106 ...b r/rrwxrwxrwx 0 0 44-48-2 /EFS-key-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:44 1730 mac. r/rrwxrwxrwx 0 0 44-128-4 /EFS-key-password.pfx
|
||||
106 mac. r/rrwxrwxrwx 0 0 44-48-2 /EFS-key-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:10 1734 ...b r/rrwxrwxrwx 0 0 45-128-4 /EFS-key-password-strong-protection.pfx
|
||||
142 ...b r/rrwxrwxrwx 0 0 45-48-2 /EFS-key-password-strong-protection.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:12 1734 mac. r/rrwxrwxrwx 0 0 45-128-4 /EFS-key-password-strong-protection.pfx
|
||||
142 mac. r/rrwxrwxrwx 0 0 45-48-2 /EFS-key-password-strong-protection.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:47 57 ...b r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
98 ...b r/rrwxrwxrwx 0 0 46-48-2 /EFS-key-info.txt ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:48 57 m.c. r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
98 mac. r/rrwxrwxrwx 0 0 46-48-2 /EFS-key-info.txt ($FILE_NAME)
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 47-128-5 /RAW/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 47-48-2 /RAW/logfile1.txt ($FILE_NAME)
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 48-128-6 /Compressed/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 48-48-2 /Compressed/logfile1.txt ($FILE_NAME)
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 49-128-7 /Encrypted/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 49-48-2 /Encrypted/logfile1.txt ($FILE_NAME)
|
||||
Mon Jan 05 2009 22:01:23 21888890 mac. r/rrwxrwxrwx 0 0 47-128-5 /RAW/logfile1.txt
|
||||
Mon Jan 05 2009 22:01:25 21888890 mac. r/rrwxrwxrwx 0 0 48-128-6 /Compressed/logfile1.txt
|
||||
Mon Jan 05 2009 22:01:26 21888890 mac. r/rrwxrwxrwx 0 0 49-128-7 /Encrypted/logfile1.txt
|
||||
Tue Jan 06 2009 19:44:13 57 .a.. r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
```
|
||||
|
||||
L'analyse détaillée de cette chronologie démontre que les actions de création et de configuration des clés de chiffrement se sont succédé très rapidement dans la soirée du **5 janvier 2009**. Le tableau ci-dessous synthétise la séquence logique des opérations :
|
||||
|
||||
| Horodatage (UTC) | Action / Événement identifié | Fichier / Chemin concerné | Inode | Métadonnées MACB |
|
||||
| :--- | :--- | :--- | :--- | :--- |
|
||||
| **05/01/2009 21:44:06** | Création du certificat EFS vierge de protection | `/EFS-key-no-password.pfx` | 43 | `...b` (Born) |
|
||||
| **05/01/2009 21:44:42** | Création du certificat EFS chiffré basique | `/EFS-key-password.pfx` | 44 | `...b` (Born) |
|
||||
| **05/01/2009 21:45:10** | Création du certificat EFS à protection forte | `/EFS-key-password-strong-protection.pfx` | 45 | `...b` (Born) |
|
||||
| **05/01/2009 21:45:47** | Génération du fichier texte d'indice contenant le secret | `/EFS-key-info.txt` | 46 | `...b` (Born) |
|
||||
| **05/01/2009 22:01:23** | Altération du journal d'événements brut | `/RAW/logfile1.txt` | 47 | `mac.` (Mod/Acc/Chg) |
|
||||
| **05/01/2009 22:01:25** | Opération de compression appliquée sur le journal | `/Compressed/logfile1.txt` | 48 | `mac.` (Mod/Acc/Chg) |
|
||||
| **05/01/2009 22:01:26** | Chiffrement effectif et enregistrement du journal protégé | `/Encrypted/logfile1.txt` | 49 | `mac.` (Mod/Acc/Chg) |
|
||||
| **06/01/2009 19:44:13** | Preuve de lecture du fichier contenant le secret | `/EFS-key-info.txt` | 46 | `.a..` (Accessed) |
|
||||
|
||||
## 6. Indicateurs de compromission (IoC) & Faiblesses structurelles
|
||||
|
||||
### 6.1. Fichiers clés et certificats EFS identifiés
|
||||
|
||||
L'investigation a permis d'isoler plusieurs artefacts cryptographiques dont la simple présence constitue une vulnérabilité sévère :
|
||||
|
||||
| Nom du fichier | Hash SHA256 | Emplacement | Inode | Description |
|
||||
| :--- | :--- | :--- | :--- | :--- |
|
||||
| `EFS-key-info.txt` | `89b04b0ed76d440379aa8914c3769c2d14e936e2d18a5de9525f6131c0298d07` | `/` | 46 | Fichier contenant le secret en clair. |
|
||||
| `EFS-key-no-password.pfx` | `bb939b30a08c51aee28c1d7ad1e31e8592059206cfa58a6bcdf1ef3e10292943` | `/` | 43 | Certificat EFS exporté sans protection par mot de passe. |
|
||||
| `EFS-key-password.pfx` | `7c41ec33d24e704ace50d5b617100458dc2e1a12bd1b13fed46c1988d23debcc` | `/` | 44 | Clé EFS (protégée par le mot de passe trivial `"password"`). |
|
||||
| `EFS-key-password-strong-protection.pfx` | `2d7297b6ee4708a169c3d5694b733df88f5c0ddfb98f3605452de8a602bae04d` | `/` | 45 | Clé EFS implémentant une protection renforcée. |
|
||||
| `logfile1.txt` | `f8a03d238825e0cce7168fec663447ec821d781837987b2ce2694b702dea9890` | `/Encrypted/` | 49 | Fichier de journalisation volumineux (~21.8 MB). |
|
||||
|
||||
### 6.2. Manquements aux politiques de sécurité relevés
|
||||
L'analyse forensique met en exergue des défaillances critiques dans l'hygiène de sécurité du système :
|
||||
* **Stockage de secrets en texte clair :** La présence du fichier `EFS-key-info.txt` à la racine rend la compromission immédiate et triviale pour tout attaquant accédant au volume.
|
||||
* **Complexité des mots de passe inexistante :** Le verrouillage d'un conteneur cryptographique (`.pfx`) avec la chaîne de caractères `"password"` annule toute l'efficacité du mécanisme de protection.
|
||||
* **Exposition injustifiée de matériel cryptographique privé :** Les certificats et clés d'agent de récupération EFS n'ont pas vocation à être stockés sur la racine d'un volume système accessible.
|
||||
|
||||
## 7. Évaluation de la compromission
|
||||
|
||||
L'état des lieux du système de fichiers dresse un bilan alarmant quant à la confidentialité des données hébergées.
|
||||
|
||||
| Élément | Présence / Statut | Commentaire analytique |
|
||||
| :--- | :---: | :--- |
|
||||
| **Stockage illégal de clés de chiffrement** | **Confirmé** | Le matériel cryptographique privé est librement accessible à la racine. |
|
||||
| **Exposition volontaire de mots de passe** | **Confirmé** | Le secret d'accès a été délibérément documenté dans `EFS-key-info.txt`. |
|
||||
| **Absence de protection sur les certificats** | **Confirmé** | Le fichier `EFS-key-no-password.pfx` a été extrait et peut être importé sans restriction. |
|
||||
| **Analyse du cycle de vie des données (RAW > Compressed > Encrypted)** | **Confirmé** | La timeline démontre une tentative de dissimulation et de traitement de logs confidentiels avant leur chiffrement. |
|
||||
|
||||
**Conclusion de l'investigation :** Bien que les éléments analysés ne démontrent pas formellement l'exécution d'un code malveillant distant, le système souffre d'un défaut de conception critique. La mauvaise gestion du chiffrement EFS a induit un état de compromission permanent : tout individu (ou processus) disposant de droits de lecture sur le volume était en mesure d'usurper les clés privées et de déchiffrer l'ensemble du contenu du répertoire `/Encrypted`.
|
||||
|
||||
## 8. Préconisations de remédiation
|
||||
|
||||
Suite aux conclusions de cette analyse, les mesures suivantes doivent être appliquées afin de restaurer l'intégrité de l'environnement de travail :
|
||||
|
||||
### Court terme (Immédiat)
|
||||
* Procéder à la suppression sécurisée des certificats et clés de chiffrement (`.pfx`) actuellement stockés en clair sur la racine des volumes.
|
||||
* Engager une procédure de révocation pour les clés EFS compromises (`EFS-key-no-password.pfx` et `EFS-key-password.pfx`).
|
||||
* Détruire le fichier compromettant `EFS-key-info.txt` (purge des secteurs associés).
|
||||
|
||||
### Moyen terme
|
||||
* Appliquer informatiquement une politique de robustesse de mot de passe lors de la génération ou de l'exportation de clés PKCS#12 et EFS.
|
||||
* Implémenter une solution de gestion des secrets centralisée (ex: HashiCorp Vault, KeepassXC) pour proscrire définitivement le stockage de mots de passe dans des fichiers textes locaux.
|
||||
* Réviser les permissions d'accès (ACLs NTFS) sur la racine des disques et les dossiers sensibles afin d'appliquer le principe du moindre privilège.
|
||||
|
||||
### Long terme
|
||||
* Intégrer la gestion du cycle de vie des certificats et des agents de récupération EFS directement via les services de domaine Active Directory (PKI d'entreprise et stratégies de groupe GPO).
|
||||
* Organiser une campagne de sensibilisation ciblée envers les équipes techniques et de développement sur les risques associés au stockage de matériel cryptographique et de secrets en clair.
|
||||
|
||||
## 9. Annexes
|
||||
|
||||
### Annexe 1 : Extrait du registre des preuves (`preuves.csv`)
|
||||
|
||||
Le fichier complet `preuves.csv` a été joint au présent rapport. Il consigne l'ensemble des artefacts extraits selon le format exigé :
|
||||
|
||||
```csv
|
||||
Type de fichier,Horodatage,Chemin,Hash SHA256,Raison du marquage
|
||||
Texte Indice,2009-01-05 21:45:47 UTC,/EFS-key-info.txt,89b04b0ed76d440379aa8914c3769c2d14e936e2d18a5de9525f6131c0298d07,Contient le mot de passe de chiffrement en clair
|
||||
Certificat PFX,2009-01-05 21:44:06 UTC,/EFS-key-no-password.pfx,bb939b30a08c51aee28c1d7ad1e31e8592059206cfa58a6bcdf1ef3e10292943,Clé EFS privée sans mot de passe
|
||||
Certificat PFX,2009-01-05 21:44:42 UTC,/EFS-key-password.pfx,7c41ec33d24e704ace50d5b617100458dc2e1a12bd1b13fed46c1988d23debcc,Clé EFS protégée par un mot de passe faible
|
||||
Certificat PFX,2009-01-05 21:45:10 UTC,/EFS-key-password-strong-protection.pfx,2d7297b6ee4708a169c3d5694b733df88f5c0ddfb98f3605452de8a602bae04d,Clé EFS à protection forte
|
||||
Fichier Log,2009-01-05 22:01:26 UTC,/Encrypted/logfile1.txt,f8a03d238825e0cce7168fec663447ec821d781837987b2ce2694b702dea9890,Fichier de log volumineux stocké en zone chiffrée
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/20076517123273.pdf,ef35e4c7ffb1befe4b605149a2dbd97e3fac67b809c387cab549a8de03c6930d,Document extrait du dossier chiffré
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/NISTSP800-88_rev1.pdf,8646b073ff05f8a6c0af300b49995cabfd557d8090964eb24af042618ad54ef6,Document NIST sur la destruction sécurisée de données
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/report02-3.pdf,f0f97ac2e3b56e628b9f128d3972652596f340aac5834d24d8e45640221708ab,Rapport d'analyse extrait du dossier chiffré
|
||||
Image JPG,2009-01-05 21:45:00 UTC,/Encrypted/NIST_logo.jpg,5d793e1cbbbcc9ca474aa4925870b6e2018e4ecdec19dc6837b74d2bb5bb43fc,Logo NIST extrait de la zone chiffrée
|
||||
```
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,15 @@
|
||||
FROM ubuntu:22.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
sleuthkit \
|
||||
ewf-tools \
|
||||
autopsy \
|
||||
kpartx \
|
||||
python3 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
WORKDIR /data
|
||||
|
||||
CMD ["bash"]
|
||||
Binary file not shown.
@@ -0,0 +1 @@
|
||||
The password for the EFS key is "password" (no quotes).
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,79 @@
|
||||
0|/$AttrDef ($FILE_NAME)|4-48-2|r/rr-xr-xr-x|48|0|82|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$AttrDef|4-128-4|r/rr-xr-xr-x|48|0|2560|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$BadClus ($FILE_NAME)|8-48-3|r/rr-xr-xr-x|0|0|82|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$BadClus|8-128-2|r/rr-xr-xr-x|0|0|0|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$BadClus:$Bad|8-128-1|r/rr-xr-xr-x|0|0|516554240|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Bitmap ($FILE_NAME)|6-48-2|r/rr-xr-xr-x|0|0|80|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Bitmap|6-128-1|r/rr-xr-xr-x|0|0|126112|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Boot ($FILE_NAME)|7-48-2|r/rr-xr-xr-x|48|0|76|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Boot|7-128-1|r/rr-xr-xr-x|48|0|8192|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Extend ($FILE_NAME)|11-48-3|d/dr-xr-xr-x|0|0|80|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Extend|11-144-4|d/dr-xr-xr-x|0|0|344|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Extend/$ObjId ($FILE_NAME)|25-48-1|r/rr-xr-xr-x|0|0|78|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$ObjId:$O|25-144-2|r/rr-xr-xr-x|0|0|224|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$Quota ($FILE_NAME)|24-48-1|r/rr-xr-xr-x|0|0|78|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$Quota:$O|24-144-3|r/rr-xr-xr-x|0|0|88|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$Quota:$Q|24-144-2|r/rr-xr-xr-x|0|0|208|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$Reparse ($FILE_NAME)|26-48-1|r/rr-xr-xr-x|0|0|82|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$Extend/$Reparse:$R|26-144-2|r/rr-xr-xr-x|0|0|48|1230763445|1230763445|1230763445|1230763445
|
||||
0|/$LogFile ($FILE_NAME)|2-48-2|r/rr-xr-xr-x|0|0|82|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$LogFile|2-128-1|r/rr-xr-xr-x|0|0|4685824|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$MFT ($FILE_NAME)|0-48-3|r/rr-xr-xr-x|0|0|74|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$MFT|0-128-1|r/rr-xr-xr-x|0|0|98304|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$MFTMirr ($FILE_NAME)|1-48-2|r/rr-xr-xr-x|0|0|82|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$MFTMirr|1-128-1|r/rr-xr-xr-x|0|0|4096|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Secure ($FILE_NAME)|9-48-7|r/rr-xr-xr-x|0|0|80|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Secure:$SDS|9-128-8|r/rr-xr-xr-x|0|0|263232|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Secure:$SDH|9-144-11|r/rr-xr-xr-x|0|0|56|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Secure:$SII|9-144-5|r/rr-xr-xr-x|0|0|288|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$UpCase ($FILE_NAME)|10-48-2|r/rr-xr-xr-x|0|0|80|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$UpCase|10-128-1|r/rr-xr-xr-x|0|0|131072|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Volume ($FILE_NAME)|3-48-1|r/rr-xr-xr-x|48|0|80|1230763442|1230763442|1230763442|1230763442
|
||||
0|/$Volume|3-128-3|r/rr-xr-xr-x|48|0|0|1230763442|1230763442|1230763442|1230763442
|
||||
0|/Compressed ($FILE_NAME)|28-48-4|d/drwxrwxrwx|0|0|86|1230763473|1230763473|1230763473|1230763473
|
||||
0|/Compressed|28-144-8|d/drwxrwxrwx|0|0|56|1231192820|1231192820|1231192820|1230763473
|
||||
0|/Compressed/20076517123273.pdf ($FILE_NAME)|40-48-2|r/rrwxrwxrwx|0|0|102|1230765380|1230765380|1230765380|1230765380
|
||||
0|/Compressed/20076517123273.pdf|40-128-1|r/rrwxrwxrwx|0|0|1001647|1230765380|1230765330|1230765336|1230765380
|
||||
0|/Compressed/logfile1.txt ($FILE_NAME)|48-48-2|r/rrwxrwxrwx|0|0|90|1231192820|1231192820|1231192820|1231192820
|
||||
0|/Compressed/logfile1.txt|48-128-6|r/rrwxrwxrwx|0|0|21888890|1231192885|1231192885|1231192885|1231192820
|
||||
0|/Compressed/NISTSP800-88_rev1.pdf ($FILE_NAME)|34-48-2|r/rrwxrwxrwx|0|0|108|1230764777|1230764777|1230764777|1230764777
|
||||
0|/Compressed/NISTSP800-88_rev1.pdf|34-128-1|r/rrwxrwxrwx|0|0|554121|1230764777|1230764762|1230764762|1230764777
|
||||
0|/Compressed/NIST_logo.jpg ($FILE_NAME)|31-48-2|r/rrwxrwxrwx|0|0|92|1230764606|1230764606|1230764606|1230764606
|
||||
0|/Compressed/NIST_logo.jpg|31-128-1|r/rrwxrwxrwx|0|0|2205|1231191700|1230763607|1230763607|1230764606
|
||||
0|/Compressed/report02-3.pdf ($FILE_NAME)|37-48-2|r/rrwxrwxrwx|0|0|94|1230764971|1230764971|1230764971|1230764971
|
||||
0|/Compressed/report02-3.pdf|37-128-1|r/rrwxrwxrwx|0|0|1421998|1230764971|1230764913|1230764913|1230764971
|
||||
0|/EFS-key-info.txt ($FILE_NAME)|46-48-2|r/rrwxrwxrwx|0|0|98|1231191948|1231191948|1231191948|1231191947
|
||||
0|/EFS-key-info.txt|46-128-1|r/rrwxrwxrwx|0|0|57|1231271053|1231191948|1231191948|1231191947
|
||||
0|/EFS-key-no-password.pfx ($FILE_NAME)|43-48-2|r/rrwxrwxrwx|0|0|112|1231191849|1231191849|1231191849|1231191846
|
||||
0|/EFS-key-no-password.pfx|43-128-4|r/rrwxrwxrwx|0|0|1730|1231191876|1231191849|1231191849|1231191846
|
||||
0|/EFS-key-password-strong-protection.pfx ($FILE_NAME)|45-48-2|r/rrwxrwxrwx|0|0|142|1231191912|1231191912|1231191912|1231191910
|
||||
0|/EFS-key-password-strong-protection.pfx|45-128-4|r/rrwxrwxrwx|0|0|1734|1231191912|1231191912|1231191912|1231191910
|
||||
0|/EFS-key-password.pfx ($FILE_NAME)|44-48-2|r/rrwxrwxrwx|0|0|106|1231191884|1231191884|1231191884|1231191882
|
||||
0|/EFS-key-password.pfx|44-128-4|r/rrwxrwxrwx|0|0|1730|1231191884|1231191884|1231191884|1231191882
|
||||
0|/Encrypted ($FILE_NAME)|29-48-4|d/drwxrwxrwx|0|0|84|1230763483|1230763483|1230763483|1230763483
|
||||
0|/Encrypted|29-144-10|d/drwxrwxrwx|0|0|56|1231192820|1231192820|1231192820|1230763483
|
||||
0|/Encrypted/20076517123273.pdf ($FILE_NAME)|41-48-2|r/rrwxrwxrwx|0|0|102|1230765386|1230765386|1230765386|1230765386
|
||||
0|/Encrypted/20076517123273.pdf|41-128-1|r/rrwxrwxrwx|0|0|1001647|1230765386|1230765330|1230765336|1230765386
|
||||
0|/Encrypted/logfile1.txt ($FILE_NAME)|49-48-2|r/rrwxrwxrwx|0|0|90|1231192820|1231192820|1231192820|1231192820
|
||||
0|/Encrypted/logfile1.txt|49-128-7|r/rrwxrwxrwx|0|0|21888890|1231192886|1231192886|1231192886|1231192820
|
||||
0|/Encrypted/NISTSP800-88_rev1.pdf ($FILE_NAME)|35-48-2|r/rrwxrwxrwx|0|0|108|1230764781|1230764781|1230764781|1230764781
|
||||
0|/Encrypted/NISTSP800-88_rev1.pdf|35-128-1|r/rrwxrwxrwx|0|0|554121|1230764781|1230764762|1230764762|1230764781
|
||||
0|/Encrypted/NIST_logo.jpg ($FILE_NAME)|32-48-2|r/rrwxrwxrwx|0|0|92|1230764612|1230764612|1230764612|1230764612
|
||||
0|/Encrypted/NIST_logo.jpg|32-128-1|r/rrwxrwxrwx|0|0|2205|1230765416|1230763607|1230763607|1230764612
|
||||
0|/Encrypted/report02-3.pdf ($FILE_NAME)|38-48-2|r/rrwxrwxrwx|0|0|94|1230764975|1230764975|1230764975|1230764975
|
||||
0|/Encrypted/report02-3.pdf|38-128-1|r/rrwxrwxrwx|0|0|1421998|1230764975|1230764913|1230764913|1230764975
|
||||
0|/RAW ($FILE_NAME)|27-48-4|d/drwxrwxrwx|0|0|72|1230763457|1230763457|1230763457|1230763457
|
||||
0|/RAW|27-144-7|d/drwxrwxrwx|0|0|56|1231192820|1231192820|1231192820|1230763457
|
||||
0|/RAW/20076517123273.pdf ($FILE_NAME)|42-48-2|r/rrwxrwxrwx|0|0|102|1230765389|1230765389|1230765389|1230765389
|
||||
0|/RAW/20076517123273.pdf|42-128-1|r/rrwxrwxrwx|0|0|1001647|1230765389|1230765330|1230765336|1230765389
|
||||
0|/RAW/logfile1.txt ($FILE_NAME)|47-48-2|r/rrwxrwxrwx|0|0|90|1231192820|1231192820|1231192820|1231192820
|
||||
0|/RAW/logfile1.txt|47-128-5|r/rrwxrwxrwx|0|0|21888890|1231192883|1231192883|1231192883|1231192820
|
||||
0|/RAW/NISTSP800-88_rev1.pdf ($FILE_NAME)|36-48-2|r/rrwxrwxrwx|0|0|108|1230764784|1230764784|1230764784|1230764784
|
||||
0|/RAW/NISTSP800-88_rev1.pdf|36-128-1|r/rrwxrwxrwx|0|0|554121|1230764784|1230764762|1230764762|1230764784
|
||||
0|/RAW/NIST_logo.jpg ($FILE_NAME)|33-48-2|r/rrwxrwxrwx|0|0|92|1230764616|1230764616|1230764616|1230764616
|
||||
0|/RAW/NIST_logo.jpg|33-128-1|r/rrwxrwxrwx|0|0|2205|1230764987|1230763607|1230763607|1230764616
|
||||
0|/RAW/report02-3.pdf ($FILE_NAME)|39-48-2|r/rrwxrwxrwx|0|0|94|1230764978|1230764978|1230764978|1230764978
|
||||
0|/RAW/report02-3.pdf|39-128-1|r/rrwxrwxrwx|0|0|1421998|1230764978|1230764913|1230764913|1230764978
|
||||
0|/System Volume Information ($FILE_NAME)|30-48-2|d/dr-xr-xr-x|0|0|116|1230763515|1230763515|1230763515|1230763515
|
||||
0|/System Volume Information|30-144-1|d/dr-xr-xr-x|0|0|48|1230763515|1230763515|1230763515|1230763515
|
||||
0|/$OrphanFiles|96|V/V---------|0|0|0|0|0|0|0
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,112 @@
|
||||
Wed Dec 31 2008 22:44:02 98304 macb r/rr-xr-xr-x 0 0 0-128-1 /$MFT
|
||||
74 macb r/rr-xr-xr-x 0 0 0-48-3 /$MFT ($FILE_NAME)
|
||||
4096 macb r/rr-xr-xr-x 0 0 1-128-1 /$MFTMirr
|
||||
82 macb r/rr-xr-xr-x 0 0 1-48-2 /$MFTMirr ($FILE_NAME)
|
||||
131072 macb r/rr-xr-xr-x 0 0 10-128-1 /$UpCase
|
||||
80 macb r/rr-xr-xr-x 0 0 10-48-2 /$UpCase ($FILE_NAME)
|
||||
344 macb d/dr-xr-xr-x 0 0 11-144-4 /$Extend
|
||||
80 macb d/dr-xr-xr-x 0 0 11-48-3 /$Extend ($FILE_NAME)
|
||||
4685824 macb r/rr-xr-xr-x 0 0 2-128-1 /$LogFile
|
||||
82 macb r/rr-xr-xr-x 0 0 2-48-2 /$LogFile ($FILE_NAME)
|
||||
0 macb r/rr-xr-xr-x 48 0 3-128-3 /$Volume
|
||||
80 macb r/rr-xr-xr-x 48 0 3-48-1 /$Volume ($FILE_NAME)
|
||||
2560 macb r/rr-xr-xr-x 48 0 4-128-4 /$AttrDef
|
||||
82 macb r/rr-xr-xr-x 48 0 4-48-2 /$AttrDef ($FILE_NAME)
|
||||
126112 macb r/rr-xr-xr-x 0 0 6-128-1 /$Bitmap
|
||||
80 macb r/rr-xr-xr-x 0 0 6-48-2 /$Bitmap ($FILE_NAME)
|
||||
8192 macb r/rr-xr-xr-x 48 0 7-128-1 /$Boot
|
||||
76 macb r/rr-xr-xr-x 48 0 7-48-2 /$Boot ($FILE_NAME)
|
||||
516554240 macb r/rr-xr-xr-x 0 0 8-128-1 /$BadClus:$Bad
|
||||
0 macb r/rr-xr-xr-x 0 0 8-128-2 /$BadClus
|
||||
82 macb r/rr-xr-xr-x 0 0 8-48-3 /$BadClus ($FILE_NAME)
|
||||
263232 macb r/rr-xr-xr-x 0 0 9-128-8 /$Secure:$SDS
|
||||
56 macb r/rr-xr-xr-x 0 0 9-144-11 /$Secure:$SDH
|
||||
288 macb r/rr-xr-xr-x 0 0 9-144-5 /$Secure:$SII
|
||||
80 macb r/rr-xr-xr-x 0 0 9-48-7 /$Secure ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:44:05 208 macb r/rr-xr-xr-x 0 0 24-144-2 /$Extend/$Quota:$Q
|
||||
88 macb r/rr-xr-xr-x 0 0 24-144-3 /$Extend/$Quota:$O
|
||||
78 macb r/rr-xr-xr-x 0 0 24-48-1 /$Extend/$Quota ($FILE_NAME)
|
||||
224 macb r/rr-xr-xr-x 0 0 25-144-2 /$Extend/$ObjId:$O
|
||||
78 macb r/rr-xr-xr-x 0 0 25-48-1 /$Extend/$ObjId ($FILE_NAME)
|
||||
48 macb r/rr-xr-xr-x 0 0 26-144-2 /$Extend/$Reparse:$R
|
||||
82 macb r/rr-xr-xr-x 0 0 26-48-1 /$Extend/$Reparse ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:44:17 56 ...b d/drwxrwxrwx 0 0 27-144-7 /RAW
|
||||
72 macb d/drwxrwxrwx 0 0 27-48-4 /RAW ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:44:33 56 ...b d/drwxrwxrwx 0 0 28-144-8 /Compressed
|
||||
86 macb d/drwxrwxrwx 0 0 28-48-4 /Compressed ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:44:43 56 ...b d/drwxrwxrwx 0 0 29-144-10 /Encrypted
|
||||
84 macb d/drwxrwxrwx 0 0 29-48-4 /Encrypted ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:45:15 48 macb d/dr-xr-xr-x 0 0 30-144-1 /System Volume Information
|
||||
116 macb d/dr-xr-xr-x 0 0 30-48-2 /System Volume Information ($FILE_NAME)
|
||||
Wed Dec 31 2008 22:46:47 2205 m.c. r/rrwxrwxrwx 0 0 31-128-1 /Compressed/NIST_logo.jpg
|
||||
2205 m.c. r/rrwxrwxrwx 0 0 32-128-1 /Encrypted/NIST_logo.jpg
|
||||
2205 m.c. r/rrwxrwxrwx 0 0 33-128-1 /RAW/NIST_logo.jpg
|
||||
Wed Dec 31 2008 23:03:26 2205 ...b r/rrwxrwxrwx 0 0 31-128-1 /Compressed/NIST_logo.jpg
|
||||
92 macb r/rrwxrwxrwx 0 0 31-48-2 /Compressed/NIST_logo.jpg ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:03:32 2205 ...b r/rrwxrwxrwx 0 0 32-128-1 /Encrypted/NIST_logo.jpg
|
||||
92 macb r/rrwxrwxrwx 0 0 32-48-2 /Encrypted/NIST_logo.jpg ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:03:36 2205 ...b r/rrwxrwxrwx 0 0 33-128-1 /RAW/NIST_logo.jpg
|
||||
92 macb r/rrwxrwxrwx 0 0 33-48-2 /RAW/NIST_logo.jpg ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:06:02 554121 m.c. r/rrwxrwxrwx 0 0 34-128-1 /Compressed/NISTSP800-88_rev1.pdf
|
||||
554121 m.c. r/rrwxrwxrwx 0 0 35-128-1 /Encrypted/NISTSP800-88_rev1.pdf
|
||||
554121 m.c. r/rrwxrwxrwx 0 0 36-128-1 /RAW/NISTSP800-88_rev1.pdf
|
||||
Wed Dec 31 2008 23:06:17 554121 .a.b r/rrwxrwxrwx 0 0 34-128-1 /Compressed/NISTSP800-88_rev1.pdf
|
||||
108 macb r/rrwxrwxrwx 0 0 34-48-2 /Compressed/NISTSP800-88_rev1.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:06:21 554121 .a.b r/rrwxrwxrwx 0 0 35-128-1 /Encrypted/NISTSP800-88_rev1.pdf
|
||||
108 macb r/rrwxrwxrwx 0 0 35-48-2 /Encrypted/NISTSP800-88_rev1.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:06:24 554121 .a.b r/rrwxrwxrwx 0 0 36-128-1 /RAW/NISTSP800-88_rev1.pdf
|
||||
108 macb r/rrwxrwxrwx 0 0 36-48-2 /RAW/NISTSP800-88_rev1.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:08:33 1421998 m.c. r/rrwxrwxrwx 0 0 37-128-1 /Compressed/report02-3.pdf
|
||||
1421998 m.c. r/rrwxrwxrwx 0 0 38-128-1 /Encrypted/report02-3.pdf
|
||||
1421998 m.c. r/rrwxrwxrwx 0 0 39-128-1 /RAW/report02-3.pdf
|
||||
Wed Dec 31 2008 23:09:31 1421998 .a.b r/rrwxrwxrwx 0 0 37-128-1 /Compressed/report02-3.pdf
|
||||
94 macb r/rrwxrwxrwx 0 0 37-48-2 /Compressed/report02-3.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:09:35 1421998 .a.b r/rrwxrwxrwx 0 0 38-128-1 /Encrypted/report02-3.pdf
|
||||
94 macb r/rrwxrwxrwx 0 0 38-48-2 /Encrypted/report02-3.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:09:38 1421998 .a.b r/rrwxrwxrwx 0 0 39-128-1 /RAW/report02-3.pdf
|
||||
94 macb r/rrwxrwxrwx 0 0 39-48-2 /RAW/report02-3.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:09:47 2205 .a.. r/rrwxrwxrwx 0 0 33-128-1 /RAW/NIST_logo.jpg
|
||||
Wed Dec 31 2008 23:15:30 1001647 m... r/rrwxrwxrwx 0 0 40-128-1 /Compressed/20076517123273.pdf
|
||||
1001647 m... r/rrwxrwxrwx 0 0 41-128-1 /Encrypted/20076517123273.pdf
|
||||
1001647 m... r/rrwxrwxrwx 0 0 42-128-1 /RAW/20076517123273.pdf
|
||||
Wed Dec 31 2008 23:15:36 1001647 ..c. r/rrwxrwxrwx 0 0 40-128-1 /Compressed/20076517123273.pdf
|
||||
1001647 ..c. r/rrwxrwxrwx 0 0 41-128-1 /Encrypted/20076517123273.pdf
|
||||
1001647 ..c. r/rrwxrwxrwx 0 0 42-128-1 /RAW/20076517123273.pdf
|
||||
Wed Dec 31 2008 23:16:20 1001647 .a.b r/rrwxrwxrwx 0 0 40-128-1 /Compressed/20076517123273.pdf
|
||||
102 macb r/rrwxrwxrwx 0 0 40-48-2 /Compressed/20076517123273.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:16:26 1001647 .a.b r/rrwxrwxrwx 0 0 41-128-1 /Encrypted/20076517123273.pdf
|
||||
102 macb r/rrwxrwxrwx 0 0 41-48-2 /Encrypted/20076517123273.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:16:29 1001647 .a.b r/rrwxrwxrwx 0 0 42-128-1 /RAW/20076517123273.pdf
|
||||
102 macb r/rrwxrwxrwx 0 0 42-48-2 /RAW/20076517123273.pdf ($FILE_NAME)
|
||||
Wed Dec 31 2008 23:16:56 2205 .a.. r/rrwxrwxrwx 0 0 32-128-1 /Encrypted/NIST_logo.jpg
|
||||
Mon Jan 05 2009 21:41:40 2205 .a.. r/rrwxrwxrwx 0 0 31-128-1 /Compressed/NIST_logo.jpg
|
||||
Mon Jan 05 2009 21:44:06 1730 ...b r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
112 ...b r/rrwxrwxrwx 0 0 43-48-2 /EFS-key-no-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:09 1730 m.c. r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
112 mac. r/rrwxrwxrwx 0 0 43-48-2 /EFS-key-no-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:36 1730 .a.. r/rrwxrwxrwx 0 0 43-128-4 /EFS-key-no-password.pfx
|
||||
Mon Jan 05 2009 21:44:42 1730 ...b r/rrwxrwxrwx 0 0 44-128-4 /EFS-key-password.pfx
|
||||
106 ...b r/rrwxrwxrwx 0 0 44-48-2 /EFS-key-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:44:44 1730 mac. r/rrwxrwxrwx 0 0 44-128-4 /EFS-key-password.pfx
|
||||
106 mac. r/rrwxrwxrwx 0 0 44-48-2 /EFS-key-password.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:10 1734 ...b r/rrwxrwxrwx 0 0 45-128-4 /EFS-key-password-strong-protection.pfx
|
||||
142 ...b r/rrwxrwxrwx 0 0 45-48-2 /EFS-key-password-strong-protection.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:12 1734 mac. r/rrwxrwxrwx 0 0 45-128-4 /EFS-key-password-strong-protection.pfx
|
||||
142 mac. r/rrwxrwxrwx 0 0 45-48-2 /EFS-key-password-strong-protection.pfx ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:47 57 ...b r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
98 ...b r/rrwxrwxrwx 0 0 46-48-2 /EFS-key-info.txt ($FILE_NAME)
|
||||
Mon Jan 05 2009 21:45:48 57 m.c. r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
98 mac. r/rrwxrwxrwx 0 0 46-48-2 /EFS-key-info.txt ($FILE_NAME)
|
||||
Mon Jan 05 2009 22:00:20 56 mac. d/drwxrwxrwx 0 0 27-144-7 /RAW
|
||||
56 mac. d/drwxrwxrwx 0 0 28-144-8 /Compressed
|
||||
56 mac. d/drwxrwxrwx 0 0 29-144-10 /Encrypted
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 47-128-5 /RAW/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 47-48-2 /RAW/logfile1.txt ($FILE_NAME)
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 48-128-6 /Compressed/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 48-48-2 /Compressed/logfile1.txt ($FILE_NAME)
|
||||
21888890 ...b r/rrwxrwxrwx 0 0 49-128-7 /Encrypted/logfile1.txt
|
||||
90 macb r/rrwxrwxrwx 0 0 49-48-2 /Encrypted/logfile1.txt ($FILE_NAME)
|
||||
Mon Jan 05 2009 22:01:23 21888890 mac. r/rrwxrwxrwx 0 0 47-128-5 /RAW/logfile1.txt
|
||||
Mon Jan 05 2009 22:01:25 21888890 mac. r/rrwxrwxrwx 0 0 48-128-6 /Compressed/logfile1.txt
|
||||
Mon Jan 05 2009 22:01:26 21888890 mac. r/rrwxrwxrwx 0 0 49-128-7 /Encrypted/logfile1.txt
|
||||
Tue Jan 06 2009 19:44:13 57 .a.. r/rrwxrwxrwx 0 0 46-128-1 /EFS-key-info.txt
|
||||
|
@@ -0,0 +1,16 @@
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
forensic-lab:
|
||||
build: .
|
||||
container_name: forensic_lab
|
||||
volumes:
|
||||
- ./data:/data
|
||||
devices:
|
||||
- "/dev/fuse:/dev/fuse"
|
||||
cap_add:
|
||||
- SYS_ADMIN
|
||||
security_opt:
|
||||
- apparmor:unconfined
|
||||
stdin_open: true
|
||||
tty: true
|
||||
@@ -0,0 +1,10 @@
|
||||
Type de fichier,Horodatage,Chemin,Hash SHA256,Raison du marquage
|
||||
Texte Indice,2009-01-05 21:45:47 UTC,/EFS-key-info.txt,89b04b0ed76d440379aa8914c3769c2d14e936e2d18a5de9525f6131c0298d07,Contient le mot de passe de chiffrement en clair
|
||||
Certificat PFX,2009-01-05 21:44:06 UTC,/EFS-key-no-password.pfx,bb939b30a08c51aee28c1d7ad1e31e8592059206cfa58a6bcdf1ef3e10292943,Clé EFS privée sans mot de passe
|
||||
Certificat PFX,2009-01-05 21:44:42 UTC,/EFS-key-password.pfx,7c41ec33d24e704ace50d5b617100458dc2e1a12bd1b13fed46c1988d23debcc,Clé EFS protégée par un mot de passe faible
|
||||
Certificat PFX,2009-01-05 21:45:10 UTC,/EFS-key-password-strong-protection.pfx,2d7297b6ee4708a169c3d5694b733df88f5c0ddfb98f3605452de8a602bae04d,Clé EFS à protection forte
|
||||
Fichier Log,2009-01-05 22:01:26 UTC,/Encrypted/logfile1.txt,f8a03d238825e0cce7168fec663447ec821d781837987b2ce2694b702dea9890,Fichier de log volumineux stocké en zone chiffrée
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/20076517123273.pdf,ef35e4c7ffb1befe4b605149a2dbd97e3fac67b809c387cab549a8de03c6930d,Document extrait du dossier chiffré
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/NISTSP800-88_rev1.pdf,8646b073ff05f8a6c0af300b49995cabfd557d8090964eb24af042618ad54ef6,Document NIST sur la destruction sécurisée de données
|
||||
Document PDF,2009-01-05 21:45:00 UTC,/Encrypted/report02-3.pdf,f0f97ac2e3b56e628b9f128d3972652596f340aac5834d24d8e45640221708ab,Rapport d'analyse extrait du dossier chiffré
|
||||
Image JPG,2009-01-05 21:45:00 UTC,/Encrypted/NIST_logo.jpg,5d793e1cbbbcc9ca474aa4925870b6e2018e4ecdec19dc6837b74d2bb5bb43fc,Logo NIST extrait de la zone chiffrée
|
||||
|
@@ -0,0 +1,154 @@
|
||||
# Lab 02 - Cybersecurity 3
|
||||
Installation Wazuh
|
||||
|
||||
## 1. Mise en place
|
||||
|
||||
Pour mettre en place la stack, je décide de passer par un `docker-compose.yml` unifié, avec un réseau partagé en mode "pont" pour des sorties internet s'il le faut.
|
||||
|
||||
En plus de la stack Wazuh (Indexer, Manager, Dashboard) et du Ubuntu, je tente un truc sympa avec un Docker... Windows !
|
||||
|
||||
Comme je suis déjà sur Windows et que Docker tourne sur WSL2, je dois modifier quelques options dans WSL pour autoriser la virtualisation imbriquée, pousser la config du Docker Engine jusqu'à 16GB de RAM (c'est que c'est gourmand Wazuh) mais ça passe.
|
||||
|
||||
Il a fallut également des fichiers de génération de certificats. Pour m'aider, j'ai utilisé l'IA Kimi K2.7 Code :
|
||||
|
||||
`certs_gen.sh`
|
||||
```bash
|
||||
# Create working directory
|
||||
mkdir -p config/wazuh_indexer_ssl_certs
|
||||
cd config
|
||||
|
||||
# Download the certificate tool
|
||||
curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
|
||||
|
||||
# Create the configuration file
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
EOF
|
||||
|
||||
# Generate certificates
|
||||
chmod +x wazuh-certs-tool.sh
|
||||
./wazuh-certs-tool.sh -A
|
||||
|
||||
# Move the generated certificates to the expected path
|
||||
mv wazuh-certificates/* wazuh_indexer_ssl_certs/
|
||||
```
|
||||
|
||||
Ca fonctionne :
|
||||
|
||||
|
||||
|
||||
### En fait...
|
||||
|
||||
"Je ne dirais pas que c'est un échec... ça n'a pas marché."
|
||||
|
||||
Le docker-compose n'a pas abouti, et à 14h j'ai migré : Wazuh est maintenant déployé sur VirtualBox, et le docker-compose.yml ne donne que du Ubuntu.
|
||||
|
||||
## 2. Fichier auth.log
|
||||
|
||||
Avec WSL2, adaptation du script en mono-ligne :
|
||||
|
||||
```bash
|
||||
bash -c '> auth.log && for i in {1..40}; do echo "Jul 21 12:00:$(printf "%02d" $i) ubuntu sshd[12345]: Failed password for invalid user user$i from 192.168.0.$((i%5+1)) port $((5000+i)) ssh2" >> auth.log; done && echo "Jul 21 12:01:00 ubuntu sshd[12345]: Accepted password for validuser from 192.168.0.1 port 5000 ssh2" >> auth.log'
|
||||
```
|
||||
|
||||
## 3. Démarrage
|
||||
|
||||
|
||||
|
||||
### Avec la refonte de l'infra
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## 4. Mettre en place la règle
|
||||
|
||||
La nouvelle règle est réécrite selon les derniers standards de Wazuh en XML :
|
||||
|
||||
```xml
|
||||
<group name="local,syslog,sshd,">
|
||||
<rule id="100001" level="10" frequency="5" timeframe="60">
|
||||
<if_matched_sid>5710</if_matched_sid>
|
||||
<srcip>192.168.0.0/24</srcip>
|
||||
<description>Plus de 5 tentatives SSH echouees en 1 minute</description>
|
||||
</rule>
|
||||
</group>
|
||||
```
|
||||
|
||||
|
||||
|
||||
## 5. Relever les anomalies
|
||||
|
||||
Première "attaque" depuis l'agent Ubuntu :
|
||||
|
||||
```bash
|
||||
for i in {1..100}; do
|
||||
RAND_IP="192.168.0.$((RANDOM % 254 + 1))"
|
||||
RAND_USER="user_$((RANDOM % 20 + 1))"
|
||||
RAND_PORT=$((RANDOM % 5000 + 10000))
|
||||
TIME=$(date +"%b %d %H:%M:%S")
|
||||
|
||||
echo "$TIME ubuntu sshd[$$]: Failed password for invalid user $RAND_USER from $RAND_IP port $RAND_PORT ssh2" >> auth.log
|
||||
sleep 0.05
|
||||
done
|
||||
```
|
||||
|
||||
Avec d'autres règles également, on peut tester des "attaques" différentes :
|
||||
|
||||
```bash
|
||||
for i in {1..100}; do
|
||||
RAND_IP="192.168.0.$((RANDOM % 254 + 1))"
|
||||
RAND_PORT=$((RANDOM % 5000 + 10000))
|
||||
TIME=$(date +"%b %d %H:%M:%S")
|
||||
|
||||
echo "$TIME ubuntu sshd[1234]: Failed password for root from $RAND_IP port $RAND_PORT ssh2" >> auth.log
|
||||
sleep 0.05
|
||||
done
|
||||
```
|
||||
|
||||
```bash
|
||||
for i in {1..100}; do
|
||||
TIME=$(date +"%b %d %H:%M:%S")
|
||||
|
||||
echo "$TIME ubuntu sudo: attacker : 3 incorrect password attempts ; TTY=pts/1 ; PWD=/tmp ; USER=root ; COMMAND=/bin/bash" >> auth.log
|
||||
sleep 0.05
|
||||
done
|
||||
```
|
||||
|
||||
```bash
|
||||
for i in {1..100}; do
|
||||
RAND_IP="192.168.0.$((RANDOM % 254 + 1))"
|
||||
RAND_PORT=$((RANDOM % 5000 + 10000))
|
||||
TIME=$(date +"%b %d %H:%M:%S")
|
||||
|
||||
echo "$TIME ubuntu sshd[1234]: Accepted password for root from $RAND_IP port $RAND_PORT ssh2" >> auth.log
|
||||
sleep 0.05
|
||||
done
|
||||
```
|
||||
|
||||
Détection comme risque "faible" :
|
||||
|
||||
|
||||
|
||||
Dans le panneau "Threat Hunting", plus prédictif, un détail apparaît :
|
||||
|
||||
|
||||
|
||||
## Annexe : Travaux et Moniteurs réels sur Datadog
|
||||
|
||||
Pour montrer un peu à quoi ressemble de la prédiction froide sur les logs suspects, des exemples de VRAIS moniteurs déployés sur Datadog, outil français de gestion centralisée des journaux, avec outils de détections divers :
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Sans compter le déploiement de WAF dans des comptes AWS par Terraform depuis des modules personnalisés. Que je n'ai pas fait, mais que j'ai amélioré avec des lifecycle, etc.
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 80 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 406 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 99 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 232 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 130 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 383 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 188 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
@@ -0,0 +1,7 @@
|
||||
# IP de la VM VirtualBox Wazuh
|
||||
WAZUH_MANAGER_IP=192.168.1.27
|
||||
|
||||
# Windows
|
||||
WIN_VERSION=11
|
||||
WIN_RAM=4G
|
||||
WIN_CPU=2
|
||||
@@ -0,0 +1,11 @@
|
||||
# Wazuh
|
||||
WAZUH_VERSION=4.9.0
|
||||
INDEXER_PASSWORD=SecretPassword123!
|
||||
API_PASSWORD=MyS3cr37P450r.*-
|
||||
DASHBOARD_USERNAME=kibanaserver
|
||||
DASHBOARD_PASSWORD=kibanaserver
|
||||
|
||||
# Windows
|
||||
WIN_VERSION=11
|
||||
WIN_RAM=4G
|
||||
WIN_CPU=2
|
||||
@@ -0,0 +1,81 @@
|
||||
Jul 21 12:00:01 ubuntu sshd[12345]: Failed password for invalid user user1 from 192.168.0.2 port 5001 ssh2
|
||||
Jul 21 12:00:02 ubuntu sshd[12345]: Failed password for invalid user user2 from 192.168.0.3 port 5002 ssh2
|
||||
Jul 21 12:00:03 ubuntu sshd[12345]: Failed password for invalid user user3 from 192.168.0.4 port 5003 ssh2
|
||||
Jul 21 12:00:04 ubuntu sshd[12345]: Failed password for invalid user user4 from 192.168.0.5 port 5004 ssh2
|
||||
Jul 21 12:00:05 ubuntu sshd[12345]: Failed password for invalid user user5 from 192.168.0.1 port 5005 ssh2
|
||||
Jul 21 12:00:06 ubuntu sshd[12345]: Failed password for invalid user user6 from 192.168.0.2 port 5006 ssh2
|
||||
Jul 21 12:00:07 ubuntu sshd[12345]: Failed password for invalid user user7 from 192.168.0.3 port 5007 ssh2
|
||||
Jul 21 12:00:08 ubuntu sshd[12345]: Failed password for invalid user user8 from 192.168.0.4 port 5008 ssh2
|
||||
Jul 21 12:00:09 ubuntu sshd[12345]: Failed password for invalid user user9 from 192.168.0.5 port 5009 ssh2
|
||||
Jul 21 12:00:10 ubuntu sshd[12345]: Failed password for invalid user user10 from 192.168.0.1 port 5010 ssh2
|
||||
Jul 21 12:00:11 ubuntu sshd[12345]: Failed password for invalid user user11 from 192.168.0.2 port 5011 ssh2
|
||||
Jul 21 12:00:12 ubuntu sshd[12345]: Failed password for invalid user user12 from 192.168.0.3 port 5012 ssh2
|
||||
Jul 21 12:00:13 ubuntu sshd[12345]: Failed password for invalid user user13 from 192.168.0.4 port 5013 ssh2
|
||||
Jul 21 12:00:14 ubuntu sshd[12345]: Failed password for invalid user user14 from 192.168.0.5 port 5014 ssh2
|
||||
Jul 21 12:00:15 ubuntu sshd[12345]: Failed password for invalid user user15 from 192.168.0.1 port 5015 ssh2
|
||||
Jul 21 12:00:16 ubuntu sshd[12345]: Failed password for invalid user user16 from 192.168.0.2 port 5016 ssh2
|
||||
Jul 21 12:00:17 ubuntu sshd[12345]: Failed password for invalid user user17 from 192.168.0.3 port 5017 ssh2
|
||||
Jul 21 12:00:18 ubuntu sshd[12345]: Failed password for invalid user user18 from 192.168.0.4 port 5018 ssh2
|
||||
Jul 21 12:00:19 ubuntu sshd[12345]: Failed password for invalid user user19 from 192.168.0.5 port 5019 ssh2
|
||||
Jul 21 12:00:20 ubuntu sshd[12345]: Failed password for invalid user user20 from 192.168.0.1 port 5020 ssh2
|
||||
Jul 21 12:00:21 ubuntu sshd[12345]: Failed password for invalid user user21 from 192.168.0.2 port 5021 ssh2
|
||||
Jul 21 12:00:22 ubuntu sshd[12345]: Failed password for invalid user user22 from 192.168.0.3 port 5022 ssh2
|
||||
Jul 21 12:00:23 ubuntu sshd[12345]: Failed password for invalid user user23 from 192.168.0.4 port 5023 ssh2
|
||||
Jul 21 12:00:24 ubuntu sshd[12345]: Failed password for invalid user user24 from 192.168.0.5 port 5024 ssh2
|
||||
Jul 21 12:00:25 ubuntu sshd[12345]: Failed password for invalid user user25 from 192.168.0.1 port 5025 ssh2
|
||||
Jul 21 12:00:26 ubuntu sshd[12345]: Failed password for invalid user user26 from 192.168.0.2 port 5026 ssh2
|
||||
Jul 21 12:00:27 ubuntu sshd[12345]: Failed password for invalid user user27 from 192.168.0.3 port 5027 ssh2
|
||||
Jul 21 12:00:28 ubuntu sshd[12345]: Failed password for invalid user user28 from 192.168.0.4 port 5028 ssh2
|
||||
Jul 21 12:00:29 ubuntu sshd[12345]: Failed password for invalid user user29 from 192.168.0.5 port 5029 ssh2
|
||||
Jul 21 12:00:30 ubuntu sshd[12345]: Failed password for invalid user user30 from 192.168.0.1 port 5030 ssh2
|
||||
Jul 21 12:00:31 ubuntu sshd[12345]: Failed password for invalid user user31 from 192.168.0.2 port 5031 ssh2
|
||||
Jul 21 12:00:32 ubuntu sshd[12345]: Failed password for invalid user user32 from 192.168.0.3 port 5032 ssh2
|
||||
Jul 21 12:00:33 ubuntu sshd[12345]: Failed password for invalid user user33 from 192.168.0.4 port 5033 ssh2
|
||||
Jul 21 12:00:34 ubuntu sshd[12345]: Failed password for invalid user user34 from 192.168.0.5 port 5034 ssh2
|
||||
Jul 21 12:00:35 ubuntu sshd[12345]: Failed password for invalid user user35 from 192.168.0.1 port 5035 ssh2
|
||||
Jul 21 12:00:36 ubuntu sshd[12345]: Failed password for invalid user user36 from 192.168.0.2 port 5036 ssh2
|
||||
Jul 21 12:00:37 ubuntu sshd[12345]: Failed password for invalid user user37 from 192.168.0.3 port 5037 ssh2
|
||||
Jul 21 12:00:38 ubuntu sshd[12345]: Failed password for invalid user user38 from 192.168.0.4 port 5038 ssh2
|
||||
Jul 21 12:00:39 ubuntu sshd[12345]: Failed password for invalid user user39 from 192.168.0.5 port 5039 ssh2
|
||||
Jul 21 12:00:40 ubuntu sshd[12345]: Failed password for invalid user user40 from 192.168.0.1 port 5040 ssh2
|
||||
Jul 21 12:01:00 ubuntu sshd[12345]: Accepted password for validuser from 192.168.0.1 port 5000 ssh2
|
||||
Jul 21 12:00:01 ubuntu sshd[12345]: Failed password for invalid user user1 from 192.168.0.2 port 5001 ssh2
|
||||
Jul 21 12:00:02 ubuntu sshd[12345]: Failed password for invalid user user2 from 192.168.0.3 port 5002 ssh2
|
||||
Jul 21 12:00:03 ubuntu sshd[12345]: Failed password for invalid user user3 from 192.168.0.4 port 5003 ssh2
|
||||
Jul 21 12:00:04 ubuntu sshd[12345]: Failed password for invalid user user4 from 192.168.0.5 port 5004 ssh2
|
||||
Jul 21 12:00:05 ubuntu sshd[12345]: Failed password for invalid user user5 from 192.168.0.1 port 5005 ssh2
|
||||
Jul 21 12:00:06 ubuntu sshd[12345]: Failed password for invalid user user6 from 192.168.0.2 port 5006 ssh2
|
||||
Jul 21 12:00:07 ubuntu sshd[12345]: Failed password for invalid user user7 from 192.168.0.3 port 5007 ssh2
|
||||
Jul 21 12:00:08 ubuntu sshd[12345]: Failed password for invalid user user8 from 192.168.0.4 port 5008 ssh2
|
||||
Jul 21 12:00:09 ubuntu sshd[12345]: Failed password for invalid user user9 from 192.168.0.5 port 5009 ssh2
|
||||
Jul 21 12:00:10 ubuntu sshd[12345]: Failed password for invalid user user10 from 192.168.0.1 port 5010 ssh2
|
||||
Jul 21 12:00:11 ubuntu sshd[12345]: Failed password for invalid user user11 from 192.168.0.2 port 5011 ssh2
|
||||
Jul 21 12:00:12 ubuntu sshd[12345]: Failed password for invalid user user12 from 192.168.0.3 port 5012 ssh2
|
||||
Jul 21 12:00:13 ubuntu sshd[12345]: Failed password for invalid user user13 from 192.168.0.4 port 5013 ssh2
|
||||
Jul 21 12:00:14 ubuntu sshd[12345]: Failed password for invalid user user14 from 192.168.0.5 port 5014 ssh2
|
||||
Jul 21 12:00:15 ubuntu sshd[12345]: Failed password for invalid user user15 from 192.168.0.1 port 5015 ssh2
|
||||
Jul 21 12:00:16 ubuntu sshd[12345]: Failed password for invalid user user16 from 192.168.0.2 port 5016 ssh2
|
||||
Jul 21 12:00:17 ubuntu sshd[12345]: Failed password for invalid user user17 from 192.168.0.3 port 5017 ssh2
|
||||
Jul 21 12:00:18 ubuntu sshd[12345]: Failed password for invalid user user18 from 192.168.0.4 port 5018 ssh2
|
||||
Jul 21 12:00:19 ubuntu sshd[12345]: Failed password for invalid user user19 from 192.168.0.5 port 5019 ssh2
|
||||
Jul 21 12:00:20 ubuntu sshd[12345]: Failed password for invalid user user20 from 192.168.0.1 port 5020 ssh2
|
||||
Jul 21 12:00:21 ubuntu sshd[12345]: Failed password for invalid user user21 from 192.168.0.2 port 5021 ssh2
|
||||
Jul 21 12:00:22 ubuntu sshd[12345]: Failed password for invalid user user22 from 192.168.0.3 port 5022 ssh2
|
||||
Jul 21 12:00:23 ubuntu sshd[12345]: Failed password for invalid user user23 from 192.168.0.4 port 5023 ssh2
|
||||
Jul 21 12:00:24 ubuntu sshd[12345]: Failed password for invalid user user24 from 192.168.0.5 port 5024 ssh2
|
||||
Jul 21 12:00:25 ubuntu sshd[12345]: Failed password for invalid user user25 from 192.168.0.1 port 5025 ssh2
|
||||
Jul 21 12:00:26 ubuntu sshd[12345]: Failed password for invalid user user26 from 192.168.0.2 port 5026 ssh2
|
||||
Jul 21 12:00:27 ubuntu sshd[12345]: Failed password for invalid user user27 from 192.168.0.3 port 5027 ssh2
|
||||
Jul 21 12:00:28 ubuntu sshd[12345]: Failed password for invalid user user28 from 192.168.0.4 port 5028 ssh2
|
||||
Jul 21 12:00:29 ubuntu sshd[12345]: Failed password for invalid user user29 from 192.168.0.5 port 5029 ssh2
|
||||
Jul 21 12:00:30 ubuntu sshd[12345]: Failed password for invalid user user30 from 192.168.0.1 port 5030 ssh2
|
||||
Jul 21 12:00:31 ubuntu sshd[12345]: Failed password for invalid user user31 from 192.168.0.2 port 5031 ssh2
|
||||
Jul 21 12:00:32 ubuntu sshd[12345]: Failed password for invalid user user32 from 192.168.0.3 port 5032 ssh2
|
||||
Jul 21 12:00:33 ubuntu sshd[12345]: Failed password for invalid user user33 from 192.168.0.4 port 5033 ssh2
|
||||
Jul 21 12:00:34 ubuntu sshd[12345]: Failed password for invalid user user34 from 192.168.0.5 port 5034 ssh2
|
||||
Jul 21 12:00:35 ubuntu sshd[12345]: Failed password for invalid user user35 from 192.168.0.1 port 5035 ssh2
|
||||
Jul 21 12:00:36 ubuntu sshd[12345]: Failed password for invalid user user36 from 192.168.0.2 port 5036 ssh2
|
||||
Jul 21 12:00:37 ubuntu sshd[12345]: Failed password for invalid user user37 from 192.168.0.3 port 5037 ssh2
|
||||
Jul 21 12:00:38 ubuntu sshd[12345]: Failed password for invalid user user38 from 192.168.0.4 port 5038 ssh2
|
||||
Jul 21 12:00:39 ubuntu sshd[12345]: Failed password for invalid user user39 from 192.168.0.5 port 5039 ssh2
|
||||
Jul 21 12:00:40 ubuntu sshd[12345]: Failed password for invalid user user40 from 192.168.0.1 port 5040 ssh2
|
||||
@@ -0,0 +1,7 @@
|
||||
> auth.log
|
||||
|
||||
for i in {1..40}; do
|
||||
echo "Jul 21 12:00:$(printf "%02d" $i) ubuntu sshd[12345]: Failed password for invalid user user$i from 192.168.0.$((i%5+1)) port $((5000+i)) ssh2" >> auth.log
|
||||
done
|
||||
|
||||
echo "Jul 21 12:01:00 ubuntu sshd[12345]: Accepted password for validuser from 192.168.0.1 port 5000 ssh2" >> auth.log
|
||||
@@ -0,0 +1,27 @@
|
||||
# Create working directory
|
||||
mkdir -p config/wazuh_indexer_ssl_certs
|
||||
cd config
|
||||
|
||||
# Download the certificate tool
|
||||
curl -sO https://packages.wazuh.com/4.9/wazuh-certs-tool.sh
|
||||
|
||||
# Create the configuration file
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
EOF
|
||||
|
||||
# Generate certificates
|
||||
chmod +x wazuh-certs-tool.sh
|
||||
./wazuh-certs-tool.sh -A
|
||||
|
||||
# Move the generated certificates to the expected path
|
||||
mv wazuh-certificates/* wazuh_indexer_ssl_certs/
|
||||
@@ -0,0 +1,13 @@
|
||||
nodes:
|
||||
# Wazuh indexer nodes
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
# Wazuh server nodes
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
# Wazuh dashboard nodes
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
@@ -0,0 +1,10 @@
|
||||
nodes:
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
ip: wazuh.indexer
|
||||
server:
|
||||
- name: wazuh.manager
|
||||
ip: wazuh.manager
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
ip: wazuh.dashboard
|
||||
@@ -0,0 +1,20 @@
|
||||
04/08/2026 11:14:32 INFO: Verbose logging redirected to /mnt/d/Users/GaWin/LiveCampus/Semaine_12/Jour_02/wazuhlab/config/wazuh-certificates-tool.log
|
||||
04/08/2026 11:14:32 INFO: Generating the root certificate.
|
||||
04/08/2026 11:14:32 INFO: Generating Admin certificates.
|
||||
04/08/2026 11:14:32 INFO: Admin certificates created.
|
||||
04/08/2026 11:14:32 INFO: Generating Wazuh indexer certificates.
|
||||
04/08/2026 11:14:32 INFO: Wazuh indexer certificates created.
|
||||
04/08/2026 11:14:32 INFO: Generating Filebeat certificates.
|
||||
04/08/2026 11:14:32 INFO: Wazuh Filebeat certificates created.
|
||||
04/08/2026 11:14:32 INFO: Generating Wazuh dashboard certificates.
|
||||
04/08/2026 11:14:33 INFO: Wazuh dashboard certificates created.
|
||||
04/08/2026 11:18:57 INFO: Verbose logging redirected to /mnt/d/Users/GaWin/LiveCampus/Semaine_12/Jour_02/wazuhlab/config/wazuh-certificates-tool.log
|
||||
04/08/2026 11:18:57 INFO: Generating the root certificate.
|
||||
04/08/2026 11:18:57 INFO: Generating Admin certificates.
|
||||
04/08/2026 11:18:57 INFO: Admin certificates created.
|
||||
04/08/2026 11:18:57 INFO: Generating Wazuh indexer certificates.
|
||||
04/08/2026 11:18:57 INFO: Wazuh indexer certificates created.
|
||||
04/08/2026 11:18:57 INFO: Generating Filebeat certificates.
|
||||
04/08/2026 11:18:57 INFO: Wazuh Filebeat certificates created.
|
||||
04/08/2026 11:18:57 INFO: Generating Wazuh dashboard certificates.
|
||||
04/08/2026 11:18:58 INFO: Wazuh dashboard certificates created.
|
||||
@@ -0,0 +1,924 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Wazuh installer
|
||||
# Copyright (C) 2015, Wazuh Inc.
|
||||
#
|
||||
# This program is a free software; you can redistribute it
|
||||
# and/or modify it under the terms of the GNU General Public
|
||||
# License (version 2) as published by the FSF - Free Software
|
||||
# Foundation.
|
||||
adminpem="/etc/wazuh-indexer/certs/admin.pem"
|
||||
adminkey="/etc/wazuh-indexer/certs/admin-key.pem"
|
||||
readonly base_path="$(dirname "$(readlink -f "$0")")"
|
||||
readonly config_file="${base_path}/config.yml"
|
||||
readonly logfile="${base_path}/wazuh-certificates-tool.log"
|
||||
cert_tmp_path="/tmp/wazuh-certificates"
|
||||
debug=">> ${logfile} 2>&1"
|
||||
readonly cert_tool_script_name=".*certs.*\.sh"
|
||||
|
||||
# ------------ certFunctions.sh ------------
|
||||
function cert_cleanFiles() {
|
||||
|
||||
common_logger -d "Cleaning certificate files."
|
||||
eval "rm -f ${cert_tmp_path}/*.csr ${debug}"
|
||||
eval "rm -f ${cert_tmp_path}/*.srl ${debug}"
|
||||
eval "rm -f ${cert_tmp_path}/*.conf ${debug}"
|
||||
eval "rm -f ${cert_tmp_path}/admin-key-temp.pem ${debug}"
|
||||
|
||||
}
|
||||
function cert_checkOpenSSL() {
|
||||
|
||||
common_logger -d "Checking if OpenSSL is installed."
|
||||
|
||||
if [ -z "$(command -v openssl)" ]; then
|
||||
common_logger -e "OpenSSL not installed."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_checkRootCA() {
|
||||
|
||||
common_logger -d "Checking if the root CA exists."
|
||||
|
||||
if [[ -n ${rootca} || -n ${rootcakey} ]]; then
|
||||
# Verify variables match keys
|
||||
if [[ ${rootca} == *".key" ]]; then
|
||||
ca_temp=${rootca}
|
||||
rootca=${rootcakey}
|
||||
rootcakey=${ca_temp}
|
||||
fi
|
||||
# Validate that files exist
|
||||
if [[ -e ${rootca} ]]; then
|
||||
eval "cp ${rootca} ${cert_tmp_path}/root-ca.pem ${debug}"
|
||||
else
|
||||
common_logger -e "The file ${rootca} does not exists"
|
||||
cert_cleanFiles
|
||||
exit 1
|
||||
fi
|
||||
if [[ -e ${rootcakey} ]]; then
|
||||
eval "cp ${rootcakey} ${cert_tmp_path}/root-ca.key ${debug}"
|
||||
else
|
||||
common_logger -e "The file ${rootcakey} does not exists"
|
||||
cert_cleanFiles
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
cert_generateRootCAcertificate
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_executeAndValidate() {
|
||||
|
||||
command_output=$(eval "$@" 2>&1)
|
||||
e_code="${PIPESTATUS[0]}"
|
||||
|
||||
if [ "${e_code}" -ne 0 ]; then
|
||||
common_logger -e "Error generating the certificates."
|
||||
common_logger -d "Error executing command: $@"
|
||||
common_logger -d "Error output: ${command_output}"
|
||||
cert_cleanFiles
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_generateAdmincertificate() {
|
||||
|
||||
common_logger "Generating Admin certificates."
|
||||
common_logger -d "Generating Admin private key."
|
||||
cert_executeAndValidate "openssl genrsa -out ${cert_tmp_path}/admin-key-temp.pem 2048"
|
||||
common_logger -d "Converting Admin private key to PKCS8 format."
|
||||
cert_executeAndValidate "openssl pkcs8 -inform PEM -outform PEM -in ${cert_tmp_path}/admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out ${cert_tmp_path}/admin-key.pem"
|
||||
common_logger -d "Generating Admin CSR."
|
||||
cert_executeAndValidate "openssl req -new -key ${cert_tmp_path}/admin-key.pem -out ${cert_tmp_path}/admin.csr -batch -subj '/C=US/L=California/O=Wazuh/OU=Wazuh/CN=admin'"
|
||||
common_logger -d "Creating Admin certificate."
|
||||
cert_executeAndValidate "openssl x509 -days 3650 -req -in ${cert_tmp_path}/admin.csr -CA ${cert_tmp_path}/root-ca.pem -CAkey ${cert_tmp_path}/root-ca.key -CAcreateserial -sha256 -out ${cert_tmp_path}/admin.pem"
|
||||
|
||||
}
|
||||
function cert_generateCertificateconfiguration() {
|
||||
|
||||
common_logger -d "Generating certificate configuration."
|
||||
cat > "${cert_tmp_path}/${1}.conf" <<- EOF
|
||||
[ req ]
|
||||
prompt = no
|
||||
default_bits = 2048
|
||||
default_md = sha256
|
||||
distinguished_name = req_distinguished_name
|
||||
x509_extensions = v3_req
|
||||
|
||||
[req_distinguished_name]
|
||||
C = US
|
||||
L = California
|
||||
O = Wazuh
|
||||
OU = Wazuh
|
||||
CN = cname
|
||||
|
||||
[ v3_req ]
|
||||
authorityKeyIdentifier=keyid,issuer
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
|
||||
subjectAltName = @alt_names
|
||||
|
||||
[alt_names]
|
||||
IP.1 = cip
|
||||
EOF
|
||||
|
||||
|
||||
conf="$(awk '{sub("CN = cname", "CN = '"${1}"'")}1' "${cert_tmp_path}/${1}.conf")"
|
||||
echo "${conf}" > "${cert_tmp_path}/${1}.conf"
|
||||
|
||||
if [ "${#@}" -gt 1 ]; then
|
||||
sed -i '/IP.1/d' "${cert_tmp_path}/${1}.conf"
|
||||
for (( i=2; i<=${#@}; i++ )); do
|
||||
isIP=$(echo "${!i}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$")
|
||||
isDNS=$(echo "${!i}" | grep -P "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])\.([A-Za-z]{2,})$" ) j=$((i-1))
|
||||
if [ "${isIP}" ]; then
|
||||
printf '%s\n' " IP.${j} = ${!i}" >> "${cert_tmp_path}/${1}.conf"
|
||||
elif [ "${isDNS}" ]; then
|
||||
printf '%s\n' " DNS.${j} = ${!i}" >> "${cert_tmp_path}/${1}.conf"
|
||||
else
|
||||
common_logger -e "Invalid IP or DNS ${!i}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
else
|
||||
common_logger -e "No IP or DNS specified"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_generateIndexercertificates() {
|
||||
|
||||
if [ ${#indexer_node_names[@]} -gt 0 ]; then
|
||||
common_logger "Generating Wazuh indexer certificates."
|
||||
|
||||
for i in "${!indexer_node_names[@]}"; do
|
||||
indexer_node_name=${indexer_node_names[$i]}
|
||||
common_logger -d "Creating the certificates for ${indexer_node_name} indexer node."
|
||||
cert_generateCertificateconfiguration "${indexer_node_name}" "${indexer_node_ips[i]}"
|
||||
common_logger -d "Creating the Wazuh indexer tmp key pair."
|
||||
cert_executeAndValidate "openssl req -new -nodes -newkey rsa:2048 -keyout ${cert_tmp_path}/${indexer_node_name}-key.pem -out ${cert_tmp_path}/${indexer_node_name}.csr -config ${cert_tmp_path}/${indexer_node_name}.conf"
|
||||
common_logger -d "Creating the Wazuh indexer certificates."
|
||||
cert_executeAndValidate "openssl x509 -req -in ${cert_tmp_path}/${indexer_node_name}.csr -CA ${cert_tmp_path}/root-ca.pem -CAkey ${cert_tmp_path}/root-ca.key -CAcreateserial -out ${cert_tmp_path}/${indexer_node_name}.pem -extfile ${cert_tmp_path}/${indexer_node_name}.conf -extensions v3_req -days 3650"
|
||||
done
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_generateFilebeatcertificates() {
|
||||
|
||||
if [ ${#server_node_names[@]} -gt 0 ]; then
|
||||
common_logger "Generating Filebeat certificates."
|
||||
|
||||
for i in "${!server_node_names[@]}"; do
|
||||
server_name="${server_node_names[i]}"
|
||||
common_logger -d "Generating the certificates for ${server_name} server node."
|
||||
j=$((i+1))
|
||||
declare -a server_ips=(server_node_ip_"$j"[@])
|
||||
cert_generateCertificateconfiguration "${server_name}" "${!server_ips}"
|
||||
common_logger -d "Creating the Wazuh server tmp key pair."
|
||||
cert_executeAndValidate "openssl req -new -nodes -newkey rsa:2048 -keyout ${cert_tmp_path}/${server_name}-key.pem -out ${cert_tmp_path}/${server_name}.csr -config ${cert_tmp_path}/${server_name}.conf"
|
||||
common_logger -d "Creating the Wazuh server certificates."
|
||||
cert_executeAndValidate "openssl x509 -req -in ${cert_tmp_path}/${server_name}.csr -CA ${cert_tmp_path}/root-ca.pem -CAkey ${cert_tmp_path}/root-ca.key -CAcreateserial -out ${cert_tmp_path}/${server_name}.pem -extfile ${cert_tmp_path}/${server_name}.conf -extensions v3_req -days 3650"
|
||||
done
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_generateDashboardcertificates() {
|
||||
if [ ${#dashboard_node_names[@]} -gt 0 ]; then
|
||||
common_logger "Generating Wazuh dashboard certificates."
|
||||
|
||||
for i in "${!dashboard_node_names[@]}"; do
|
||||
dashboard_node_name="${dashboard_node_names[i]}"
|
||||
cert_generateCertificateconfiguration "${dashboard_node_name}" "${dashboard_node_ips[i]}"
|
||||
common_logger -d "Creating the Wazuh dashboard tmp key pair."
|
||||
cert_executeAndValidate "openssl req -new -nodes -newkey rsa:2048 -keyout ${cert_tmp_path}/${dashboard_node_name}-key.pem -out ${cert_tmp_path}/${dashboard_node_name}.csr -config ${cert_tmp_path}/${dashboard_node_name}.conf"
|
||||
common_logger -d "Creating the Wazuh dashboard certificates."
|
||||
cert_executeAndValidate "openssl x509 -req -in ${cert_tmp_path}/${dashboard_node_name}.csr -CA ${cert_tmp_path}/root-ca.pem -CAkey ${cert_tmp_path}/root-ca.key -CAcreateserial -out ${cert_tmp_path}/${dashboard_node_name}.pem -extfile ${cert_tmp_path}/${dashboard_node_name}.conf -extensions v3_req -days 3650"
|
||||
done
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_generateRootCAcertificate() {
|
||||
|
||||
common_logger "Generating the root certificate."
|
||||
cert_executeAndValidate "openssl req -x509 -new -nodes -newkey rsa:2048 -keyout ${cert_tmp_path}/root-ca.key -out ${cert_tmp_path}/root-ca.pem -batch -subj '/OU=Wazuh/O=Wazuh/L=California/' -days 3650"
|
||||
|
||||
}
|
||||
function cert_parseYaml() {
|
||||
|
||||
local prefix=$2
|
||||
local separator=${3:-_}
|
||||
local indexfix
|
||||
# Detect awk flavor
|
||||
if awk --version 2>&1 | grep -q "GNU Awk" ; then
|
||||
# GNU Awk detected
|
||||
indexfix=-1
|
||||
elif awk -Wv 2>&1 | grep -q "mawk" ; then
|
||||
# mawk detected
|
||||
indexfix=0
|
||||
fi
|
||||
|
||||
local s='[[:space:]]*' sm='[ \t]*' w='[a-zA-Z0-9_]*' fs=${fs:-$(echo @|tr @ '\034')} i=${i:- }
|
||||
cat $1 2>/dev/null | \
|
||||
awk -F$fs "{multi=0;
|
||||
if(match(\$0,/$sm\|$sm$/)){multi=1; sub(/$sm\|$sm$/,\"\");}
|
||||
if(match(\$0,/$sm>$sm$/)){multi=2; sub(/$sm>$sm$/,\"\");}
|
||||
while(multi>0){
|
||||
str=\$0; gsub(/^$sm/,\"\", str);
|
||||
indent=index(\$0,str);
|
||||
indentstr=substr(\$0, 0, indent+$indexfix) \"$i\";
|
||||
obuf=\$0;
|
||||
getline;
|
||||
while(index(\$0,indentstr)){
|
||||
obuf=obuf substr(\$0, length(indentstr)+1);
|
||||
if (multi==1){obuf=obuf \"\\\\n\";}
|
||||
if (multi==2){
|
||||
if(match(\$0,/^$sm$/))
|
||||
obuf=obuf \"\\\\n\";
|
||||
else obuf=obuf \" \";
|
||||
}
|
||||
getline;
|
||||
}
|
||||
sub(/$sm$/,\"\",obuf);
|
||||
print obuf;
|
||||
multi=0;
|
||||
if(match(\$0,/$sm\|$sm$/)){multi=1; sub(/$sm\|$sm$/,\"\");}
|
||||
if(match(\$0,/$sm>$sm$/)){multi=2; sub(/$sm>$sm$/,\"\");}
|
||||
}
|
||||
print}" | \
|
||||
sed -e "s|^\($s\)?|\1-|" \
|
||||
-ne "s|^$s#.*||;s|$s#[^\"']*$||;s|^\([^\"'#]*\)#.*|\1|;t1;t;:1;s|^$s\$||;t2;p;:2;d" | \
|
||||
sed -ne "s|,$s\]$s\$|]|" \
|
||||
-e ":1;s|^\($s\)\($w\)$s:$s\(&$w\)\?$s\[$s\(.*\)$s,$s\(.*\)$s\]|\1\2: \3[\4]\n\1$i- \5|;t1" \
|
||||
-e "s|^\($s\)\($w\)$s:$s\(&$w\)\?$s\[$s\(.*\)$s\]|\1\2: \3\n\1$i- \4|;" \
|
||||
-e ":2;s|^\($s\)-$s\[$s\(.*\)$s,$s\(.*\)$s\]|\1- [\2]\n\1$i- \3|;t2" \
|
||||
-e "s|^\($s\)-$s\[$s\(.*\)$s\]|\1-\n\1$i- \2|;p" | \
|
||||
sed -ne "s|,$s}$s\$|}|" \
|
||||
-e ":1;s|^\($s\)-$s{$s\(.*\)$s,$s\($w\)$s:$s\(.*\)$s}|\1- {\2}\n\1$i\3: \4|;t1" \
|
||||
-e "s|^\($s\)-$s{$s\(.*\)$s}|\1-\n\1$i\2|;" \
|
||||
-e ":2;s|^\($s\)\($w\)$s:$s\(&$w\)\?$s{$s\(.*\)$s,$s\($w\)$s:$s\(.*\)$s}|\1\2: \3 {\4}\n\1$i\5: \6|;t2" \
|
||||
-e "s|^\($s\)\($w\)$s:$s\(&$w\)\?$s{$s\(.*\)$s}|\1\2: \3\n\1$i\4|;p" | \
|
||||
sed -e "s|^\($s\)\($w\)$s:$s\(&$w\)\(.*\)|\1\2:\4\n\3|" \
|
||||
-e "s|^\($s\)-$s\(&$w\)\(.*\)|\1- \3\n\2|" | \
|
||||
sed -ne "s|^\($s\):|\1|" \
|
||||
-e "s|^\($s\)\(---\)\($s\)||" \
|
||||
-e "s|^\($s\)\(\.\.\.\)\($s\)||" \
|
||||
-e "s|^\($s\)-$s[\"']\(.*\)[\"']$s\$|\1$fs$fs\2|p;t" \
|
||||
-e "s|^\($s\)\($w\)$s:$s[\"']\(.*\)[\"']$s\$|\1$fs\2$fs\3|p;t" \
|
||||
-e "s|^\($s\)-$s\(.*\)$s\$|\1$fs$fs\2|" \
|
||||
-e "s|^\($s\)\($w\)$s:$s[\"']\?\(.*\)$s\$|\1$fs\2$fs\3|" \
|
||||
-e "s|^\($s\)[\"']\?\([^&][^$fs]\+\)[\"']$s\$|\1$fs$fs$fs\2|" \
|
||||
-e "s|^\($s\)[\"']\?\([^&][^$fs]\+\)$s\$|\1$fs$fs$fs\2|" \
|
||||
-e "s|$s\$||p" | \
|
||||
awk -F$fs "{
|
||||
gsub(/\t/,\" \",\$1);
|
||||
gsub(\"name: \", \"\");
|
||||
if(NF>3){if(value!=\"\"){value = value \" \";}value = value \$4;}
|
||||
else {
|
||||
if(match(\$1,/^&/)){anchor[substr(\$1,2)]=full_vn;getline};
|
||||
indent = length(\$1)/length(\"$i\");
|
||||
vname[indent] = \$2;
|
||||
value= \$3;
|
||||
for (i in vname) {if (i > indent) {delete vname[i]; idx[i]=0}}
|
||||
if(length(\$2)== 0){ vname[indent]= ++idx[indent] };
|
||||
vn=\"\"; for (i=0; i<indent; i++) { vn=(vn)(vname[i])(\"$separator\")}
|
||||
vn=\"$prefix\" vn;
|
||||
full_vn=vn vname[indent];
|
||||
if(vn==\"$prefix\")vn=\"$prefix$separator\";
|
||||
if(vn==\"_\")vn=\"__\";
|
||||
}
|
||||
assignment[full_vn]=value;
|
||||
if(!match(assignment[vn], full_vn))assignment[vn]=assignment[vn] \" \" full_vn;
|
||||
if(match(value,/^\*/)){
|
||||
ref=anchor[substr(value,2)];
|
||||
if(length(ref)==0){
|
||||
printf(\"%s=\\\"%s\\\"\n\", full_vn, value);
|
||||
} else {
|
||||
for(val in assignment){
|
||||
if((length(ref)>0)&&index(val, ref)==1){
|
||||
tmpval=assignment[val];
|
||||
sub(ref,full_vn,val);
|
||||
if(match(val,\"$separator\$\")){
|
||||
gsub(ref,full_vn,tmpval);
|
||||
} else if (length(tmpval) > 0) {
|
||||
printf(\"%s=\\\"%s\\\"\n\", val, tmpval);
|
||||
}
|
||||
assignment[val]=tmpval;
|
||||
}
|
||||
}
|
||||
}
|
||||
} else if (length(value) > 0) {
|
||||
printf(\"%s=\\\"%s\\\"\n\", full_vn, value);
|
||||
}
|
||||
}END{
|
||||
for(val in assignment){
|
||||
if(match(val,\"$separator\$\"))
|
||||
printf(\"%s=\\\"%s\\\"\n\", val, assignment[val]);
|
||||
}
|
||||
}"
|
||||
|
||||
}
|
||||
function cert_checkPrivateIp() {
|
||||
|
||||
local ip=$1
|
||||
common_logger -d "Checking if ${ip} is private."
|
||||
|
||||
# Check private IPv4 ranges
|
||||
if [[ $ip =~ ^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^(127\.) ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Check private IPv6 ranges (fc00::/7 prefix)
|
||||
if [[ $ip =~ ^fc ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
|
||||
}
|
||||
function cert_readConfig() {
|
||||
|
||||
common_logger -d "Reading configuration file."
|
||||
|
||||
if [ -f "${config_file}" ]; then
|
||||
if [ ! -s "${config_file}" ]; then
|
||||
common_logger -e "File ${config_file} is empty"
|
||||
exit 1
|
||||
fi
|
||||
eval "$(cert_convertCRLFtoLF "${config_file}")"
|
||||
|
||||
eval "indexer_node_names=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+indexer[_]+[0-9]+=" | cut -d = -f 2 ) )"
|
||||
eval "server_node_names=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+server[_]+[0-9]+=" | cut -d = -f 2 ) )"
|
||||
eval "dashboard_node_names=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+dashboard[_]+[0-9]+=" | cut -d = -f 2) )"
|
||||
eval "indexer_node_ips=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+indexer[_]+[0-9]+[_]+ip=" | cut -d = -f 2) )"
|
||||
eval "server_node_ips=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+server[_]+[0-9]+[_]+ip=" | cut -d = -f 2) )"
|
||||
eval "dashboard_node_ips=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+dashboard[_]+[0-9]+[_]+ip=" | cut -d = -f 2 ) )"
|
||||
eval "server_node_types=( $(cert_parseYaml "${config_file}" | grep -E "nodes[_]+server[_]+[0-9]+[_]+node_type=" | cut -d = -f 2 ) )"
|
||||
eval "number_server_ips=( $(cert_parseYaml "${config_file}" | grep -o -E 'nodes[_]+server[_]+[0-9]+[_]+ip' | sort -u | wc -l) )"
|
||||
all_ips=("${indexer_node_ips[@]}" "${server_node_ips[@]}" "${dashboard_node_ips[@]}")
|
||||
|
||||
for ip in "${all_ips[@]}"; do
|
||||
isIP=$(echo "${ip}" | grep -P "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$")
|
||||
if [[ -n "${isIP}" ]]; then
|
||||
if ! cert_checkPrivateIp "$ip"; then
|
||||
common_logger -e "The IP ${ip} is public."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
for i in $(seq 1 "${number_server_ips}"); do
|
||||
nodes_server="nodes[_]+server[_]+${i}[_]+ip"
|
||||
eval "server_node_ip_$i=( $( cert_parseYaml "${config_file}" | grep -E "${nodes_server}" | sed '/\./!d' | cut -d = -f 2 | sed -r 's/\s+//g') )"
|
||||
done
|
||||
|
||||
unique_names=($(echo "${indexer_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_names[@]}" -ne "${#indexer_node_names[@]}" ]; then
|
||||
common_logger -e "Duplicated indexer node names."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
unique_ips=($(echo "${indexer_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_ips[@]}" -ne "${#indexer_node_ips[@]}" ]; then
|
||||
common_logger -e "Duplicated indexer node ips."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
unique_names=($(echo "${server_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_names[@]}" -ne "${#server_node_names[@]}" ]; then
|
||||
common_logger -e "Duplicated Wazuh server node names."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
unique_ips=($(echo "${server_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_ips[@]}" -ne "${#server_node_ips[@]}" ]; then
|
||||
common_logger -e "Duplicated Wazuh server node ips."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
unique_names=($(echo "${dashboard_node_names[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_names[@]}" -ne "${#dashboard_node_names[@]}" ]; then
|
||||
common_logger -e "Duplicated dashboard node names."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
unique_ips=($(echo "${dashboard_node_ips[@]}" | tr ' ' '\n' | sort -u | tr '\n' ' '))
|
||||
if [ "${#unique_ips[@]}" -ne "${#dashboard_node_ips[@]}" ]; then
|
||||
common_logger -e "Duplicated dashboard node ips."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for i in "${server_node_types[@]}"; do
|
||||
if ! echo "$i" | grep -ioq master && ! echo "$i" | grep -ioq worker; then
|
||||
common_logger -e "Incorrect node_type $i must be master or worker"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "${#server_node_names[@]}" -le 1 ]; then
|
||||
if [ "${#server_node_types[@]}" -ne 0 ]; then
|
||||
common_logger -e "The tag node_type can only be used with more than one Wazuh server."
|
||||
exit 1
|
||||
fi
|
||||
elif [ "${#server_node_names[@]}" -gt "${#server_node_types[@]}" ]; then
|
||||
common_logger -e "The tag node_type needs to be specified for all Wazuh server nodes."
|
||||
exit 1
|
||||
elif [ "${#server_node_names[@]}" -lt "${#server_node_types[@]}" ]; then
|
||||
common_logger -e "Found extra node_type tags."
|
||||
exit 1
|
||||
elif [ "$(grep -io master <<< "${server_node_types[*]}" | wc -l)" -ne 1 ]; then
|
||||
common_logger -e "Wazuh cluster needs a single master node."
|
||||
exit 1
|
||||
elif [ "$(grep -io worker <<< "${server_node_types[*]}" | wc -l)" -ne $(( ${#server_node_types[@]} - 1 )) ]; then
|
||||
common_logger -e "Incorrect number of workers."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "${#dashboard_node_names[@]}" -ne "${#dashboard_node_ips[@]}" ]; then
|
||||
common_logger -e "Different number of dashboard node names and IPs."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
else
|
||||
common_logger -e "No configuration file found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function cert_setpermisions() {
|
||||
eval "chmod -R 744 ${cert_tmp_path} ${debug}"
|
||||
}
|
||||
function cert_convertCRLFtoLF() {
|
||||
if [[ ! -d "/tmp/wazuh-install-files" ]]; then
|
||||
eval "mkdir /tmp/wazuh-install-files ${debug}"
|
||||
fi
|
||||
eval "chmod -R 755 /tmp/wazuh-install-files ${debug}"
|
||||
eval "tr -d '\015' < $1 > /tmp/wazuh-install-files/new_config.yml"
|
||||
eval "mv /tmp/wazuh-install-files/new_config.yml $1 ${debug}"
|
||||
}
|
||||
|
||||
# ------------ certMain.sh ------------
|
||||
function getHelp() {
|
||||
|
||||
echo -e ""
|
||||
echo -e "NAME"
|
||||
echo -e " wazuh-cert-tool.sh - Manages the creation of certificates of the Wazuh components."
|
||||
echo -e ""
|
||||
echo -e "SYNOPSIS"
|
||||
echo -e " wazuh-cert-tool.sh [OPTIONS]"
|
||||
echo -e ""
|
||||
echo -e "DESCRIPTION"
|
||||
echo -e " -a, --admin-certificates </path/to/root-ca.pem> </path/to/root-ca.key>"
|
||||
echo -e " Creates the admin certificates, add root-ca.pem and root-ca.key."
|
||||
echo -e ""
|
||||
echo -e " -A, --all </path/to/root-ca.pem> </path/to/root-ca.key>"
|
||||
echo -e " Creates certificates specified in config.yml and admin certificates. Add a root-ca.pem and root-ca.key or leave it empty so a new one will be created."
|
||||
echo -e ""
|
||||
echo -e " -ca, --root-ca-certificates"
|
||||
echo -e " Creates the root-ca certificates."
|
||||
echo -e ""
|
||||
echo -e " -v, --verbose"
|
||||
echo -e " Enables verbose mode."
|
||||
echo -e ""
|
||||
echo -e " -wd, --wazuh-dashboard-certificates </path/to/root-ca.pem> </path/to/root-ca.key>"
|
||||
echo -e " Creates the Wazuh dashboard certificates, add root-ca.pem and root-ca.key."
|
||||
echo -e ""
|
||||
echo -e " -wi, --wazuh-indexer-certificates </path/to/root-ca.pem> </path/to/root-ca.key>"
|
||||
echo -e " Creates the Wazuh indexer certificates, add root-ca.pem and root-ca.key."
|
||||
echo -e ""
|
||||
echo -e " -ws, --wazuh-server-certificates </path/to/root-ca.pem> </path/to/root-ca.key>"
|
||||
echo -e " Creates the Wazuh server certificates, add root-ca.pem and root-ca.key."
|
||||
echo -e ""
|
||||
echo -e " -tmp, --cert_tmp_path </path/to/tmp_dir>"
|
||||
echo -e " Modifies the default tmp directory (/tmp/wazuh-ceritificates) to the specified one."
|
||||
echo -e " Must be used along with one of these options: -a, -A, -ca, -wi, -wd, -ws"
|
||||
echo -e ""
|
||||
|
||||
exit 1
|
||||
|
||||
}
|
||||
function main() {
|
||||
|
||||
umask 177
|
||||
|
||||
cert_checkOpenSSL
|
||||
|
||||
if [ -n "${1}" ]; then
|
||||
while [ -n "${1}" ]
|
||||
do
|
||||
case "${1}" in
|
||||
"-a"|"--admin-certificates")
|
||||
if [[ -z "${2}" || -z "${3}" ]]; then
|
||||
common_logger -e "Error on arguments. Probably missing </path/to/root-ca.pem> </path/to/root-ca.key> after -a|--admin-certificates"
|
||||
getHelp
|
||||
exit 1
|
||||
else
|
||||
cadmin=1
|
||||
rootca="${2}"
|
||||
rootcakey="${3}"
|
||||
shift 3
|
||||
fi
|
||||
;;
|
||||
"-A"|"--all")
|
||||
if [[ -n "${2}" && "${2}" != "-v" && "${2}" != "-tmp" ]]; then
|
||||
# Validate that the user has entered the 2 files
|
||||
if [[ -z ${3} ]]; then
|
||||
if [[ ${2} == *".key" ]]; then
|
||||
common_logger -e "You have not entered a root-ca.pem"
|
||||
exit 1
|
||||
else
|
||||
common_logger -e "You have not entered a root-ca.key"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
all=1
|
||||
rootca="${2}"
|
||||
rootcakey="${3}"
|
||||
shift 3
|
||||
else
|
||||
all=1
|
||||
shift 1
|
||||
fi
|
||||
;;
|
||||
"-ca"|"--root-ca-certificate")
|
||||
ca=1
|
||||
shift 1
|
||||
;;
|
||||
"-h"|"--help")
|
||||
getHelp
|
||||
;;
|
||||
"-v"|"--verbose")
|
||||
debugEnabled=1
|
||||
shift 1
|
||||
;;
|
||||
"-wd"|"--wazuh-dashboard-certificates")
|
||||
if [[ -z "${2}" || -z "${3}" ]]; then
|
||||
common_logger -e "Error on arguments. Probably missing </path/to/root-ca.pem> </path/to/root-ca.key> after -wd|--wazuh-dashboard-certificates"
|
||||
getHelp
|
||||
exit 1
|
||||
else
|
||||
cdashboard=1
|
||||
rootca="${2}"
|
||||
rootcakey="${3}"
|
||||
shift 3
|
||||
fi
|
||||
;;
|
||||
"-wi"|"--wazuh-indexer-certificates")
|
||||
if [[ -z "${2}" || -z "${3}" ]]; then
|
||||
common_logger -e "Error on arguments. Probably missing </path/to/root-ca.pem> </path/to/root-ca.key> after -wi|--wazuh-indexer-certificates"
|
||||
getHelp
|
||||
exit 1
|
||||
else
|
||||
cindexer=1
|
||||
rootca="${2}"
|
||||
rootcakey="${3}"
|
||||
shift 3
|
||||
fi
|
||||
;;
|
||||
"-ws"|"--wazuh-server-certificates")
|
||||
if [[ -z "${2}" || -z "${3}" ]]; then
|
||||
common_logger -e "Error on arguments. Probably missing </path/to/root-ca.pem> </path/to/root-ca.key> after -ws|--wazuh-server-certificates"
|
||||
getHelp
|
||||
exit 1
|
||||
else
|
||||
cserver=1
|
||||
rootca="${2}"
|
||||
rootcakey="${3}"
|
||||
shift 3
|
||||
fi
|
||||
;;
|
||||
"-tmp"|"--cert_tmp_path")
|
||||
if [[ -n "${3}" || ( "${cadmin}" == 1 || "${all}" == 1 || "${ca}" == 1 || "${cdashboard}" == 1 || "${cindexer}" == 1 || "${cserver}" == 1 ) ]]; then
|
||||
if [[ -z "${2}" || ! "${2}" == /* ]]; then
|
||||
common_logger -e "Error on arguments. Probably missing </path/to/tmp_dir> or path does not start with '/'."
|
||||
getHelp
|
||||
exit 1
|
||||
else
|
||||
cert_tmp_path="${2}"
|
||||
shift 2
|
||||
fi
|
||||
else
|
||||
common_logger -e "Error: -tmp must be used along with one of these options: -a, -A, -ca, -wi, -wd, -ws"
|
||||
getHelp
|
||||
exit 1
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "Unknow option: ${1}"
|
||||
getHelp
|
||||
esac
|
||||
done
|
||||
|
||||
common_logger "Verbose logging redirected to ${logfile}"
|
||||
|
||||
if [[ -d "${base_path}"/wazuh-certificates ]]; then
|
||||
if [ -n "$(ls -A "${base_path}"/wazuh-certificates)" ]; then
|
||||
common_logger -e "Directory wazuh-certificates already exists in the same path as the script. Please, remove the certs directory to create new certificates."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ ! -d "${cert_tmp_path}" ]]; then
|
||||
mkdir -p "${cert_tmp_path}"
|
||||
chmod 744 "${cert_tmp_path}"
|
||||
fi
|
||||
|
||||
cert_readConfig
|
||||
|
||||
if [ -n "${debugEnabled}" ]; then
|
||||
debug="2>&1 | tee -a ${logfile}"
|
||||
fi
|
||||
|
||||
if [[ -n "${cadmin}" ]]; then
|
||||
cert_checkRootCA
|
||||
cert_generateAdmincertificate
|
||||
common_logger "Admin certificates created."
|
||||
cert_cleanFiles
|
||||
cert_setpermisions
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
fi
|
||||
|
||||
if [[ -n "${all}" ]]; then
|
||||
cert_checkRootCA
|
||||
cert_generateAdmincertificate
|
||||
common_logger "Admin certificates created."
|
||||
if cert_generateIndexercertificates; then
|
||||
common_logger "Wazuh indexer certificates created."
|
||||
fi
|
||||
if cert_generateFilebeatcertificates; then
|
||||
common_logger "Wazuh Filebeat certificates created."
|
||||
fi
|
||||
if cert_generateDashboardcertificates; then
|
||||
common_logger "Wazuh dashboard certificates created."
|
||||
fi
|
||||
cert_cleanFiles
|
||||
cert_setpermisions
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
fi
|
||||
|
||||
if [[ -n "${ca}" ]]; then
|
||||
cert_generateRootCAcertificate
|
||||
common_logger "Authority certificates created."
|
||||
cert_cleanFiles
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
fi
|
||||
|
||||
if [[ -n "${cindexer}" ]]; then
|
||||
if [ ${#indexer_node_names[@]} -gt 0 ]; then
|
||||
cert_checkRootCA
|
||||
cert_generateIndexercertificates
|
||||
common_logger "Wazuh indexer certificates created."
|
||||
cert_cleanFiles
|
||||
cert_setpermisions
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
else
|
||||
common_logger -e "Indexer node not present in config.yml."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -n "${cserver}" ]]; then
|
||||
if [ ${#server_node_names[@]} -gt 0 ]; then
|
||||
cert_checkRootCA
|
||||
cert_generateFilebeatcertificates
|
||||
common_logger "Wazuh Filebeat certificates created."
|
||||
cert_cleanFiles
|
||||
cert_setpermisions
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
else
|
||||
common_logger -e "Server node not present in config.yml."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -n "${cdashboard}" ]]; then
|
||||
if [ ${#dashboard_node_names[@]} -gt 0 ]; then
|
||||
cert_checkRootCA
|
||||
cert_generateDashboardcertificates
|
||||
common_logger "Wazuh dashboard certificates created."
|
||||
cert_cleanFiles
|
||||
cert_setpermisions
|
||||
eval "mv ${cert_tmp_path} ${base_path}/wazuh-certificates ${debug}"
|
||||
else
|
||||
common_logger -e "Dashboard node not present in config.yml."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
getHelp
|
||||
fi
|
||||
|
||||
}
|
||||
# ------------ certVariables.sh ------------
|
||||
|
||||
function common_checkAptLock() {
|
||||
|
||||
attempt=0
|
||||
seconds=30
|
||||
max_attempts=10
|
||||
|
||||
while fuser "${apt_lockfile}" >/dev/null 2>&1 && [ "${attempt}" -lt "${max_attempts}" ]; do
|
||||
attempt=$((attempt+1))
|
||||
common_logger "Another process is using APT. Waiting for it to release the lock. Next retry in ${seconds} seconds (${attempt}/${max_attempts})"
|
||||
sleep "${seconds}"
|
||||
done
|
||||
|
||||
}
|
||||
function common_logger() {
|
||||
|
||||
now=$(date +'%d/%m/%Y %H:%M:%S')
|
||||
mtype="INFO:"
|
||||
debugLogger=
|
||||
nolog=
|
||||
if [ -n "${1}" ]; then
|
||||
while [ -n "${1}" ]; do
|
||||
case ${1} in
|
||||
"-e")
|
||||
mtype="ERROR:"
|
||||
shift 1
|
||||
;;
|
||||
"-w")
|
||||
mtype="WARNING:"
|
||||
shift 1
|
||||
;;
|
||||
"-d")
|
||||
debugLogger=1
|
||||
mtype="DEBUG:"
|
||||
shift 1
|
||||
;;
|
||||
"-nl")
|
||||
nolog=1
|
||||
shift 1
|
||||
;;
|
||||
*)
|
||||
message="${1}"
|
||||
shift 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
fi
|
||||
|
||||
if [ -z "${debugLogger}" ] || { [ -n "${debugLogger}" ] && [ -n "${debugEnabled}" ]; }; then
|
||||
if [ -z "${nolog}" ] && { [ "$EUID" -eq 0 ] || [[ "$(basename "$0")" =~ $cert_tool_script_name ]]; }; then
|
||||
printf "%s\n" "${now} ${mtype} ${message}" | tee -a ${logfile}
|
||||
else
|
||||
printf "%b\n" "${now} ${mtype} ${message}"
|
||||
fi
|
||||
fi
|
||||
|
||||
}
|
||||
function common_checkRoot() {
|
||||
|
||||
common_logger -d "Checking root permissions."
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "This script must be run as root."
|
||||
exit 1;
|
||||
fi
|
||||
|
||||
common_logger -d "Checking sudo package."
|
||||
if ! command -v sudo > /dev/null; then
|
||||
common_logger -e "The sudo package is not installed and it is necessary for the installation."
|
||||
exit 1;
|
||||
fi
|
||||
}
|
||||
function common_checkInstalled() {
|
||||
|
||||
common_logger -d "Checking Wazuh installation."
|
||||
wazuh_installed=""
|
||||
indexer_installed=""
|
||||
filebeat_installed=""
|
||||
dashboard_installed=""
|
||||
|
||||
if [ "${sys_type}" == "yum" ]; then
|
||||
eval "rpm -q wazuh-manager --quiet && wazuh_installed=1"
|
||||
elif [ "${sys_type}" == "apt-get" ]; then
|
||||
wazuh_installed=$(apt list --installed 2>/dev/null | grep wazuh-manager)
|
||||
fi
|
||||
|
||||
if [ -d "/var/ossec" ]; then
|
||||
common_logger -d "There are Wazuh remaining files."
|
||||
wazuh_remaining_files=1
|
||||
fi
|
||||
|
||||
if [ "${sys_type}" == "yum" ]; then
|
||||
eval "rpm -q wazuh-indexer --quiet && indexer_installed=1"
|
||||
|
||||
elif [ "${sys_type}" == "apt-get" ]; then
|
||||
indexer_installed=$(apt list --installed 2>/dev/null | grep wazuh-indexer)
|
||||
fi
|
||||
|
||||
if [ -d "/var/lib/wazuh-indexer/" ] || [ -d "/usr/share/wazuh-indexer" ] || [ -d "/etc/wazuh-indexer" ] || [ -f "${base_path}/search-guard-tlstool*" ]; then
|
||||
common_logger -d "There are Wazuh indexer remaining files."
|
||||
indexer_remaining_files=1
|
||||
fi
|
||||
|
||||
if [ "${sys_type}" == "yum" ]; then
|
||||
eval "rpm -q filebeat --quiet && filebeat_installed=1"
|
||||
elif [ "${sys_type}" == "apt-get" ]; then
|
||||
filebeat_installed=$(apt list --installed 2>/dev/null | grep filebeat)
|
||||
fi
|
||||
|
||||
if [ -d "/var/lib/filebeat/" ] || [ -d "/usr/share/filebeat" ] || [ -d "/etc/filebeat" ]; then
|
||||
common_logger -d "There are Filebeat remaining files."
|
||||
filebeat_remaining_files=1
|
||||
fi
|
||||
|
||||
if [ "${sys_type}" == "yum" ]; then
|
||||
eval "rpm -q wazuh-dashboard --quiet && dashboard_installed=1"
|
||||
elif [ "${sys_type}" == "apt-get" ]; then
|
||||
dashboard_installed=$(apt list --installed 2>/dev/null | grep wazuh-dashboard)
|
||||
fi
|
||||
|
||||
if [ -d "/var/lib/wazuh-dashboard/" ] || [ -d "/usr/share/wazuh-dashboard" ] || [ -d "/etc/wazuh-dashboard" ] || [ -d "/run/wazuh-dashboard/" ]; then
|
||||
common_logger -d "There are Wazuh dashboard remaining files."
|
||||
dashboard_remaining_files=1
|
||||
fi
|
||||
|
||||
}
|
||||
function common_checkSystem() {
|
||||
|
||||
if [ -n "$(command -v yum)" ]; then
|
||||
sys_type="yum"
|
||||
sep="-"
|
||||
common_logger -d "YUM package manager will be used."
|
||||
elif [ -n "$(command -v apt-get)" ]; then
|
||||
sys_type="apt-get"
|
||||
sep="="
|
||||
common_logger -d "APT package manager will be used."
|
||||
else
|
||||
common_logger -e "Couldn't find YUM or APT package manager. Try installing the one corresponding to your operating system and then, launch the installation assistant again."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function common_checkWazuhConfigYaml() {
|
||||
|
||||
common_logger -d "Checking Wazuh YAML configuration file."
|
||||
filecorrect=$(cert_parseYaml "${config_file}" | grep -Ev '^#|^\s*$' | grep -Pzc "\A(\s*(nodes_indexer__name|nodes_indexer__ip|nodes_server__name|nodes_server__ip|nodes_server__node_type|nodes_dashboard__name|nodes_dashboard__ip)=.*?)+\Z")
|
||||
if [[ "${filecorrect}" -ne 1 ]]; then
|
||||
common_logger -e "The configuration file ${config_file} does not have a correct format."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
}
|
||||
function common_curl() {
|
||||
|
||||
if [ -n "${curl_has_connrefused}" ]; then
|
||||
eval "curl $@ --retry-connrefused"
|
||||
e_code="${PIPESTATUS[0]}"
|
||||
else
|
||||
retries=0
|
||||
eval "curl $@"
|
||||
e_code="${PIPESTATUS[0]}"
|
||||
while [ "${e_code}" -eq 7 ] && [ "${retries}" -ne 12 ]; do
|
||||
retries=$((retries+1))
|
||||
sleep 5
|
||||
eval "curl $@"
|
||||
e_code="${PIPESTATUS[0]}"
|
||||
done
|
||||
fi
|
||||
return "${e_code}"
|
||||
|
||||
}
|
||||
function common_remove_gpg_key() {
|
||||
|
||||
common_logger -d "Removing GPG key from system."
|
||||
if [ "${sys_type}" == "yum" ]; then
|
||||
if { rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n' | grep "Wazuh"; } >/dev/null ; then
|
||||
key=$(rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n' | grep "Wazuh Signing Key" | awk '{print $1}' )
|
||||
rpm -e "${key}"
|
||||
else
|
||||
common_logger "Wazuh GPG key not found in the system"
|
||||
return 1
|
||||
fi
|
||||
elif [ "${sys_type}" == "apt-get" ]; then
|
||||
if [ -f "/usr/share/keyrings/wazuh.gpg" ]; then
|
||||
rm -rf "/usr/share/keyrings/wazuh.gpg" "${debug}"
|
||||
else
|
||||
common_logger "Wazuh GPG key not found in the system"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
}
|
||||
function common_checkYumLock() {
|
||||
|
||||
attempt=0
|
||||
seconds=30
|
||||
max_attempts=10
|
||||
|
||||
while [ -f "${yum_lockfile}" ] && [ "${attempt}" -lt "${max_attempts}" ]; do
|
||||
attempt=$((attempt+1))
|
||||
common_logger "Another process is using YUM. Waiting for it to release the lock. Next retry in ${seconds} seconds (${attempt}/${max_attempts})"
|
||||
sleep "${seconds}"
|
||||
done
|
||||
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -0,0 +1,17 @@
|
||||
server.host: 0.0.0.0
|
||||
server.port: 5601
|
||||
opensearch.hosts: ["https://wazuh.indexer:9200"]
|
||||
opensearch.username: "admin"
|
||||
opensearch.password: "SecretPassword123!"
|
||||
opensearch.ssl.verificationMode: none
|
||||
opensearch.requestHeadersAllowlist:
|
||||
- securitytenant
|
||||
- Authorization
|
||||
opensearch_security.multitenancy.enabled: false
|
||||
opensearch_security.readonly_mode.roles:
|
||||
- kibana_read_only
|
||||
server.ssl.enabled: true
|
||||
server.ssl.certificate: /usr/share/wazuh-dashboard/certs/wazuh.dashboard.pem
|
||||
server.ssl.key: /usr/share/wazuh-dashboard/certs/wazuh.dashboard-key.pem
|
||||
opensearch.ssl.certificateAuthorities: [/usr/share/wazuh-dashboard/certs/root-ca.pem]
|
||||
uiSettings.overrides.defaultRoute: /app/wazuh
|
||||
@@ -0,0 +1,13 @@
|
||||
hosts:
|
||||
- default:
|
||||
url: https://wazuh.manager
|
||||
port: 55000
|
||||
username: wazuh-wui
|
||||
password: MyS3cr37P450r.*-
|
||||
run_as: false
|
||||
- 1513629884013:
|
||||
url: https://wazuh.manager
|
||||
port: 55000
|
||||
username: wazuh-wui
|
||||
password: MyS3cr37P450r.*-
|
||||
run_as: false
|
||||
@@ -0,0 +1,52 @@
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
cluster.initial_master_nodes:
|
||||
- "wazuh.indexer"
|
||||
cluster.name: "wazuh-cluster"
|
||||
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
path.repo: /var/lib/wazuh-indexer/snapshots
|
||||
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
plugins.security.authcz.admin_dn:
|
||||
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices:
|
||||
- ".opendistro-alerting-config"
|
||||
- ".opendistro-alerting-alert*"
|
||||
- ".opendistro-anomaly-results*"
|
||||
- ".opendistro-anomaly-detector*"
|
||||
- ".opendistro-anomaly-checkpoints"
|
||||
- ".opendistro-anomaly-detection-state"
|
||||
- ".opendistro-reports-*"
|
||||
- ".opendistro-notifications-*"
|
||||
- ".opendistro-notebooks"
|
||||
- ".opendistro-observability"
|
||||
- ".opendistro-asynchronous-search-response*"
|
||||
- ".replication-metadata-store"
|
||||
- ".opensearch-observability"
|
||||
- ".opensearch-notifications-*"
|
||||
- ".opensearch-reports-*"
|
||||
- ".opensearch-anomaly-results*"
|
||||
- ".opensearch-anomaly-detector*"
|
||||
- ".opensearch-anomaly-checkpoints"
|
||||
- ".opensearch-anomaly-detection-state"
|
||||
- ".opensearch-security"
|
||||
- ".wazuh"
|
||||
- ".wazuh-*"
|
||||
- ".plugins-*"
|
||||
|
||||
compatibility.override_main_response_version: true
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC67BSZ85ZK4mP4
|
||||
YxKz7BwFsonyg5nn/JRN9YbQq/bt8eMkWbm4Js2Fpi/oIxC2aEyWNrQOa8D3SJuI
|
||||
5vPUaF/uOa4CtxZt9Ds/3dYftQn9dGplhOp9uoSVIXrU3uuUI5xQuMGORu+8xfa9
|
||||
24WWCsf6fdz7fZJ0dB0zcZpLmLZARk8LqoOn4a8uwaYdtpJ/avCeOZAjkfzgNPzh
|
||||
e9r4L7Lhwd1RdejFssF6DvlfcxBFSmIfuttEbrxDV+LhdRhUTrQnOswSBJBU7otK
|
||||
XXImKV4FZ27h+ATLY3m5c36SdcBWXXfeVpL8HZF7sXfkvUFHqYPu8A2aS5AeVp0e
|
||||
ZCWVylvFAgMBAAECggEAE2a/o1RvgWmgJhQ6c7xfvY5Q19V7BbjnYnQdQHl+PCet
|
||||
g4S19ybn5tBfYUE1JzRfhqk6On5Kssqxgh3eqb8E/gK0ogmDkCQX0O2N9Q/jGpCZ
|
||||
Hoe+QxCMrwyg5YlsevLQnbxKMsyqw4rqAmjPo8mOBNzy2+j7vjnzHKIqTrW/bPTx
|
||||
dsC/u24Rffibj6FP0X9jmkYczMfVBLnnbNSryQ42QvUAzXRUYRbedGkXPQj8DXxR
|
||||
lA71gJB3Jo0k8SovVGbd96/ripUIzgT/I565JlZk3YDf/W5aDwL18K5vHAWQj+/v
|
||||
8kzYlYg4t/L8P8HXjKaOBMYdS0mPoZq0yGVwYarlXQKBgQD5M1mjaq/wEKcK6qgy
|
||||
GzD+svw0YKJdOoVuS6UEMI6HdaHHu5HaALPVkSM9U8GYzwyr+WGOSOAWRjlIrLqC
|
||||
sffUJchXgClJCoHD01WcVksczsAjWYhsrZhHXVs2aWtGkO3BBgdrpFFvJG52pe5y
|
||||
sCgRm7hz8UhqDaOcnfWH1+1sPwKBgQDABbhDhhL2+kws7CVKmJFQrovpIcNJHisK
|
||||
nMKhoCbFfX1jbu89xXaQqV+2C2iqlsfWxualYMtWgTq4umnAum4rUNjJWmZY4Fqy
|
||||
Pb57fN1LML3+tcwbCCp5w+NmtvJK5dh9+IgmD8xM4thq4awlnv2tQqP/HolhVTF2
|
||||
lMvekZhG+wKBgEP2Bh80DFFLKVMn1cD8e2sqwu9B32XPfO4sgQ9YcrZslTdUZx1u
|
||||
DZ1T3Klv+x9CcDFCbKGSLFLGyf6Q5LiZ8n2P5EhAsoGx9NvD+dgODKQJmorJcxQ4
|
||||
b4we4K5BJ7lx8vUuQL3RbUgDRoDjFdl/Qx4yOqacCeSqXZFr3rcyYxSfAoGAc2o8
|
||||
saFBft88r/eUBn0jQqpW/95CQY13c157gagABc4CcqR3+dnZBOQ42fOLipUsMkTE
|
||||
1vwR28G66NNqwuOLWk+yrXu/boYTHXUNK64GWK5IVHMy5cCHvz5lTRSDF0+FS1n5
|
||||
g18VfdUPHVbdIJOqh9w5NBtHmZAaNdsDmphKPccCgYEAsnMoj8gM64JDpti6OwIV
|
||||
TrMTv076CGPGisx5Ooemewvy/g9bPKiQjQdZg5GKQmCq+7OSNUFLZXBwkV6oBJV7
|
||||
StWi3s01um+08ljs5sXhsw4c8e8RCJ8CrkxGqoaKoGEXHXFgS0CLqy430CBza4Ra
|
||||
ounGuRkS5kwqfeXfVC4Rq/U=
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDVzCCAj+gAwIBAgIUEO25S+4jYn8uga3bnRiVBbdOp7gwDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzMloXDTM2MDgwMTA5MTQzMlowUjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEOMAwGA1UEAwwFYWRtaW4wggEiMA0GCSqGSIb3DQEBAQUA
|
||||
A4IBDwAwggEKAoIBAQC67BSZ85ZK4mP4YxKz7BwFsonyg5nn/JRN9YbQq/bt8eMk
|
||||
Wbm4Js2Fpi/oIxC2aEyWNrQOa8D3SJuI5vPUaF/uOa4CtxZt9Ds/3dYftQn9dGpl
|
||||
hOp9uoSVIXrU3uuUI5xQuMGORu+8xfa924WWCsf6fdz7fZJ0dB0zcZpLmLZARk8L
|
||||
qoOn4a8uwaYdtpJ/avCeOZAjkfzgNPzhe9r4L7Lhwd1RdejFssF6DvlfcxBFSmIf
|
||||
uttEbrxDV+LhdRhUTrQnOswSBJBU7otKXXImKV4FZ27h+ATLY3m5c36SdcBWXXfe
|
||||
VpL8HZF7sXfkvUFHqYPu8A2aS5AeVp0eZCWVylvFAgMBAAGjQjBAMB0GA1UdDgQW
|
||||
BBTcbvDe4y2Kjkid0TCkFISXIZT4lDAfBgNVHSMEGDAWgBQe9+49H4XrSFxTrm+1
|
||||
QJmwqBxBTzANBgkqhkiG9w0BAQsFAAOCAQEAovG1Sk+lSe8X9ZF7irPzpIFeFqOB
|
||||
C/kS/+v0t+AGnGey7gNUbkFtvRed6XLtCbDaxUxHviuIcgWuIBnKEoioAuaNWIde
|
||||
yGjj+BFQQlaaKQkP1U57j5EDj8+31pucCgogiXU773azVcSx+pJcgW6FWEfC4T33
|
||||
tl/cK8tSQUEOJf5XttLkCxCOUxlySwcd4p4YaHViOQWoyvMV2HU36GX/c5c4XDZC
|
||||
Cqhb44UqAQ5KoKxZCNtePCHpC1xw/XyLbTbEV+Vfqkm6hXznohU9wBLGC6Q7hij0
|
||||
i/BIjYDELtcCl4x67rROhYWq9XA2eqe2EelC7CtS3bsWNt9w5PR4QYlIwA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDSzCCAjOgAwIBAgIUCDO5y/zFBSClCe04yo1K1flC6u4wDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzMloXDTM2MDgwMTA5MTQzMlowNTEOMAwG
|
||||
A1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApDYWxpZm9ybmlh
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzh/t2fj3XR6PVptMw54F
|
||||
8evxZGnOW+oG+/CQwF5UCKggF/7geBUA4uDNCrRBVn4DFX+GLz1n858NyDIZTfRI
|
||||
80UaxAHtQ7vDuONeog6K6e4ia/MtqWIf6pKam1gT5amKwuUZ/Nq0L4xgUHVhb8ax
|
||||
BhMbNox1OeYsdXfjVXCIhwSwsu7YAE6i+jmTB/9KklDf57lPzFuU9ivdJ6feJJ7i
|
||||
v1bGzbaMqnOqU9qWdEk3v7KPV/o8s/+3BwcHTGHYc8Uxrxbb2GIokj0587DoUo2o
|
||||
5WCtxx8eSu+fMdPu2r6UCy7eT3u8z9fFrnntrWJr9rzVaOnmCmccbqoP05VK25v6
|
||||
OwIDAQABo1MwUTAdBgNVHQ4EFgQUHvfuPR+F60hcU65vtUCZsKgcQU8wHwYDVR0j
|
||||
BBgwFoAUHvfuPR+F60hcU65vtUCZsKgcQU8wDwYDVR0TAQH/BAUwAwEB/zANBgkq
|
||||
hkiG9w0BAQsFAAOCAQEAfVTbHPiMuwRdz/9OLvHI9OMWD2pNDsxR1o53n1HS6VeS
|
||||
R07LxLhUYhe5N9ruqQ11tdbVAHvxmKwuA8Rw432/e8vH/655Gieljq3QnxbekXGZ
|
||||
Zn5yC646aAMKL7jPhz+ZkTw3KDMeHsTGAHJ84hg8g9Tm3kt3MS0ILOv7xseEyklW
|
||||
0hyiN7TIqFHOPqSxQWx8sJRABergDFmTig1QxJLpl4rph5izcSg+qc9YivuwuPb3
|
||||
DX1Y2Z2AsodaWSW02FwczVtwrxJA8wZSMp3bd6SR3ddgDy7j8fJgFJGjsitH1rMJ
|
||||
2lznWBTlNYjnsztmluESROZmdeILj0MpZL/BhuQkcQ==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDOH+3Z+PddHo9W
|
||||
m0zDngXx6/Fkac5b6gb78JDAXlQIqCAX/uB4FQDi4M0KtEFWfgMVf4YvPWfznw3I
|
||||
MhlN9EjzRRrEAe1Du8O4416iDorp7iJr8y2pYh/qkpqbWBPlqYrC5Rn82rQvjGBQ
|
||||
dWFvxrEGExs2jHU55ix1d+NVcIiHBLCy7tgATqL6OZMH/0qSUN/nuU/MW5T2K90n
|
||||
p94knuK/VsbNtoyqc6pT2pZ0STe/so9X+jyz/7cHBwdMYdhzxTGvFtvYYiiSPTnz
|
||||
sOhSjajlYK3HHx5K758x0+7avpQLLt5Pe7zP18Wuee2tYmv2vNVo6eYKZxxuqg/T
|
||||
lUrbm/o7AgMBAAECggEAYpUCvO1F4VNsWo+L90LstPeTS+MOvwb+sCAuGtMCfeFq
|
||||
+A7+bHAfLGM3rZboaOV7tBx5oL5NqUa44LaVQ6NCAJdcZcJGJ871nMehywAJkDhE
|
||||
Xjy/6fL0MMxNBV7qpTyhEPVhqH0xEEyjA9gf8cWlhLI+oagrqLVdLhFYuNRJd8j6
|
||||
LAwq9E1hRf+J61DtQMU1hqiRaUq7/IBpPK7xyb/WwP5n0VSkpYJBLukv5OrfynO2
|
||||
64IrtE6NpHm9PRMRyS4UAvF4yVl6XqHpxFxBoYGvcO3EO+tF75dXtroSEVt1nxcd
|
||||
6D8jzjQX8PYFOKy1fjboj/m1oIGP0LFsH5m0+E4TgQKBgQD26PLx2SFFEzAaDGYc
|
||||
Wm51RMdcP+21Tb9sgHJe5tH7G0EwwR0Dg34g7HaMuZaBm9f2hVmt+mOlbT1QDumu
|
||||
B8FAat6zQ4lz80GJkvgiRmLBO6TTFxyuWkkpEEGNZx8hU+Q9LuP+6MDn7iaEGxKY
|
||||
iGygu2dsv40+i1+8AjwYwXD2hwKBgQDVtpd6/hNyZDiEhkpxHK7grF6cPWZhwUgx
|
||||
83VpWNZwt2H2GbJQ4Jj2HoSWOX/WxCsVfy4GHNeDAVslvSPjGhSxObhjsMsVpjNr
|
||||
lueB+2niah2wyoqW7J8VcctI694d8ytKfg1ilG+MCSFxStCPQgrj/h64U62x1KTp
|
||||
9aEpl3bXrQKBgCO2R8VROW2rO87YskAxmD5f51HhcTlC+IfyABjX29Es/P3XQKIM
|
||||
d8a9TNxHz4wJhXADk5gFWjpIFZEpxwTD3GC71GArSYs6yOTkG/2hHpGCVfGuKxjQ
|
||||
uDo3PrP8EVWZs65hxNpOwfAJ0wpSfBsRyFxrHqdtATnloMAptpWCDRurAoGBAMhD
|
||||
2314u/Z07fVZ9kY6r7GANQRKETfHrISKdNrsUb68ScMZX1ykqxHvlSVE6oPxvcHe
|
||||
NN2rh1SPH7+klw2Ich2FTkG0+QnnfcXzWiwW0alG8V2q3uYBBC5PPUSvKqx8I3Qh
|
||||
3R8ko8bhA4Krrfag153Akz79wwWik4teDtDvy4DdAoGAAY+QYfOohgU9rrTtKEWp
|
||||
AHpAYqPHwhAAT0MZ12NJE4H9evEqjMCtkxndTFk00c01rFeNGrMKOVexp8D4FX6d
|
||||
MiHHLeW3YrF9JatKbR0A2ZykS3dKWMNt2JO+H9OH4YS6pPh7HKGuWPCdGRYyqy4k
|
||||
8PYyytiTLfzJhOUVwiVg2L0=
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDSzCCAjOgAwIBAgIUCDO5y/zFBSClCe04yo1K1flC6u4wDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzMloXDTM2MDgwMTA5MTQzMlowNTEOMAwG
|
||||
A1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApDYWxpZm9ybmlh
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzh/t2fj3XR6PVptMw54F
|
||||
8evxZGnOW+oG+/CQwF5UCKggF/7geBUA4uDNCrRBVn4DFX+GLz1n858NyDIZTfRI
|
||||
80UaxAHtQ7vDuONeog6K6e4ia/MtqWIf6pKam1gT5amKwuUZ/Nq0L4xgUHVhb8ax
|
||||
BhMbNox1OeYsdXfjVXCIhwSwsu7YAE6i+jmTB/9KklDf57lPzFuU9ivdJ6feJJ7i
|
||||
v1bGzbaMqnOqU9qWdEk3v7KPV/o8s/+3BwcHTGHYc8Uxrxbb2GIokj0587DoUo2o
|
||||
5WCtxx8eSu+fMdPu2r6UCy7eT3u8z9fFrnntrWJr9rzVaOnmCmccbqoP05VK25v6
|
||||
OwIDAQABo1MwUTAdBgNVHQ4EFgQUHvfuPR+F60hcU65vtUCZsKgcQU8wHwYDVR0j
|
||||
BBgwFoAUHvfuPR+F60hcU65vtUCZsKgcQU8wDwYDVR0TAQH/BAUwAwEB/zANBgkq
|
||||
hkiG9w0BAQsFAAOCAQEAfVTbHPiMuwRdz/9OLvHI9OMWD2pNDsxR1o53n1HS6VeS
|
||||
R07LxLhUYhe5N9ruqQ11tdbVAHvxmKwuA8Rw432/e8vH/655Gieljq3QnxbekXGZ
|
||||
Zn5yC646aAMKL7jPhz+ZkTw3KDMeHsTGAHJ84hg8g9Tm3kt3MS0ILOv7xseEyklW
|
||||
0hyiN7TIqFHOPqSxQWx8sJRABergDFmTig1QxJLpl4rph5izcSg+qc9YivuwuPb3
|
||||
DX1Y2Z2AsodaWSW02FwczVtwrxJA8wZSMp3bd6SR3ddgDy7j8fJgFJGjsitH1rMJ
|
||||
2lznWBTlNYjnsztmluESROZmdeILj0MpZL/BhuQkcQ==
|
||||
-----END CERTIFICATE-----
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDCP/mmbQguMNNG
|
||||
xui0v15irdTfz82U0d5t4R6plsmMd2o2l/q2QQBvddDnIODQdOIXl7ZklHkZ3bvG
|
||||
zF3SNsOSa/31dxkpfQTOqHbQ/QxyR+8T9z9WHIH7I0YXjQWZe7WpJdAbIm7Ne3KY
|
||||
lRKCZ2+B+Hy4PsA8q6LBLkVtfhrQ2g0MHb2EN9xa+SaKHO3kXF4EvPTHWefBdyOW
|
||||
FIhvZK8jgjJyo18qHLec0MZ6dAizVipqUNR2UMPQRBPQU7E9a47dhdCPq3rnmeAv
|
||||
WoVr9W4qsZLAcQIzOBaIfGINEltBShlo7LipKc2NI0raOmb/iVwnhivfLHez+6eQ
|
||||
zL9bUgdvAgMBAAECggEABs0DmhKOK0PVWdCD/DQJA25vmghl+7RfU7yCfNCFLPBP
|
||||
XSr0AaaD8+MNldH+XP4Cnm3W2m2iUcgEF4E3NbFqJnm2cf4h+ORiIzQduNJrOaMQ
|
||||
GURaSNMFr/u7q/5peEavBQWIZDLP60zLpdDuTXd+nW/MOg0kYNtnftj2YE9+c9pm
|
||||
32GgCn7OfL5DB9BCraWkHxd9l+PhN1DTuwDTvZ97tJT9tbSTdS+mZ8VL1KtorDbn
|
||||
E+nn/pNO7jkEMPQqggh6iPiAD8H8CO5HF/VzApSbnZsHyiSlKYpbjmnm+D1+wI5j
|
||||
+rZtDR2vGjPvnRady/oZzTeoSYP+HQ7byFdSynHBfQKBgQDsVuiVxnrKxwqFQhtv
|
||||
5BxeuUVu03IMPstVKi9l38EW+t7/ujisWTCE1+Dmh5k/lI4AtF170+IU6Eiqg9oL
|
||||
NwnfBcjAKpp9cIcCJO7kcHlXq1WTV+HWoEz4dB8AIBDwNL3gMv9/XZ+xKfd2Cijm
|
||||
EXYo12ZJLhYeWRxqgnh6sFL6uwKBgQDSaLnSbnv4BcNBCvGmZmncvM+IQNZF7XCc
|
||||
2NZ98YSKe+dHnjiySOfH8uG/7noD54u27K2Rl/d4Anxz9QTzCubW5fW9FAE51aay
|
||||
R0cXvxyPo9OrYEEl3PGT7JgjQ0EDunijhsVAfJrEM/jrZzi71EH5NGdYqLAw9ec7
|
||||
znFfo2d83QKBgAWwygThNI+xXzV6NALrsSsuttdGTBazZF32mBGR46pT/A6YQ0kT
|
||||
FLH+KLIkTbJUN18Y+K9EmMr8FNPWPOfMOXafQwgtfm7KyNVqYj4p3yIXRAY6NXvf
|
||||
fDr3QM/V9dJy0qeVUsWUUYYIhqbW88kmXnv5Q8M7UtkEOETwQ0pg+H6FAoGAOaob
|
||||
6zD+Zq3loijGq2z77FQOqG/kiYuWRlYjCqcrROzKKNWTAkF6zFCjT/+ijvlhUAOz
|
||||
WeiFGO3Nf9YRwi4lr5WccHJQF7KXGdrw//APespSU3BwyliwGHNKCrf+1G/Bakeg
|
||||
PZkorUb1HEbQxKFaZ1rWS/UHPJPYCIr+hVB6Jz0CgYEAm5pTdO4jse4v9vYgBV2J
|
||||
ZJL9iRHryq04O12XkEvU0RU2ijL4+IJFIllDjFOQL67Aongn4/fVR9xje/ojUfoQ
|
||||
sprPjCIBxK9z/9BA2NDxg+lJ3i3y/wXtglMCwTzowNVN6QCYGU/BOATEBjVfkNd3
|
||||
jeshWSUXZHXVDgDn9OV/p8k=
|
||||
-----END PRIVATE KEY-----
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDVzCCAj+gAwIBAgIUaUXeUZypaWNhAf4NeHIx+WU3/h0wDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTg1N1oXDTM2MDgwMTA5MTg1N1owUjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEOMAwGA1UEAwwFYWRtaW4wggEiMA0GCSqGSIb3DQEBAQUA
|
||||
A4IBDwAwggEKAoIBAQDCP/mmbQguMNNGxui0v15irdTfz82U0d5t4R6plsmMd2o2
|
||||
l/q2QQBvddDnIODQdOIXl7ZklHkZ3bvGzF3SNsOSa/31dxkpfQTOqHbQ/QxyR+8T
|
||||
9z9WHIH7I0YXjQWZe7WpJdAbIm7Ne3KYlRKCZ2+B+Hy4PsA8q6LBLkVtfhrQ2g0M
|
||||
Hb2EN9xa+SaKHO3kXF4EvPTHWefBdyOWFIhvZK8jgjJyo18qHLec0MZ6dAizVipq
|
||||
UNR2UMPQRBPQU7E9a47dhdCPq3rnmeAvWoVr9W4qsZLAcQIzOBaIfGINEltBShlo
|
||||
7LipKc2NI0raOmb/iVwnhivfLHez+6eQzL9bUgdvAgMBAAGjQjBAMB0GA1UdDgQW
|
||||
BBSU6Apj61sQcH6066OzaXPGn8VUlzAfBgNVHSMEGDAWgBT88rlO1zQfeuFsLYIz
|
||||
XLPaTQBaQjANBgkqhkiG9w0BAQsFAAOCAQEADTPpf6GUrUxXe99x/yp1nCwR6d9h
|
||||
lsoDN9bmppgL+UHqVQaPS91sxJC3/6e4KyhGjMkessCOaVvmJUxj71wiGtgHqbNE
|
||||
TJSv/ejCCmhsZTIvonzgpTzXK8BCkBagrtdFdt62wNqrBEqeYU32Vhpub1WTjwbA
|
||||
SCmyVKBHwDonkN/9fkhqhX3190hx9FEWU4cltNpGRCyHuTEagb/NmPt77War9USk
|
||||
P5YZFYXauKtdDSh7H5bPM9DpKVeJVcvP0yesiolw6QVq7qGwT9j+L6XAFbtRvErw
|
||||
ZE0g/5MMvSIdhuMAGruzzCUgf8Tq4zGBtiepxpPTPiTE6o8LhHh9j1HwcQ==
|
||||
-----END CERTIFICATE-----
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDVP/W7/eUcOw4z
|
||||
V4phy+K43Ic2hZxmPOhK7EpOzHlMJz5/8PpSSPCMzZ7VsVW/4puuRElaZ99PrJNa
|
||||
0jkpv8MqIaJayIj8B9KA7H3V3TSI/hQeWgf4GP3akFOJfJL8kzaYpcy48ynVIbXV
|
||||
YWKuG8++G/wC1Dh15KTHZC7ah8xFaRZz96n333PW0j7Pe8kdxryzpXuTKQ5QMHiR
|
||||
U0bcB/zs3d0E4sx1RfJlHHBpqdfx1HtLXMPQACFdL3f11kBypRmQeZPcF00z6Ngx
|
||||
NB3iF6xsK4oDtXVt4SGscfgxKIaxzvuHpJG851h/rw6WdVL/rRRIf8ecbUrEOtmP
|
||||
Yu8vd7a3AgMBAAECggEAYaEqq6qNneMbmT3WyPdDEUdFUBzTgasY3lRXoMPUNJ0y
|
||||
6/gzYkCqgIwSz9qkW3kvtRTmUFGF10A3JjlgmlCE1WEYp19v95LNOOEMq0DesGlC
|
||||
ZLLrOxaWAd5ZoHQ8Bw6OzEv78iDBYiZQzSQMvZFWBr9hHRpzzuWi2vZuzPWm+49O
|
||||
odlmsKbdAtHsgWpOrVGswkZuzWMUw7K0f9wicZsRjwBPnqifo4hVwpOHcGJ9O+DF
|
||||
vpef9kSUAj3hpYmRreEEGZ/Jl/58klfcdIQLIuQSx+UgNBL5S/oyKEo+DuWgBuyW
|
||||
NdhUsv/atj7EuU1eWnc1XdCysnyjUpH/SrGMD+GuwQKBgQD5vneVck2BjOxTCoZv
|
||||
g9+9FVsoZws6t3r0olL+IhymnRy2oovuBxfJLfpkDo3GKCevkbY9Aoeulozk4yU5
|
||||
GwdPzkbUnTKHGXnLkzGrkRojX+IB2jDlY55jlTuCsfJMZ3yvGvhXf13XIQl1SE9I
|
||||
JGmi0DGi8fDPH0etBkbB0AgnfwKBgQDal3d5oLkuK5nRzZGotwLdLsxqJH1eaKBJ
|
||||
G5od8rJZZkwzzjfk+1ZRzcQ2ByLqYgr6Nsn/q62reVE2YlrTeKFJV/TPWzhIOq6K
|
||||
AM7hhFxmKyyxNXhMeVqux575s70dI8Au/BgnttN7YRdtWMdn/s/z73/dT0QEvxTP
|
||||
HoTK5ilMyQKBgQCU2d4Cd9cUMP8l228XBh2TYCgt44TA4Vzqc9lNWN2EvL3BaQ5H
|
||||
t3iI0tubSUVc5tAIh6t7n4dpGpgtT+j+qUppWYPD81GLTjbWjAudu2U90kctXXOp
|
||||
NP/RUL/gfNjyive4kjWUSPiQYUN24LtIP1Oq07XR7aved0FMMiJ4H9rMVwKBgQCc
|
||||
YGdUV6qiYQa1lL5zWBlwah5KgLg/ZdHk+x4R9qGoWwqAtTI/WZ6y/uUzUX+k9Wat
|
||||
Aa0YfpTLawqyQUKArneTpJy6CqQE6BYdG97kbnA7lv9t9raM3vQEvUH5mJ/dzMmb
|
||||
0zTklGJOjXLZAv4EY8IY3Gk4xY//ZUNZuJd/H5DEIQKBgQCryQrh/KBWSylx+LKX
|
||||
OdLDz/JRSOPuBt+X8IlOGL01cVnh2ZdNZ4vWX8+vFdgeoRmYUtyeHf7+jWddkT9R
|
||||
jCAl8qh3CHiJ2tXezvdzQMjxGvDsC+ntRirOLyXLvHwvnpU1gBUNrnWzMbNrInw1
|
||||
GGTIzCnewsYdGchVXS97ERxp0g==
|
||||
-----END PRIVATE KEY-----
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDSzCCAjOgAwIBAgIUXRaBjAmvzh9Z4NPrGcV/YwGPjgEwDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTg1N1oXDTM2MDgwMTA5MTg1N1owNTEOMAwG
|
||||
A1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApDYWxpZm9ybmlh
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1T/1u/3lHDsOM1eKYcvi
|
||||
uNyHNoWcZjzoSuxKTsx5TCc+f/D6UkjwjM2e1bFVv+KbrkRJWmffT6yTWtI5Kb/D
|
||||
KiGiWsiI/AfSgOx91d00iP4UHloH+Bj92pBTiXyS/JM2mKXMuPMp1SG11WFirhvP
|
||||
vhv8AtQ4deSkx2Qu2ofMRWkWc/ep999z1tI+z3vJHca8s6V7kykOUDB4kVNG3Af8
|
||||
7N3dBOLMdUXyZRxwaanX8dR7S1zD0AAhXS939dZAcqUZkHmT3BdNM+jYMTQd4hes
|
||||
bCuKA7V1beEhrHH4MSiGsc77h6SRvOdYf68OlnVS/60USH/HnG1KxDrZj2LvL3e2
|
||||
twIDAQABo1MwUTAdBgNVHQ4EFgQU/PK5Ttc0H3rhbC2CM1yz2k0AWkIwHwYDVR0j
|
||||
BBgwFoAU/PK5Ttc0H3rhbC2CM1yz2k0AWkIwDwYDVR0TAQH/BAUwAwEB/zANBgkq
|
||||
hkiG9w0BAQsFAAOCAQEABqYTJq5koRr//p3FkVKvB+zG+DBpklr5PH4T3LLT5kS3
|
||||
dBOP3bzMBc688io7sJGMF4+pCCklJDdIjJniz3GWhYgl5fddR5NQhr3w9OwXpYul
|
||||
+zl4BBzIlGLzEnQaDjq/LqA4hpPC0zw4EeHPpMdrKrVlb0ytwgxYis+/ih5zZ5U2
|
||||
qsStB9VOXOJLJuxB+1F0tESnSbC2m5DoyQ1H1Xvf5FuMVRqJE5B+AFjn7FBchI5C
|
||||
sa3YV/VAsq/be0H6nR81SjSEXKBcpx/4SiEzaII5qZWzSptTHIWonI4D+YSC2U5e
|
||||
Fcn+swamrdfbR/b4y+PePivO3FUfbFPh7NWNWWWuQA==
|
||||
-----END CERTIFICATE-----
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCZcezA682KN3ll
|
||||
Mo0uV7Nyy2xpDKsf7HQfYvZgGcaFMCtpCfF15qsIj/MQwST14s3tyW2KpR2dyXtN
|
||||
/akihNS39g0OFx4R9eeSDQUWFkb9DBAXxewWBW/9shxCpCieQ3kv/eH35Uh4NXcr
|
||||
mpdd4hiF1SZrMqhTMoREquIKrUVG1XG9CHjArGuH0gpEI86RzNGoeLqvzbBKjWR8
|
||||
OjgKSEHnsrrU8bK7+b1NrjyGriBH2nhLhaepH6q27IDny7WsLHrmFFE7Ah+03taQ
|
||||
uzDGEM4ZpWL2s7mFlyWgPrFdOWY8hJmke8kliZqoZq3RUgPnQ1aLs1DZWOtAF2eD
|
||||
7eIV5AprAgMBAAECggEAOz1Z53NB45IeKl0VV2Zhb7isbnQHHuiFPlbRAnIBDAt4
|
||||
PvGpSFjZABG/B+FhWRKKaTqCMWwknnWaRpZfNWXtz+XMzXtMTyfOErs3EvtfxbLi
|
||||
BaOSTUAlJ98a/PluewdWopoUIsXgsBQIIYvp00OGLykGz4z7oj8XBIGqie+yFrGY
|
||||
wNmbkj11Fr82Lxk5ECebUt9VS+RTeSQri2Q3S6nJ//xsyVz419MeoQosjvk8bGy4
|
||||
ZF5BP42sH5/Xr55SZvGSlMpR3Ai/ZWJJ/ziQ13ynVnx+/1ursIlOlXnaf1K0ZarP
|
||||
HpzMED/iMm9KHVbGsuAxckYUWS6QdwVpEyAYMrKjXQKBgQDMJXujbpQgX/GZBays
|
||||
IeXDFVkpWDKKq1eyLjrFemRvugJsgq0w78powlh/esl0ywJT1zWXwIIrobNV+eUV
|
||||
dP98mbMv2OfMb8+6gJw+vz7x/4bK6TbtwHQNqkPAJ27VWMJIC2OSEKSJkCVp9pkI
|
||||
SNcFxNzpRkQEYBNAT5boWnuwHQKBgQDAa5vx/dO4gPUZUhmpuxuW9c6yts4KsC0Y
|
||||
JtA3A5FiFWvmjbP60NMI1weNATshCBoEcK8YFLM2flgpNaroygISmK4Z9UXVUeG2
|
||||
ImX7rHDkDvNw4eXE/nXkkZxMhzQat9Mged3Fnj8ywQh2VOiMD8FzMsp/4qkRakzE
|
||||
1k0ywlMuJwKBgQC3vXzciihUQ0aGPe8+Nnw/67UGW1WSLcmOm8FWAGTpknegBrWu
|
||||
+AQr6dARXQh5UEbWAzs/TItcjfuFhJfFijpxgT0f8ZAgFvrWl+8JIsSatyww8Vr4
|
||||
/mD186trBZLh/zNN+MIzszsEfXLPPp5aMIUnshpK821AquBo37mpg9cTmQKBgHMF
|
||||
IB/EMbXdaCVtnSeHUBOp9ZeAjKN48ku4j8gC2vm9glU7qTUpdKyZFMtly/mPxTWY
|
||||
QiHr5cCSP5LKoNIsRpblK1Ua91ZvbrOX1kxdpNG+WijE77sUvFYX8E0SmMPL1Gla
|
||||
T4XcdTyahLtvP97RYDrDRqaxT4y4dRFIZLcNz/kLAoGBAMZOVp1eOppL/btFwFUz
|
||||
85PqkrfCshaqGR+DarQaXY9q0pijX57MD3kG4d61Fe/ZDglvtuMPOfa/6UVqQ0xg
|
||||
Zo+4VeqV7MuESERXoQJXY/EuJU2SQoroRuf/9WvuP6fTRZBiOcKHGQ24Xnhq00bZ
|
||||
jfiJvUDtVX2P2Zq+b9MjUda7
|
||||
-----END PRIVATE KEY-----
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDlTCCAn2gAwIBAgIUaUXeUZypaWNhAf4NeHIx+WU3/iAwDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTg1N1oXDTM2MDgwMTA5MTg1N1owXDELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEYMBYGA1UEAwwPd2F6dWguZGFzaGJvYXJkMIIBIjANBgkq
|
||||
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmXHswOvNijd5ZTKNLlezcstsaQyrH+x0
|
||||
H2L2YBnGhTAraQnxdearCI/zEMEk9eLN7cltiqUdncl7Tf2pIoTUt/YNDhceEfXn
|
||||
kg0FFhZG/QwQF8XsFgVv/bIcQqQonkN5L/3h9+VIeDV3K5qXXeIYhdUmazKoUzKE
|
||||
RKriCq1FRtVxvQh4wKxrh9IKRCPOkczRqHi6r82wSo1kfDo4CkhB57K61PGyu/m9
|
||||
Ta48hq4gR9p4S4WnqR+qtuyA58u1rCx65hRROwIftN7WkLswxhDOGaVi9rO5hZcl
|
||||
oD6xXTlmPISZpHvJJYmaqGat0VID50NWi7NQ2VjrQBdng+3iFeQKawIDAQABo3Yw
|
||||
dDAfBgNVHSMEGDAWgBT88rlO1zQfeuFsLYIzXLPaTQBaQjAJBgNVHRMEAjAAMAsG
|
||||
A1UdDwQEAwIE8DAaBgNVHREEEzARgg93YXp1aC5kYXNoYm9hcmQwHQYDVR0OBBYE
|
||||
FAMTHGTK6fnv6diwU536UPAmECzwMA0GCSqGSIb3DQEBCwUAA4IBAQBG4V1+29CI
|
||||
Ir28WZuoMCzW3+HVViKC1ZVLyNFzfF/6k+64Oax9VDE9bn+cvuECfcud5KoZiGsB
|
||||
vDBHaYC88D90sdMbfdP1XAB2+ZXNiZGja/zqb+13N//pUWkNRbVqnvWoVaRuPD55
|
||||
XQXDwxzztRPv1noy1jPou8hyybAC74IKYbjO5OyYgOhj0sWf94rf74JnMoJJfflp
|
||||
jKF79J3xBdJIptMh5gckijaHO36Wa9cmWoWBGb4/lEqq+TGA6y3ynd/DT2iypHgf
|
||||
9jZFc9fNP1abwVbFQnDYY3gODjTGN22AT1TUoCZ0t3RMVsNyfwpoXIwuVGZBmlWq
|
||||
UPMN48jNLSFl
|
||||
-----END CERTIFICATE-----
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCa+qmbhEI/pAOe
|
||||
tMGjhjIdiCeKGWTfDbBL4bef9RP+5PIEXS7msYnvjiwu7ayOR8EoZ4UXBdxOUdq3
|
||||
Xlp2QXKqgHHs9T8KaJNny0PILMkliqTvDbccgB5DSTGcbK7iI8tI5CtdNoBMSTlK
|
||||
PaZkgcHfSYQ2u+dBrIdW5iWtS8/BhCq32Tf9scDR34xvzlV+X199yMGc1fPQ5eo4
|
||||
T0MVnx942qsBQMw1mw+2kngd83dDkGUp2jgxkWEQ7+yIG4cWrMqhEfH8XvHShBe+
|
||||
8ryvwA4x84Sy/utCd9+JsOxx4mdVmsKVyDRk4Wr6xL5XG29ECyU7Xph7PHhagP6l
|
||||
1jHqbrEbAgMBAAECggEAA3nOC6tb3a0yLuvd5erQvUHRpTLBmju73E/RJvi/pzlU
|
||||
8OJyzAC9AmQ9ZcYLLIZmdMoG6EfHiPLOsCB2cJgyLVRuea0xv0GDgNHvEL0UZnpQ
|
||||
Dakl61viPInBNOwTwLBN0weEWMsBS0oJy2T2POMoySG5zI0f+CSZmnTUm9OLSCCY
|
||||
8fX2IdeSqHiWx4Gfnc7J0OnZxq/XfdFKIL8aKKdBTlqqhsas3J6jaJsp7xjDJFP4
|
||||
3Ut0L8QLPIQFXepAOPNICgqE4bxnq6OPtG+P1yNOTCROqP9hqHJwSsTAVT1EVsAI
|
||||
EX8mLL3sjvzMWNA+yAPH4MUirRsTMMWStkErKg63CQKBgQDJPWedGS9+0urvPrBg
|
||||
KmtwEkPmAhVaFXcfVd2ZJTMYI8f2Jvuxp/qmubmR4A05Ba7E/BGH2e16zJm8EbVi
|
||||
bT/+MYH7j6nphUbP2FZ3MFjoE6BolWDhsqkYbaGajHMCaHb8Dml7blXCyKnMLquL
|
||||
E+9JYoWFJxdtYtKilXR3otXtgwKBgQDFJq8+rNNzIhDQnQC8CcX2Q7ij5Iz1DmeS
|
||||
8Nwn5/1hTQIQpmPvzSPunsEPaqByXFdUqLEt4VbM0+xuTcSbLZcB6F4icfC7FDdx
|
||||
wpGoN4hW5R7sKn+lj3FLU38IKoixeIbhZ24bTPlykSO9xYWWhWl4TOaGYjVr1Rdx
|
||||
1g5JHgUyiQKBgQC/bqlNGXND+tJAKmtP36p6XvW2LI8xNbAu39jAYVG8ifUjJKxT
|
||||
sM7QoWZ07STG9K/vdTYb/GRbZ5xq+pGIgxLX9TKIIn7oxL664zpFgXlhs6HpOwiB
|
||||
SxpuQYP0Z9zUEpn1ZqRTJX9xnr9fm5nV4G3FanJHWwt/I/3pabD0SbOljwKBgF2B
|
||||
Un6MY6Fol8cJn+6PSBfb2LfKz1vu4AreN9ypeBBtALy63g0/I3qqSvCv5rc2uqjJ
|
||||
dXdIN+3f2XQbaFMdFVDvT65Qkhd4qC9JU+IPrJdiBf+GzJHObbKHQGm0Gq7pdjdz
|
||||
4dIK+QhwdB4uj4RrdDF9b5xu+d1R7NOt7YqaNWbZAoGAcZoLBl0jcyRQzPwBKPxq
|
||||
Y5l470WBgKD4P1dSQryVccwnn5bquCqRgpn8R5DsMW3416IiekUWT2Z/Wxoek6rm
|
||||
FJV/N0Uddom/V8lkyOzhnuFmk3ymez33WyxCbrRUfdECcf0Y9usnp1zJyuxqsOwX
|
||||
2H8NK/j+9Gsi7diskZN4pKU=
|
||||
-----END PRIVATE KEY-----
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDkTCCAnmgAwIBAgIUaUXeUZypaWNhAf4NeHIx+WU3/h4wDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTg1N1oXDTM2MDgwMTA5MTg1N1owWjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWguaW5kZXhlcjCCASIwDQYJKoZI
|
||||
hvcNAQEBBQADggEPADCCAQoCggEBAJr6qZuEQj+kA560waOGMh2IJ4oZZN8NsEvh
|
||||
t5/1E/7k8gRdLuaxie+OLC7trI5HwShnhRcF3E5R2rdeWnZBcqqAcez1Pwpok2fL
|
||||
Q8gsySWKpO8NtxyAHkNJMZxsruIjy0jkK102gExJOUo9pmSBwd9JhDa750Gsh1bm
|
||||
Ja1Lz8GEKrfZN/2xwNHfjG/OVX5fX33IwZzV89Dl6jhPQxWfH3jaqwFAzDWbD7aS
|
||||
eB3zd0OQZSnaODGRYRDv7IgbhxasyqER8fxe8dKEF77yvK/ADjHzhLL+60J334mw
|
||||
7HHiZ1WawpXINGThavrEvlcbb0QLJTtemHs8eFqA/qXWMepusRsCAwEAAaN0MHIw
|
||||
HwYDVR0jBBgwFoAU/PK5Ttc0H3rhbC2CM1yz2k0AWkIwCQYDVR0TBAIwADALBgNV
|
||||
HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWguaW5kZXhlcjAdBgNVHQ4EFgQUi5Pi
|
||||
BFtookZvHby/raO/4vHTARAwDQYJKoZIhvcNAQELBQADggEBAHWCqlnLe86tlxtB
|
||||
5EZDCpVoeGZtOSzSQ6mAVirtcJKCEy0azDVA7RygRa+A5PCjrPAsjbllCCb1T5kw
|
||||
zc/DWiBwnkR6m613LPgcL8wHSE+F9MLEV5CuAXKiVCU+K8a+jDC06Ac6nQTScdSs
|
||||
cFSEt7PIcY9WFwaD+BXnSdmP7ntQisrTmtHpGtJfW466q4Z4GgYU8WU8WZn0gDBF
|
||||
M5MEXgnqvGyRgEMrj4k9SLxJ6qOWMZt34Nq8s/N9pS1AF2Gcw5qZ7/OXigPDcowZ
|
||||
JZL2RQ3ggzi3kdFHN2dP/7Yu7HpgTkwszm81H/0jly/HwgpvIy1Dj1xvypLC+gvu
|
||||
Swxa47Y=
|
||||
-----END CERTIFICATE-----
|
||||
+28
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDQIOxmML0eR6D6
|
||||
elqQ0AHAtOBdHbSGTOVfmShaHTlYunflWLxQxgQlVXinnR9xd7GPIykitf8aZBcR
|
||||
L7bG0xC4U9pz3dIqTfsqnkur8+1mw/o9HmiqdNnYpZm79xLY/HlCGpZ3gUuvh+uI
|
||||
Hfl/GIT95+tY1W9Q1DCMqAi4FTgkba9fuqTRY6PrpL7bvi/NsE1MEUEbf5uukclB
|
||||
/Ow6nOYZJEqxgKxbMDIGLBIxs6PE/KNfefxFjnkol5KNn/IoYcQfMf0/uu/ZCMBN
|
||||
MDOtY+s2maVWzp3nMHDjNtc6AY9m2KtSAQjbUCf3wbKesP9qajrkj8leIpxHxx3a
|
||||
q8OEBXnzAgMBAAECggEAEC6XIsTkV1/bWM49j2fU0w5dKXA/UnfVF685T3RZOphY
|
||||
7RiOn7sdpGd2V5XkVXaodAgYUS4UVRF2J6xtihzr/mDqqbqT9h0VC7W+DXMMQMK5
|
||||
CJp+Kc6nB2ysvMwTh5JtvSGDFGyVnWK0geNOvD6ETJeFGWWS35Z35d/EucdQk6hd
|
||||
goKKYOl/FOqMTzI5oQmcB5bpBF4h6edbxs+xCdVhtdl6TBcMiBVfCyCqn0H9GKWN
|
||||
6xoCIBK4sV1Hnc8ARNYoj+t6VWac5nWXBhTiYAgXzwpNsJAGf4DmFoGx3xra76J4
|
||||
fn3eajxWUqxCJWAGVGL4jbc7yVUiX2ukmJdCA3LJzQKBgQD8UYPA7NHsxnd9CXFy
|
||||
bAIYPt9C7n7uFON6oEatnlLJFRcO59ExQ1JKGB5faeJCiASpP79QiRl6MhB7wnzi
|
||||
AuqN8jSMA5SofiZGp+3HrrG0cl2RoKn4BKCjP/XrRhq7rOOPRxh21b3q4LzZfTHe
|
||||
D9aUFkjBJcWZM12uGg21jDq6fwKBgQDTKli1JYLeo3mCvrRLRbwe1dVYHgYDvFVF
|
||||
p74KFTjg8RoDKdp0lJfwmK873YQkfZ7Y6D4JwcpKceT21g7wGeOPZhYSkCEJ4dsk
|
||||
E9fdN0S5FV4HKHrByscwUIsu4g4QEM19Dwj66yHSoUbFzoQYA3hMdtHSNVpWxwp0
|
||||
yjIOvH4+jQKBgQCpVc+Vl5ofTOb+PGstvnz9ZpyRn9wBznUIZC5q8LlgiE3sS/ni
|
||||
FOtSHLOtlzMpMX3nVIgB9bDqiFT1qgYD7K8bynQnj3OiTN9FRghXnc9XafWP+YJ4
|
||||
mCpyxUc2udrRH2utSaqKflIyIte7IsFn5bs9sWLsdXwSoB177bJLqCv14wKBgCGc
|
||||
CNh0KvtCq7FqpwmgBMwnnrhStwRbMntOsomqTQ5Icap1O+b4S6KouqNdo42nTOQb
|
||||
OtyUspzcueOruF7wz+5gAj1cIVYQU6/PVLlJ9a87vmaHQ9qaas++0hhZNIHMGti/
|
||||
zt8ZE54Ru1D6iL3Ft5z8AHNjuIg9T+W81PDRgYp1AoGAPH3Ra44JM62ADGUeYgCL
|
||||
Fr9FqxR8mfv5ffjAEhJjxWSfz0z7k+sYDyhNa7VQufnA+eGDuwmMliNR5wRbpFjA
|
||||
u7TF6osGWnteiiBRN3twTPFgPb1sqenX0xpFj9GIctxyZQSkZB8TZtG+OzxkF4e/
|
||||
INPUwhYcaduu8Hqq4TVOJPg=
|
||||
-----END PRIVATE KEY-----
|
||||
+22
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDkTCCAnmgAwIBAgIUaUXeUZypaWNhAf4NeHIx+WU3/h8wDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTg1N1oXDTM2MDgwMTA5MTg1N1owWjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWgubWFuYWdlcjCCASIwDQYJKoZI
|
||||
hvcNAQEBBQADggEPADCCAQoCggEBANAg7GYwvR5HoPp6WpDQAcC04F0dtIZM5V+Z
|
||||
KFodOVi6d+VYvFDGBCVVeKedH3F3sY8jKSK1/xpkFxEvtsbTELhT2nPd0ipN+yqe
|
||||
S6vz7WbD+j0eaKp02dilmbv3Etj8eUIalneBS6+H64gd+X8YhP3n61jVb1DUMIyo
|
||||
CLgVOCRtr1+6pNFjo+ukvtu+L82wTUwRQRt/m66RyUH87Dqc5hkkSrGArFswMgYs
|
||||
EjGzo8T8o195/EWOeSiXko2f8ihhxB8x/T+679kIwE0wM61j6zaZpVbOnecwcOM2
|
||||
1zoBj2bYq1IBCNtQJ/fBsp6w/2pqOuSPyV4inEfHHdqrw4QFefMCAwEAAaN0MHIw
|
||||
HwYDVR0jBBgwFoAU/PK5Ttc0H3rhbC2CM1yz2k0AWkIwCQYDVR0TBAIwADALBgNV
|
||||
HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWgubWFuYWdlcjAdBgNVHQ4EFgQUgCtN
|
||||
4MfdT4L7AIb/7O+dYuWFRGUwDQYJKoZIhvcNAQELBQADggEBAKkf4FPQH93Auc/F
|
||||
ui2Y4df5L9PTihoKXcFfiFUb1d0fCZra96b8dTVlcQJt8PdYQOpndVQbj5J/1qLP
|
||||
/ogpe43304g46bMEhvX79z3w1ZgFmHn3TXd1pG2LO4VT6ULQ1/4J8UP4Mc8Sq+Ip
|
||||
gpSscpwNbF/9+1sGRYH2KB1KivTFqRppKX6YmK722QHqJEL2cLimUjJfvuqTfEGR
|
||||
KVNnbJPgsLOcAHtnKew82/uWl14DeoiA6gfYO1rTJSjvqWV3eE/opyTxLbxWYZFb
|
||||
YFKw8Joxp1zovoxvJ6tii9MjGo/cg3BVoxYydFklwd2CtPtnjPdGZPmdHoXPvt9L
|
||||
ziqxi0E=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCzLfw3OkK9yfCp
|
||||
FWxFPRwWCrFVasYmM1q5N0SQXx3aMqhfKSCeGP9cso6jvxbmPhobYJm5FIOuu/4q
|
||||
hkyMXngROxa0z/PdgEoJQCfNgnU37by73EDiiXeePyfchqoBpN7o6Fc8cojwrMyw
|
||||
aodvzG+qbaEdEer0IWw50Ae+/qJz0CEoz9vYRxiD+WoSm7svm2u1cGwrAECa3VhV
|
||||
4hUPcUa5+PS2/Y5W0IVqLPCz94uwxvsyKly4iGVC5JZ9GteG3473aZwwNnsuoPhG
|
||||
XlmwlXM4/ipYbAyUjDCyIoMbSj9l2Lemc+Bl98MOz6hwd7TxYw8yZvkHTAUdvDe/
|
||||
T0SAgjyDAgMBAAECggEABjLF7mFhkh5KsBXP2z40KTDRDvdjDvV28RXBseItyxRS
|
||||
36YVBBv4YJpSA/5URrAQK5Tykb3Q0iFGt18195UglNgDVC7Q+w2ALNKi4y/AlIub
|
||||
f80QE1RWETZ2FowzzVulY09w8Y7RMlsWKZ7UA0C7NtYU62QTu1Duc0ikyi1OnrBI
|
||||
xUjGg/EqQsJnpQGxBnDtvtN0uwOTrlAT2jx9UXqevXgbblB+I4lokrZ581+s7kJH
|
||||
1K7hrrP2Ve0KReqzduxkBepjvffNR3iDz++WkkXcIMHleY5/uH9dizitx3AAbwIw
|
||||
mTmxyCMzXox10qjqMHvT/totohKUGBiUtQocKPx2IQKBgQDdsGKuaCg/o+GZhNBd
|
||||
SN82gLyGfSufM1aGvFD0rlLJYIGhUVdCvKzpKv+mRQc2ceAOzlYH6IWcbR8+bNN9
|
||||
SWSvczRJLbuXMozz/JvteiOo8G0TGOSqHFLo6Rc1EqEuJAzxLj0q+18QjWdrtTLq
|
||||
l7zwGKscakG9tNAFpZ0SmpTB7wKBgQDO6VJM37h4LM2EvR6ls+1E12vhPBLojkw1
|
||||
KLWphE5+PiT4CR1i4pvk8/RnrwsyzN4bB5T65o89J36PFcoh5fi1ZpOwHW5t0/pA
|
||||
dfDc6+tfCoI8C9cJWhCMszaNgZviCww1ZaMFtVAvBVDb0iVHJ+/94Cz6GDk1l8VC
|
||||
x6y9Xg2yrQKBgQDcYiAH39W7RnDczBLT2cDFDv/b9w1pi4DGGumkBLSaKw1TUGie
|
||||
GLEQb0WMhmzgLB6guXD/FaHV2wlHZqpsj4y/epiM8yDc80z6tLJSR6yxoqncZU/U
|
||||
6Klnj2kZwrZnB0GyddQrKY/dBaW9hnniiwwx52QbsGpAbEKsinJ27yNZEwKBgEU6
|
||||
LU4JICgdHVoHCIT6US1SQgbm2ZCzY235w+YGnViBpE7Uhd964BvXP3OdTkrd3oX+
|
||||
oGrdzxjv6NkouitjTTYsLsei4TqfzL/adg8EZAi1dGNwtq6rUpQwtdTcg3I6rggD
|
||||
jGqxgjVpOueBRPWsuBAh/AplJmb284nnUrU9Dao1AoGBAM4ldSzN3SCst0Owc0xx
|
||||
SzlX8v9xWzsL292eRSnzDtPuvdKvyWlke8XdkC2Pi1AoVNCOFCn0bcjXtN0XLn/e
|
||||
MwF9j8h9wG7W21nCJLflUG2RXRV5fWHBvP6FhKLbQut7wJBf5EMOBPK6RkUn0Vs7
|
||||
SrT3ZxQ+uwY5q9jjMN84bJ8M
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDlTCCAn2gAwIBAgIUEO25S+4jYn8uga3bnRiVBbdOp7swDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzM1oXDTM2MDgwMTA5MTQzM1owXDELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEYMBYGA1UEAwwPd2F6dWguZGFzaGJvYXJkMIIBIjANBgkq
|
||||
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsy38NzpCvcnwqRVsRT0cFgqxVWrGJjNa
|
||||
uTdEkF8d2jKoXykgnhj/XLKOo78W5j4aG2CZuRSDrrv+KoZMjF54ETsWtM/z3YBK
|
||||
CUAnzYJ1N+28u9xA4ol3nj8n3IaqAaTe6OhXPHKI8KzMsGqHb8xvqm2hHRHq9CFs
|
||||
OdAHvv6ic9AhKM/b2EcYg/lqEpu7L5trtXBsKwBAmt1YVeIVD3FGufj0tv2OVtCF
|
||||
aizws/eLsMb7MipcuIhlQuSWfRrXht+O92mcMDZ7LqD4Rl5ZsJVzOP4qWGwMlIww
|
||||
siKDG0o/Zdi3pnPgZffDDs+ocHe08WMPMmb5B0wFHbw3v09EgII8gwIDAQABo3Yw
|
||||
dDAfBgNVHSMEGDAWgBQe9+49H4XrSFxTrm+1QJmwqBxBTzAJBgNVHRMEAjAAMAsG
|
||||
A1UdDwQEAwIE8DAaBgNVHREEEzARgg93YXp1aC5kYXNoYm9hcmQwHQYDVR0OBBYE
|
||||
FOhA2S6VZLZ+9HLvwp2q/15tWWriMA0GCSqGSIb3DQEBCwUAA4IBAQA4AcoCljOx
|
||||
HE09IZxkFk2ESNF0q0fjv6FXb5G22rZfrjNGxsle8SRy6hlBtJ2N4Tuod98wtdJP
|
||||
dNtvnZ78pc6fkQcbHuoqjJpfpwZD9AjAawvUwRQvYz/ndXw7PypNG14xUhnidhIW
|
||||
1pex6Ceao/vD4yrA8XPWA/1KmThPxiXkXgNg24XxvGz+ybUahauRmrrKdnd60nik
|
||||
0mN8txFOD/myjj6+oXw/YwRwwAvTXmarTJKs8JyZ3MWJQN2by6eTm+vqxZmRVAF9
|
||||
pWNG6pmblu6S0t9Wq8SzGAA5ilfFdETjLEx8jB4G/Fxb5TvxdNnNWuVV1pw02RJ1
|
||||
ph2lJjGORmRu
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCxHoTdbep5b6tY
|
||||
O/ROcmLToE1HUn2JsnYLuXmJUZFlYG6Ww2+wUmcD36hmuZ8mWPDpKqW2m3O9rYE9
|
||||
H7k/FDVU+4h1ToPstlgHESNX+gbwn7iN6i2t6D3FgdAENZ7+t8UVz1hi3ClA8IzV
|
||||
pQ9PTY+ST16VhCCzKU9VvDYbcDl3IWj1kA2R7jKmYVl5vqgC8ywHpEzLUcKP+/gK
|
||||
nnJT+H8MSOjQUhBzrMkDHB1Lq4A82U9nhZWOZBeEz/KAhG/IG+lUTMH3P0IbhEwZ
|
||||
NeztJPylfjyTemOCBnXPhUbqltrfqU+lMIStPLurH2V9hr8c2aa97+/XjLnDM/bR
|
||||
aAtkWV3FAgMBAAECggEACqrG37sd8wBZtm+t8AeNkidGYDREoUVhPKWH/1AtTIi5
|
||||
QFU25cygragLsVwejKWwpKpP3qaQGu1XKkI92uGxsJORjVcUNO5qcMqEcWj6gAVu
|
||||
jQV8iMvC5KFD0O0VzUtuEDkznoiZ53JVWQye1mzaZ7pl/OU/PusO/x/dtltU6qq7
|
||||
eIQFUDCvqdZJ+XxJ6tjRx7wGqIVhdaoq87W+CzTxgBSNyWEZ+6YQ2ToiF0e0979B
|
||||
mQ/PdGmOjhzsZKvv2YiK9sTU/0yIV1zNrLLx6Vk7lYW7inb0krsScnnUSvzg2C06
|
||||
wZdmqzIuCPzkSLBjZ/AdWlRhN1virf8Ryafjw+0oQQKBgQD5zRJIL3djXpFybQHp
|
||||
hYhhXvzGtGoGCJ9yugJj9r9Wo+9JPSEMs14x/tHa7PMVCswE5xqDgdtqIRtPtQmg
|
||||
SObZ1DEOkHwWNN1o6Pfejowr95WENkN6D03JZdNuHb7+9bsyoxvrw8BaaIz1upoe
|
||||
hWmoBn13bfGso7IDaT0Pv/sicQKBgQC1g7dxLvc9oyMhHRCUxspJ8R1ppUTgMs8W
|
||||
WTDcCVxlPoMkWLIPs5dlDlgu80LxOvzskIqwOf/kFly39xvSlGQNJTBGwOHwLBtf
|
||||
XJDoJfcgBKueV7vvoVA9A4Xzuoqv74DUYJIEvAd9Ak0VkbehixSW2Q/IqRiub6AP
|
||||
P9imK1hylQKBgQCSP1ahvnB2U+pxhJJnBo+2+iahqwSbrba0M2Ss48xXzDiOt2Q/
|
||||
DFBsktSICMu0GRMjF651KbSs6N8VhlcxaR0GkO17qmmLkr3B6wsbWHeGUjhOJHrS
|
||||
3lzbOWtUf8PPf0xutAHnwT4/cBB+2RXcIp2eCtav8kVYnqncx2NBclN0cQKBgH1t
|
||||
JQd68rGO1yl8kgacTxBFIpPr9eoOcfb5br+9YDE9vxUQjQo4iTb1cI4Q3oMexcMa
|
||||
JhucGGyd3zfn8zvR+kjzF6bshbOWZtvAdQlVoqxnTce+zEjL6Uwf8SH4Fvl3wEgA
|
||||
6yWGYI5LVsS+ymtAVdve5f88iaePzsR609QPQ7D5AoGAMp3Vo7xWVV+4OPAc1nuS
|
||||
Usl4XRhw5q4VcJme+7TP2x++cH84f3eDFTLDbsKHe16hRRwRwSUjLopkpu+Cm4/a
|
||||
04dtCy2qmt5FqG8OFBjwMUBiw8dflym7RzWmxCrhB87PeMKkOVgE8w21T6+olvDG
|
||||
w7B2JcALXtaQJ4DAJDUMbgQ=
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDkTCCAnmgAwIBAgIUEO25S+4jYn8uga3bnRiVBbdOp7kwDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzMloXDTM2MDgwMTA5MTQzMlowWjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWguaW5kZXhlcjCCASIwDQYJKoZI
|
||||
hvcNAQEBBQADggEPADCCAQoCggEBALEehN1t6nlvq1g79E5yYtOgTUdSfYmydgu5
|
||||
eYlRkWVgbpbDb7BSZwPfqGa5nyZY8Okqpbabc72tgT0fuT8UNVT7iHVOg+y2WAcR
|
||||
I1f6BvCfuI3qLa3oPcWB0AQ1nv63xRXPWGLcKUDwjNWlD09Nj5JPXpWEILMpT1W8
|
||||
NhtwOXchaPWQDZHuMqZhWXm+qALzLAekTMtRwo/7+AqeclP4fwxI6NBSEHOsyQMc
|
||||
HUurgDzZT2eFlY5kF4TP8oCEb8gb6VRMwfc/QhuETBk17O0k/KV+PJN6Y4IGdc+F
|
||||
RuqW2t+pT6UwhK08u6sfZX2GvxzZpr3v79eMucMz9tFoC2RZXcUCAwEAAaN0MHIw
|
||||
HwYDVR0jBBgwFoAUHvfuPR+F60hcU65vtUCZsKgcQU8wCQYDVR0TBAIwADALBgNV
|
||||
HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWguaW5kZXhlcjAdBgNVHQ4EFgQUlR0c
|
||||
nRgkuXrBwGz/x9wVv84qs/QwDQYJKoZIhvcNAQELBQADggEBALnKkXTP+5NxVaPN
|
||||
lR4+abl3qFNKj+oYoHAvX+TjrTzj26dF8ZvUgXNRTvgGJd8UyKe6hvGtfJOZWXtx
|
||||
bDimfBDCmHlWjgmonHLCyDmJMOsjcy31ui0hQD8YvP/fUKkbxzcq3gse78Ox5q8g
|
||||
qZhpnkAphOH4Uko2EIID4q+zAvXYO6K0YjPIqSm9amWDp1Xa5spzno9yE4HKgyci
|
||||
xJlaGckXAr1bxjXRTpIczSaqJJyg5GuiaU70HNDnFZiVqzW7PjOONNtJHo+2lTf8
|
||||
m7qRw4pXkOBv3J4m1GRkJ3krqQFRkxroKWIW3cm1mozvcueh9fpEdswLUYfwGCxt
|
||||
jvGLn0Q=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDkOPY3id/evBCe
|
||||
CKRwAOOy5f459a1Pdaa9wgT9pV9AWcBMVNNRTWFj8hs/SkMPD7YAe9gcToTkRqWW
|
||||
JEWt0ISeuR9hZ1S0P/mRjdvZdqDqRN6+RioznEw+pB3E/FX5d0G4U5trGbSjQGz0
|
||||
fjnmFLEQUg2SkGRz9+4cxyIyiyZvgxqatK4G7XrJouZazHt/C+e/nPxmYGPgLkOP
|
||||
hPxuPBBRRRWswJ0t7zkj6wjxDNsQhz/WbHO5H0/7KB7larI2E30RjyjWZhxJBY1e
|
||||
HXT+TMxTlvEzMefCSf4TblozYRD9qS5FpvjjpieL9tAHjepDjseQQRCM3e+EvDJJ
|
||||
NCbkuWuRAgMBAAECggEADOfTtIxNZpEH94fRlKvYNHOhDrH/3PBwP2bLVXSWkFMC
|
||||
9s4NLRnNGhPEyq1uYVmoFxrpu6AND8OW9YiTkCKsfTVGuwFW3uKHQF3fQsrciqLe
|
||||
XbAmDskV3qz1KgCC9Bp0UvIXZdUMS/cGskS5DXO6F4wsTE9x/sTUaDgyjN0ljUSn
|
||||
U+cWNtWx8R34nZPdpJekYRGoidFlDgOzPK0U3CNohDrUDKNozp1BXQ3IIq3D3cvR
|
||||
5EyzwwXZG0eDsvRcgfEt5e5RP652u1XBEJhFW2WGraK34P5jtdXpNAKt7JaIJAC3
|
||||
79ad+OO6dptR1W4LcaET/tVJjxINPSWrFoiFgg9igQKBgQDzwmjr/T0FvZ4+ixup
|
||||
LbSs/uKS30hrPPuSXRO02kl60eaOoEpHamMwE6qU/oZah9fnazj8HY+XnRMqD5b0
|
||||
fKgKpPnW0qKQP2gTcbDSejC77iyErNZLROm/io7XDhitT7oMd43MMcapgHej5m6i
|
||||
lShZ79u/dS8HkunNYPisbfg8CQKBgQDvrtIsj23QLDbS8lWOLQ43hrNkun3ebdF7
|
||||
tI/YAMtw6WD+uijeZZkGALMJ83/VQLprVm/WH81T/VS3Uv2jl5fxlm3daZp8lAMh
|
||||
V62SGUFcTQELstM0Tkqe1Wsw2zNW7qtNbGKMMYxePwsXoXnZUYY6yrh1ZwK+jbxF
|
||||
8lg2LOslSQKBgD+NvYth0Eox4RNPc5vNZeEA55QBkUEcej7z85Jgo23ZUjJ3ikZK
|
||||
b6f2SLBmGCN8bYdRxl69WlXeR0PdIq+F3M5Bqz4eVvIjBgCj0MVfxFsLQyIoagrf
|
||||
4c3l004wx7BQLCLZ/OdzRuekrgzWpJvRJd8lEXc+l09zN3Ary0oxtdn5AoGAE9kD
|
||||
OINsEYgHxjIhGZPrkHeMFXRIBgpMBZVvL/Do5+G7kXxy8++v20pliRZr6Inipg7T
|
||||
VgTuKN1ajY/Gxyw/fdb6JBKho11SYQl0qxuCSRVrV7+oM7WkAkEkDjioqLM85j1q
|
||||
b7eOqyNHVN6fS3qvxeCRo88y7/qms5gc6+eOVVkCgYAHOqBwVXFMFEXuBGtB1eVW
|
||||
Zuj84RpA/VZbZpiGpinBHbp7dYL/Sl43Ff04jnBEIa+ziSShtbN2eZyqWGKAlepr
|
||||
p2yIZTdpYqq0i1d2+2NI8Ed8GbQmrwy48uqlFqsKACX2ixSkzkYliA0By15wsTD9
|
||||
/WoHpR3j0H4VeaBS8HNygQ==
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDkTCCAnmgAwIBAgIUEO25S+4jYn8uga3bnRiVBbdOp7owDQYJKoZIhvcNAQEL
|
||||
BQAwNTEOMAwGA1UECwwFV2F6dWgxDjAMBgNVBAoMBVdhenVoMRMwEQYDVQQHDApD
|
||||
YWxpZm9ybmlhMB4XDTI2MDgwNDA5MTQzMloXDTM2MDgwMTA5MTQzMlowWjELMAkG
|
||||
A1UEBhMCVVMxEzARBgNVBAcMCkNhbGlmb3JuaWExDjAMBgNVBAoMBVdhenVoMQ4w
|
||||
DAYDVQQLDAVXYXp1aDEWMBQGA1UEAwwNd2F6dWgubWFuYWdlcjCCASIwDQYJKoZI
|
||||
hvcNAQEBBQADggEPADCCAQoCggEBAOQ49jeJ3968EJ4IpHAA47Ll/jn1rU91pr3C
|
||||
BP2lX0BZwExU01FNYWPyGz9KQw8PtgB72BxOhORGpZYkRa3QhJ65H2FnVLQ/+ZGN
|
||||
29l2oOpE3r5GKjOcTD6kHcT8Vfl3QbhTm2sZtKNAbPR+OeYUsRBSDZKQZHP37hzH
|
||||
IjKLJm+DGpq0rgbtesmi5lrMe38L57+c/GZgY+AuQ4+E/G48EFFFFazAnS3vOSPr
|
||||
CPEM2xCHP9Zsc7kfT/soHuVqsjYTfRGPKNZmHEkFjV4ddP5MzFOW8TMx58JJ/hNu
|
||||
WjNhEP2pLkWm+OOmJ4v20AeN6kOOx5BBEIzd74S8Mkk0JuS5a5ECAwEAAaN0MHIw
|
||||
HwYDVR0jBBgwFoAUHvfuPR+F60hcU65vtUCZsKgcQU8wCQYDVR0TBAIwADALBgNV
|
||||
HQ8EBAMCBPAwGAYDVR0RBBEwD4INd2F6dWgubWFuYWdlcjAdBgNVHQ4EFgQUc9d5
|
||||
sFzgRCGk70iw5/qNrH98sp0wDQYJKoZIhvcNAQELBQADggEBAITNql9jvgHTACd+
|
||||
4nSlqmAejCoBGwoZmfJqOLlk2NXOWLNEuO8rm1cNv03vBY6UwlgvHFNXeCBEw1Sf
|
||||
WHG0xTrQYgBJrW2DL5HX7OL9z4BPekzdTC01HBWG+ueinvS6Rzy5vImxW+XmYjsm
|
||||
coCQnXbw3os8SsS7Kr1IsJRhVmdTHs2gmnuTjNjE3Pmyxb2E82qP/BiIM/lEH+IB
|
||||
ONwbSUVP3RvVQvFTP3seWDfA9fU6mXC/KujmmSmnissCxg+bEJkMMqwYFDfefFio
|
||||
NWb4oxNB0HguolYydi4PnP3kTImr6dWpqYeiOY8r5sEddUKrmZ5BtY0u6VkRVHJ8
|
||||
PhcR5cA=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,164 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:${WAZUH_VERSION}
|
||||
container_name: wazuh.indexer
|
||||
hostname: wazuh.indexer
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "OPENSEARCH_INITIAL_ADMIN_PASSWORD=${INDEXER_PASSWORD}"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:${WAZUH_VERSION}
|
||||
container_name: wazuh.manager
|
||||
hostname: wazuh.manager
|
||||
restart: unless-stopped
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 655360
|
||||
hard: 655360
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=${INDEXER_PASSWORD}
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=${API_PASSWORD}
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||
- wazuh_etc:/var/ossec/etc
|
||||
- wazuh_logs:/var/ossec/logs
|
||||
- wazuh_queue:/var/ossec/queue
|
||||
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||
- wazuh_integrations:/var/ossec/integrations
|
||||
- wazuh_active_response:/var/ossec/active-response/bin
|
||||
- wazuh_agentless:/var/ossec/agentless
|
||||
- wazuh_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:${WAZUH_VERSION}
|
||||
container_name: wazuh.dashboard
|
||||
hostname: wazuh.dashboard
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "443:5601"
|
||||
environment:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=${INDEXER_PASSWORD}
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=${DASHBOARD_USERNAME}
|
||||
- DASHBOARD_PASSWORD=${DASHBOARD_PASSWORD}
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=${API_PASSWORD}
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh.dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh.dashboard-key.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
- wazuh.manager
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
ubuntu-gui:
|
||||
image: lscr.io/linuxserver/webtop:ubuntu-xfce
|
||||
container_name: ubuntu-gui
|
||||
hostname: ubuntu-gui
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "3000:3000"
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=Europe/Paris
|
||||
volumes:
|
||||
- ./data/ubuntu_gui:/config
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
windows:
|
||||
image: dockurr/windows
|
||||
container_name: windows
|
||||
hostname: windows
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "8006:8006"
|
||||
- "3389:3389/tcp"
|
||||
- "3389:3389/udp"
|
||||
environment:
|
||||
- VERSION=${WIN_VERSION}
|
||||
- RAM_SIZE=${WIN_RAM}
|
||||
- CPU_CORES=${WIN_CPU}
|
||||
- ADAPTER=e1000e
|
||||
devices:
|
||||
- /dev/kvm
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
volumes:
|
||||
- ./data/windows:/storage
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
volumes:
|
||||
wazuh-indexer-data:
|
||||
wazuh_api_configuration:
|
||||
wazuh_etc:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_integrations:
|
||||
wazuh_active_response:
|
||||
wazuh_agentless:
|
||||
wazuh_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
wazuh-dashboard-custom:
|
||||
|
||||
networks:
|
||||
lab-network:
|
||||
driver: bridge
|
||||
name: lab-network
|
||||
@@ -0,0 +1,23 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
wazuh-agent:
|
||||
image: ubuntu:22.04
|
||||
container_name: wazuh-agent
|
||||
hostname: wazuh-agent
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ./auth.log:/var/log/auth.log:ro
|
||||
environment:
|
||||
- WAZUH_MANAGER_IP=${WAZUH_MANAGER_IP}
|
||||
command: >
|
||||
bash -c "
|
||||
apt-get update &&
|
||||
apt-get install -y curl apt-transport-https gnupg &&
|
||||
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add - &&
|
||||
echo 'deb https://packages.wazuh.com/4.x/apt/ stable main' > /etc/apt/sources.list.d/wazuh.list &&
|
||||
apt-get update &&
|
||||
WAZUH_MANAGER=\"$WAZUH_MANAGER_IP\" apt-get install -y wazuh-agent &&
|
||||
service wazuh-agent start &&
|
||||
tail -f /var/log/auth.log
|
||||
"
|
||||
@@ -0,0 +1,164 @@
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
wazuh.indexer:
|
||||
image: wazuh/wazuh-indexer:${WAZUH_VERSION}
|
||||
container_name: wazuh.indexer
|
||||
hostname: wazuh.indexer
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "9200:9200"
|
||||
environment:
|
||||
- "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
|
||||
- "OPENSEARCH_INITIAL_ADMIN_PASSWORD=${INDEXER_PASSWORD}"
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 65536
|
||||
hard: 65536
|
||||
volumes:
|
||||
- wazuh-indexer-data:/var/lib/wazuh-indexer
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/certs/admin.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/certs/admin-key.pem
|
||||
- ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/opensearch.yml
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
wazuh.manager:
|
||||
image: wazuh/wazuh-manager:${WAZUH_VERSION}
|
||||
container_name: wazuh.manager
|
||||
hostname: wazuh.manager
|
||||
restart: unless-stopped
|
||||
ulimits:
|
||||
memlock:
|
||||
soft: -1
|
||||
hard: -1
|
||||
nofile:
|
||||
soft: 655360
|
||||
hard: 655360
|
||||
ports:
|
||||
- "1514:1514"
|
||||
- "1515:1515"
|
||||
- "514:514/udp"
|
||||
- "55000:55000"
|
||||
environment:
|
||||
- INDEXER_URL=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=${INDEXER_PASSWORD}
|
||||
- FILEBEAT_SSL_VERIFICATION_MODE=full
|
||||
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
|
||||
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
|
||||
- SSL_KEY=/etc/ssl/filebeat.key
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=${API_PASSWORD}
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/ossec/api/configuration
|
||||
- wazuh_etc:/var/ossec/etc
|
||||
- wazuh_logs:/var/ossec/logs
|
||||
- wazuh_queue:/var/ossec/queue
|
||||
- wazuh_var_multigroups:/var/ossec/var/multigroups
|
||||
- wazuh_integrations:/var/ossec/integrations
|
||||
- wazuh_active_response:/var/ossec/active-response/bin
|
||||
- wazuh_agentless:/var/ossec/agentless
|
||||
- wazuh_wodles:/var/ossec/wodles
|
||||
- filebeat_etc:/etc/filebeat
|
||||
- filebeat_var:/var/lib/filebeat
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
wazuh.dashboard:
|
||||
image: wazuh/wazuh-dashboard:${WAZUH_VERSION}
|
||||
container_name: wazuh.dashboard
|
||||
hostname: wazuh.dashboard
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "443:5601"
|
||||
environment:
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=${INDEXER_PASSWORD}
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=${DASHBOARD_USERNAME}
|
||||
- DASHBOARD_PASSWORD=${DASHBOARD_PASSWORD}
|
||||
- API_USERNAME=wazuh-wui
|
||||
- API_PASSWORD=${API_PASSWORD}
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh.dashboard.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh.dashboard-key.pem
|
||||
- ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
- ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
|
||||
- ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
|
||||
- wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
|
||||
depends_on:
|
||||
- wazuh.indexer
|
||||
- wazuh.manager
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
ubuntu-gui:
|
||||
image: lscr.io/linuxserver/webtop:ubuntu-xfce
|
||||
container_name: ubuntu-gui
|
||||
hostname: ubuntu-gui
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "3000:3000"
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=Europe/Paris
|
||||
volumes:
|
||||
- ./data/ubuntu_gui:/config
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
windows:
|
||||
image: dockurr/windows
|
||||
container_name: windows
|
||||
hostname: windows
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "8006:8006"
|
||||
- "3389:3389/tcp"
|
||||
- "3389:3389/udp"
|
||||
environment:
|
||||
- VERSION=${WIN_VERSION}
|
||||
- RAM_SIZE=${WIN_RAM}
|
||||
- CPU_CORES=${WIN_CPU}
|
||||
- ADAPTER=e1000e
|
||||
devices:
|
||||
- /dev/kvm
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
volumes:
|
||||
- ./data/windows:/storage
|
||||
networks:
|
||||
- lab-network
|
||||
|
||||
volumes:
|
||||
wazuh-indexer-data:
|
||||
wazuh_api_configuration:
|
||||
wazuh_etc:
|
||||
wazuh_logs:
|
||||
wazuh_queue:
|
||||
wazuh_var_multigroups:
|
||||
wazuh_integrations:
|
||||
wazuh_active_response:
|
||||
wazuh_agentless:
|
||||
wazuh_wodles:
|
||||
filebeat_etc:
|
||||
filebeat_var:
|
||||
wazuh-dashboard-custom:
|
||||
|
||||
networks:
|
||||
lab-network:
|
||||
driver: bridge
|
||||
name: lab-network
|
||||
@@ -0,0 +1,7 @@
|
||||
services:
|
||||
generator:
|
||||
image: wazuh/wazuh-certs-generator:0.0.4
|
||||
hostname: wazuh-certs-generator
|
||||
volumes:
|
||||
- ./config/wazuh_indexer_ssl_certs/:/certificates/
|
||||
- ./config/certs.yml:/config/certs.yml
|
||||
@@ -0,0 +1,90 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
mkdir -p config/wazuh_indexer
|
||||
mkdir -p config/wazuh_dashboard
|
||||
|
||||
cat > config/wazuh_indexer/wazuh.indexer.yml <<'EOF'
|
||||
network.host: "0.0.0.0"
|
||||
node.name: "wazuh.indexer"
|
||||
cluster.initial_master_nodes:
|
||||
- "wazuh.indexer"
|
||||
cluster.name: "wazuh-cluster"
|
||||
|
||||
path.data: /var/lib/wazuh-indexer
|
||||
path.logs: /var/log/wazuh-indexer
|
||||
path.repo: /var/lib/wazuh-indexer/snapshots
|
||||
|
||||
plugins.security.ssl.transport.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /usr/share/wazuh-indexer/certs/wazuh.indexer.key
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/wazuh-indexer/certs/root-ca.pem
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
plugins.security.authcz.admin_dn:
|
||||
- "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.restapi.roles_enabled:
|
||||
- "all_access"
|
||||
- "security_rest_api_access"
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices:
|
||||
- ".opendistro-alerting-config"
|
||||
- ".opendistro-alerting-alert*"
|
||||
- ".opendistro-anomaly-results*"
|
||||
- ".opendistro-anomaly-detector*"
|
||||
- ".opendistro-anomaly-checkpoints"
|
||||
- ".opendistro-anomaly-detection-state"
|
||||
- ".opendistro-reports-*"
|
||||
- ".opendistro-notifications-*"
|
||||
- ".opendistro-notebooks"
|
||||
- ".opendistro-observability"
|
||||
- ".opendistro-asynchronous-search-response*"
|
||||
- ".replication-metadata-store"
|
||||
- ".opensearch-observability"
|
||||
- ".opensearch-notifications-*"
|
||||
- ".opensearch-reports-*"
|
||||
- ".opensearch-anomaly-results*"
|
||||
- ".opensearch-anomaly-detector*"
|
||||
- ".opensearch-anomaly-checkpoints"
|
||||
- ".opensearch-anomaly-detection-state"
|
||||
- ".opensearch-security"
|
||||
- ".wazuh"
|
||||
- ".wazuh-*"
|
||||
- ".plugins-*"
|
||||
|
||||
compatibility.override_main_response_version: true
|
||||
EOF
|
||||
|
||||
cat > config/wazuh_dashboard/opensearch_dashboards.yml <<'EOF'
|
||||
server.host: 0.0.0.0
|
||||
server.port: 5601
|
||||
opensearch.hosts: https://wazuh.indexer:9200
|
||||
opensearch.ssl.verificationMode: certificate
|
||||
opensearch.requestHeadersAllowlist:
|
||||
- securitytenant
|
||||
- Authorization
|
||||
opensearch_security.multitenancy.enabled: false
|
||||
opensearch_security.readonly_mode.roles:
|
||||
- kibana_read_only
|
||||
server.ssl.enabled: true
|
||||
server.ssl.certificate: /usr/share/wazuh-dashboard/certs/wazuh.dashboard.pem
|
||||
server.ssl.key: /usr/share/wazuh-dashboard/certs/wazuh.dashboard-key.pem
|
||||
opensearch.ssl.certificateAuthorities: /usr/share/wazuh-dashboard/certs/root-ca.pem
|
||||
uiSettings.overrides.defaultRoute: /app/wazuh
|
||||
EOF
|
||||
|
||||
cat > config/wazuh_dashboard/wazuh.yml <<'EOF'
|
||||
hosts:
|
||||
- default:
|
||||
url: https://wazuh.manager
|
||||
port: 55000
|
||||
username: wazuh-wui
|
||||
password: MyS3cr37P450r.*-
|
||||
run_as: false
|
||||
EOF
|
||||
|
||||
echo "Configuration files created successfully."
|
||||
Reference in New Issue
Block a user