Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SPECS for new SCA Rocky Linux 9 #2282

Closed
72nomada opened this issue Jul 16, 2023 · 4 comments · Fixed by #2299
Closed

SPECS for new SCA Rocky Linux 9 #2282

72nomada opened this issue Jul 16, 2023 · 4 comments · Fixed by #2299
Assignees
@DFolchA
Labels
level/subtask Task issue type/enhancement Enhancement issue

Comments

@72nomada
Copy link
Contributor

Create SPECS as needed for a new OS SCA

PR - wazuh/wazuh#17810 Is ready to merge
Branch - https://github.com/wazuh/wazuh/tree/SCA-Rocky-Linux-9

PLEASE confirm with @wazuh/threat-intel before merging.
@vikman90
Copy link
Member

This is a subtask of wazuh/wazuh#16618.

@vikman90 vikman90 added level/subtask Task issue type/enhancement Enhancement issue labels Jul 17, 2023
@DFolchA
Copy link
Contributor

DFolchA commented Jul 19, 2023

Update: Testing

AGENT

[root@rockylinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-agent-4.5.1-0.0.0.rocky9.x86_64.rpm -y
Last metadata expiration check: 2:25:08 ago on Wed 19 Jul 2023 11:55:50 AM UTC.
wazuh-agent-4.5.1-0.0.0.rocky9.x86_64.rpm                                                                   792 kB/s | 8.8 MB     00:11    
Dependencies resolved.
============================================================================================================================================
 Package                         Architecture               Version                                  Repository                        Size
============================================================================================================================================
Installing:
 wazuh-agent                     x86_64                     4.5.1-0.0.0.rocky9                       @commandline                     8.8 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 8.8 M
Installed size: 25 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Installing       : wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 
  Verifying        : wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                              1/1 

Installed:
  wazuh-agent-4.5.1-0.0.0.rocky9.x86_64                                                                                                     

Complete!
[root@rockylinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_rocky_linux_9.yml

MANAGER

[root@rockylinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-manager-4.5.1-0.0.0.rocky9.x86_64.rpm -y
Last metadata expiration check: 2:33:15 ago on Wed 19 Jul 2023 11:55:50 AM UTC.
wazuh-manager-4.5.1-0.0.0.rocky9.x86_64.rpm                                                                 7.6 MB/s | 164 MB     00:21    
Dependencies resolved.
============================================================================================================================================
 Package                           Architecture               Version                                Repository                        Size
============================================================================================================================================
Installing:
 wazuh-manager                     x86_64                     4.5.1-0.0.0.rocky9                     @commandline                     164 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 164 M
Installed size: 598 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Installing       : wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 
  Verifying        : wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                            1/1 

Installed:
  wazuh-manager-4.5.1-0.0.0.rocky9.x86_64                                                                                                   

Complete!
[root@rockylinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_amazon_linux_1.yml.disabled     cis_mongodb_36.yml.disabled           cis_sqlserver_2014.yml.disabled
cis_amazon_linux_2.yml.disabled     cis_mysql5-6_community.yml.disabled   cis_sqlserver_2016.yml.disabled
cis_apache_24.yml.disabled          cis_mysql5-6_enterprise.yml.disabled  cis_sqlserver_2017.yml.disabled
cis_apple_macOS_10.11.yml.disabled  cis_nginx_1.yml.disabled              cis_sqlserver_2019.yml.disabled
cis_apple_macOS_10.12.yml.disabled  cis_oracle_database_19c.yml.disabled  cis_ubuntu14-04.yml.disabled
cis_apple_macOS_10.13.yml.disabled  cis_postgre-sql-13.yml.disabled       cis_ubuntu16-04.yml.disabled
cis_apple_macOS_10.14.yml.disabled  cis_rhel5_linux.yml.disabled          cis_ubuntu18-04.yml.disabled
cis_apple_macOS_10.15.yml.disabled  cis_rhel6_linux.yml.disabled          cis_ubuntu20-04.yml.disabled
cis_apple_macOS_11.1.yml.disabled   cis_rhel7_linux.yml.disabled          cis_ubuntu22-04.yml.disabled
cis_apple_macOS_12.0.yml.disabled   cis_rhel8_linux.yml.disabled          cis_win10_enterprise.yml.disabled
cis_centos6_linux.yml.disabled      cis_rhel9_linux.yml.disabled          cis_win11_enterprise.yml.disabled
cis_centos7_linux.yml.disabled      cis_rocky_linux_9.yml                 cis_win2012r2.yml.disabled
cis_centos8_linux.yml.disabled      cis_sles11_linux.yml.disabled         cis_win2016.yml.disabled
cis_debian10.yml.disabled           cis_sles12_linux.yml.disabled         cis_win2019.yml.disabled
cis_debian7.yml.disabled            cis_sles15_linux.yml.disabled         cis_win2022.yml.disabled
cis_debian8.yml.disabled            cis_solaris11.4.yml.disabled          sca_unix_audit.yml.disabled
cis_debian9.yml.disabled            cis_solaris11.yml.disabled            web_vulnerabilities.yml.disabled
cis_iis_10.yml.disabled             cis_sqlserver_2012.yml.disabled
[root@rockylinux9 vagrant]#

This was referenced Jul 19, 2023
Merged
Merged
Open
@vikman90
Copy link
Member

PR #2303 ready, blocked by wazuh/wazuh#17810.

@mjcr99
Copy link
Member

mjcr99 commented Jan 15, 2024

Issue updates

(15/01/2024) - Updated PR with the requested changes to add Rocky Linux 9 SCA files. The PR has been tested, the resulting packages contain the new files as expected:

Manager

Manager package build: https://ci.wazuh.info/job/Packages_builder/180778

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-manager-4.8.1-rl9.x86_64.rpm
Rocky Linux 9 - BaseOS                          2.3 MB/s | 2.2 MB     00:00    
Rocky Linux 9 - AppStream                       1.9 MB/s | 7.4 MB     00:03    
Rocky Linux 9 - Extras                           14 kB/s |  14 kB     00:00    
wazuh-manager-4.8.1-rl9.x86_64.rpm               21 MB/s | 351 MB     00:16    
Dependencies resolved.
================================================================================
 Package              Architecture  Version           Repository           Size
================================================================================
Installing:
 wazuh-manager        x86_64        4.8.1-rl9         @commandline        351 M

Transaction Summary
================================================================================
Install  1 Package

Total size: 351 M
Installed size: 856 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Running scriptlet: wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Installing       : wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Running scriptlet: wazuh-manager-4.8.1-rl9.x86_64                         1/1 
  Verifying        : wazuh-manager-4.8.1-rl9.x86_64                         1/1 

Installed:
  wazuh-manager-4.8.1-rl9.x86_64                                                

Complete!

SCA file found:

[root@localhost vagrant]# ls /var/ossec/ruleset/sca/
cis_amazon_linux_1.yml.disabled       cis_rhel6_linux.yml.disabled
cis_amazon_linux_2023.yml.disabled    cis_rhel7_linux.yml.disabled
cis_amazon_linux_2.yml.disabled       cis_rhel8_linux.yml.disabled
cis_apache_24.yml.disabled            cis_rhel9_linux.yml.disabled
cis_apple_macOS_10.11.yml.disabled    cis_rocky_linux_8.yml.disabled
cis_apple_macOS_10.12.yml.disabled    cis_rocky_linux_9.yml
cis_apple_macOS_10.13.yml.disabled    cis_sles11_linux.yml.disabled
cis_apple_macOS_10.14.yml.disabled    cis_sles12_linux.yml.disabled
cis_apple_macOS_10.15.yml.disabled    cis_sles15_linux.yml.disabled
cis_apple_macOS_11.1.yml.disabled     cis_solaris11.4.yml.disabled
cis_apple_macOS_12.0.yml.disabled     cis_solaris11.yml.disabled
cis_apple_macOS_13.x.yml.disabled     cis_sqlserver_2012.yml.disabled
cis_apple_macOS_14.0.yml.disabled     cis_sqlserver_2014.yml.disabled
cis_centos6_linux.yml.disabled        cis_sqlserver_2016.yml.disabled
cis_centos7_linux.yml.disabled        cis_sqlserver_2017.yml.disabled
cis_centos8_linux.yml.disabled        cis_sqlserver_2019.yml.disabled
cis_debian10.yml.disabled             cis_ubuntu14-04.yml.disabled
cis_debian11.yml.disabled             cis_ubuntu16-04.yml.disabled
cis_debian12.yml.disabled             cis_ubuntu18-04.yml.disabled
cis_debian7.yml.disabled              cis_ubuntu20-04.yml.disabled
cis_debian8.yml.disabled              cis_ubuntu22-04.yml.disabled
cis_debian9.yml.disabled              cis_win10_enterprise.yml.disabled
cis_iis_10.yml.disabled               cis_win11_enterprise.yml.disabled
cis_mongodb_36.yml.disabled           cis_win2012r2.yml.disabled
cis_mysql5-6_community.yml.disabled   cis_win2016.yml.disabled
cis_mysql5-6_enterprise.yml.disabled  cis_win2019.yml.disabled
cis_nginx_1.yml.disabled              cis_win2022.yml.disabled
cis_oracle_database_19c.yml.disabled  sca_unix_audit.yml.disabled
cis_postgre-sql-13.yml.disabled       web_vulnerabilities.yml.disabled
cis_rhel5_linux.yml.disabled
Agent

Agent package build: https://ci.wazuh.info/job/Packages_builder/180779

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-agent-4.8.1-rl9.x86_64.rpm
Rocky Linux 9 - BaseOS                         1.0 MB/s | 2.2 MB     00:02    
Rocky Linux 9 - AppStream                      1.5 MB/s | 7.4 MB     00:04    
Rocky Linux 9 - Extras                          25 kB/s |  14 kB     00:00    
wazuh-agent-4.8.1-rl9.x86_64.rpm               3.8 MB/s | 9.3 MB     00:02    
Dependencies resolved.
===============================================================================
 Package            Architecture  Version            Repository           Size
===============================================================================
Installing:
 wazuh-agent        x86_64        4.8.1-rl9          @commandline        9.3 M

Transaction Summary
===============================================================================
Install  1 Package

Total size: 9.3 M
Installed size: 27 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                       1/1 
  Running scriptlet: wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Installing       : wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Running scriptlet: wazuh-agent-4.8.1-rl9.x86_64                          1/1 
  Verifying        : wazuh-agent-4.8.1-rl9.x86_64                          1/1 

Installed:
  wazuh-agent-4.8.1-rl9.x86_64                                                 

Complete!

SCA file found:

[root@localhost vagrant]#  ls /var/ossec/ruleset/sca
cis_rocky_linux_9.yml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@DFolchA DFolchA

Labels
level/subtask Task issue type/enhancement Enhancement issue
Projects
No open projects
Release 4.9.0
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Include SCA policy for Rocky Linux 9 in SPECS wazuh/wazuh-packages
4 participants
@vikman90 @DFolchA @72nomada @mjcr99