Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unify unatteded check firewalls #1224

Open
wants to merge 14 commits into
base: unify-unattended
Choose a base branch
from
65 changes: 65 additions & 0 deletions unattended_installer/install_functions/checks.sh
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,71 @@ function checkArguments() {

}

function checkFirewalls() {


firewallsList=( "iptables"
"nft"
"ufw"
"firewall-cmd")

portsTCPLists=( "1514"
"1515"
"1516"
"514"
"55000"
"9200"
"9300"
"9400"
"443")

for command in "${firewallsList[@]}"; do

if [ -n "$(command -v $command)" ]; then
logger_cert "The $command command is present on this system. This could affect the correct communication between Wazuh components. We will proceed to try to validate firewall rules that may affect the processes and report what is found."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
firewallstatus='true'

if [ $command == "iptables" ]; then
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
logger "iptables report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command -L -n | grep DROP | grep $port)" ]; then
logger " ...port $port must be open in your firewall rules."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
fi
done

elif [ $command == "nft" ]; then
logger "nft report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command list ruleset | grep drop | grep $port)" ]; then
logger " ...port $port must be open in your firewall rules."
fi
done

elif [ $command == "ufw" ]; then
logger "ufw report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$(cat /etc/ufw/user.rules | grep DROP | grep $port)" ]; then
logger " ...port $port must be open in your firewall rules."
fi
done

elif [ $command == "firewall-cmd" ]; then
logger "firewall-cmd report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command --list-all | grep $port)" ]; then
logger " ...port $port must be open in your firewall rules."
fi
done
fi
fi
done

if [ -n "${firewallstatus}" ]; then
logger -w "Please check your firewall. And make the recommended fixes. To then repeat the installation of Wazuh."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
exit 1
fi
}

function checkHealth() {

checkSpecs
Expand Down
5 changes: 5 additions & 0 deletions unattended_installer/wazuh_install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -330,6 +330,11 @@ function main() {

logger "Starting Wazuh unattended installer. Wazuh version: ${wazuh_version}. Wazuh installer version: ${wazuh_install_vesion}"

if [ -z "${configurations}" ] && [ -z "${start_elastic_cluster}" ] ; then
logger "---------------------------------- Check firewalls -----------------------------------"
checkFirewalls
fi

# -------------- Uninstall case ------------------------------------

checkIfInstalled
Expand Down