Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unify unatteded check firewalls #1224

Open
wants to merge 14 commits into
base: unify-unattended
Choose a base branch
from
56 changes: 56 additions & 0 deletions unattended_installer/install_functions/checks.sh
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,62 @@ function checkArguments() {

}

function checkFirewalls() {


firewallsList=( "iptables"
"nft"
"firewall-cmd")

portsTCPLists=( "1514"
"1515"
"1516"
"514"
"55000"
"9200"
"9300"
"9400"
"443")

for command in "${firewallsList[@]}"; do

if [ -n "$(command -v $command)" ]; then
logger_cert -w "The $command command is present on this system. This could affect the correct communication between Wazuh components. We will proceed to try to validate firewall rules that may affect the processes and report what is found."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
firewallstatus='true'

if [ $command == "iptables" ]; then
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
logger -w "iptables report:"
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command -L -n | grep DROP | grep $port)" ]; then
logger -w " ...port $port must be open in your firewall rules."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
fi
done

elif [ $command == "nft" ]; then
logger -w "nft report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command list ruleset | grep drop | grep $port)" ]; then
logger -w " ...port $port must be open in your firewall rules."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
fi
done

elif [ $command == "firewall-cmd" ]; then
logger -w "firewall-cmd report:"
for port in "${portsTCPLists[@]}"; do
if [ -n "$($command --list-all | grep $port)" ]; then
logger -w " ...port $port must be open in your firewall rules."
fi
done
fi
fi
done

if [ -n "${firewallstatus}" ]; then
logger -w "Please check your firewall. And make the recommended fixes. To then repeat the installation of Wazuh."
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
exit 1
fi
}

function checkHealth() {

checkSpecs
Expand Down
5 changes: 5 additions & 0 deletions unattended_installer/wazuh_install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -358,6 +358,11 @@ function main() {
fi
checkArguments

if [ -n "${AIO}" ] || [ -n "${indexer}" ] || [ -n "${dashboard}" ] || [ -n "${wazuh}" ]; then
alberpilot marked this conversation as resolved.
Show resolved Hide resolved
logger "---------------------------------- Check firewalls -----------------------------------"
checkFirewalls
fi

# -------------- Configuration creation case -----------------------

# Creation certificate case: Only AIO and -c option can create certificates.
Expand Down