Merge 4.8.0 into 4.8.1

.github/actions/offline-installation/common.sh

@@ -150,7 +150,7 @@ function filebeat_installation() {
     filebeat keystore create
     echo admin | filebeat keystore add username --stdin --force
     echo admin | filebeat keystore add password --stdin --force
-    tar -xzf ./wazuh-offline/wazuh-files/wazuh-filebeat-0.2.tar.gz -C /usr/share/filebeat/module
+    tar -xzf ./wazuh-offline/wazuh-files/wazuh-filebeat-0.4.tar.gz -C /usr/share/filebeat/module
 
     echo "INFO: Generating certificates of Filebeat..."
     NODE_NAME=wazuh-1

aix/SPECS/wazuh-agent-aix.spec

@@ -296,7 +296,7 @@ rm -fr %{buildroot}
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-8-0.html
 * Sun Dec 17 2023 support <[email protected]> - 4.7.2
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
-* Tue Dec 05 2023 support <[email protected]> - 4.7.1
+* Wed Dec 13 2023 support <[email protected]> - 4.7.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 * Tue Nov 21 2023 support <[email protected]> - 4.7.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-0.html

debs/SPECS/wazuh-agent/debian/changelog

@@ -20,7 +20,7 @@ wazuh-agent (4.7.1-RELEASE) stable; urgency=low
 
   * More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 
- -- Wazuh, Inc <[email protected]>  Tue, 05 Dec 2023 00:00:00 +0000
+ -- Wazuh, Inc <[email protected]>  Wed, 13 Dec 2023 00:00:00 +0000
 
 wazuh-agent (4.7.0-RELEASE) stable; urgency=low
 

debs/SPECS/wazuh-agent/debian/rules

@@ -105,6 +105,7 @@ override_dh_install:
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/9
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/10
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/11
+	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/12
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/ubuntu/12/04
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/ubuntu/14/04
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/ubuntu/16/04
@@ -123,6 +124,7 @@ override_dh_install:
 	cp etc/templates/config/debian/9/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/9
 	cp etc/templates/config/debian/10/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/10
 	cp etc/templates/config/debian/11/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/11
+	cp etc/templates/config/debian/12/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/12
 
 	cp etc/templates/config/ubuntu/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/ubuntu
 	cp etc/templates/config/ubuntu/12/04/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/ubuntu/12/04

debs/SPECS/wazuh-manager/debian/changelog

@@ -20,7 +20,7 @@ wazuh-manager (4.7.1-RELEASE) stable; urgency=low
 
   * More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 
- -- Wazuh, Inc <[email protected]>  Tue, 05 Dec 2023 00:00:00 +0000
+ -- Wazuh, Inc <[email protected]>  Wed, 13 Dec 2023 00:00:00 +0000
 
 wazuh-manager (4.7.0-RELEASE) stable; urgency=low
 

debs/SPECS/wazuh-manager/debian/rules

@@ -136,6 +136,7 @@ override_dh_install:
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/9
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/10
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/11
+	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/12
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/rhel/5
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/rhel/6
 	mkdir -p ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/rhel/7
@@ -182,6 +183,7 @@ override_dh_install:
 	cp etc/templates/config/debian/9/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/9
 	cp etc/templates/config/debian/10/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/10
 	cp etc/templates/config/debian/11/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/11
+	cp etc/templates/config/debian/12/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/debian/12
 
 	cp etc/templates/config/centos/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/centos
 	cp etc/templates/config/centos/5/sca.files ${TARGET_DIR}$(INSTALLATION_SCRIPTS_DIR)/sca/centos/5

rpms/SPECS/wazuh-agent.spec

@@ -631,7 +631,7 @@ rm -fr %{buildroot}
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-8-0.html
 * Sun Dec 17 2023 support <[email protected]> - 4.7.2
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
-* Tue Dec 05 2023 support <[email protected]> - 4.7.1
+* Wed Dec 13 2023 support <[email protected]> - 4.7.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 * Tue Nov 21 2023 support <[email protected]> - 4.7.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-0.html

rpms/SPECS/wazuh-manager.spec

@@ -116,7 +116,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/{a
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/amzn/{1,2,2023}
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/centos/{8,7,6,5}
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/darwin/{15,16,17,18,19,20,21,22,23}
-mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/debian/{7,8,9,10,11}
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/debian/{7,8,9,10,11,12}
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/ubuntu/{12,14,16,18,20,22}/04
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/rhel/{9,8,7,6,5}
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/tmp/sca-%{version}-%{release}-tmp/sles/{11,12,15}
@@ -859,7 +859,7 @@ rm -fr %{buildroot}
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-8-0.html
 * Sun Dec 17 2023 support <[email protected]> - 4.7.2
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
-* Tue Dec 05 2023 support <[email protected]> - 4.7.1
+* Wed Dec 13 2023 support <[email protected]> - 4.7.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 * Tue Nov 21 2023 support <[email protected]> - 4.7.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-0.html

stack/dashboard/deb/debian/changelog

@@ -20,7 +20,7 @@ wazuh-dashboard (4.7.1-RELEASE) stable; urgency=low
 
   * More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 
- -- Wazuh, Inc <[email protected]>  Tue, 05 Dec 2023 00:00:00 +0000
+ -- Wazuh, Inc <[email protected]>  Wed, 13 Dec 2023 00:00:00 +0000
 
 wazuh-dashboard (4.7.0-RELEASE) stable; urgency=low
 

stack/dashboard/rpm/wazuh-dashboard.spec

@@ -341,7 +341,7 @@ rm -fr %{buildroot}
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-8-0.html
 * Sun Dec 17 2023 support <[email protected]> - 4.7.2
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
-* Tue Dec 05 2023 support <[email protected]> - 4.7.1
+* Wed Dec 13 2023 support <[email protected]> - 4.7.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 * Tue Nov 21 2023 support <[email protected]> - 4.7.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-0.html

stack/indexer/deb/debian/changelog

@@ -20,7 +20,7 @@ wazuh-indexer (4.7.1-RELEASE) stable; urgency=low
 
   * More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 
- -- Wazuh, Inc <[email protected]>  Tue, 05 Dec 2023 00:00:00 +0000
+ -- Wazuh, Inc <[email protected]>  Wed, 13 Dec 2023 00:00:00 +0000
 
 wazuh-indexer (4.7.0-RELEASE) stable; urgency=low
 

stack/indexer/indexer-ism-init.sh

@@ -84,7 +84,24 @@ function generate_rollover_template() {
 # Loads the index templates for the rollover policy to the indexer.
 #########################################################################
 function load_templates() {
-    # Note: the wazuh-template.json could also be loaded here.
+    # Load wazuh-template.json, needed for initial indices creation.
+    local wazuh_template_path="/etc/wazuh-indexer/wazuh-template.json"
+    echo "Will create 'wazuh' index template"
+    if [ -f $wazuh_template_path ]; then
+        cat $wazuh_template_path |
+        if ! curl -s -k ${C_AUTH} \
+            -X PUT "${INDEXER_URL}/_template/wazuh" \
+            -o "${LOG_FILE}" --create-dirs \
+            -H 'Content-Type: application/json' -d @-; then
+            echo "  ERROR: 'wazuh' template creation failed"
+            exit 1
+        else
+            echo " SUCC: 'wazuh' template created or updated"
+        fi
+    else
+        echo "  ERROR: $wazuh_template_path not found"
+    fi
+
     echo "Will create index templates to configure the alias"
     for alias in "${aliases[@]}"; do
         generate_rollover_template "${alias}" |

stack/indexer/rpm/wazuh-indexer.spec

@@ -691,7 +691,7 @@ rm -fr %{buildroot}
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-8-0.html
 * Sun Dec 17 2023 support <[email protected]> - 4.7.2
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-2.html
-* Tue Dec 05 2023 support <[email protected]> - 4.7.1
+* Wed Dec 13 2023 support <[email protected]> - 4.7.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-1.html
 * Tue Nov 21 2023 support <[email protected]> - 4.7.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-7-0.html

unattended_installer/builder.sh

@@ -16,8 +16,8 @@ readonly resources_certs="${base_path_builder}/cert_tool"
 readonly resources_passwords="${base_path_builder}/passwords_tool"
 readonly resources_common="${base_path_builder}/common_functions"
 readonly resources_download="${base_path_builder}/downloader"
-readonly source_directory="$(git rev-parse --show-toplevel)"
-source_branch=`cat ${source_directory}/VERSION`
+readonly source_directory="$( cd $(dirname $0) ; pwd -P )"
+source_branch=$(cat ${source_directory}/../VERSION)
 
 function getHelp() {
 
@@ -74,15 +74,15 @@ function buildInstaller() {
         echo 'readonly repogpg="https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH"' >> "${output_script_path}"
         echo 'readonly repobaseurl="https://packages-dev.wazuh.com/'${devrepo}'"' >> "${output_script_path}"
         echo 'readonly reporelease="unstable"' >> "${output_script_path}"
-        echo 'readonly filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.3.tar.gz"' >> "${output_script_path}"
+        echo 'readonly filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.4.tar.gz"' >> "${output_script_path}"
         echo 'readonly bucket="packages-dev.wazuh.com"' >> "${output_script_path}"
         echo 'readonly repository="'"${devrepo}"'"' >> "${output_script_path}"
         sed -i 's|v${wazuh_version}|${wazuh_version}|g' "${resources_installer}/installVariables.sh"
     else
         echo 'readonly repogpg="https://packages.wazuh.com/key/GPG-KEY-WAZUH"' >> "${output_script_path}"
         echo 'readonly repobaseurl="https://packages.wazuh.com/4.x"' >> "${output_script_path}"
         echo 'readonly reporelease="stable"' >> "${output_script_path}"
-        echo 'readonly filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.3.tar.gz"' >> "${output_script_path}"
+        echo 'readonly filebeat_wazuh_module="${repobaseurl}/filebeat/wazuh-filebeat-0.4.tar.gz"' >> "${output_script_path}"
         echo 'readonly bucket="packages.wazuh.com"' >> "${output_script_path}"
         echo 'readonly repository="4.x"' >> "${output_script_path}"
     fi

unattended_installer/common_functions/common.sh

@@ -7,6 +7,20 @@
 # License (version 2) as published by the FSF - Free Software
 # Foundation.
 
+function common_checkAptLock() {
+
+    attempt=0
+    seconds=30
+    max_attempts=10
+
+    while fuser "${apt_lockfile}" >/dev/null 2>&1 && [ "${attempt}" -lt "${max_attempts}" ]; do
+        attempt=$((attempt+1))
+        common_logger "Another process is using APT. Waiting for it to release the lock. Next retry in ${seconds} seconds (${attempt}/${max_attempts})"
+        sleep "${seconds}"
+    done
+
+}
+
 function common_logger() {
 
     now=$(date +'%d/%m/%Y %H:%M:%S')

unattended_installer/install_functions/indexer.sh

@@ -190,12 +190,5 @@ function indexer_startCluster() {
             common_logger "The Wazuh indexer cluster ISM initialized."
         fi
     fi
-    eval "common_curl --silent ${filebeat_wazuh_template} --max-time 300 --retry 5 --retry-delay 5 ${debug}" | eval "common_curl -X PUT 'https://${indexer_node_ips[pos]}:9200/_template/wazuh' -H 'Content-Type: application/json' -d @- -uadmin:admin -k --silent --max-time 300 --retry 5 --retry-delay 5 ${debug}"
-    if [  "${PIPESTATUS[0]}" != 0  ]; then
-        common_logger -e "The wazuh-alerts template could not be inserted into the Wazuh indexer cluster."
-        exit 1
-    else
-        common_logger -d "Inserted wazuh-alerts template into the Wazuh indexer cluster."
-    fi
 
-}
+}

unattended_installer/install_functions/installCommon.sh

@@ -98,7 +98,7 @@ function installCommon_aptInstall() {
         installer=${package}
     fi
     command="DEBIAN_FRONTEND=noninteractive apt-get install ${installer} -y -q"
-    installCommon_checkAptLock
+    common_checkAptLock
 
     if [ "${attempt}" -ne "${max_attempts}" ]; then
         apt_output=$(eval "${command} 2>&1")
@@ -572,7 +572,7 @@ function installCommon_rollBack() {
                 manager_installed=$(yum list installed 2>/dev/null | grep wazuh-manager)
             fi
         elif [ "${sys_type}" == "apt-get" ]; then
-            installCommon_checkAptLock
+            common_checkAptLock
             eval "apt-get remove --purge wazuh-manager -y ${debug}"
             manager_installed=$(apt list --installed 2>/dev/null | grep wazuh-manager)
         fi
@@ -598,7 +598,7 @@ function installCommon_rollBack() {
                 indexer_installed=$(yum list installed 2>/dev/null | grep wazuh-indexer)
             fi
         elif [ "${sys_type}" == "apt-get" ]; then
-            installCommon_checkAptLock
+            common_checkAptLock
             eval "apt-get remove --purge wazuh-indexer -y ${debug}"
             indexer_installed=$(apt list --installed 2>/dev/null | grep wazuh-indexer)
         fi
@@ -625,7 +625,7 @@ function installCommon_rollBack() {
                 filebeat_installed=$(yum list installed 2>/dev/null | grep filebeat)
             fi
         elif [ "${sys_type}" == "apt-get" ]; then
-            installCommon_checkAptLock
+            common_checkAptLock
             eval "apt-get remove --purge filebeat -y ${debug}"
             filebeat_installed=$(apt list --installed 2>/dev/null | grep filebeat)
         fi
@@ -652,7 +652,7 @@ function installCommon_rollBack() {
                 dashboard_installed=$(yum list installed 2>/dev/null | grep wazuh-dashboard)
             fi
         elif [ "${sys_type}" == "apt-get" ]; then
-            installCommon_checkAptLock
+            common_checkAptLock
             eval "apt-get remove --purge wazuh-dashboard -y ${debug}"
             dashboard_installed=$(apt list --installed 2>/dev/null | grep wazuh-dashboard)
         fi

unattended_installer/install_functions/installVariables.sh

@@ -58,7 +58,8 @@ readonly wazuh_manager_ports=( 1514 1515 1516 55000 )
 wazuh_dashboard_port="${http_port}"
 readonly wia_yum_dependencies=( systemd grep tar coreutils sed procps-ng gawk lsof curl openssl )
 readonly wia_apt_dependencies=( systemd grep tar coreutils sed procps gawk lsof curl openssl )
-readonly wazuh_apt_dependencies=( gnupg apt-transport-https )
+readonly wazuh_yum_dependencies=( libcap )
+readonly wazuh_apt_dependencies=( apt-transport-https libcap2-bin software-properties-common gnupg )
 readonly indexer_yum_dependencies=( coreutils )
 readonly indexer_apt_dependencies=( debconf adduser procps gnupg apt-transport-https )
 readonly dashboard_yum_dependencies=( libcap )