Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow certificates to be defined by file path #112

Merged
merged 4 commits into from
Apr 2, 2019
Merged

Conversation

LuisGi93
Copy link
Contributor

@LuisGi93 LuisGi93 commented Apr 2, 2019

Hi team,
this PR aim to resolve #66. The options of the auth section in ossec.conf are used so the ossec-authd daemon is able to locate the CA, the manager certificate and its key. For the Wazuh agent the cert, key and CA are specified when calling agent-auth.

@LuisGi93
Copy link
Contributor Author

LuisGi93 commented Apr 2, 2019

Some example scenarios:

1. Verify the manager using ssl

  • We have the manager.cert and manager.key at the /home/manager/ssl directory at our manager and the rootCA.pem at /home/manager/ folder . We can define the following manifest:
node "master-debian-1" {
   class { 'wazuh::server':
     smtp_server => 'localhost',
     ossec_auth_ssl_cert => "/home/manager/ssl/sslmanager.cert",
     ossec_auth_ssl_key => "/home/manager/ssl/sslmanager.key"
   }

}

This manifest will deploy a manager which ossec-auth will be using the /home/centos/ssl/sslmanager.cert and /home/centos/ssl/sslmanager.key. If we wanted to deploy an agent that verifies the deployed manager we can use the following manifest:

node "agent-debian-1" {

class { "wazuh::client":
  ossec_server_ip => "x.x.y.y",
  agent_name=> "agent-debian-1",
  wazuh_manager_root_ca_pem_path => "/home/agent/rootCA.pem"
}

}

The following test were done:

  • Agent and manager are deployed successfully without enabling the specification of the certs and keys by path.
  • Agent and manager are deployed successfully specifying the cert and key file for the manager and the CA for the agent.
  • Ossec-authd it not launched if the cert or the key are wrong.
  • If the wrong CA is especified when deploying the agent an error will happen at the registration phase.
  • Debug was enable to verify the the agent_auth command.
  • Ossec.conf was verified at the manager to verify that the correct settings were set.

2. Agent verification using SSL

Another scenario is when we want to verify agents using ssl. At this scenario we have the sslagent.cert and sslagent.key at /home/agent directory at the agent host and the rootCA.pem at the /home/manager directory at the manager host. An example manifest for the manager:

node "master-debian-1" {
   class { 'wazuh::server':
     smtp_server => 'localhost',
     ossec_auth_ssl_ca => "/home/manager/rootCA.pem"
   }

}

The above manifest will deploy a manager and will use the /home/manager/rootCA.pem file to verify the certs of the agents. An example manifest for the agent:

node "agent-debian-1" {

class { "wazuh::client":
  ossec_server_ip => "x.x.y.y.",
  agent_name=> "agente-debian-1",
  wazuh_agent_cert_path => "/home/agent/sslagent.cert",
  wazuh_agent_key_path => "//home/agent/sslagent.key"
}

}

The following test were done:

  • Registration of the agent fail if an incorrect cert or key are provided.
  • Agent registers correctly if the correct cert and key are provided.
  • If the correct CA is specified for the manager the agent registration fail

@LuisGi93 LuisGi93 marked this pull request as ready for review April 2, 2019 14:03
@manuasir manuasir merged commit 15fb6fa into 3.9 Apr 2, 2019
@manuasir manuasir deleted the dev-certificate_by_path branch April 2, 2019 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants