mrcharles
af18104f7b
Port Modules/Security/secharden-wazuh.sh. Installs the Wazuh agent from the official apt repository with the configured manager address. The agent package is held to prevent uncontrolled upgrades. Skipped entirely on the Wazuh server host (tsys-nsm) via the wazuh_server inventory group. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
---
|
|
# Wazuh agent — port of Modules/Security/secharden-wazuh.sh.
|
|
# Skipped entirely on the wazuh server itself (legacy TSYS_NSM_CHECK).
|
|
# Uses the is_wazuh_server fact set by preflight based on the 'wazuh_server'
|
|
# inventory group.
|
|
|
|
- name: Skip agent install on the Wazuh server
|
|
ansible.builtin.debug:
|
|
msg: "Skipping wazuh-agent install on the wazuh server ({{ inventory_hostname }})."
|
|
when: is_wazuh_server | bool
|
|
|
|
- name: Install wazuh-agent (non-server hosts)
|
|
when: not (is_wazuh_server | bool)
|
|
block:
|
|
- name: Remove any stale wazuh keyring
|
|
ansible.builtin.file:
|
|
path: /usr/share/keyrings/wazuh.gpg
|
|
state: absent
|
|
|
|
- name: Create keyring directory
|
|
ansible.builtin.file:
|
|
path: /usr/share/keyrings
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Fetch Wazuh GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://packages.wazuh.com/key/GPG-KEY-WAZUH
|
|
dest: /tmp/GPG-KEY-WAZUH
|
|
mode: "0644"
|
|
changed_when: false
|
|
|
|
- name: Import Wazuh GPG key into keyring
|
|
ansible.builtin.command: >-
|
|
gpg --no-default-keyring
|
|
--keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg
|
|
--import /tmp/GPG-KEY-WAZUH
|
|
args:
|
|
creates: /usr/share/keyrings/wazuh.gpg
|
|
|
|
- name: Clean up GPG key temp file
|
|
ansible.builtin.file:
|
|
path: /tmp/GPG-KEY-WAZUH
|
|
state: absent
|
|
|
|
- name: Set keyring permissions
|
|
ansible.builtin.file:
|
|
path: /usr/share/keyrings/wazuh.gpg
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Add Wazuh apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main"
|
|
filename: wazuh
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Install wazuh-agent
|
|
ansible.builtin.apt:
|
|
name: wazuh-agent
|
|
state: present
|
|
update_cache: false
|
|
environment:
|
|
WAZUH_MANAGER: "{{ wazuh_manager }}"
|
|
|
|
- name: Hold wazuh-agent package (prevent uncontrolled upgrades)
|
|
ansible.builtin.dpkg_selections:
|
|
name: wazuh-agent
|
|
selection: hold
|
|
|
|
- name: Enable and start wazuh-agent
|
|
ansible.builtin.systemd:
|
|
name: wazuh-agent
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
failed_when: false
|