mrcharles
5f26f7dca1
secharden-wazuh.sh did a hard `systemctl start wazuh-agent`. The agent attempts to reach its manager (tsys-nsm.knel.net) during startup; when that host is unreachable (e.g. an isolated lab/sandbox VM, or the SIEM being temporarily down during a fresh build), systemd's start exceeds its timeout and the whole provisioning aborts under the framework's errexit. The agent is already installed and enabled, so it will keep retrying the manager on its own. Make the start non-fatal with `|| true` so a host can finish building even when the manager isn't reachable at deploy time. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
57 lines
1.7 KiB
Bash
57 lines
1.7 KiB
Bash
#!/bin/bash
|
|
|
|
#########################################
|
|
#Core framework functions...
|
|
#########################################
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
export PROJECT_ROOT_PATH
|
|
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
|
|
|
export GIT_VENDOR_PATH_ROOT
|
|
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
|
|
|
|
export KNELShellFrameworkRoot
|
|
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
|
|
|
|
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
|
|
|
|
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
|
|
source "$framework_include_file"
|
|
done
|
|
|
|
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
|
|
source "$project_include_file"
|
|
done
|
|
|
|
|
|
#########################################
|
|
# Core script code begins here
|
|
#########################################
|
|
|
|
# We don't want to run this on the wazuh server, otherwise bad things happen...
|
|
|
|
export TSYS_NSM_CHECK
|
|
TSYS_NSM_CHECK="$(hostname |grep -c tsys-nsm ||true)"
|
|
|
|
if [ "$TSYS_NSM_CHECK" -eq 0 ]; then
|
|
|
|
if [ -f /usr/share/keyrings/wazuh.gpg ]; then
|
|
rm -f /usr/share/keyrings/wazuh.gpg
|
|
fi
|
|
|
|
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
|
|
chmod 644 /usr/share/keyrings/wazuh.gpg
|
|
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
|
|
apt-get update
|
|
|
|
WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable wazuh-agent
|
|
systemctl start wazuh-agent || true
|
|
|
|
echo "wazuh-agent hold" | dpkg --set-selections
|
|
|
|
fi |