KNEL/PFVCluster
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(siem): agent fixes from fleet pass; IPv6 kill script [#335][#748]

Browse Source 
deploy-agent.sh now self-heals the three postinst failure modes found on
PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root
ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with
in-file rollback notes. Rollout state in #335/#748.
Meat: https://projects.knownelement.com/issues/335#note-4008
This commit is contained in:
mrcharles
2026-09-03 07:13:28 -05:00
parent 2485866ccd
commit d75366edf5
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/disable-ipv6.sh
+30
View File
@@ -0,0 +1,30 @@
#!/bin/bash
#
# disable-ipv6.sh — kill IPv6 live + persist (no reboot) [#748]
# Run as root. Idempotent. Charles ruling 2026-09-03: IPv6 off fleet-wide.
# Rollback per host: delete /etc/sysctl.d/99-disable-ipv6.conf, then
# sysctl -w net.ipv6.conf.all.disable_ipv6=0 (and per-interface =0 as needed).
#
set -euo pipefail
CONF=/etc/sysctl.d/99-disable-ipv6.conf
cat > "$CONF" <<'EOF'
# IPv6 disabled fleet-wide (Charles ruling 2026-09-03, [#748], follow-on to [#745])
# Rollback: delete this file, then set net.ipv6.conf.{all,default,lo}.disable_ipv6=0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF
# Live apply: 'all' gates new traffic; per-interface flags disable existing ifs
# (incl. lo, tailscale0, docker0 — fleet-wide consistent, v4 everywhere).
sysctl -q -w net.ipv6.conf.all.disable_ipv6=1
sysctl -q -w net.ipv6.conf.default.disable_ipv6=1
sysctl -q -w net.ipv6.conf.lo.disable_ipv6=1
for f in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
echo 1 > "$f" 2>/dev/null || true
done
v=$(sysctl -n net.ipv6.conf.all.disable_ipv6)
n=$(ip -6 addr show 2>/dev/null | grep -c inet6 || true)
echo "host=$(hostname) ipv6_disabled=$v remaining_inet6_addrs=$n"
siem/deploy-agent.sh
+10
View File
@@ -27,6 +27,16 @@ if ! grep -q "<address>$MGR</address>" "$CONF"; then
sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
fi
# Package robustness (learned on PMG/PBS hosts 2026-09-03): postinst can
# leave the MANAGER_IP placeholder, a missing wazuh user, and root:root
# ownership — all three break startup with misleading errors.
id wazuh >/dev/null 2>&1 || useradd -r -d /var/ossec -s /usr/sbin/nologin wazuh
sed -i "s|<address>MANAGER_IP</address>|<address>$MGR</address>|" "$CONF"
chown -R root:wazuh /var/ossec 2>/dev/null || true
chown -R wazuh:wazuh /var/ossec/queue /var/ossec/logs /var/ossec/etc 2>/dev/null || true
chown root:wazuh /var/ossec/var/run 2>/dev/null || true
chmod 770 /var/ossec/queue/sockets /var/ossec/var/run /var/ossec/etc 2>/dev/null || true
systemctl enable wazuh-agent >/dev/null 2>&1 || true
systemctl restart wazuh-agent
sleep 8