mrcharles
d75366edf5
deploy-agent.sh now self-heals the three postinst failure modes found on PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with in-file rollback notes. Rollout state in #335/#748. Meat: https://projects.knownelement.com/issues/335#note-4008
45 lines
1.9 KiB
Bash
45 lines
1.9 KiB
Bash
#!/bin/bash
|
|
#
|
|
# deploy-agent.sh — Wazuh agent rollout for Ubuntu VMs [#335]
|
|
# Run as root on the target VM. Idempotent; safe to re-run.
|
|
# Manager: tsys-wazuh.knel.net (syslog/agent ports verified 2026-09-02).
|
|
#
|
|
set -euo pipefail
|
|
|
|
MGR="tsys-wazuh.knel.net"
|
|
VER="4.14.7-1"
|
|
|
|
if ! dpkg -s wazuh-agent >/dev/null 2>&1; then
|
|
echo "installing wazuh-agent $VER (manager: $MGR)"
|
|
curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb \
|
|
"https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_amd64.deb"
|
|
WAZUH_MANAGER="$MGR" WAZUH_REGISTRATION_SERVER="$MGR" \
|
|
DEBIAN_FRONTEND=noninteractive dpkg -i /tmp/wazuh-agent.deb
|
|
rm -f /tmp/wazuh-agent.deb
|
|
else
|
|
echo "wazuh-agent already installed: $(dpkg -l wazuh-agent | tail -1 | awk '{print $3}')"
|
|
fi
|
|
|
|
CONF=/var/ossec/etc/ossec.conf
|
|
if ! grep -q "<address>$MGR</address>" "$CONF"; then
|
|
echo "correcting manager address in ossec.conf"
|
|
cp "$CONF" "$CONF.bak.$(date +%Y%m%d%H%M%S)"
|
|
sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
|
|
fi
|
|
|
|
# Package robustness (learned on PMG/PBS hosts 2026-09-03): postinst can
|
|
# leave the MANAGER_IP placeholder, a missing wazuh user, and root:root
|
|
# ownership — all three break startup with misleading errors.
|
|
id wazuh >/dev/null 2>&1 || useradd -r -d /var/ossec -s /usr/sbin/nologin wazuh
|
|
sed -i "s|<address>MANAGER_IP</address>|<address>$MGR</address>|" "$CONF"
|
|
chown -R root:wazuh /var/ossec 2>/dev/null || true
|
|
chown -R wazuh:wazuh /var/ossec/queue /var/ossec/logs /var/ossec/etc 2>/dev/null || true
|
|
chown root:wazuh /var/ossec/var/run 2>/dev/null || true
|
|
chmod 770 /var/ossec/queue/sockets /var/ossec/var/run /var/ossec/etc 2>/dev/null || true
|
|
|
|
systemctl enable wazuh-agent >/dev/null 2>&1 || true
|
|
systemctl restart wazuh-agent
|
|
sleep 8
|
|
systemctl -q is-active wazuh-agent && echo "wazuh-agent ACTIVE"
|
|
grep -iE "enroll|connected to" /var/ossec/logs/ossec.log | tail -3 || echo "(no enrollment lines yet — check manager side)"
|