chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152
2026-09-03 21:22:18 -05:00
commit 64198418ee
18 changed files with 1118 additions and 0 deletions
@@ -0,0 +1,48 @@
+#!/bin/bash
+#
+# deploy-agent.sh — Wazuh agent rollout for Ubuntu VMs [#335]
+# Run as root on the target VM. Idempotent; safe to re-run.
+# Manager: tsys-wazuh.knel.net (syslog/agent ports verified 2026-09-02).
+#
+set -euo pipefail
+
+MGR="tsys-wazuh.knel.net"
+VER="4.14.7-1"
+ARCH="$(dpkg --print-architecture)"
+# Pinned mirror on tsys-ca [#758]; upstream fallback if the mirror is down
+MIRROR="http://tsys-ca.knel.net/ca/dist/wazuh-agent/${VER}/wazuh-agent_${VER}_${ARCH}.deb"
+UPSTREAM="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_${VER}_${ARCH}.deb"
+
+if ! dpkg -s wazuh-agent >/dev/null 2>&1; then
+  echo "installing wazuh-agent $VER ($ARCH; manager: $MGR)"
+  curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb "$MIRROR" \
+    || curl -sSf --max-time 120 -o /tmp/wazuh-agent.deb "$UPSTREAM"
+  WAZUH_MANAGER="$MGR" WAZUH_REGISTRATION_SERVER="$MGR" \
+    DEBIAN_FRONTEND=noninteractive dpkg -i /tmp/wazuh-agent.deb
+  rm -f /tmp/wazuh-agent.deb
+else
+  echo "wazuh-agent already installed: $(dpkg -l wazuh-agent | tail -1 | awk '{print $3}')"
+fi
+
+CONF=/var/ossec/etc/ossec.conf
+if ! grep -q "<address>$MGR</address>" "$CONF"; then
+  echo "correcting manager address in ossec.conf"
+  cp "$CONF" "$CONF.bak.$(date +%Y%m%d%H%M%S)"
+  sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
+fi
+
+# Package robustness (learned on PMG/PBS hosts 2026-09-03): postinst can
+# leave the MANAGER_IP placeholder, a missing wazuh user, and root:root
+# ownership — all three break startup with misleading errors.
+id wazuh >/dev/null 2>&1 || useradd -r -d /var/ossec -s /usr/sbin/nologin wazuh
+sed -i "s|<address>MANAGER_IP</address>|<address>$MGR</address>|" "$CONF"
+chown -R root:wazuh /var/ossec 2>/dev/null || true
+chown -R wazuh:wazuh /var/ossec/queue /var/ossec/logs /var/ossec/etc 2>/dev/null || true
+chown root:wazuh /var/ossec/var/run 2>/dev/null || true
+chmod 770 /var/ossec/queue/sockets /var/ossec/var/run /var/ossec/etc 2>/dev/null || true
+
+systemctl enable wazuh-agent >/dev/null 2>&1 || true
+systemctl restart wazuh-agent
+sleep 8
+systemctl -q is-active wazuh-agent && echo "wazuh-agent ACTIVE"
+grep -iE "enroll|connected to" /var/ossec/logs/ossec.log | tail -3 || echo "(no enrollment lines yet — check manager side)"