diff --git a/README.md b/README.md index cb026f8076f0ed389cb4c5f8de699fa33b0ee83d..ac1dfb4ea857a9bb3f6e0d76dc19a944dad5c9fd 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ Temporary solution: Upload your ssh key to gitlab.geant.org `cd soctools` Install soctools: -Edit group_vars/all/main.yml and change 'dslproxy' so that it point to the FQDN of the server. +Edit group_vars/all/main.yml and change 'soctoolsproxy' so that it point to the FQDN of the server. `vi group_vars/all/main.yml` The first entry in the soctools_users variable is the user with full admin privileges in NiFi and Kibana. diff --git a/buildca.yml b/buildca.yml index b718286139aa329e0a343f4ff60624cdfc6b3c34..37ef902ce7086d5c92610d72eb86fa0e5022aec6 100644 --- a/buildca.yml +++ b/buildca.yml @@ -1,7 +1,7 @@ --- - name: Build certification authority - hosts: dsldev + hosts: soctoolsmain roles: - ca diff --git a/buildimages.yml b/buildimages.yml index d30f905968d72cffd2aaf2973fcf65a33a3107b2..8a935836e253947d7181cf637718e66cb6b80b23 100644 --- a/buildimages.yml +++ b/buildimages.yml @@ -1,7 +1,7 @@ --- - name: Build docker images - hosts: dsldev + hosts: soctoolsmain roles: - build diff --git a/group_vars/all/main.yml b/group_vars/all/main.yml index 28c551bbd87d232f7194b03905c229cd6721826e..840fe8340eef3338d7c72dd9612e31f19ccb7000 100644 --- a/group_vars/all/main.yml +++ b/group_vars/all/main.yml @@ -1,6 +1,6 @@ --- -dslproxy: "<CHANGE_ME:hostname>" +soctoolsproxy: "<CHANGE_ME:hostname>" # TheHive Button plugin THEHIVE_URL: "https://hive.gn4-3-wp8-soc.sunet.se/" @@ -14,14 +14,14 @@ repo: gn43-dsl version: 7 suffix: a20201004 -haproxy_name: "dsoclab-haproxy" +haproxy_name: "soctools-haproxy" haproxy_version: "2.2" haproxy_img: "{{repo}}/haproxy:{{version}}{{suffix}}" HAPROXY_PROCESSES: "2" HAPROXY_STATS_PASS: "eiph2Eepaizicheelah3tei+bae3ohgh" FILEBEAT_VERSION: "7.9.3" -FILEBEAT_OUTPUT_HOST: "{{dslproxy}}" +FILEBEAT_OUTPUT_HOST: "{{soctoolsproxy}}" FILEBEAT_OUTPUT_PORT: "6000" FILEBEAT_CERT: "/opt/filebeat/filebeat.crt" FILEBEAT_KEY: "/opt/filebeat/filebeat.key" @@ -30,27 +30,27 @@ temp_root: "/tmp/centosbuild" openjdk_img: "{{repo}}/openjdk:{{version}}{{suffix}}" -zookeeper_name: "dsoclab-zookeeper" +zookeeper_name: "soctools-zookeeper" zookeeper_img: "{{repo}}/zookeeper:{{version}}{{suffix}}" -misp_name: "dsoclab-misp" +misp_name: "soctools-misp" misp_img: "{{repo}}/misp:{{version}}{{suffix}}" nifi_img: "{{repo}}/nifi:{{version}}{{suffix}}" -mysql_name: "dsoclab-mysql" +mysql_name: "soctools-mysql" mysql_img: "{{repo}}/mysql:{{version}}{{suffix}}" mysql_dbrootpass: "Pass006" -cassandra_name: "dsoclab-cassandra" +cassandra_name: "soctools-cassandra" cassandra_img: "{{repo}}/cassandra:{{version}}{{suffix}}" -thehive_name: "dsoclab-thehive" +thehive_name: "soctools-thehive" thehive_img: "{{repo}}/thehive:{{version}}{{suffix}}" # GENERATED WITH cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1 thehive_secret_key: "LcnI9eKLo33711BmCnzf6UM1y05pdmj3dlADL81PxuffWqhobRoiiGFftjNPKpmM" -cortex_name: "dsoclab-cortex" +cortex_name: "soctools-cortex" cortex_img: "{{repo}}/cortex:{{version}}{{suffix}}" cortex_elasticsearch_mem: "256m" # GENERATED WITH cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 64 | head -n 1 diff --git a/inventories/cassandra b/inventories/cassandra index 82e7f1e6c1a8a8a4d16cd47bcdeb87158432657c..65a4f3475d64e7d85474ef8f6831d9df949b6dee 100644 --- a/inventories/cassandra +++ b/inventories/cassandra @@ -1,2 +1,2 @@ [cassandra] -dsoclab-cassandra ansible_connection=docker +soctools-cassandra ansible_connection=docker diff --git a/inventories/cortex b/inventories/cortex index aeedc48a40d42d256b5e644de5b90ea2680fef0c..6a64e81773fe3de5f89dd23e65ed35d6fcf4bfdd 100644 --- a/inventories/cortex +++ b/inventories/cortex @@ -1,2 +1,2 @@ [cortex] -dsoclab-cortex ansible_connection=docker +soctools-cortex ansible_connection=docker diff --git a/inventories/elasticsearch b/inventories/elasticsearch index 5f4b7ded6cd315b35c574619cffdafe239fbb378..73901fb0cd71e4434bd33159a45fc97c34ee98bb 100644 --- a/inventories/elasticsearch +++ b/inventories/elasticsearch @@ -1,3 +1,3 @@ [odfeescontainers] -dsoclab-odfe-1 ansible_connection=docker -dsoclab-odfe-2 ansible_connection=docker +soctools-odfe-1 ansible_connection=docker +soctools-odfe-2 ansible_connection=docker diff --git a/inventories/filebeat b/inventories/filebeat index 067871d702a8d20fc9f2642e21074ef9a9b1cc32..d0fd1a29c65399c25ca1e6a5ce363b913004afcd 100644 --- a/inventories/filebeat +++ b/inventories/filebeat @@ -1,15 +1,15 @@ [filebeat] -dsoclab-nifi-1 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" -dsoclab-nifi-2 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" -dsoclab-nifi-3 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" -dsoclab-misp ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-php72/log/php-fpm/*.log","/var/opt/rh/rh-redis32/log/redis/redis.log","/var/log/httpd/*log","/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="misp" FILEBEAT_LOG_FORMAT="text" -#dsoclab-odfe-1 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/dsoclab-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe1" FILEBEAT_LOG_FORMAT="json" -#dsoclab-odfe-2 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/dsoclab-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe2" FILEBEAT_LOG_FORMAT="json" -dsoclab-kibana ansible_connection=docker FILEBEAT_FILES='["/usr/share/kibana/kblog"]' FILEBEAT_LOG_TYPE="kibana" FILEBEAT_LOG_FORMAT="text" -dsoclab-keycloak ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="keycloak" FILEBEAT_LOG_FORMAT="text" -dsoclab-mysql ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-mariadb103/log/mariadb/mariadb.log"]' FILEBEAT_LOG_TYPE="mysql" FILEBEAT_LOG_FORMAT="text" -dsoclab-haproxy ansible_connection=docker FILEBEAT_SYSLOG_PORT=9000 FILEBEAT_LOG_TYPE="haproxy" FILEBEAT_LOG_FORMAT="text" -dsoclab-zookeeper ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="zookeeper" FILEBEAT_LOG_FORMAT="text" -dsoclab-cortex ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="cortex" FILEBEAT_LOG_FORMAT="text" -dsoclab-thehive ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="thehive" FILEBEAT_LOG_FORMAT="text" -dsoclab-cassandra ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="cassandra" FILEBEAT_LOG_FORMAT="text" +soctools-nifi-1 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" +soctools-nifi-2 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" +soctools-nifi-3 ansible_connection=docker FILEBEAT_FILES='["/opt/nifi/nifi-current/logs/nifi-app.log","/opt/nifi/nifi-current/logs/nifi-bootstrap.log","/opt/nifi/nifi-current/logs/nifi-user.log"]' FILEBEAT_LOG_TYPE="nifi" FILEBEAT_LOG_FORMAT="text" +soctools-misp ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-php72/log/php-fpm/*.log","/var/opt/rh/rh-redis32/log/redis/redis.log","/var/log/httpd/*log","/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="misp" FILEBEAT_LOG_FORMAT="text" +#soctools-odfe-1 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/soctools-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe1" FILEBEAT_LOG_FORMAT="json" +#soctools-odfe-2 ansible_connection=docker FILEBEAT_FILES='["/usr/share/elasticsearch/logs/soctools-cluster_server.json"]' FILEBEAT_LOG_TYPE="odfe2" FILEBEAT_LOG_FORMAT="json" +soctools-kibana ansible_connection=docker FILEBEAT_FILES='["/usr/share/kibana/kblog"]' FILEBEAT_LOG_TYPE="kibana" FILEBEAT_LOG_FORMAT="text" +soctools-keycloak ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="keycloak" FILEBEAT_LOG_FORMAT="text" +soctools-mysql ansible_connection=docker FILEBEAT_FILES='["/var/opt/rh/rh-mariadb103/log/mariadb/mariadb.log"]' FILEBEAT_LOG_TYPE="mysql" FILEBEAT_LOG_FORMAT="text" +soctools-haproxy ansible_connection=docker FILEBEAT_SYSLOG_PORT=9000 FILEBEAT_LOG_TYPE="haproxy" FILEBEAT_LOG_FORMAT="text" +soctools-zookeeper ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="zookeeper" FILEBEAT_LOG_FORMAT="text" +soctools-cortex ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="cortex" FILEBEAT_LOG_FORMAT="text" +soctools-thehive ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="thehive" FILEBEAT_LOG_FORMAT="text" +soctools-cassandra ansible_connection=docker FILEBEAT_FILES='["/var/log/supervisor/*.log"]' FILEBEAT_LOG_TYPE="cassandra" FILEBEAT_LOG_FORMAT="text" diff --git a/inventories/haproxy b/inventories/haproxy index b8ea6a7a98ef1830a3c9e3325b9f222ca3479880..7ded04a5134a971fadf026b2d214fa2ce11e1ec4 100644 --- a/inventories/haproxy +++ b/inventories/haproxy @@ -1,2 +1,2 @@ [haproxy] -dsoclab-haproxy ansible_connection=docker \ No newline at end of file +soctools-haproxy ansible_connection=docker \ No newline at end of file diff --git a/inventories/keycloak b/inventories/keycloak index c2746ec3f1e8691c5f153a526229ae9417a979f9..b998e8f6a613fd2feb0450a5ad11a0237c952ae6 100644 --- a/inventories/keycloak +++ b/inventories/keycloak @@ -1,2 +1,2 @@ [keycloakcontainers] -dsoclab-keycloak ansible_connection=docker +soctools-keycloak ansible_connection=docker diff --git a/inventories/kibana b/inventories/kibana index 557280d755934082c50d14f2afef5f35fcf63bf3..1f00ac6c362b94aaf698cb74343d1fbf2a402ab1 100644 --- a/inventories/kibana +++ b/inventories/kibana @@ -1,2 +1,2 @@ [odfekibanacontainers] -dsoclab-kibana ansible_connection=docker +soctools-kibana ansible_connection=docker diff --git a/inventories/misp b/inventories/misp index 331506d27ba5decc558906ead132ad2539918ff5..445ec1e88dde819705331e8a221d9540bf7cf34e 100644 --- a/inventories/misp +++ b/inventories/misp @@ -1,2 +1,2 @@ [mispcontainers] -dsoclab-misp ansible_connection=docker +soctools-misp ansible_connection=docker diff --git a/inventories/mysql b/inventories/mysql index f9dcc2455a3a2f44f4c6c02f99503fa8e85500ec..6d0b3065b10647a34ff7eebc94dde8d3197788be 100644 --- a/inventories/mysql +++ b/inventories/mysql @@ -1,2 +1,2 @@ [mysql] -dsoclab-mysql ansible_connection=docker \ No newline at end of file +soctools-mysql ansible_connection=docker \ No newline at end of file diff --git a/inventories/nifi b/inventories/nifi index e2c7ff18e58bbd5b70056bb6c43692807febe697..d434490139a0736c046257fdf260d503f76576ff 100644 --- a/inventories/nifi +++ b/inventories/nifi @@ -1,4 +1,4 @@ [nificontainers] -dsoclab-nifi-1 ansible_connection=docker -dsoclab-nifi-2 ansible_connection=docker -dsoclab-nifi-3 ansible_connection=docker +soctools-nifi-1 ansible_connection=docker +soctools-nifi-2 ansible_connection=docker +soctools-nifi-3 ansible_connection=docker diff --git a/inventories/soctools b/inventories/soctools index 71a2d973d4714863feb8fb76cfe341e0673e685b..46ea675635f842bbcae314c0c21ff55b3d3ab425 100644 --- a/inventories/soctools +++ b/inventories/soctools @@ -1,2 +1,2 @@ -[dsldev] +[soctoolsmain] localhost ansible_connection=local diff --git a/inventories/thehive b/inventories/thehive index e19556d6137d67cb17fc28fb5b3ca3be3f10488e..6fd7b99444c07fac165fa5bca0ec19ec270db0ef 100644 --- a/inventories/thehive +++ b/inventories/thehive @@ -1,2 +1,2 @@ [thehive] -dsoclab-thehive ansible_connection=docker +soctools-thehive ansible_connection=docker diff --git a/roles/build/tasks/main.yml b/roles/build/tasks/main.yml index 223766f87e2d7d1ae88de3d70dd7810a0dbdf091..e08a9cf271fd3bab9ba3b2f72f87e2eec3efdc54 100644 --- a/roles/build/tasks/main.yml +++ b/roles/build/tasks/main.yml @@ -2,7 +2,7 @@ - assert: that: - - "'CHANGE_ME' not in dslproxy" + - "'CHANGE_ME' not in soctoolsproxy" fail_msg: "Review *all* settings in group_vars/all/main.yml" - include: centos.yml diff --git a/roles/build/templates/cortex/application.conf b/roles/build/templates/cortex/application.conf index 0e28b4d0d71643d558b0d014be354985a02d19c7..afe42a610e0b4865af6e2d382cc88e46d7943882 100644 --- a/roles/build/templates/cortex/application.conf +++ b/roles/build/templates/cortex/application.conf @@ -17,7 +17,7 @@ search { index = cortex3 # ElasticSearch instance address. # For cluster, join address:port with ',': "http://ip1:9200,ip2:9200,ip3:9200" - uri = "http://dsoclab-elastic:9200" + uri = "http://soctools-elastic:9200" ## Advanced configuration # Scroll keepalive. diff --git a/roles/ca/tasks/main.yml b/roles/ca/tasks/main.yml index ded1deb425aa646a11f3d9af8c2137cb398e8988..8d982c51d19b61b28dbb39164565784404c8901d 100644 --- a/roles/ca/tasks/main.yml +++ b/roles/ca/tasks/main.yml @@ -57,7 +57,7 @@ - name: Generate host certificates command: > roles/ca/files/easyrsa/easyrsa - --subject-alt-name="DNS:{{item}},DNS:{{dslproxy}}" + --subject-alt-name="DNS:{{item}},DNS:{{soctoolsproxy}}" build-serverClient-full {{item}} nopass with_items: - "{{ groups['nificontainers'] }}" diff --git a/roles/cortex/templates/application.conf.j2 b/roles/cortex/templates/application.conf.j2 index 35323e050bc2460ef223066103b41aa563dd95e6..56ef22f5583db5ac8b0e9413276a19b4efc76f20 100644 --- a/roles/cortex/templates/application.conf.j2 +++ b/roles/cortex/templates/application.conf.j2 @@ -38,7 +38,7 @@ search { ## ## ## SSL configuration ## search.keyStore { -## path = "/etc/cortex/dsoclab-cortex.p12" +## path = "/etc/cortex/soctools-cortex.p12" ## type = "PKCS12" # or PKCS12 ## password = "{{kspass}}" ## } diff --git a/roles/keycloak/templates/initkeycloakrealm.sh.j2 b/roles/keycloak/templates/initkeycloakrealm.sh.j2 index 481942ebb8a47efbb0397a0f0976daf5ca762c2b..f4cfc9ec97b8829820128672692c6b3ef844e8c9 100644 --- a/roles/keycloak/templates/initkeycloakrealm.sh.j2 +++ b/roles/keycloak/templates/initkeycloakrealm.sh.j2 @@ -21,14 +21,14 @@ kcadm.sh create realms/{{openid_realm}}/users -b '{"enabled":true,"attributes":{ kcadm.sh set-password -r {{openid_realm}} --username {{user.username}} --new-password {{user.password}} {% endfor %} -NIFICLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"dsoclab-nifi","protocol":"openid-connect","clientAuthenticatorType": "client-secret","redirectUris": ["https://{{dslproxy}}:9443/*" ],"webOrigins": [], "publicClient": false }') +NIFICLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"soctools-nifi","protocol":"openid-connect","clientAuthenticatorType": "client-secret","redirectUris": ["https://{{soctoolsproxy}}:9443/*" ],"webOrigins": [], "publicClient": false }') kcadm.sh create realms/{{openid_realm}}/clients/${NIFICLIENT}/protocol-mappers/models -b '{"protocol":"openid-connect","config":{"id.token.claim":"true","access.token.claim":"true","userinfo.token.claim":"true","multivalued":"","aggregate.attrs":"","user.attribute":"DN","claim.name":"DN","jsonType.label":"String"},"name":"SendDN","protocolMapper":"oidc-usermodel-attribute-mapper"}' kcadm.sh get realms/{{openid_realm}}/clients/${NIFICLIENT}/client-secret --fields value > /opt/jboss/keycloak/nifisecret -KIBANACLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"dsoclab-kibana","protocol":"openid-connect","clientAuthenticatorType": "client-secret","rootUrl": "https://{{dslproxy}}:5601","adminUrl": "","redirectUris": ["https://{{dslproxy}}:5601", "https://{{dslproxy}}:5601/auth/openid/login", "https://{{dslproxy}}:5601/app/kibana" ],"webOrigins": [], "publicClient": false }') +KIBANACLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"soctools-kibana","protocol":"openid-connect","clientAuthenticatorType": "client-secret","rootUrl": "https://{{soctoolsproxy}}:5601","adminUrl": "","redirectUris": ["https://{{soctoolsproxy}}:5601", "https://{{soctoolsproxy}}:5601/auth/openid/login", "https://{{soctoolsproxy}}:5601/app/kibana" ],"webOrigins": [], "publicClient": false }') kcadm.sh get realms/{{openid_realm}}/clients/${KIBANACLIENT}/client-secret --fields value > /opt/jboss/keycloak/kibanasecret -MISPCLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"dsoclab-misp","protocol":"openid-connect","clientAuthenticatorType": "client-secret","rootUrl": "https://{{dslproxy}}:6443","adminUrl": "","redirectUris": ["https://{{dslproxy}}:6443/users/login/keycloak"],"webOrigins": [], "publicClient": false }') +MISPCLIENT=$(kcadm.sh create realms/{{openid_realm}}/clients -i -b '{"enabled":true, "clientId":"soctools-misp","protocol":"openid-connect","clientAuthenticatorType": "client-secret","rootUrl": "https://{{soctoolsproxy}}:6443","adminUrl": "","redirectUris": ["https://{{soctoolsproxy}}:6443/users/login/keycloak"],"webOrigins": [], "publicClient": false }') kcadm.sh get realms/{{openid_realm}}/clients/${MISPCLIENT}/client-secret --fields value > /opt/jboss/keycloak/mispsecret kcadm.sh config truststore --delete diff --git a/roles/misp/tasks/config.yml b/roles/misp/tasks/config.yml index 8ff025289eee2b5e9e757485f273628f82887e3a..52bfaac96d8de021dd493fc69ebb5c42da1f0dce 100644 --- a/roles/misp/tasks/config.yml +++ b/roles/misp/tasks/config.yml @@ -9,7 +9,7 @@ - {"var":"Plugin.CustomAuth_enable","value":"true"} - {"var":"Plugin.CustomAuth_header","value":"X_REMOTE_USER"} - {"var":"Plugin.CustomAuth_disable_logout","value":"true"} - - {"var":"MISP.external_baseurl","value":"https://{{dslproxy}}:6443"} + - {"var":"MISP.external_baseurl","value":"https://{{soctoolsproxy}}:6443"} - {"var":"MISP.live","value":"true"} - name: Init default user @@ -35,7 +35,7 @@ - name: add users uri: - url: "https://{{dslproxy}}:6443/admin/users/add/1" + url: "https://{{soctoolsproxy}}:6443/admin/users/add/1" method: POST body_format: json headers: @@ -49,7 +49,7 @@ - name: Enable feed uri: - url: "https://{{dslproxy}}:6443/feeds/edit/1" + url: "https://{{soctoolsproxy}}:6443/feeds/edit/1" method: POST body_format: json headers: diff --git a/roles/misp/templates/misp.conf.j2 b/roles/misp/templates/misp.conf.j2 index 4e3189ce7e2d625323239672d6ae7c43a32b3be7..a1fa137965d50ab49999d749527dd6ca7df6e54b 100644 --- a/roles/misp/templates/misp.conf.j2 +++ b/roles/misp/templates/misp.conf.j2 @@ -1,7 +1,7 @@ Listen 6443 https <VirtualHost *:6443> -ServerAdmin admin@{{dslproxy}} -ServerName {{dslproxy}} +ServerAdmin admin@{{soctoolsproxy}} +ServerName {{soctoolsproxy}} DocumentRoot /var/www/MISP/app/webroot <Directory /var/www/MISP/app/webroot> Options -Indexes @@ -15,9 +15,9 @@ ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9000/var/www/MISP/app/webroot SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 OIDCCryptoPassphrase {{misp_crypto_pass}} -OIDCProviderMetadataURL https://{{dslproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration -OIDCRedirectURI https://{{dslproxy}}:6443/users/login/keycloak -OIDCClientID dsoclab-misp +OIDCProviderMetadataURL https://{{soctoolsproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration +OIDCRedirectURI https://{{soctoolsproxy}}:6443/users/login/keycloak +OIDCClientID soctools-misp OIDCScope "openid profile" OIDCClientSecret {{mispsecret.value}} OIDCRemoteUserClaim email diff --git a/roles/nifi/templates/flow.xml.j2 b/roles/nifi/templates/flow.xml.j2 index 8070e40a1f0a7db2357a5228a8bb1457035138cf..8fbd37ffb0939b420f881637ec2d3bbfeb8ddd0c 100644 --- a/roles/nifi/templates/flow.xml.j2 +++ b/roles/nifi/templates/flow.xml.j2 @@ -10679,7 +10679,7 @@ <variable name="misp_ip_first_interval" value="60d" /> <variable name="elastic_username" value="{{ elastic_username }}" /> <variable name="misp_url" value="{{ misp_url }}" /> - <variable name="elastic_url" value="https://{{ dslproxy }}:9200" /> + <variable name="elastic_url" value="https://{{ soctoolsproxy }}:9200" /> <variable name="elastic_password" value="{{ odfees_adminpass }}" /> </rootGroup> <controllerServices /> diff --git a/roles/nifi/templates/nifi.properties.j2 b/roles/nifi/templates/nifi.properties.j2 index e9db2e89f89702dcfcabeeba55a4a3e40042a031..6efbc1e3169fb8f8e1f7422b5d8cb4627697782e 100644 --- a/roles/nifi/templates/nifi.properties.j2 +++ b/roles/nifi/templates/nifi.properties.j2 @@ -143,7 +143,7 @@ nifi.web.jetty.working.directory=./work/jetty nifi.web.jetty.threads=200 nifi.web.max.header.size=16 KB nifi.web.proxy.context.path=/nifi -nifi.web.proxy.host={{ dslproxy }}:9443 +nifi.web.proxy.host={{ soctoolsproxy }}:9443 # security properties # nifi.sensitive.props.key= @@ -165,10 +165,10 @@ nifi.security.ocsp.responder.url= nifi.security.ocsp.responder.certificate= # OpenId Connect SSO Properties # -nifi.security.user.oidc.discovery.url=https://{{dslproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration +nifi.security.user.oidc.discovery.url=https://{{soctoolsproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration nifi.security.user.oidc.connect.timeout=5 secs nifi.security.user.oidc.read.timeout=5 secs -nifi.security.user.oidc.client.id=dsoclab-nifi +nifi.security.user.oidc.client.id=soctools-nifi nifi.security.user.oidc.client.secret={{nifisecret.value}} nifi.security.user.oidc.preferred.jwsalgorithm= nifi.security.user.oidc.additional.scopes={{openid_scope}} @@ -226,7 +226,7 @@ nifi.cluster.load.balance.max.thread.count=8 nifi.cluster.load.balance.comms.timeout=30 sec # zookeeper properties, used for cluster management # -nifi.zookeeper.connect.string=dsoclab-zookeeper:2181 +nifi.zookeeper.connect.string=soctools-zookeeper:2181 nifi.zookeeper.connect.timeout=60 secs nifi.zookeeper.session.timeout=60 secs nifi.zookeeper.root.node=/nifi diff --git a/roles/odfees/tasks/main.yml b/roles/odfees/tasks/main.yml index ae6ae65701c4bebcf8cbd04bc4d4ddb9e246acfd..215392884bd059b535474fa198078cde3a7cb166 100644 --- a/roles/odfees/tasks/main.yml +++ b/roles/odfees/tasks/main.yml @@ -106,7 +106,7 @@ - start - name: Configure OpenDistro security - command: "bash ./plugins/opendistro_security/tools/securityadmin.sh -h {{groups['odfeescontainers'][0]}} -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -ks '/usr/share/elasticsearch/config/{{soctools_users[0].CN}}.p12' -kspass {{soctools_users[0].password}} -ts /usr/share/elasticsearch/config/cacerts.jks -tspass {{tspass}} -cn dsoclab-cluster" + command: "bash ./plugins/opendistro_security/tools/securityadmin.sh -h {{groups['odfeescontainers'][0]}} -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -ks '/usr/share/elasticsearch/config/{{soctools_users[0].CN}}.p12' -kspass {{soctools_users[0].password}} -ts /usr/share/elasticsearch/config/cacerts.jks -tspass {{tspass}} -cn soctools-cluster" when: "'{{groups['odfeescontainers'][0]}}' in inventory_hostname" tags: - start diff --git a/roles/odfees/templates/config/elasticsearch.yml.j2 b/roles/odfees/templates/config/elasticsearch.yml.j2 index ef61cd36dac6bdefebeaeab66a3c15b97aa3a25d..298388859563c8e7df385c5f2ccb9fccb011a648 100644 --- a/roles/odfees/templates/config/elasticsearch.yml.j2 +++ b/roles/odfees/templates/config/elasticsearch.yml.j2 @@ -1,4 +1,4 @@ -cluster.name: "dsoclab-cluster" +cluster.name: "soctools-cluster" #network.host: 0.0.0.0 network.host: {{ inventory_hostname }} discovery.seed_hosts: diff --git a/roles/odfees/templates/securityconfig/config.yml.j2 b/roles/odfees/templates/securityconfig/config.yml.j2 index 26e77a4fa806fe68767015fc40ad620117985ac5..49368676333bb6153b32e988dcd9bd60764426b2 100644 --- a/roles/odfees/templates/securityconfig/config.yml.j2 +++ b/roles/odfees/templates/securityconfig/config.yml.j2 @@ -116,7 +116,7 @@ config: config: subject_key: {{openid_subjkey}} roles_key: roles - openid_connect_url: https://{{dslproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration + openid_connect_url: https://{{soctoolsproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration enable_ssl: true verify_hostnames: false pemtrustedcas_filepath: "/usr/share/elasticsearch/config/{{ca_cn}}.crt" diff --git a/roles/odfekibana/tasks/main.yml b/roles/odfekibana/tasks/main.yml index de89a77becee078489558b90d881bf0c9a967694..8d373812adf98c26147002bd01ef9acf4b3a311f 100644 --- a/roles/odfekibana/tasks/main.yml +++ b/roles/odfekibana/tasks/main.yml @@ -119,7 +119,7 @@ - name: Check Kibana health remote_user: kibana - shell: 'curl -k -b /tmp/cookie.txt -c /tmp/cookie.txt -X "GET" "https://{{dslproxy}}:5601/api/status" \ + shell: 'curl -k -b /tmp/cookie.txt -c /tmp/cookie.txt -X "GET" "https://{{soctoolsproxy}}:5601/api/status" \ | egrep status....overall....state...green' register: result until: result.rc == 0 @@ -138,7 +138,7 @@ # - start # #- name: change tenant to global -# shell: 'curl -X "POST" "https://{{dslproxy}}:5601/api/v1/multitenancy/tenant" \ +# shell: 'curl -X "POST" "https://{{soctoolsproxy}}:5601/api/v1/multitenancy/tenant" \ # -b /tmp/cookie.txt -c /tmp/cookie.txt \ # -k --user admin:{{ odfees_adminpass }} \ # -H "kbn-xsrf: reporting" -H "Content-Type: application/json" \ @@ -156,7 +156,7 @@ - name: Import graphs to kibana remote_user: kibana - shell: 'curl -X "POST" "https://{{dslproxy}}:5601/api/saved_objects/_import?overwrite=true" \ + shell: 'curl -X "POST" "https://{{soctoolsproxy}}:5601/api/saved_objects/_import?overwrite=true" \ -b /tmp/cookie.txt -c /tmp/cookie.txt \ -k --user admin:{{ odfees_adminpass }} \ -H "kbn-xsrf: reporting" -H "Content-Type: multipart/form-data" \ @@ -174,7 +174,7 @@ - name: Grant admin permissions to users remote_user: kibana - shell: 'curl -X "POST" "https://{{dslproxy}}:5601/api/v1/configuration/rolesmapping/all_access" \ + shell: 'curl -X "POST" "https://{{soctoolsproxy}}:5601/api/v1/configuration/rolesmapping/all_access" \ -b /tmp/cookie.txt -c /tmp/cookie.txt \ -k --user admin:{{ odfees_adminpass }} \ -H "kbn-xsrf: reporting" -H "Content-Type: application/json" \ diff --git a/roles/odfekibana/templates/kibana.yml.j2 b/roles/odfekibana/templates/kibana.yml.j2 index 55210f56dff446b1348f11163f64399901833032..a94de652aa8cd0ef0a6b5501e22ba9fa91c0d41a 100644 --- a/roles/odfekibana/templates/kibana.yml.j2 +++ b/roles/odfekibana/templates/kibana.yml.j2 @@ -39,11 +39,11 @@ opendistro_security.readonly_mode.roles: ["kibana_read_only"] #telemetry.enabled: false opendistro_security.auth.type: "openid" -opendistro_security.openid.connect_url: "https://{{dslproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration" -opendistro_security.openid.client_id: "dsoclab-kibana" +opendistro_security.openid.connect_url: "https://{{soctoolsproxy}}:12443/auth/realms/{{openid_realm}}/.well-known/openid-configuration" +opendistro_security.openid.client_id: "soctools-kibana" opendistro_security.openid.client_secret: "{{kibanasecret.value}}" opendistro_security.openid.root_ca: "/usr/share/kibana/config/{{ca_cn}}.crt" -opendistro_security.openid.base_redirect_url: "https://{{dslproxy}}:5601" +opendistro_security.openid.base_redirect_url: "https://{{soctoolsproxy}}:5601" opendistro_security.cookie.secure: true opendistro_security.cookie.password: "{{odfekibana_cookie}}" diff --git a/soctools_server.yml b/soctools_server.yml index 23716c5a7e7d32fdc7bedd0faf775afb5c55bfbc..382d998567a630c58950d28fd43802eaf31089d9 100644 --- a/soctools_server.yml +++ b/soctools_server.yml @@ -1,5 +1,5 @@ --- -- hosts: dsldev +- hosts: soctoolsmain become: true roles: - soctools-server diff --git a/startsoctools.yml b/startsoctools.yml index f2fd9c9c45640d07284a07b3bc181435c29dee63..929573b9807cf4f184b2f9663022965d36bf74b5 100644 --- a/startsoctools.yml +++ b/startsoctools.yml @@ -1,7 +1,7 @@ --- - name: Start docker containers - hosts: dsldev + hosts: soctoolsmain roles: - docker diff --git a/stopsoctools.yml b/stopsoctools.yml index 045c3f06243bc3358245c8bbf219d68e9f89a9a5..5bd121746729120486802cfc5538a181235b1642 100644 --- a/stopsoctools.yml +++ b/stopsoctools.yml @@ -6,7 +6,7 @@ - nifi - name: Stop all containers - hosts: dsldev + hosts: soctoolsmain roles: - docker diff --git a/utils/flow2template.py b/utils/flow2template.py index 570a1ef23d0606d7ef2db44b7133d5a6ec9f43b2..e00930a0049675d9b2723d2b68fd7029b4d2173c 100755 --- a/utils/flow2template.py +++ b/utils/flow2template.py @@ -19,7 +19,7 @@ for v in et.findall(".//variable"): elif a['name']=="maxmind_key": a['value']="{{ maxmind_key }}" elif a['name']=="elastic_url": - a['value']="https://{{ dslproxy }}:9200" + a['value']="https://{{ soctoolsproxy }}:9200" elif a['name']=="elastic_username": a['value']="{{ elastic_username }}" elif a['name']=="elastic_password":