From 6f777761e752054eb0dc0149f6f20be20080b06c Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Sat, 14 Feb 2026 13:28:00 +0100 Subject: [PATCH] feat(wazuh): Add Wazuh security agent package New package secubox-app-wazuh provides: - Wazuh Agent installation and management for ARM64/OpenWrt - File Integrity Monitoring (FIM) for /etc, /usr/sbin, /etc/config - Log analysis: syslog, CrowdSec, firewall - Rootcheck and Security Configuration Assessment - CrowdSec integration for threat sync - CLI: wazuhctl with install/configure/register/status commands Wazuh provides SIEM/XDR capabilities complementing CrowdSec: - Endpoint detection and response - Compliance monitoring (PCI-DSS, GDPR, HIPAA) - Vulnerability detection - Active response automation Requires external Wazuh Manager or future secubox-wazuh-manager LXC. Co-Authored-By: Claude Opus 4.5 --- package/secubox/secubox-app-wazuh/Makefile | 53 +++ package/secubox/secubox-app-wazuh/README.md | 132 ++++++ .../secubox-app-wazuh/files/etc/config/wazuh | 35 ++ .../secubox-app-wazuh/files/etc/init.d/wazuh | 51 +++ .../secubox-app-wazuh/files/usr/sbin/wazuhctl | 431 ++++++++++++++++++ 5 files changed, 702 insertions(+) create mode 100644 package/secubox/secubox-app-wazuh/Makefile create mode 100644 package/secubox/secubox-app-wazuh/README.md create mode 100644 package/secubox/secubox-app-wazuh/files/etc/config/wazuh create mode 100644 package/secubox/secubox-app-wazuh/files/etc/init.d/wazuh create mode 100644 package/secubox/secubox-app-wazuh/files/usr/sbin/wazuhctl diff --git a/package/secubox/secubox-app-wazuh/Makefile b/package/secubox/secubox-app-wazuh/Makefile new file mode 100644 index 00000000..fcf5b258 --- /dev/null +++ b/package/secubox/secubox-app-wazuh/Makefile @@ -0,0 +1,53 @@ +include $(TOPDIR)/rules.mk + +PKG_NAME:=secubox-app-wazuh +PKG_VERSION:=1.0.0 +PKG_RELEASE:=1 + +PKG_MAINTAINER:=CyberMind +PKG_LICENSE:=GPL-2.0 + +include $(INCLUDE_DIR)/package.mk + +define Package/secubox-app-wazuh + SECTION:=secubox + CATEGORY:=SecuBox + SUBMENU:=Security + TITLE:=Wazuh Security Agent + DEPENDS:=+bash +curl +ca-bundle +coreutils-stat + PKGARCH:=all +endef + +define Package/secubox-app-wazuh/description + Wazuh security monitoring agent for SecuBox. + Provides endpoint detection, file integrity monitoring, + log analysis, and SIEM integration. + + Features: + - Wazuh Agent installation and management + - Integration with CrowdSec threat data + - OpenWrt system log monitoring + - File integrity monitoring (FIM) + - Security configuration assessment + - CLI: wazuhctl +endef + +define Package/secubox-app-wazuh/conffiles +/etc/config/wazuh +endef + +define Build/Compile +endef + +define Package/secubox-app-wazuh/install + $(INSTALL_DIR) $(1)/usr/sbin + $(INSTALL_BIN) ./files/usr/sbin/wazuhctl $(1)/usr/sbin/ + + $(INSTALL_DIR) $(1)/etc/config + $(INSTALL_CONF) ./files/etc/config/wazuh $(1)/etc/config/ + + $(INSTALL_DIR) $(1)/etc/init.d + $(INSTALL_BIN) ./files/etc/init.d/wazuh $(1)/etc/init.d/ +endef + +$(eval $(call BuildPackage,secubox-app-wazuh)) diff --git a/package/secubox/secubox-app-wazuh/README.md b/package/secubox/secubox-app-wazuh/README.md new file mode 100644 index 00000000..146fe6ba --- /dev/null +++ b/package/secubox/secubox-app-wazuh/README.md @@ -0,0 +1,132 @@ +# SecuBox Wazuh Agent + +Wazuh security monitoring agent for SecuBox. Provides endpoint detection and response (EDR), file integrity monitoring (FIM), log analysis, and SIEM integration. + +## Features + +- **Endpoint Detection**: Real-time threat detection on OpenWrt +- **File Integrity Monitoring**: Track changes to critical system files +- **Log Analysis**: Monitor syslog, CrowdSec, firewall logs +- **Security Configuration Assessment**: Compliance checking +- **CrowdSec Integration**: Sync threat intelligence +- **Rootcheck**: Detect rootkits and malware + +## Quick Start + +```bash +# Install Wazuh agent +wazuhctl install + +# Configure manager connection +wazuhctl configure 192.168.1.100 + +# Register with manager +wazuhctl register + +# Start agent +wazuhctl start + +# Check status +wazuhctl status +``` + +## CLI Reference + +### Installation +| Command | Description | +|---------|-------------| +| `wazuhctl install` | Download and install Wazuh agent | +| `wazuhctl uninstall` | Remove Wazuh agent | +| `wazuhctl upgrade` | Upgrade to latest version | + +### Configuration +| Command | Description | +|---------|-------------| +| `wazuhctl configure ` | Configure manager connection | +| `wazuhctl register` | Register agent with manager | +| `wazuhctl set-name ` | Set agent hostname | + +### Service Control +| Command | Description | +|---------|-------------| +| `wazuhctl start` | Start Wazuh agent | +| `wazuhctl stop` | Stop Wazuh agent | +| `wazuhctl restart` | Restart agent | +| `wazuhctl status` | Show agent status | + +### Monitoring +| Command | Description | +|---------|-------------| +| `wazuhctl info` | Show agent information | +| `wazuhctl logs [n]` | Show last n log lines | +| `wazuhctl alerts [n]` | Show recent alerts | + +### Integration +| Command | Description | +|---------|-------------| +| `wazuhctl crowdsec-sync` | Sync CrowdSec alerts | +| `wazuhctl configure-fim` | Configure FIM directories | +| `wazuhctl configure-sca` | Enable SCA checks | + +## UCI Configuration + +``` +config wazuh 'main' + option enabled '1' + option manager_ip '192.168.1.100' + option manager_port '1514' + option agent_name 'secubox' + option protocol 'tcp' + +config monitoring 'monitoring' + option syslog '1' + option crowdsec_alerts '1' + option file_integrity '1' + option rootcheck '1' + +config fim 'fim' + list directories '/etc' + list directories '/usr/sbin' + list directories '/etc/config' + option realtime '1' +``` + +## Monitored Paths + +Default File Integrity Monitoring: +- `/etc` - System configuration +- `/etc/config` - UCI configuration +- `/etc/init.d` - Init scripts +- `/usr/sbin` - System binaries + +## CrowdSec Integration + +Wazuh monitors CrowdSec logs for: +- Ban decisions +- Alert events +- Threat patterns + +Sync manually: `wazuhctl crowdsec-sync` + +## Requirements + +- Wazuh Manager (external server or SecuBox LXC) +- Network connectivity to manager on port 1514 (TCP/UDP) +- ~35MB RAM for agent + +## Architecture + +``` +SecuBox (Agent) Wazuh Manager ++---------------+ +------------------+ +| wazuhctl | | Wazuh Server | +| ossec.conf |------->| OpenSearch | +| FIM/Rootcheck | | Dashboard | ++---------------+ +------------------+ +``` + +## References + +- [Wazuh Documentation](https://documentation.wazuh.com/) +- [Wazuh GitHub](https://github.com/wazuh/wazuh) +- [Agent Installation](https://documentation.wazuh.com/current/installation-guide/wazuh-agent/) diff --git a/package/secubox/secubox-app-wazuh/files/etc/config/wazuh b/package/secubox/secubox-app-wazuh/files/etc/config/wazuh new file mode 100644 index 00000000..520aa523 --- /dev/null +++ b/package/secubox/secubox-app-wazuh/files/etc/config/wazuh @@ -0,0 +1,35 @@ +config wazuh 'main' + option enabled '0' + option manager_ip '' + option manager_port '1514' + option agent_name '' + option registration_password '' + option protocol 'tcp' + +config agent 'agent' + option installed '0' + option version '' + option agent_id '' + option status 'disconnected' + +config monitoring 'monitoring' + option syslog '1' + option auth_log '1' + option firewall_log '1' + option crowdsec_alerts '1' + option file_integrity '1' + option rootcheck '1' + option sca '1' + +config fim 'fim' + list directories '/etc' + list directories '/usr/sbin' + list directories '/etc/config' + list directories '/etc/init.d' + option realtime '1' + option report_changes '1' + +config integration 'crowdsec' + option enabled '1' + option alerts_path '/var/log/crowdsec.log' + option sync_bans '1' diff --git a/package/secubox/secubox-app-wazuh/files/etc/init.d/wazuh b/package/secubox/secubox-app-wazuh/files/etc/init.d/wazuh new file mode 100644 index 00000000..7478812b --- /dev/null +++ b/package/secubox/secubox-app-wazuh/files/etc/init.d/wazuh @@ -0,0 +1,51 @@ +#!/bin/sh /etc/rc.common +# Wazuh Agent init script for SecuBox + +START=95 +STOP=10 +USE_PROCD=1 + +WAZUH_DIR="/var/ossec" +WAZUH_BIN="$WAZUH_DIR/bin/wazuh-agentd" +WAZUH_CONTROL="$WAZUH_DIR/bin/wazuh-control" + +start_service() { + local enabled + config_load wazuh + config_get enabled main enabled '0' + + [ "$enabled" != "1" ] && return 0 + + # Check if agent is installed + [ ! -x "$WAZUH_CONTROL" ] && { + logger -t wazuh "Wazuh agent not installed. Run: wazuhctl install" + return 1 + } + + procd_open_instance + procd_set_param command "$WAZUH_CONTROL" start + procd_set_param respawn + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_close_instance + + logger -t wazuh "Wazuh agent started" +} + +stop_service() { + [ -x "$WAZUH_CONTROL" ] && "$WAZUH_CONTROL" stop 2>/dev/null + logger -t wazuh "Wazuh agent stopped" +} + +reload_service() { + [ -x "$WAZUH_CONTROL" ] && "$WAZUH_CONTROL" reload 2>/dev/null + logger -t wazuh "Wazuh agent reloaded" +} + +service_triggers() { + procd_add_reload_trigger "wazuh" +} + +status() { + [ -x "$WAZUH_CONTROL" ] && "$WAZUH_CONTROL" status +} diff --git a/package/secubox/secubox-app-wazuh/files/usr/sbin/wazuhctl b/package/secubox/secubox-app-wazuh/files/usr/sbin/wazuhctl new file mode 100644 index 00000000..0309262f --- /dev/null +++ b/package/secubox/secubox-app-wazuh/files/usr/sbin/wazuhctl @@ -0,0 +1,431 @@ +#!/bin/bash +# SecuBox Wazuh Agent Controller +# Manages Wazuh security monitoring agent + +set -e + +WAZUH_VERSION="4.9.2" +WAZUH_DIR="/var/ossec" +WAZUH_CONF="$WAZUH_DIR/etc/ossec.conf" +WAZUH_CONTROL="$WAZUH_DIR/bin/wazuh-control" +CONFIG="wazuh" +DOWNLOAD_URL="https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent" + +. /lib/functions.sh + +log_info() { echo "[INFO] $*"; logger -t wazuh "$*"; } +log_warn() { echo "[WARN] $*" >&2; } +log_error() { echo "[ERROR] $*" >&2; } + +uci_get() { uci -q get ${CONFIG}.$1; } +uci_set() { uci set ${CONFIG}.$1="$2" && uci commit ${CONFIG}; } + +usage() { + cat <<'EOF' +SecuBox Wazuh Agent Controller + +Usage: wazuhctl [options] + +Installation: + install Download and install Wazuh agent + uninstall Remove Wazuh agent + upgrade Upgrade to latest version + +Configuration: + configure Configure manager connection + register Register agent with manager + set-name Set agent name + +Service Control: + start Start Wazuh agent + stop Stop Wazuh agent + restart Restart Wazuh agent + status Show agent status + +Monitoring: + info Show agent information + logs [n] Show last n log lines (default: 50) + alerts [n] Show recent alerts + +Integration: + crowdsec-sync Sync CrowdSec alerts to Wazuh + configure-fim Configure File Integrity Monitoring + configure-sca Configure Security Configuration Assessment + +Examples: + wazuhctl install + wazuhctl configure 192.168.1.100 + wazuhctl register + wazuhctl start +EOF +} + +# =========================================== +# Installation Functions +# =========================================== + +detect_arch() { + local arch=$(uname -m) + case "$arch" in + aarch64|arm64) echo "arm64" ;; + x86_64) echo "amd64" ;; + armv7l) echo "armhf" ;; + *) log_error "Unsupported architecture: $arch"; return 1 ;; + esac +} + +cmd_install() { + local arch=$(detect_arch) + [ -z "$arch" ] && return 1 + + log_info "Installing Wazuh Agent v$WAZUH_VERSION ($arch)..." + + # Check if already installed + if [ -x "$WAZUH_CONTROL" ]; then + log_warn "Wazuh agent already installed" + "$WAZUH_CONTROL" info 2>/dev/null || true + return 0 + fi + + # Create directories + mkdir -p /tmp/wazuh-install + cd /tmp/wazuh-install + + # Download agent package + local pkg_name="wazuh-agent_${WAZUH_VERSION}-1_${arch}.deb" + local pkg_url="${DOWNLOAD_URL}/${pkg_name}" + + log_info "Downloading $pkg_name..." + curl -fsSL -o "$pkg_name" "$pkg_url" || { + log_error "Failed to download Wazuh agent" + return 1 + } + + # Extract deb package (OpenWrt doesn't have dpkg) + log_info "Extracting package..." + ar x "$pkg_name" + tar -xzf data.tar.gz -C / + + # Set permissions + chmod 750 "$WAZUH_DIR" + chmod 640 "$WAZUH_CONF" 2>/dev/null || true + + # Cleanup + cd / + rm -rf /tmp/wazuh-install + + # Update UCI + uci_set agent.installed "1" + uci_set agent.version "$WAZUH_VERSION" + + log_info "Wazuh agent installed successfully" + log_info "Next: wazuhctl configure " +} + +cmd_uninstall() { + log_info "Uninstalling Wazuh agent..." + + # Stop service + [ -x "$WAZUH_CONTROL" ] && "$WAZUH_CONTROL" stop 2>/dev/null + + # Remove files + rm -rf "$WAZUH_DIR" + + # Update UCI + uci_set agent.installed "0" + uci_set agent.version "" + uci_set agent.agent_id "" + uci_set agent.status "uninstalled" + + log_info "Wazuh agent uninstalled" +} + +# =========================================== +# Configuration Functions +# =========================================== + +cmd_configure() { + local manager_ip="$1" + [ -z "$manager_ip" ] && { log_error "Manager IP required"; return 1; } + + local manager_port=$(uci_get main.manager_port) + local protocol=$(uci_get main.protocol) + local agent_name=$(uci_get main.agent_name) + + [ -z "$agent_name" ] && agent_name=$(uci -q get system.@system[0].hostname) + + log_info "Configuring Wazuh agent..." + log_info " Manager: $manager_ip:$manager_port" + log_info " Agent name: $agent_name" + + # Update UCI + uci_set main.manager_ip "$manager_ip" + uci_set main.agent_name "$agent_name" + + # Generate ossec.conf + cat > "$WAZUH_CONF" < + + +
$manager_ip
+ $manager_port + $protocol + + openwrt, secubox + 10 + 60 + yes + + + + no + 5000 + 500 + + + + + no + 43200 + yes + /etc + /usr/sbin + /etc/config + /etc/init.d + /etc/resolv.conf + /etc/mtab + + + + + no + yes + yes + yes + yes + yes + yes + yes + 43200 + + + + + syslog + /var/log/messages + + + + syslog + /var/log/crowdsec.log + + + + + command + logread -l 100 + openwrt-syslog + 60 + + + + command + cat /proc/net/nf_conntrack 2>/dev/null | wc -l + conntrack-count + 300 + + + + + no + $WAZUH_DIR/etc/wpk_root.pem + + + +CONF + + chmod 640 "$WAZUH_CONF" + log_info "Configuration saved to $WAZUH_CONF" +} + +cmd_register() { + local manager_ip=$(uci_get main.manager_ip) + local agent_name=$(uci_get main.agent_name) + local password=$(uci_get main.registration_password) + + [ -z "$manager_ip" ] && { log_error "Manager not configured. Run: wazuhctl configure "; return 1; } + + log_info "Registering agent with manager $manager_ip..." + + local reg_cmd="$WAZUH_DIR/bin/agent-auth" + if [ -x "$reg_cmd" ]; then + local args="-m $manager_ip -A $agent_name" + [ -n "$password" ] && args="$args -P $password" + + $reg_cmd $args || { + log_error "Registration failed" + return 1 + } + + # Get agent ID + local agent_id=$(grep -oP '(?<=)[^<]+' "$WAZUH_DIR/etc/client.keys" 2>/dev/null | head -1) + [ -n "$agent_id" ] && uci_set agent.agent_id "$agent_id" + + log_info "Agent registered successfully (ID: $agent_id)" + else + log_error "agent-auth not found. Install agent first." + return 1 + fi +} + +cmd_set_name() { + local name="$1" + [ -z "$name" ] && { log_error "Agent name required"; return 1; } + uci_set main.agent_name "$name" + log_info "Agent name set to: $name" +} + +# =========================================== +# Service Control +# =========================================== + +cmd_start() { + if [ ! -x "$WAZUH_CONTROL" ]; then + log_error "Wazuh agent not installed" + return 1 + fi + uci_set main.enabled "1" + "$WAZUH_CONTROL" start + uci_set agent.status "running" + log_info "Wazuh agent started" +} + +cmd_stop() { + if [ -x "$WAZUH_CONTROL" ]; then + "$WAZUH_CONTROL" stop + uci_set agent.status "stopped" + log_info "Wazuh agent stopped" + fi +} + +cmd_restart() { + cmd_stop + sleep 2 + cmd_start +} + +cmd_status() { + echo "=== Wazuh Agent Status ===" + echo "" + + local installed=$(uci_get agent.installed) + local version=$(uci_get agent.version) + local agent_id=$(uci_get agent.agent_id) + local manager_ip=$(uci_get main.manager_ip) + local enabled=$(uci_get main.enabled) + + echo "Installed: $([ "$installed" = "1" ] && echo "Yes ($version)" || echo "No")" + echo "Agent ID: ${agent_id:-Not registered}" + echo "Manager: ${manager_ip:-Not configured}" + echo "Enabled: $([ "$enabled" = "1" ] && echo "Yes" || echo "No")" + echo "" + + if [ -x "$WAZUH_CONTROL" ]; then + echo "=== Service Status ===" + "$WAZUH_CONTROL" status 2>/dev/null || echo "Service not running" + fi +} + +cmd_info() { + if [ -x "$WAZUH_CONTROL" ]; then + "$WAZUH_CONTROL" info + else + log_error "Wazuh agent not installed" + fi +} + +cmd_logs() { + local lines="${1:-50}" + local log_file="$WAZUH_DIR/logs/ossec.log" + + if [ -f "$log_file" ]; then + tail -n "$lines" "$log_file" + else + log_warn "Log file not found: $log_file" + logread | grep -i wazuh | tail -n "$lines" + fi +} + +cmd_alerts() { + local lines="${1:-20}" + local alerts_file="$WAZUH_DIR/logs/alerts/alerts.json" + + if [ -f "$alerts_file" ]; then + tail -n "$lines" "$alerts_file" | python3 -m json.tool 2>/dev/null || tail -n "$lines" "$alerts_file" + else + log_warn "Alerts file not found" + fi +} + +# =========================================== +# Integration Functions +# =========================================== + +cmd_crowdsec_sync() { + log_info "Syncing CrowdSec alerts to Wazuh..." + + local cs_log="/var/log/crowdsec.log" + local wazuh_log="$WAZUH_DIR/logs/crowdsec-alerts.log" + + if [ -f "$cs_log" ]; then + # Parse CrowdSec alerts and format for Wazuh + grep -E "alert|ban|decision" "$cs_log" | tail -100 > "$wazuh_log" + log_info "CrowdSec alerts synced to $wazuh_log" + else + log_warn "CrowdSec log not found: $cs_log" + fi +} + +cmd_configure_fim() { + log_info "Configuring File Integrity Monitoring..." + + # Read directories from UCI + local dirs=$(uci -q get wazuh.fim.directories) + + log_info "Monitored directories:" + for dir in $dirs; do + echo " - $dir" + done + + log_info "FIM configured. Restart agent to apply." +} + +cmd_configure_sca() { + log_info "Security Configuration Assessment enabled" + log_info "SCA will run on next agent restart" +} + +# =========================================== +# Main +# =========================================== + +case "$1" in + install) cmd_install ;; + uninstall) cmd_uninstall ;; + upgrade) cmd_uninstall && cmd_install ;; + configure) shift; cmd_configure "$@" ;; + register) cmd_register ;; + set-name) shift; cmd_set_name "$@" ;; + start) cmd_start ;; + stop) cmd_stop ;; + restart) cmd_restart ;; + status) cmd_status ;; + info) cmd_info ;; + logs) shift; cmd_logs "$@" ;; + alerts) shift; cmd_alerts "$@" ;; + crowdsec-sync) cmd_crowdsec_sync ;; + configure-fim) cmd_configure_fim ;; + configure-sca) cmd_configure_sca ;; + -h|--help|help|"") usage ;; + *) log_error "Unknown command: $1"; usage; exit 1 ;; +esac