diff --git a/website/integrations/services/wazuh/applications_overview.png b/website/integrations/services/wazuh/applications_overview.png new file mode 100644 index 000000000..f3a2125a3 Binary files /dev/null and b/website/integrations/services/wazuh/applications_overview.png differ diff --git a/website/integrations/services/wazuh/dashboardsyml.png b/website/integrations/services/wazuh/dashboardsyml.png new file mode 100644 index 000000000..aae8f6dda Binary files /dev/null and b/website/integrations/services/wazuh/dashboardsyml.png differ diff --git a/website/integrations/services/wazuh/entityid.png b/website/integrations/services/wazuh/entityid.png new file mode 100644 index 000000000..87ba55fa6 Binary files /dev/null and b/website/integrations/services/wazuh/entityid.png differ diff --git a/website/integrations/services/wazuh/index.md b/website/integrations/services/wazuh/index.md index 5779233b5..6d3b12187 100644 --- a/website/integrations/services/wazuh/index.md +++ b/website/integrations/services/wazuh/index.md @@ -23,7 +23,7 @@ The following placeholders will be used: While wazuh allows both LDAP and SAML integration, in this post we will only walk through the SAML integration. -### Step 1 +### Step 1 - certificates The first step would be to add a certificate for wazuh. @@ -36,7 +36,7 @@ Add a name, set the validity period to 365 days and click `Generate` If all goes well authentik will display a message like the one below ![](./certificate1.png) -### Step 2 +### Step 2 - saml provider Now add a SAML provider - you can find the options under `Applications` -> `Providers` @@ -59,7 +59,7 @@ The last step is to select the previously created `Signing Certificate` from the ![](./provider4.png) ![](./provider5.png) -### Step 3 +### Step 3 - property mapping Time to create a Property Mapping - this is a custom function that takes group/user data from authentik and provides it to wazuh in a structured way. @@ -80,18 +80,140 @@ if ak_is_group_member(request.user, name="wazuh-admins"): Make sure to adjust the provider to include the newly created property mapping in the `Advanced protocol settings`. ![](./property-mapping3.png) -### Step 4 +### Step 4 - saml application -Now create an application to use the newly created provider. `Applications` -> `Applications` - `Create` - -`Name: wazuh` - -`Slug: wazuh` +Now create an application to use the newly created provider. `Applications` -> `Applications` -> `Create` +`Name: wazuh-saml` +`Slug: wazuh-saml` `Provider: SAML` - `Policy Engine: any` + ![](./application.png) -### Step 5 +You can change the UI / upload a logo so that in the applications overview you have a nice layout and can easily identify the new wazuh app. +![](./applications_overview.png) + +### Step 5 - metadata + wazuh opensearch-security configuration +Now download the metadata file `saml_authentik_meta.xml` from the `Applications` -> `Provider` -> `Related Objects` -> `Download` + +and copy/save it on the wazuh server - ideally under `/etc/wazuh-indexer/opensearch-security/idp-metadata.xml` +![Alt text](./metadata.png) + +Next up change the `/etc/wazuh-indexer/opensearch-security/config.yml` and make sure it looks like the one below + +- you need to adjust the `metadata_file` if your name differs from the one shown above/below +- `entity_id` needs to change twice, once in the `idp` section and once in the `sp` section - you can look it up in the metadata xml file - search for `entityID` +![Alt text](entityid.png) +- adapt the `kibana_url` to match your wazuh dashboard url - e.g. `https://wazuh.myhomelab.com/` +- copy/paste the `exchange_key`, you can get it from the metadata file (find the key between the `` tags, it usually starts with MII...) - DO NOT FORGET TO PUT QUOTES AROUND THE CERTIFICATE +- make sure to adjust the ownership and access rights via the following commands: + +```bash +sudo chown wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/opensearch-security/idp-metadata.xml + +sudo chmod 640 /etc/wazuh-indexer/opensearch-security/idp-metadata.xml +``` + +```yml +authc: + basic_internal_auth_domain: + description: "Authenticate via HTTP Basic + SAML against internal users database" + http_enabled: true + transport_enabled: true b + order: 0 + http_authenticator: + type: basic + challenge: false + authentication_backend: + type: intern + saml_auth_domain: + http_enabled: true + transport_enabled: false + order: 1 + http_authenticator: + type: saml + challenge: true + config: + idp: + metadata_file: "/etc/wazuh-indexer/opensearch-security/idp-metadata.xml" + entity_id: "wazuh-saml" + sp: + entity_id: "wazuh-saml" + kibana_url: "https://" + roles_key: Roles + exchange_key: "MIIGIODCCA+ygAwIBAgITREIpdNn++usuy4Gq5g0W2/SQs..." + authentication_backend: + type: noop +``` + +### Step 6 - securityadmin.sh + +After you save the `config.yml` you need to restart the wazuh manager and tell it to load the modified file - this can be done automagically using the `securityadmin.sh` wazuh provides with the following command: + +```bash +export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/config.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv +``` + +If all goes well this shows `Done with success` in the end + +### Step 7 - roles_mapping.yml + +In order to map the backend roles from authentik to wazuh specific roles you need to adjust the `/etc/wazuh-indexer/opensearch-security/roles_mapping.yml` + +Open the file and scroll to the following section: +![Alt text](roles_mapping.png) + +under `backend_roles` add `wazuh-admin` and check that reserved is `false` + the rest looks like below: + +```yml +all_access: + reserved: false + hidden: false + backend_roles: + - "wazuh-admin" + - "admin" + hosts: [] + users: [] + and_backend_roles: [] + description: "Maps admin to all_access" +``` + +save the file and use the securityadmin.sh with the following command to load the adjusted `roles_mapping.yml`: +```bash +export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml -icl -key /etc/wazuh-indexer/certs/admin-key.pem -cert /etc/wazuh-indexer/certs/admin.pem -cacert /etc/wazuh-indexer/certs/root-ca.pem -h localhost -nhnv +``` + +If all goes well this shows `Done with success` in the end + + +### Step 8 - wazuh.yml +Check `/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml` and make sure that `run_as` is set to `false`. +![](wazuhyml.png) + +### Step 9 - security role mapping +open the wazuh dashboard - click on the downward pointing triangle next to the wazuh logo then on `Security` and `Roles mapping`. +![](roles_mapping1.png) +We will now add a new role mapping - add any name + the respective Roles -> in this case administrator and add a new custom rule at the bottom that matches (`FIND`) the `user_name` to `wazuh-admin`. +![](saml-admin.png) + + +### Step 10 - final step - opensearch_dashboards.yml + +The last step is to adapt the `/etc/wazuh-dashboard/opensearch_dashboards.yml` and add three lines to the bottom of the file: + +```yml +opensearch_security.auth.type: "saml" +server.xsrf.allowlist: ["/_opendistro/_security/saml/acs", "/_opendistro/_security/saml/logout", "/_opendistro/_security/saml/acs/idpinitiated"] +opensearch_security.session.keepalive: false +``` + +![](dashboardsyml.png) + +If all went well you should now only have to restart the wazuh dashboard + +`systemctl restart wazuh-dashboard` + +and then you should be greeted by the authentik login screen when you try to connect to the dashboard +![](login.png) \ No newline at end of file diff --git a/website/integrations/services/wazuh/login.png b/website/integrations/services/wazuh/login.png new file mode 100644 index 000000000..289b0ff49 Binary files /dev/null and b/website/integrations/services/wazuh/login.png differ diff --git a/website/integrations/services/wazuh/metadata.png b/website/integrations/services/wazuh/metadata.png new file mode 100644 index 000000000..8d904cf0d Binary files /dev/null and b/website/integrations/services/wazuh/metadata.png differ diff --git a/website/integrations/services/wazuh/roles_mapping.png b/website/integrations/services/wazuh/roles_mapping.png new file mode 100644 index 000000000..4982e4d3e Binary files /dev/null and b/website/integrations/services/wazuh/roles_mapping.png differ diff --git a/website/integrations/services/wazuh/roles_mapping1.png b/website/integrations/services/wazuh/roles_mapping1.png new file mode 100644 index 000000000..a828b3698 Binary files /dev/null and b/website/integrations/services/wazuh/roles_mapping1.png differ diff --git a/website/integrations/services/wazuh/saml-admin.png b/website/integrations/services/wazuh/saml-admin.png new file mode 100644 index 000000000..acd4c88e6 Binary files /dev/null and b/website/integrations/services/wazuh/saml-admin.png differ diff --git a/website/integrations/services/wazuh/wazuhyml.png b/website/integrations/services/wazuh/wazuhyml.png new file mode 100644 index 000000000..9bbd7f335 Binary files /dev/null and b/website/integrations/services/wazuh/wazuhyml.png differ