wazuh-packages
wazuh-packages copied to clipboard
Bug generating certificates using multiple DNS in the Wazuh manager
Wazuh version | Install type | Action performed | Platform |
---|---|---|---|
4.5.0 | Installation Assistant | Generating certificates | Any |
In https://github.com/wazuh/wazuh-packages/issues/2350, a new bug has been found while generating the certificates of the Wazuh server nodes when using multiple DNS.
If an invalid DNS is specified in the config.yml
file (for example, localhost
), the script does not generate any error and its certificate is skipped, but the rest of them are created:
The config.yml
file, the server
configuration:
server:
- name: wazuh-1
ip: www.google.es
ip: localhost
ip: wikipedia.org
The certificates are created:
24/08/2023 11:25:37 DEBUG: Creating the Wazuh server certificates.
Ignoring -days without -x509; not generating a certificate
........+......+..................+..+......+....+...+..+....+.........+...+..+...............+...+....+......+...+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*........+..............+...+......+....+............+.....+.+...+.....+.........+...+....+...........+....+...+..+.+...............+...+......+...+.....+......+.......+.........+...+.....+......+.......+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
..+...+..........+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+...+............+..................+.+..+....+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+..+...+...............+.+...+..+.+.....+...+......+....+...........+...+.+.....+....+.....+..........+.....+.+.....+......+.+..+.......+...+.....+................+...............+..+....+.....+...+.+..+.......+...+..+............+.+..+.............+..+.+...........+.+.........+.....+....+..+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
Certificate request self-signature ok
subject=C = US, L = California, O = Wazuh, OU = Wazuh, CN = wazuh-1
But, if the code is debugged, it seems that the invalid DNS is ignored:
++ server_node_ip_1=("www.google.es" "wikipedia.org")
+ set +x
On the other hand, if there is just one DNS specified, an error is generated and the certificates are not generated:
24/08/2023 12:21:59 ERROR: Invalid IP or DNS localhost
Tasks
- [ ] Investigate a fix that validates every DNS specified in the Wazuh manager section.
- [ ] Apply the fix.
- [ ] Check that the certificates are not generated if an invalid DNS is specified using multiple DNS.
This issue goes to On Hold due to https://github.com/wazuh/wazuh-ansible/issues/1001
This issue goes to "Blocked" due to https://github.com/wazuh/wazuh-packages/issues/2417.