Skip to content

Commit c564b0d

Browse files
JocLRojasylladaKbayero
authored
Release/v10.8.4 (#1266)
* Update agent-manager to use http.Server with TLS 1.3 configuration * Update the Bitdefender plugin to enforce the minimum required TLS version 1.3 * update nginx tls config to v1.3 * update changelog * trigger action * Allow agent dependencies download using powershell with tls v1.3 * allow only secure ciphersuites in tls 1.2 for agent dependencies * remove auth in dependencies endpoint * remove authentication when downloading dependencies from agent --------- Co-authored-by: Yadian Llada Lopez <yadian.llada@gmail.com> Co-authored-by: Yorjander Hernandez Vergara <yorjaKbayero@gmail.com>
1 parent 6aa7646 commit c564b0d

12 files changed

Lines changed: 54 additions & 83 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# UTMStack 10.8.3 Release Notes
1+
# UTMStack 10.8.4 Release Notes
22

3-
- Fixed a potential delay in log input in O365, AWS, and Sophos Central integrations.
3+
- Enhanced security and compliance by upgrading several internal components—most notably the update server—to exclusively support TLS 1.3.

‎agent-manager/auth/dependencies_interceptor.go‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎agent-manager/updates/updates.go‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
package updates
22

33
import (
4+
"crypto/tls"
45
"net/http"
56

67
"github.com/gin-contrib/gzip"
78
"github.com/gin-gonic/gin"
8-
"github.com/utmstack/UTMStack/agent-manager/auth"
99
"github.com/utmstack/UTMStack/agent-manager/util"
1010
)
1111

@@ -27,14 +27,38 @@ func ServeDependencies() {
2727

2828
r.NoRoute(notFound)
2929

30-
group := r.Group("/private", auth.HTTPAuthInterceptor())
30+
group := r.Group("/private")
3131
group.StaticFS("/dependencies", http.Dir("/dependencies"))
3232

33+
cert, err := tls.LoadX509KeyPair("/cert/utm.crt", "/cert/utm.key")
34+
if err != nil {
35+
util.Logger.ErrorF("failed to load certificates: %v", err)
36+
}
37+
38+
tlsConfig := &tls.Config{
39+
MinVersion: tls.VersionTLS12,
40+
Certificates: []tls.Certificate{cert},
41+
CipherSuites: []uint16{
42+
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
43+
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
44+
tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
45+
},
46+
47+
PreferServerCipherSuites: true,
48+
}
49+
50+
server := &http.Server{
51+
Addr: ":8080",
52+
Handler: r,
53+
TLSConfig: tlsConfig,
54+
}
55+
3356
util.Logger.Info("Starting HTTP server on port 8080")
34-
if err := r.RunTLS(":8080", "/cert/utm.crt", "/cert/utm.key"); err != nil {
57+
err = server.ListenAndServeTLS("", "")
58+
if err != nil {
3559
util.Logger.ErrorF("error starting HTTP server: %v", err)
36-
return
3760
}
61+
3862
}
3963

4064
func notFound(c *gin.Context) {

‎agent/serv/clean-old.go‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -51,14 +51,8 @@ func CleanOldServices(cnf *config.Config) {
5151

5252
if oldVersion {
5353
utils.Logger.Info("old version of agent found, downloading new version")
54-
headers := map[string]string{
55-
"key": cnf.AgentKey,
56-
"id": fmt.Sprintf("%v", cnf.AgentID),
57-
"type": "agent",
58-
}
59-
6054
if runtime.GOOS != "darwin" {
61-
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.UpdaterSelf, "")), headers, fmt.Sprintf(config.UpdaterSelf, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
55+
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.UpdaterSelf, "")), map[string]string{}, fmt.Sprintf(config.UpdaterSelf, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
6256
utils.Logger.LogF(100, "error downloading updater: %v", err)
6357
return
6458
}

‎agent/updates/dependencies.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,13 @@ import (
1212
)
1313

1414
func DownloadFirstDependencies(address string, authKey string, insecure bool) error {
15-
headers := map[string]string{"connection-key": authKey}
16-
17-
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, "version.json"), headers, "version.json", utils.GetMyPath(), insecure); err != nil {
15+
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, "version.json"), map[string]string{}, "version.json", utils.GetMyPath(), insecure); err != nil {
1816
return fmt.Errorf("error downloading version.json : %v", err)
1917
}
2018

2119
dependFiles := config.DependFiles
2220
for _, file := range dependFiles {
23-
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, file), headers, file, utils.GetMyPath(), insecure); err != nil {
21+
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, address, config.DependenciesPort, file), map[string]string{}, file, utils.GetMyPath(), insecure); err != nil {
2422
return fmt.Errorf("error downloading file %s: %v", file, err)
2523
}
2624
}

‎agent/updates/update.go‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,7 @@ func UpdateDependencies(cnf *config.Config) {
2929
for {
3030
time.Sleep(checkEvery)
3131

32-
headers := map[string]string{
33-
"key": cnf.AgentKey,
34-
"id": fmt.Sprintf("%v", cnf.AgentID),
35-
"type": "agent",
36-
}
37-
38-
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, "version.json"), headers, "version_new.json", utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
32+
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, "version.json"), map[string]string{}, "version_new.json", utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
3933
utils.Logger.ErrorF("error downloading version.json: %v", err)
4034
continue
4135
}
@@ -48,7 +42,7 @@ func UpdateDependencies(cnf *config.Config) {
4842

4943
if newVersion.Version != currentVersion.Version {
5044
utils.Logger.Info("New version of agent found: %s", newVersion.Version)
51-
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.ServiceFile, "")), headers, fmt.Sprintf(config.ServiceFile, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
45+
if err := utils.DownloadFile(fmt.Sprintf(config.DependUrl, cnf.Server, config.DependenciesPort, fmt.Sprintf(config.ServiceFile, "")), map[string]string{}, fmt.Sprintf(config.ServiceFile, "_new"), utils.GetMyPath(), cnf.SkipCertValidation); err != nil {
5246
utils.Logger.ErrorF("error downloading agent: %v", err)
5347
continue
5448
}

‎bitdefender/server/server.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package server
22

33
import (
4+
"crypto/tls"
45
"encoding/json"
56
"net/http"
67
"path/filepath"
@@ -80,12 +81,17 @@ func ServerUp(cnf *types.ConfigurationSection, certsPath string) {
8081
_, _ = w.Write([]byte("Server is up and running"))
8182
}).Methods("GET")
8283

84+
tlsConfig := &tls.Config{
85+
MinVersion: tls.VersionTLS13,
86+
}
87+
8388
server := &http.Server{
8489
Addr: ":" + constants.GetConnectorPort(),
8590
Handler: r,
8691
ReadTimeout: 10 * time.Second,
8792
WriteTimeout: 10 * time.Second,
8893
MaxHeaderBytes: 1 << 20,
94+
TLSConfig: tlsConfig,
8995
}
9096

9197
go func() {

‎frontend/src/app/app-module/guides/guide-as400/constants.ts‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ export const PLATFORM = [
55
name: 'WINDOWS',
66
install: `New-Item -ItemType Directory -Force -Path "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` +
77
`cd "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` +
8-
`Invoke-WebRequest -Uri "https://V_IP:9001/private/dependencies/collector/windows-as400-collector.zip" ` +
9-
`-OutFile ".\\windows-as400-collector.zip"; Expand-Archive -Path ".\\windows-as400-collector.zip" ` +
10-
`-DestinationPath "."; Remove-Item ".\\windows-as400-collector.zip"; Start-Process ".\\utmstack_collectors_installer.exe" ` +
8+
`& curl.exe -k -o ".\\windows-as400-collector.zip" ` +
9+
`"https://V_IP:9001/private/dependencies/collector/windows-as400-collector.zip"; ` +
10+
`Expand-Archive -Path ".\\windows-as400-collector.zip" -DestinationPath "."; ` +
11+
`Remove-Item ".\\windows-as400-collector.zip"; Start-Process ".\\utmstack_collectors_installer.exe" ` +
1112
`-ArgumentList 'install', 'as400', 'V_IP', '<secret>V_TOKEN</secret>' -NoNewWindow -Wait`,
1213

1314
uninstall: `cd "C:\\Program Files\\UTMStack\\UTMStack Collectors\\AS400"; ` +
@@ -29,11 +30,11 @@ export const PLATFORM = [
2930
name: 'LINUX UBUNTU',
3031
install: `sudo bash -c "apt update -y && apt install wget unzip -y && mkdir -p ` +
3132
`/opt/utmstack-linux-collectors/as400 && cd /opt/utmstack-linux-collectors/as400 && ` +
32-
`wget --no-check-certificate --header='connection-key: V_TOKEN' ` +
33+
`wget --no-check-certificate ` +
3334
`https://V_IP:9001/private/dependencies/collector/linux-as400-collector.zip ` +
3435
`&& unzip linux-as400-collector.zip && rm linux-as400-collector.zip && chmod -R 777 ` +
3536
`utmstack_collectors_installer && ./utmstack_collectors_installer install as400 ` +
36-
`V_IP V_TOKEN"`,
37+
`V_IP <secret>V_TOKEN<secret>"`,
3738

3839

3940
uninstall: `sudo bash -c " cd /opt/utmstack-linux-collectors/as400 && ./utmstack_collectors_installer ` +

‎frontend/src/app/app-module/guides/guide-linux-agent/guide-linux-agent.component.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ export class GuideLinuxAgentComponent implements OnInit {
3737
const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host;
3838

3939
return `sudo bash -c "apt update -y && apt install wget -y && mkdir -p /opt/utmstack-linux-agent && \
40-
wget --no-check-certificate --header='connection-key: <secret>${this.token}</secret>' -P /opt/utmstack-linux-agent \
40+
wget --no-check-certificate -P /opt/utmstack-linux-agent \
4141
https://${ip}:9001/private/dependencies/agent/${installerName} && \
4242
chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \
4343
/opt/utmstack-linux-agent/${installerName} install ${ip} <secret>${this.token}</secret> yes"`;
@@ -47,7 +47,7 @@ export class GuideLinuxAgentComponent implements OnInit {
4747
const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host;
4848

4949
return `sudo bash -c "yum install wget -y && mkdir -p /opt/utmstack-linux-agent && \
50-
wget --no-check-certificate --header='connection-key: <secret>${this.token}</secret>' -P /opt/utmstack-linux-agent \
50+
wget --no-check-certificate -P /opt/utmstack-linux-agent \
5151
https://${ip}:9001/private/dependencies/agent/${installerName} && \
5252
chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \
5353
/opt/utmstack-linux-agent/${installerName} install ${ip} <secret>${this.token}</secret> yes"`;
@@ -57,7 +57,7 @@ export class GuideLinuxAgentComponent implements OnInit {
5757
const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host;
5858

5959
return `sudo bash -c "dnf install wget -y && mkdir -p /opt/utmstack-linux-agent && \
60-
wget --no-check-certificate --header='connection-key: <secret>${this.token}</secret>' -P /opt/utmstack-linux-agent \
60+
wget --no-check-certificate -P /opt/utmstack-linux-agent \
6161
https://${ip}:9001/private/dependencies/agent/${installerName} && \
6262
chmod -R 777 /opt/utmstack-linux-agent/${installerName} && \
6363
/opt/utmstack-linux-agent/${installerName} install ${ip} <secret>${this.token}</secret> yes"`;

‎frontend/src/app/app-module/guides/guide-winlogbeat/guide-winlogbeat.component.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,7 @@ export class GuideWinlogbeatComponent implements OnInit {
5656
const ip = window.location.host.includes(':') ? window.location.host.split(':')[0] : window.location.host;
5757

5858
return `New-Item -ItemType Directory -Force -Path "C:\\Program Files\\UTMStack\\UTMStack Agent"; ` +
59-
`& curl.exe -k -H "connection-key: <secret>${this.token}</secret>" ` +
60-
`-o "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` +
59+
`& curl.exe -k -o "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` +
6160
`"https://${ip}:9001/private/dependencies/agent/${arch}"; ` +
6261
`Start-Process "C:\\Program Files\\UTMStack\\UTMStack Agent\\${arch}" ` +
6362
`-ArgumentList 'install', '${ip}', '<secret>${this.token}</secret>', 'yes' -NoNewWindow -Wait`;

0 commit comments

Comments
 (0)