Skip to content

Verify WPK with Wazuh CA by default#799

Merged
chemamartinez merged 6 commits into3.3from
fix-wpk-default-cert
Jun 15, 2018
Merged

Verify WPK with Wazuh CA by default#799
chemamartinez merged 6 commits into3.3from
fix-wpk-default-cert

Conversation

@vikman90
Copy link
Member

@vikman90 vikman90 commented Jun 14, 2018

Related issue: #758

This PR makes the agent use the default root CA "wpk_root.pem" if no such <ca_store> is defined in the <active-response> section.

This way, the agent forces to verify every WPK file that the manager sends it. On the other hand, a new option has been introduced to disable explicitly the verification with CA:

<active-response>
  <ca_verification>no</ca_verification>
</active-response>

If the root CA settings is not present in the configuration, this message appears:

ossec-execd: INFO: No option <ca_store> defined. Using Wazuh default CA (/var/ossec/etc/wpk_root.pem).

This message appears in the log if the WPK validation with CA is disabled:

ossec-execd: INFO: WPK verification with CA is disabled.

We have added another improvement: if the option <ca_store> is empty, its value is ignored.

@vikman90 vikman90 added the type/bug Something isn't working label Jun 14, 2018
@vikman90 vikman90 requested review from chemamartinez and snaow June 14, 2018 21:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants