API: Flask - YAML configuration

[crd1985]

This issue is related to #2413

Current nodejs API configuration is located in /var/ossec/api/configuration/config.js file. It is time to migrate to a config.yml file!

Tasks:

• Research and select the best Python package to deal with yml files
• Load the configuration into Python from the new config.yml file

[mgmacias95]

Hello @crd1985,

I think the most suitable option is PyYaml.. It isn't fully compatible with Python 3.7 (yaml/pyyaml#212) but hopefully, that will be fixed soon.

Best regards,
Marta

[mgmacias95]

Status update

Summary

I'm working on branch dev-api-flask-config-yml. I have translated the config.js file to yml. This new configuration file will be installed under api/configuration/ directory. In addition, I have also added support for CORS and HTTPS.

Tasks

• Translate configuration to YML (1f77a5e).
• Install configuration file (1f77a5e).
• Load configuration file when the API daemon is started (1f77a5e).
• Configure API logging (logging level and log file path) using variables from configuration (f1d79c3).
• Configure API's port and host using values defined in configuration (4d6660f).
• Add support for CORS (1913196).
• Add support for HTTPS (without CA) (8754a99).

Best regards,
Marta

[mgmacias95]

Hello @crd1985,

I have been doing research on certificate authorities. I have found out that use_ca and ca options in the configuration aren't necessary. The steps to have a self generated CA on the API server are:

1. Create the CA:

   # openssl req -x509 -new -nodes -newkey rsa:2048 -keyout rootCA.key -out rootCA.pem -batch -subj "/C=US/ST=CA/O=Manager"
   Generating a 2048 bit RSA private key
   ...................+++
   .........................................................+++
   writing new private key to 'rootCA.key'
   -----

2. Create a certificate for the API server:

   # openssl req -new -nodes -newkey rsa:2048 -keyout server.key -out server.csr -subj '/C=US/CN=172.17.0.100'
   Generating a 2048 bit RSA private key
   ........................................................................................+++
   .....................+++
   writing new private key to 'server.key'
   -----
   # openssl x509 -req -days 365 -in server.csr -CA rootCA.pem -CAkey rootCA.key -out server.crt -CAcreateserial
   Signature ok
   subject=C = US, CN = 172.17.0.100
   Getting CA Private Key

3. Use the CA to make requests against the API:

   # curl -u foo:bar "https://172.17.0.100:55000/agents?limit=1" --cacert /var/ossec/api/configuration/ssl/rootCA.pem
   {
      "data": {
      "items": [
         {
           "dateAdd": "2019-02-19 11:17:53",
           "id": "000",
           "ip": "127.0.0.1",
           "lastKeepAlive": "9999-12-31 23:59:59",
           "manager": "master",
           "name": "master",
           "node_name": "master",
           "os": {
             "arch": "x86_64",
             "codename": "Bionic Beaver",
             "major": "18",
             "minor": "04",
             "name": "Ubuntu",
             "platform": "ubuntu",
             "uname": "Linux |master |4.15.0-43-generic |#46-Ubuntu SMP Thu Dec 6 14:45:28 UTC 2018 |x86_64",
             "version": "18.04.1 LTS"
           },
           "status": "Active",
           "version": "Wazuh v3.9.0"
         }
       ],
       "totalItems": 2
     },
     "error": 0
   }

I have removed ca and use_ca options in commit 2cd29c7.

Best regards,
Marta

[mgmacias95]

Hello team,

The main goal of this issue has already been achieved: configuration is already translated to YML and the API uses it. However, there are some options which implementation remains pending:

• basic_auth: Depends on API: Flask - Authentication #2564.
• behind_proxy_server: Only used in POST/agents and POST/agents/insert API calls. Depends on API: Flask - Create full specification with openapi #2639.
• use_only_authd: It's only used when adding/removing agents. Depends on API: Flask - Create full specification with openapi #2639.
• experimental_features: Used to enable /experimental endpoints. Depends on API: Flask - Create full specification with openapi #2639.
• cache: I haven't found a suitable way of adding a cache in our current implementation. This task requires more time and research.

Best regards,
Marta