Secure redis communications with TLS

Author: Logan L

.gitmodules

@@ -1,3 +1,3 @@
-[submodule "shell-lib"]
-	path = shell-lib
+[submodule "scripts/shell-lib"]
+	path = scripts/shell-lib
 	url = [email protected]:activecm/shell-lib.git

agent/install-sysmon-beats.ps1

@@ -154,6 +154,9 @@ winlogbeat.event_logs:
 output.redis:
   hosts:
     - ${RedisHost}:${RedisPort}
+  ssl:
+    enabled: true
+    verification_mode: none
   key: "net-data:sysmon"
   password: `"`${REDIS_PASSWORD}`"
 "@ > winlogbeat.yml

docker-compose.yml

@@ -10,6 +10,7 @@ services:
       #net.ipv4.tcp_max_syn_backlog: 512 works on ubuntu 18, but not 16
     ports:
       - "${ESPY_REDIS_PORT:-6379}:6379"
+    entrypoint: ""
     command: ["redis-server", "/etc/espy/redis.conf"]
 
   espy:
@@ -25,4 +26,5 @@ services:
 #    image: redis:6.0
 #    volumes:
 #      - ${ESPY_CONFIG_DIR:-/etc/espy}:/etc/espy
+#    entrypoint: ""
 #    command: ["redis-cli", "-h", "redis-server"]

espy.sh

@@ -12,8 +12,8 @@ if [ ! -w "/var/run/docker.sock" -o ! -r ".env" ]; then
 fi
 
 # Check for pre-requisites
-shell-lib/docker/check_docker.sh || echo "You do not have a supported version of Docker installed."
-shell-lib/docker/check_docker-compose.sh || echo "You do not have a supported version of Docker-Compose installed."
+scripts/shell-lib/docker/check_docker.sh || echo "You do not have a supported version of Docker installed."
+scripts/shell-lib/docker/check_docker-compose.sh || echo "You do not have a supported version of Docker-Compose installed."
 
 # TMPDIR is erased even if -E is passed to sudo. https://serverfault.com/questions/478741/sudo-does-not-preserve-tmpdir
 # Need to explicitly pass tmpdir in if it exists.

espy/config/running.go

@@ -6,6 +6,7 @@ import (
 	"github.com/blang/semver"
 	log "github.com/sirupsen/logrus"
 	"io/ioutil"
+	"os"
 )
 
 type (
@@ -53,7 +54,9 @@ func parseStaticTLSConfig(staticTLS *TLSStaticCfg) *tls.Config {
 	if !staticTLS.VerifyCertificate {
 		tlsConf.InsecureSkipVerify = true
 	}
-	if len(staticTLS.CAFile) > 0 {
+
+	finfo, err := os.Stat(staticTLS.CAFile)
+	if err != nil && !finfo.IsDir() {
 		pem, err := ioutil.ReadFile(staticTLS.CAFile)
 		if err != nil {
 			log.WithField("file", staticTLS.CAFile).WithError(err).Error("Could not read CA file")

espy/etc/espy.docker.yaml

@@ -12,7 +12,7 @@ Redis:
   Password: "NET_RECEIVER_SECRET_PLACEHOLDER"
   # TLS should be enabled if Redis is running on a separate machine
   TLS:
-    Enabled: false
+    Enable: true
     # If set, Espy will check the Redis certificate's hostname and signatures
     VerifyCertificate: false
     #If set, Espy will use the provided CA file instead of the system's CA's
@@ -30,7 +30,7 @@ Elasticsearch:
   Password: ""
   # TLS should be enabled if Redis is running on a separate machine
   TLS:
-    Enabled: false
+    Enable: false
     # If set, Espy will check the ES certificate's hostname and signatures
     VerifyCertificate: false
     #If set, Espy will use the provided CA file instead of the system's CA's