Update Vulnerability CVE with Proxy

[Sergey E.]

Hello Team,

Now I use local updates for  Vulnerability detector CVE files cause of firewall restrictions.

But want to make it automated.

My IT says that I can use proxy link. Like this:

https://httpproxy:gBKAKLDSKm...@some-proxy.it:443

Is it possible to force Wazuh use proxy to download NVD, MSU and RedHat CVE's?

PS: Cron+Wget is possible, but don't want to increase number of components.

[Facundo Dalmau]

Hi Sergey, thanks for using Wazuh!

Please check the following link Vulnerability Detector - Offline Update. It has different sections that describe how to perform offline updates with different available scripts for Red Hat , NVD and MSU.

Hope this works for you!

Regards,

Facundo

[Sergey E.]

Hi Facundo,

I'm using this way to update right now.

The question was:  Is it possible to force Wazuh use proxy to download NVD, MSU and RedHat CVE's? I mean any settings on Wazuh manager nodes  for updating CVE automatically with proxy?

среда, 21 сентября 2022 г. в 20:20:06 UTC+3, facundo...@wazuh.com:

[swapnils]

Hi..

Even I was looking out for such option but somehow could not find it.

As a workaround, I have created a daily cronjob to download these feeds using nvd-generator.sh / rh-generator.sh. Download link is there in the documentation. Only change I have made is, added proxy switch in those bash scripts for curl to hit internet via proxy. Hope this helps.

[Facundo Dalmau]

There is no direct way for the Wazuh manager to set the automatic update. It needs to be done as described in the previous messages. 

Also, you can configure the proxy, as explained in the issue: 

• https://github.com/wazuh/wazuh/issues/1112

So that /etc/systemd/system/wazuh-manager.service is modified and you do not need to use the offline update.

    

    [Service] 

    Type=forking 

    EnvironmentFile=/etc/ossec-init.conf 

    Environment="https_proxy=http://<proxy_IP:port>" 

    Environment="http_proxy="http://<proxy_IP:port>" 

    LimitNOFILE=65536

And reloading daemon and service (systemctl restart wazuh-manager.service).

Regards,

Facundo

[Patrik Blomqvist]

Hi!

In Wazuh v4.3.10 CentOS7 and about proxy, the EnvironmentFile=/etc/ossec-init.conf  does not exist

Seems to be impossible to make this work when behind a proxy

Patrik