Merge pull request #937 from cisagov/v26.04.0_merge_cisagov

Malcolm v26.04.0

Author: mmguero

.dockerignore

@@ -45,7 +45,7 @@ scripts
 !scripts/malcolm_utils.py
 zeek-logs
 suricata-logs
-redis
+valkey
 postgres
 filescan-logs
 netbox/media

.envrc.example

@@ -120,7 +120,7 @@ export AUTH_GENERATE_WEBCERTS=true
 export AUTH_GENERATE_FWCERTS=true
 export AUTH_GENERATE_OPENSEARCH_CREDS=true
 export AUTH_GENERATE_NETBOX_PASSWORDS=true
-export AUTH_GENERATE_REDIS_PASSWORD=true
+export AUTH_GENERATE_VALKEY_PASSWORD=true
 export AUTH_GENERATE_POSTGRES_PASSWORD=true
 export AUTH_GENERATE_KEYCLOAK_DB_PASSWORD=true
 export AUTH_KEYCLOAK_REALM=master

…/workflows/redis-build-and-push-ghcr.yml …workflows/valkey-build-and-push-ghcr.yml.github/workflows/redis-build-and-push-ghcr.yml renamed to .github/workflows/valkey-build-and-push-ghcr.yml .github/workflows/redis-build-and-push-ghcr.yml renamed to .github/workflows/valkey-build-and-push-ghcr.yml

@@ -1,13 +1,13 @@
-name: redis-build-and-push-ghcr
+name: valkey-build-and-push-ghcr
 
 on:
   push:
     branches:
       - main
       - staging
     paths:
-      - 'Dockerfiles/redis.Dockerfile'
-      - 'container-health-scripts/redis.sh'
+      - 'Dockerfiles/valkey.Dockerfile'
+      - 'container-health-scripts/valkey.sh'
       - 'shared/bin/docker-uid-gid-setup.sh'
       - 'shared/bin/service_check_passthrough.sh'
       - '.trigger_workflow_build'
@@ -18,5 +18,5 @@ jobs:
   docker:
     uses: ./.github/workflows/docker-build-push-scan.yml
     with:
-      service: redis
-      dockerfile: ./Dockerfiles/redis.Dockerfile
+      service: valkey
+      dockerfile: ./Dockerfiles/valkey.Dockerfile

.gitignore

@@ -27,7 +27,7 @@
 .configured
 .os-info
 config.*/
-/redis
+/valkey
 /postgres
 /filescan-logs
 malcolm-config_2*.json

.justfile

@@ -212,7 +212,7 @@ auth-setup:
     --auth-method "${AUTH_METHOD:-basic}" \
     --auth-generate-opensearch-internal-creds "${AUTH_GENERATE_OPENSEARCH_CREDS}" \
     --auth-generate-netbox-passwords "${AUTH_GENERATE_NETBOX_PASSWORDS:-false}" \
-    --auth-generate-redis-password "${AUTH_GENERATE_REDIS_PASSWORD:-true}" \
+    --auth-generate-valkey-password "${AUTH_GENERATE_VALKEY_PASSWORD:-true}" \
     --auth-generate-postgres-password "${AUTH_GENERATE_POSTGRES_PASSWORD:-false}" \
     --auth-generate-keycloak-db-password "${AUTH_GENERATE_KEYCLOAK_DB_PASSWORD:-true}" \
     --auth-admin-username "${AUTH_ADMIN_USERNAME}" \
@@ -268,6 +268,7 @@ wipe:
 nuke:
   {{call_recipe}} wipe
   rm -rf ./postgres/*
+  rm -rf ./valkey/*
 
 stop:
   #!/usr/bin/env bash

.trigger_iso_workflow_build

@@ -1,2 +1,2 @@
 # this file exists solely for the purpose of being updated and seen by github to trigger a commit build action
-1
+2

Dockerfiles/arkime.Dockerfile

@@ -33,7 +33,7 @@ ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 
 ENV ARKIME_DIR="/opt/arkime"
-ENV ARKIME_VERSION="5.8.3"
+ENV ARKIME_VERSION="6.1.1"
 ENV ARKIME_DEB_URL="https://github.com/arkime/arkime/releases/download/v${ARKIME_VERSION}/arkime_${ARKIME_VERSION}-1.debian13_XXX.deb"
 ENV ARKIME_JA4_SO_URL="https://github.com/arkime/arkime/releases/download/v${ARKIME_VERSION}/ja4plus.XXX.so"
 ENV ARKIME_LOCALELASTICSEARCH=no
@@ -52,6 +52,7 @@ ARG ARKIME_SSL=true
 ARG ARKIME_VIEWER_PORT=8005
 #Whether or not Arkime is in charge of deleting old PCAP files to reclaim space
 ARG MANAGE_PCAP_FILES=false
+ARG ARKIME_PCAP_LIBPCAP=false
 ARG ARKIME_PCAP_PROCESSOR=true
 ARG ARKIME_LIVE_CAPTURE=false
 ARG ARKIME_ROTATED_PCAP=true
@@ -88,6 +89,7 @@ ENV VIEWER=$VIEWER
 ENV ARKIME_SSL=$ARKIME_SSL
 ENV ARKIME_VIEWER_PORT=$ARKIME_VIEWER_PORT
 ENV MANAGE_PCAP_FILES=$MANAGE_PCAP_FILES
+ENV ARKIME_PCAP_LIBPCAP=$ARKIME_PCAP_LIBPCAP
 ENV AUTO_TAG=$AUTO_TAG
 ENV PCAP_PIPELINE_VERBOSITY=$PCAP_PIPELINE_VERBOSITY
 ENV PCAP_MONITOR_HOST=$PCAP_MONITOR_HOST
@@ -117,6 +119,7 @@ RUN export DEBARCH=$(dpkg --print-architecture) && \
       libmaxminddb0 \
       libpcap0.8 \
       libpcre2-8-0 \
+      libpython3.13 \
       librdkafka1 \
       libssl3 \
       libtool \
@@ -200,8 +203,8 @@ RUN groupadd --gid $DEFAULT_GID $PGROUP && \
       setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip CAP_IPC_LOCK+eip' $ARKIME_DIR/bin/capture && \
     chown root:${PGROUP} /sbin/ethtool && \
       setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /sbin/ethtool && \
-    mkdir -p /var/run/arkime $ARKIME_DIR/logs $ARKIME_DIR/lua && \
-    chown -R $PUSER:$PGROUP $ARKIME_DIR/etc $ARKIME_DIR/lua $ARKIME_DIR/rules $ARKIME_DIR/logs /var/run/arkime
+    mkdir -p /var/run/arkime $ARKIME_DIR/logs $ARKIME_DIR/parsers $ARKIME_DIR/lua && \
+    chown -R $PUSER:$PGROUP $ARKIME_DIR/etc $ARKIME_DIR/parsers $ARKIME_DIR/lua $ARKIME_DIR/rules $ARKIME_DIR/logs /var/run/arkime
 #Update Path
 ENV PATH="/opt:$ARKIME_DIR/bin:${PATH}"
 

Dockerfiles/dashboards-helper.Dockerfile

@@ -91,7 +91,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     groupadd --gid ${DEFAULT_GID} ${PUSER} && \
-      useradd -M --uid ${DEFAULT_UID} --gid ${DEFAULT_GID} -d /nonexistant -s /sbin/nologin ${PUSER} && \
+      useradd -M --uid ${DEFAULT_UID} --gid ${DEFAULT_GID} -d /nonexistent -s /sbin/nologin ${PUSER} && \
       usermod -a -G tty ${PUSER} && \
     mkdir -p /data/init /opt/ecs && \
       cd /opt && \

Dockerfiles/dirinit.Dockerfile

@@ -26,7 +26,7 @@ ADD --chmod=755 shared/bin/docker-uid-gid-setup.sh /usr/local/bin/
 RUN apk update --no-cache && \
     apk --no-cache add bash jq psmisc rsync shadow tini && \
     addgroup -g ${DEFAULT_GID} ${PGROUP} ; \
-      adduser -D -H -u ${DEFAULT_UID} -h /nonexistant -s /sbin/nologin -G ${PGROUP} -g ${PUSER} ${PUSER} ; \
+      adduser -D -H -u ${DEFAULT_UID} -h /nonexistent -s /sbin/nologin -G ${PGROUP} -g ${PUSER} ${PUSER} ; \
       addgroup ${PUSER} tty ; \
     addgroup ${PUSER} tty
 

Dockerfiles/file-upload.Dockerfile

@@ -87,6 +87,7 @@ RUN export BINARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
       rsync \
       tini \
       vim-tiny && \
+    rm -f /etc/ssh/ssh_host_* && \
     curl -fsSL -o /usr/local/bin/supercronic "${SUPERCRONIC_URL}${BINARCH}" && \
       chmod +x /usr/local/bin/supercronic && \
     mkdir -p /var/www/upload/server/php \
@@ -132,7 +133,7 @@ RUN mkdir -p /run/php \
             /var/www/upload/server/php/chroot && \
   echo "Put your files into /files. Don't use subdirectories." \
       >/var/www/upload/server/php/chroot/README.txt && \
-  rm -rf /var/lib/apt/lists/* /var/cache/* /tmp/* /var/tmp/*
+  rm -rf /var/lib/apt/lists/* /var/cache/* /tmp/* /var/tmp/* /var/log/journal
 
 # see PUSER_CHOWN comment above
 VOLUME [ "/var/www/upload/server/php/chroot/files" ]