SPECS for new SCA Alma Linux 9

[72nomada]

Create SPECS as needed for a new OS SCA

PR - wazuh/wazuh#17811 Is ready to merge
Branch - https://github.com/wazuh/wazuh/tree/SCA-Alma-Linux-9

PLEASE confirm with @wazuh/threat-intel before merging.

[vikman90]

This is a subtask of wazuh/wazuh#16616.

[DFolchA]

Update: Testing

AGENT

[root@almalinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-agent-4.5.1-0.0.0.alma9.x86_64.rpm -y
Last metadata expiration check: 2:11:29 ago on Wed 19 Jul 2023 12:10:11 PM UTC.
wazuh-agent-4.5.1-0.0.0.alma9.x86_64.rpm                                                                    1.0 MB/s | 8.8 MB     00:08    
Dependencies resolved.
============================================================================================================================================
 Package                         Architecture               Version                                  Repository                        Size
============================================================================================================================================
Installing:
 wazuh-agent                     x86_64                     4.5.1-0.0.0.alma9                        @commandline                     8.8 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 8.8 M
Installed size: 25 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.alma9.x86_64                                                                               1/1 
  Installing       : wazuh-agent-4.5.1-0.0.0.alma9.x86_64                                                                               1/1 
  Running scriptlet: wazuh-agent-4.5.1-0.0.0.alma9.x86_64                                                                               1/1 
  Verifying        : wazuh-agent-4.5.1-0.0.0.alma9.x86_64                                                                               1/1 

Installed:
  wazuh-agent-4.5.1-0.0.0.alma9.x86_64                                                                                                      

Complete!
[root@almalinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_alma_linux_9.yml

MANAGER

[root@almalinux9 vagrant]# yum install https://s3.us-west-1.amazonaws.com/packages-dev.wazuh.com/warehouse/test/4.5/rpm/var/wazuh-manager-4.5.1-0.0.0.alma9.x86_64.rpm -y
Last metadata expiration check: 2:21:58 ago on Wed 19 Jul 2023 12:10:11 PM UTC.
wazuh-manager-4.5.1-0.0.0.alma9.x86_64.rpm                                                                  7.4 MB/s | 164 MB     00:22    
Dependencies resolved.
============================================================================================================================================
 Package                           Architecture               Version                                Repository                        Size
============================================================================================================================================
Installing:
 wazuh-manager                     x86_64                     4.5.1-0.0.0.alma9                      @commandline                     164 M

Transaction Summary
============================================================================================================================================
Install  1 Package

Total size: 164 M
Installed size: 598 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                    1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.alma9.x86_64                                                                             1/1 
  Installing       : wazuh-manager-4.5.1-0.0.0.alma9.x86_64                                                                             1/1 
  Running scriptlet: wazuh-manager-4.5.1-0.0.0.alma9.x86_64                                                                             1/1 
  Verifying        : wazuh-manager-4.5.1-0.0.0.alma9.x86_64                                                                             1/1 

Installed:
  wazuh-manager-4.5.1-0.0.0.alma9.x86_64                                                                                                    

Complete!
[root@almalinux9 vagrant]# ls /var/ossec/ruleset/sca/
cis_alma_linux_9.yml                cis_iis_10.yml.disabled               cis_sqlserver_2014.yml.disabled
cis_amazon_linux_1.yml.disabled     cis_mongodb_36.yml.disabled           cis_sqlserver_2016.yml.disabled
cis_amazon_linux_2.yml.disabled     cis_mysql5-6_community.yml.disabled   cis_sqlserver_2017.yml.disabled
cis_apache_24.yml.disabled          cis_mysql5-6_enterprise.yml.disabled  cis_sqlserver_2019.yml.disabled
cis_apple_macOS_10.11.yml.disabled  cis_nginx_1.yml.disabled              cis_ubuntu14-04.yml.disabled
cis_apple_macOS_10.12.yml.disabled  cis_oracle_database_19c.yml.disabled  cis_ubuntu16-04.yml.disabled
cis_apple_macOS_10.13.yml.disabled  cis_postgre-sql-13.yml.disabled       cis_ubuntu18-04.yml.disabled
cis_apple_macOS_10.14.yml.disabled  cis_rhel5_linux.yml.disabled          cis_ubuntu20-04.yml.disabled
cis_apple_macOS_10.15.yml.disabled  cis_rhel6_linux.yml.disabled          cis_ubuntu22-04.yml.disabled
cis_apple_macOS_11.1.yml.disabled   cis_rhel7_linux.yml.disabled          cis_win10_enterprise.yml.disabled
cis_apple_macOS_12.0.yml.disabled   cis_rhel8_linux.yml.disabled          cis_win11_enterprise.yml.disabled
cis_centos6_linux.yml.disabled      cis_rhel9_linux.yml.disabled          cis_win2012r2.yml.disabled
cis_centos7_linux.yml.disabled      cis_sles11_linux.yml.disabled         cis_win2016.yml.disabled
cis_centos8_linux.yml.disabled      cis_sles12_linux.yml.disabled         cis_win2019.yml.disabled
cis_debian10.yml.disabled           cis_sles15_linux.yml.disabled         cis_win2022.yml.disabled
cis_debian7.yml.disabled            cis_solaris11.4.yml.disabled          sca_unix_audit.yml.disabled
cis_debian8.yml.disabled            cis_solaris11.yml.disabled            web_vulnerabilities.yml.disabled
cis_debian9.yml.disabled            cis_sqlserver_2012.yml.disabled
[root@almalinux9 vagrant]# 

[vikman90]

PR #2303 ready, blocked by wazuh/wazuh#17811.

[mjcr99]

Issue updates

(12/01/2024) - Updated PR with the requested changes to add Almalinux 9 SCA files. The PR has been tested, the resulting packages contain the new files as expected:

Manager

Manager package build: https://ci.wazuh.info/job/Packages_builder/180487

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-manager-4.8.1-al9.x86_64.rpm
AlmaLinux 9 - AppStream                                                                                 4.6 MB/s | 8.1 MB     00:01    
AlmaLinux 9 - BaseOS                                                                                    4.1 MB/s | 3.5 MB     00:00    
AlmaLinux 9 - Extras                                                                                     27 kB/s |  17 kB     00:00    
wazuh-manager-4.8.1-al9.x86_64.rpm                                                                       20 MB/s | 351 MB     00:17    
Dependencies resolved.
========================================================================================================================================
 Package                            Architecture                Version                         Repository                         Size
========================================================================================================================================
Installing:
 wazuh-manager                      x86_64                      4.8.1-al9                       @commandline                      351 M

Transaction Summary
========================================================================================================================================
Install  1 Package

Total size: 351 M
Installed size: 856 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                1/1 
  Running scriptlet: wazuh-manager-4.8.1-al9.x86_64                                                                                 1/1 
  Installing       : wazuh-manager-4.8.1-al9.x86_64                                                                                 1/1 
  Running scriptlet: wazuh-manager-4.8.1-al9.x86_64                                                                                 1/1 
  Verifying        : wazuh-manager-4.8.1-al9.x86_64                                                                                 1/1 

Installed:
  wazuh-manager-4.8.1-al9.x86_64                                                                                                        

Complete!

SCA file found:

[root@localhost vagrant]# ls /var/ossec/ruleset/sca
[root@localhost vagrant]# ls /var/ossec/ruleset/sca
cis_alma_linux_8.yml.disabled       cis_debian12.yml.disabled             cis_solaris11.4.yml.disabled
cis_alma_linux_9.yml                cis_debian7.yml.disabled              cis_solaris11.yml.disabled
cis_amazon_linux_1.yml.disabled     cis_debian8.yml.disabled              cis_sqlserver_2012.yml.disabled
cis_amazon_linux_2.yml.disabled     cis_debian9.yml.disabled              cis_sqlserver_2014.yml.disabled
cis_amazon_linux_2023.yml.disabled  cis_iis_10.yml.disabled               cis_sqlserver_2016.yml.disabled
cis_apache_24.yml.disabled          cis_mongodb_36.yml.disabled           cis_sqlserver_2017.yml.disabled
cis_apple_macOS_10.11.yml.disabled  cis_mysql5-6_community.yml.disabled   cis_sqlserver_2019.yml.disabled
cis_apple_macOS_10.12.yml.disabled  cis_mysql5-6_enterprise.yml.disabled  cis_ubuntu14-04.yml.disabled
cis_apple_macOS_10.13.yml.disabled  cis_nginx_1.yml.disabled              cis_ubuntu16-04.yml.disabled
cis_apple_macOS_10.14.yml.disabled  cis_oracle_database_19c.yml.disabled  cis_ubuntu18-04.yml.disabled
cis_apple_macOS_10.15.yml.disabled  cis_postgre-sql-13.yml.disabled       cis_ubuntu20-04.yml.disabled
cis_apple_macOS_11.1.yml.disabled   cis_rhel5_linux.yml.disabled          cis_ubuntu22-04.yml.disabled
cis_apple_macOS_12.0.yml.disabled   cis_rhel6_linux.yml.disabled          cis_win10_enterprise.yml.disabled
cis_apple_macOS_13.x.yml.disabled   cis_rhel7_linux.yml.disabled          cis_win11_enterprise.yml.disabled
cis_apple_macOS_14.0.yml.disabled   cis_rhel8_linux.yml.disabled          cis_win2012r2.yml.disabled
cis_centos6_linux.yml.disabled      cis_rhel9_linux.yml.disabled          cis_win2016.yml.disabled
cis_centos7_linux.yml.disabled      cis_rocky_linux_8.yml.disabled        cis_win2019.yml.disabled
cis_centos8_linux.yml.disabled      cis_sles11_linux.yml.disabled         cis_win2022.yml.disabled
cis_debian10.yml.disabled           cis_sles12_linux.yml.disabled         sca_unix_audit.yml.disabled
cis_debian11.yml.disabled           cis_sles15_linux.yml.disabled         web_vulnerabilities.yml.disabled

Agent

Agent package build: https://ci.wazuh.info/job/Packages_builder/180488

Package installation:

[root@localhost vagrant]# yum install -y https://packages-dev.wazuh.com/warehouse/test/4.8/rpm/var/wazuh-agent-4.8.1-al9.x86_64.rpm
AlmaLinux 9 - AppStream                                                                                 4.7 MB/s | 8.1 MB     00:01    
AlmaLinux 9 - BaseOS                                                                                    3.7 MB/s | 3.5 MB     00:00    
AlmaLinux 9 - Extras                                                                                     32 kB/s |  17 kB     00:00    
wazuh-agent-4.8.1-al9.x86_64.rpm                                                                        3.7 MB/s | 9.3 MB     00:02    
Dependencies resolved.
========================================================================================================================================
 Package                          Architecture                Version                           Repository                         Size
========================================================================================================================================
Installing:
 wazuh-agent                      x86_64                      4.8.1-al9                         @commandline                      9.3 M

Transaction Summary
========================================================================================================================================
Install  1 Package

Total size: 9.3 M
Installed size: 28 M
Downloading Packages:
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                1/1 
  Running scriptlet: wazuh-agent-4.8.1-al9.x86_64                                                                                   1/1 
  Installing       : wazuh-agent-4.8.1-al9.x86_64                                                                                   1/1 
  Running scriptlet: wazuh-agent-4.8.1-al9.x86_64                                                                                   1/1 
  Verifying        : wazuh-agent-4.8.1-al9.x86_64                                                                                   1/1 

Installed:
  wazuh-agent-4.8.1-al9.x86_64                                                                                                          

Complete!

SCA file found:

[root@localhost vagrant]# ls /var/ossec/ruleset/sca
cis_alma_linux_9.yml