Install Wazuh server from sources

Installing Wazuh manager

1. Install development tools and compilers. In Linux this can easily be done using your distribution's package manager:

1. For RPM-based distributions:

$ sudo yum install make gcc git

# If you want to use Auth, also install:
$ sudo yum install openssl-devel

2. For Debian-based distributions:

$ sudo apt-get install gcc make git libc6-dev curl

# If you want to use Auth, also install:
$ sudo apt-get install libssl-dev

2. Download and extract the latest version:

$ curl -Ls https://github.com/wazuh/wazuh/archive/v2.1.1.tar.gz | tar zx

3. Run the install.sh script, this will display a wizard that will guide you through the installation process using the Wazuh sources:

$ cd wazuh-*
$ sudo ./install.sh

4. The script will ask about what kind of installation you want. Type server to install Wazuh Manager:

1- What kind of installation do you want (server, agent, local, hybrid or help)? server

5. Start the services using this command:

$ sudo /var/ossec/bin/ossec-control start

Installing Wazuh API

1. NodeJS >= 4.6.1 is required in order to run the Wazuh API. If you do not have NodeJS installed or your version is older than 4.6.1, we recommend you add the official repository as this has more recent versions.

1. For RPM-based distributions:

$ curl --silent --location https://rpm.nodesource.com/setup_6.x | bash -
$ sudo yum -y install nodejs

2. For Debian-based distributions:

$ curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
$ sudo apt-get install -y nodejs

Note

Official guide to install NodeJS.

2. Download and execute the installation script:

$ curl -s -o install_api.sh https://raw.githubusercontent.com/wazuh/wazuh-api/v2.1.1/install_api.sh && bash ./install_api.sh download

3. Python >= 2.7 is required in order to run the API. It is installed by default or included in the official repositories of most Linux distributions. It is possible to set a custom Python path for the API to use, in /var/ossec/api/configuration/config.js:

config.python = [
    // Default installation
    {
        bin: "python",
        lib: ""
    },
    // Package 'python27' for CentOS 6
    {
        bin: "/opt/rh/python27/root/usr/bin/python",
        lib: "/opt/rh/python27/root/usr/lib64"
    }
];

CentOS 6 and Red Hat 6 come with Python 2.6, you can install Python 2.7 in parallel maintaining older version:

1. For CentOS 6:

$ sudo yum install -y centos-release-scl
$ sudo yum install -y python27

2. For RHEL 6:

$ sudo yum install python27

# You may need to first enable a repository in order to get python27, with a command like this:
#   sudo yum-config-manager --enable rhui-REGION-rhel-server-rhscl
#   sudo yum-config-manager --enable rhel-server-rhscl-6-rpms

Installing Filebeat

While Filebeat can be installed from source (see this doc), the process is more complex than you may like, and it is beyond the scope of Wazuh documentation. We recommend installing Filebeat via repository package, otherwise, you can install it from a binary tarball, that's should work for any Linux distro. See more here.

Next steps

Once you have installed the manager, API and Filebeat (only needed for distributed architectures), you are ready to install Elastic Stack.