MacOS X agents

Open a session in your MacOS X agent host as root user. After that, you can register the Agent using agent-auth and a password as follows:

  1. Register the agent using the password. The agents can use the password by storing it on a file or as a command line argument, so you can use any of these two options:

  1. Write the password on /Library/Ossec/etc/authd.pass and run the agent-auth program:

# echo "TopSecret" > /Library/Ossec/etc/authd.pass
# /Library/Ossec/bin/agent-auth -m <MANAGER_IP_ADDRESS>

  1. Run the program with the -P flag, and insert the password:

# /Library/Ossec/bin/agent-auth -m <MANAGER_IP_ADDRESS> -P "TopSecret"

  1. Edit the Wazuh agent configuration to add the Wazuh server IP address.

In the file /Library/Ossec/etc/ossec.conf, in the <client><server> section, change the MANAGER_IP value to the Wazuh server address:

<client>
  <server>
    <address>MANAGER_IP</address>
    ...
  </server>
</client>

  1. Start the agent.

# /Library/Ossec/bin/ossec-control start