Configuring a cluster

Reasons for using a cluster

High availability

Server eventually fail: hardware can be broken, a human can turn them off, the system can go down... And while the server is restored, you won't be able to see what is happening in your agents. Using a cluster you make sure your agents will always have a manager to report to.

Types of nodes

Deploying a Wazuh cluster

Follow these steps to deploy a Wazuh cluster:

1. Install dependencies

1. For RPM-based distributions:

# yum install python-setuptools python-cryptography

2. For Debian-based distributions:

# apt-get install python-cryptography

2. Set the cluster configuration

Using the <cluster> section in the Local configuration, set the cluster configuration as below:

• <node_type>: Set the node type.

• <key>: The key must be 32 characters long and should be the same for all of the nodes of the cluster. You may use the following command to generate a random one:

  # openssl rand -hex 16
  

• <disabled>: Set this field to no in order to enable the cluster.

• <nodes>: The address of the master must be specified in all nodes (including the master itself). The address can be either an IP or a DNS.

  The following is an example of the configuration of a client node:

  <cluster>
      <name>wazuh</name>
      <node_name>node02</node_name>
      <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
      <node_type>client</node_type>
      <port>1516</port>
      <bind_addr>0.0.0.0</bind_addr>
      <nodes>
        <node>master</node>
      </nodes>
      <hidden>no</hidden>
      <disabled>no</disabled>
  </cluster>
  

  And the following is an example of the configuration of a master node:

  <cluster>
      <name>wazuh</name>
      <node_name>node01</node_name>
      <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
      <node_type>master</node_type>
      <port>1516</port>
      <bind_addr>0.0.0.0</bind_addr>
      <nodes>
        <node>master</node>
      </nodes>
      <hidden>no</hidden>
      <disabled>no</disabled>
  </cluster>
  

3. Restart the node

   # systemctl restart wazuh-manager
   

Agent registration in the cluster

All agents must be registered in the master node. The master is responsible for replicating the new agent's information across all client nodes. If an agent is registered in a client node, it will be deleted by the master node.

Configuring the Wazuh Kibana App

Although all nodes can have an API installed, the Wazuh Kibana app must be configured with the master node API because the master node is the one that has all the information about the agents and the cluster.

Pointing agents to the cluster with a load balancer

The best setup to report agents' events to a cluster is a load balancer. Keep in mind the following considerations:

• It is recommended to use TCP protocol instead of UDP. Permanent connections and stickiness are needed in order to make sure agent data is consistent. In order to use the TCP protocol, you should configure both your agents and your nodes.

• Disable the option use_source_ip in your authd configuration. When using a LB, the cluster nodes will only see the LB's IP and no the agents'. This will make the agents unable to connect to the cluster.

Running the cluster in CentOS 6

Python 2.6 is the default python version in CentOS 6. Since Python 2.7 is required to run the cluster, follow these steps to install and use this version:

1. Install Python 2.7 as follows:

# yum install -y centos-release-scl
# yum install -y python27

2. Install the Python package cryptography via pip:

# export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/rh/python27/root/usr/lib64:/opt/rh/python27/root/usr/lib
# /opt/rh/python27/root/usr/bin/pip2.7 install cryptography

3. Since the cluster doesn't use the default python version in CentOS 6, the service file should be modified to load the correct python version when wazuh-manager service starts:

# sed -i 's#echo -n "Starting OSSEC: "#echo -n "Starting OSSEC (EL6): "; source /opt/rh/python27/enable; export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/var/ossec/framework/lib#' /etc/init.d/wazuh-manager

4. Use service command instead of /var/ossec/bin/ossec-control to start, stop and restart Wazuh:

# service wazuh-manager restart
Stopping OSSEC:                                            [  OK  ]
Starting OSSEC (EL6):                                      [  OK  ]

5. Finally, check the cluster is running:

# ps aux | grep cluster
ossec     9725  0.1  1.3 137364 14216 ?        S    14:22   0:00 python /var/ossec/bin/wazuh-clusterd
root      9767  0.0  0.0 103340   904 pts/0    S+   14:22   0:00 grep cluster

Running the cluster in Ubuntu Trusty (14.04)

In order to run the Wazuh cluster in Ubuntu Trusty, ensure that Python 2.7 is installed in your machine. After that, to run the cluster follow these steps:

1. Install the following packages:

# apt-get install python-pip libssl-dev python-dev libffi-dev

2. Install the latests version of setuptools package using pip:

# pip install setuptools --upgrade

3. Install cryptography module, its dependencies and ipaddress:

# pip install enum34 six cffi cryptography ipaddress

Once you have executed all these commands, you can set the cluster configuration and run the cluster.

Keep alive thread

The keep alive thread sends a keep-alive to the master every so often. It is necessary to keep the connection opened between master and client, since the cluster uses permanent connections.

Agent info thread

The agent info thread sends the statuses of the agents that are reporting to the client node. The master checks the modification date of each received agent status file and keeps the most recent one.

The master also checks whether the agent exists or not before saving its status update. This is done to prevent the master to store unnecessary information. For example, this situation is very common when an agent is removed but the master hasn't notified client nodes yet.

Integrity thread

The integrity thread is in charge of synchrozing the files sent by the master node to the clients. Those files are:

• Agent keys file.

• User defined rules, decoders and CDB lists.

• Agent groups files and assignments.

Usually, the master is responsible for sending group assignments, but just in case a new agent starts reporting in a client node, the client will send the new agent's group assignment to the master.

File Integrity Thread

The integrity of each file is calculated using its MD5 checksum and its modification time. To avoid calculating the integrity with each client connection, the integrity is calculated in a different thread, called File integrity thread, in the master node every so often.