Install Wazuh server with DEB packages

Adding Wazuh Repositories

The first step to setting up Wazuh is to add the Wazuh repository to your server. If you want to download the wazuh-manager package directly, or check the compatible versions, click here.

1. To perform this procedure, the curl, apt-transport-https and lsb-release packages must be installed on your system. If they are not already present, install them using the commands below:

# apt-get update
# apt-get install curl apt-transport-https lsb-release

If the /usr/bin/python file doesn't exist (like in Ubuntu 16.04 LTS or later), create a symlink to Python (2.7 or newer) with the following command:

# if [ ! -f /usr/bin/python ]; then ln -s /usr/bin/python3 /usr/bin/python; fi

2. Install the GPG key:

# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -

3. Add the repository:

# echo "deb https://packages.wazuh.com/3.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

4. Update the package information:

# apt-get update

Installing the Wazuh Manager

On your terminal, install the Wazuh manager:

# apt-get install wazuh-manager=3.4.0-1

Once the process is completed, you can check the service status with:

1. For Systemd:

# systemctl status wazuh-manager

2. For SysV Init:

# service wazuh-manager status

Installing the Wazuh API

1. NodeJS >= 4.6.1 is required in order to run the Wazuh API. If you do not have NodeJS installed or your version is older than 4.6.1, we recommend that you add the official NodeJS repository like this:

# curl -sL https://deb.nodesource.com/setup_8.x | bash -

Note

If you are using Ubuntu 12.04 (Precise) or Debian 7 (Wheezy) you must install NodeJS 6 using the command below: # curl -sL https://deb.nodesource.com/setup_6.x | bash -

and then, install NodeJS:

# apt-get install nodejs

2. Install the Wazuh API. It will update NodeJS if it is required:

# apt-get install wazuh-api=3.4.0-1

3. Once the process is complete, you can check the service status with:

1. For Systemd:

# systemctl status wazuh-api

2. For SysV Init:

# service wazuh-api status

4. Python >= 2.7 is required in order to run the API. It is installed by default or included in the official repositories in most Linux distributions.

   It is possible to set a custom Python path for the API in /var/ossec/api/configuration/config.js, in case the stock version of Python in your distro is too old:

config.python = [
    // Default installation
    {
        bin: "python",
        lib: ""
    },
    // Package 'python27' for CentOS 6
    {
        bin: "/opt/rh/python27/root/usr/bin/python",
        lib: "/opt/rh/python27/root/usr/lib64"
    }
];

Installing Filebeat

Filebeat is the tool on the Wazuh server that securely forwards alerts and archived events to the Logstash service on the Elastic Stack server(s).

The DEB package is suitable for Debian, Ubuntu, and other Debian-based systems.

1. Install the GPG keys from Elastic and then the Elastic repository:

# curl -s https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
# echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | tee /etc/apt/sources.list.d/elastic-6.x.list
# apt-get update

2. Install Filebeat:

# apt-get install filebeat=6.3.2

3. Download the Filebeat config file from the Wazuh repository. This is pre-configured to forward Wazuh alerts to Logstash:

# curl -so /etc/filebeat/filebeat.yml https://raw.githubusercontent.com/wazuh/wazuh/3.4/extensions/filebeat/filebeat.yml

4. Edit the file /etc/filebeat/filebeat.yml and replace ELASTIC_SERVER_IP with the IP address or the hostname of the Elastic Stack server. For example:

output:
  logstash:
    hosts: ["ELASTIC_SERVER_IP:5000"]

5. Enable and start the Filebeat service:

1. For Systemd:

# systemctl daemon-reload
# systemctl enable filebeat.service
# systemctl start filebeat.service

2. For SysV Init:

# update-rc.d filebeat defaults 95 10
# service filebeat start

Next steps

Once you have installed the manager, API and Filebeat (only needed for distributed architectures), you are ready to install Elastic Stack.