Installing Wazuh server from sources

Installing Wazuh manager

# yum install make cmake gcc gcc-c++ python3 python3-policycoreutils automake autoconf libtool

# apt-get install python gcc make libc6-dev curl policycoreutils automake autoconf libtool

# zypper install make gcc policycoreutils-python automake autoconf libtool

Optional. Install the following dependencies only if the installation directory is not /var/ossec. Since v3.9.0, make deps will download a pre-compiled version of CPython, built to be installed in /var/ossec. Otherwise, it will download a modified version of CPython sources and it will be necessary to compile it.

To install the build dependencies of CPython, follow these steps:

# yum install epel-release yum-utils -y
# yum-builddep python34 -y

# echo "deb-src http://deb.debian.org/debian $(lsb_release -cs) main" >> /etc/apt/sources.list
# apt-get update
# apt-get build-dep python3.5 -y

# zypper install epel-release yum-utils -y
# zypper-builddep python34 -y

1. Download and extract the latest version:

   # curl -Ls https://github.com/wazuh/wazuh/archive/v4.0.4.tar.gz | tar zx
   

2. Run the install.sh script. This will display a wizard to guide you through the installation process using the Wazuh sources:

   Warning

   If you want to enable the database output, check out this section before running the installation script.

   # cd wazuh-*
   # ./install.sh
   

   If you have previously compiled for another platform, you must clean the build using the Makefile in src:

   # cd wazuh-*
   # make -C src clean
   # make -C src clean-deps
   

3. When the script asks what kind of installation you want, type manager to install the Wazuh manager:

   1- What kind of installation do you want (manager, agent, local, hybrid or help)? manager
   

   Note

   During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to manager, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt.

   Warning

   Be extremely careful not to select a critical installation directory if you choose a different path than the default. If the directory already exist the installer will ask if delete the directory or if installing Wazuh inside.

4. The installer asks if you want to start Wazuh at the end of the installation. If you choosed not to, you can start it later with:

# systemctl start wazuh-manager

# service wazuh-manager start

Uninstall

To uninstall Wazuh manager:

# OSSEC_INIT="/etc/ossec-init.conf"
# . $OSSEC_INIT 2> /dev/null

Stop the service:

# service wazuh-manager stop 2> /dev/null

Stop the daemon:

# $DIRECTORY/bin/ossec-control stop 2> /dev/null

Remove files and service artifacts:

# rm -rf $DIRECTORY $OSSEC_INIT

Delete the service:

For SysV Init:

# [ -f /etc/rc.local ] && sed -i'' '/ossec-control start/d' /etc/rc.local
# find /etc/{init.d,rc*.d} -name "*wazuh" | xargs rm -f

For Systemd:

# find /etc/systemd/system -name "wazuh*" | xargs rm -f
# systemctl daemon-reload

Remove users:

# userdel ossec 2> /dev/null
# userdel ossecm 2> /dev/null
# userdel ossecr 2> /dev/null
# groupdel ossec 2> /dev/null