Step-by-step installation

Adding the Elastic Stack repository

Elasticsearch installation and configuration

1. Install the Elasticsearch package:

   YumAPTZYpp

   # yum install elasticsearch-7.11.2
   

2. Download the configuration file /etc/elasticsearch/elasticsearch.yml as follows:

   # curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/resources/4.1/elastic-stack/elasticsearch/7.x/elasticsearch_all_in_one.yml
   

Certificates creation and deployment

1. Download the configuration file for creating the certificates:

   # curl -so /usr/share/elasticsearch/instances.yml https://packages.wazuh.com/resources/4.1/elastic-stack/instances_aio.yml
   

   In the following steps, a file that contains a folder named after the instance defined here will be created. This folder will contain the certificates and the keys necessary to communicate with the Elasticsearch node using SSL.

2. The certificates can be created using the elasticsearch-certutil tool:

   # /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in instances.yml --keep-ca-key --out ~/certs.zip
   

3. Extract the generated /usr/share/elasticsearch/certs.zip file from the previous step.

   # unzip ~/certs.zip -d ~/certs
   

4. The next step is to create the directory /etc/elasticsearch/certs, and then copy the CA file, the certificate and the key there:

   # mkdir /etc/elasticsearch/certs/ca -p
   # cp -R ~/certs/ca/ ~/certs/elasticsearch/* /etc/elasticsearch/certs/
   # chown -R elasticsearch: /etc/elasticsearch/certs
   # chmod -R 500 /etc/elasticsearch/certs
   # chmod 400 /etc/elasticsearch/certs/ca/ca.* /etc/elasticsearch/certs/elasticsearch.*
   # rm -rf ~/certs/ ~/certs.zip
   

5. Enable and start the Elasticsearch service:

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable elasticsearch
   # systemctl start elasticsearch
   

6. Generate credentials for all the Elastic Stack pre-built roles and users:

   # /usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto
   

   The command above will prompt an output like this. Save the password of the elastic user for further steps:

   Changed password for user apm_system
   PASSWORD apm_system = lLPZhZkB6oUOzzCrkLSF
   
   Changed password for user kibana_system
   PASSWORD kibana_system = TaLqVOnSoqKTYLIU0vDn
   
   Changed password for user kibana
   PASSWORD kibana = TaLqVOvXoqKTYLIU0vDn
   
   Changed password for user logstash_system
   PASSWORD logstash_system = UtuDv2tWkXGYL83v9kWA
   
   Changed password for user beats_system
   PASSWORD beats_system = qZcbvCslafMpoEOrE9Ob
   
   Changed password for user remote_monitoring_user
   PASSWORD remote_monitoring_user = LzJpQiSylncmCU2GLBTS
   
   Changed password for user elastic
   PASSWORD elastic = AN4UeQGA7HGl5iHpMla7
   

To check that the installation was made successfully, run the following command replacing <elastic_password> by the password generated on the previous step for elastic user:

# curl -XGET https://localhost:9200 -u elastic:<elastic_password> -k

This command should have an output like this:

{
  "name" : "elasticsearch",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "TLGcuHLRTL6PAyIRlxjtLg",
  "version" : {
    "number" : "7.11.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "3e5a16cfec50876d20ea77b075070932c6464c7d",
    "build_date" : "2021-03-06T05:54:38.141101Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Adding the Wazuh repository

Installing the Wazuh manager

1. Install the Wazuh manager package:

   YumAPTZYpp

   # yum install wazuh-manager-4.1.5-1
   

2. Enable and start the Wazuh manager service:

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

3. Run the following command to check if the Wazuh manager is active:

   SystemdSysV Init

   # systemctl status wazuh-manager
   

Filebeat installation and configuration

1. Install the Filebeat package:

   YumAPTZYpp

   # yum install filebeat-7.11.2
   

2. Download the pre-configured Filebeat config file used to forward Wazuh alerts to Elasticsearch:

   # curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/resources/4.1/elastic-stack/filebeat/7.x/filebeat_all_in_one.yml
   

3. Download the alerts template for Elasticsearch:

   # curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.1/extensions/elasticsearch/7.x/wazuh-template.json
   # chmod go+r /etc/filebeat/wazuh-template.json
   

4. Download the Wazuh module for Filebeat:

   # curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
   

5. Edit the file /etc/filebeat/filebeat.yml:

   output.elasticsearch.password: <elasticsearch_password>
   

   Replace elasticsearch_password with the previously generated password for elastic user.

6. Copy the certificates into /etc/filebeat/certs/

   # cp -r /etc/elasticsearch/certs/ca/ /etc/filebeat/certs/
   # cp /etc/elasticsearch/certs/elasticsearch.crt /etc/filebeat/certs/filebeat.crt
   # cp /etc/elasticsearch/certs/elasticsearch.key /etc/filebeat/certs/filebeat.key
   

7. Enable and start the Filebeat service:

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

To ensure that Filebeat has been successfully installed, run the following command:

# filebeat test output

An example response should look as follows:

elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.11.2