Wazuh Puppet module

Single-node

You can use the manifest shown below to deploy a single-node stack. This stack consists of:

• Wazuh dashboard

• Wazuh indexer

• Wazuh manager

• Filebeat

To configure the manager before deployment, check the Wazuh puppet reference.

1. Install the following packages if missing on the Puppet agent. The Wazuh central components require these packages:

   APTYumDNF

   # apt-get install debhelper tar curl libcap2-bin #debhelper version 9 or later
   

2. Create the stack.pp file on the Puppet master at /etc/puppetlabs/code/environments/production/manifests/ with the code below:

   $discovery_type = 'single-node'
   stage { 'certificates': }
   stage { 'repo': }
   stage { 'indexerdeploy': }
   stage { 'securityadmin': }
   stage { 'dashboard': }
   stage { 'manager': }
   Stage[certificates] -> Stage[repo] -> Stage[indexerdeploy] -> Stage[securityadmin] -> Stage[manager] -> Stage[dashboard]
   Exec {
   timeout => 0,
   }
   node "<PUPPET_MASTER>" {
   class { 'wazuh::certificates':
     indexer_certs => [['node-1','127.0.0.1']],
     manager_certs => [['master','127.0.0.1']],
     dashboard_certs => ['127.0.0.1'],
     stage => certificates,
   }
   }
   node "<PUPPET_AGENT>" {
   class { 'wazuh::repo':
   stage => repo,
   }
   class { 'wazuh::indexer':
     stage => indexerdeploy,
   }
   class { 'wazuh::securityadmin':
   stage => securityadmin
   }
   class { 'wazuh::manager':
     stage => manager,
   }
   class { 'wazuh::filebeat_oss':
     stage => manager,
   }
   class { 'wazuh::dashboard':
     stage => dashboard,
   }
   }
   

   Where:

   • PUPPET_MASTER is the hostname of the Puppet server where the Wazuh module was installed.

   • PUPPET_AGENT is the hostname of the Puppet agent.

3. Trigger a Puppet run on the Puppet server to generate the Wazuh certificates. Skip this step if you want the stack to run on the specified node once the run interval time, as set in puppet.conf elapses:

   # puppet agent -t
   

4. Perform a Puppet run on the Puppet agent to start the deployment of the Wazuh stack. Skip this step if you want the stack to run on the specified node once the run interval time, as set in puppet.conf elapses:

   # puppet agent -t
   

Multi-node

Using the multi-node manifest below, you can deploy a distributed stack consisting of the following nodes on three servers or Virtual Machines (VMs).

• 3 indexer nodes

• Manager master node

• Manager worker node

• Dashboard node

You must include the server's hostname where you are installing each application.

1. Install the following packages if missing. These packages are required by the Wazuh central components:

   APTYumDNF

   # apt-get install debhelper tar curl libcap2-bin #debhelper version 9 or later
   

2. Create the stack.pp file at /etc/puppetlabs/code/environments/production/manifests/ with the code below:

   $node1host   = '<WAZUH_INDEXER_NODE1>'
   $node2host   = '<WAZUH_INDEXER_NODE2>'
   $node3host   = '<WAZUH_INDEXER_NODE3>'
   $masterhost    = '<WAZUH_MANAGER_MASTER>'
   $workerhost    = '<WAZUH_MANAGER_WORKER>'
   $dashboardhost = '<WAZUH_DASHBOARD>'
   $indexer_node1_name = 'node1'
   $indexer_node2_name = 'node2'
   $indexer_node3_name = 'node3'
   $master_name = 'master'
   $worker_name = 'worker'
   $cluster_size = '3'
   $indexer_discovery_hosts = [$node1host, $node2host, $node3host]
   $indexer_cluster_initial_master_nodes = [$node1host, $node2host, $node3host]
   $indexer_cluster_CN = [$indexer_node1_name, $indexer_node2_name, $indexer_node3_name]
   # Define stage for order execution
   stage { 'certificates': }
   stage { 'repo': }
   stage { 'indexerdeploy': }
   stage { 'securityadmin': }
   stage { 'dashboard': }
   stage { 'manager': }
   Stage[certificates] -> Stage[repo] -> Stage[indexerdeploy] -> Stage[securityadmin] -> Stage[manager] -> Stage[dashboard]
   Exec {
   timeout => 0,
   }
   node "puppet-server" {
   class { 'wazuh::certificates':
     indexer_certs => [["$indexer_node1_name","$node1host" ],["$indexer_node2_name","$node2host" ],["$indexer_node3_name","$node3host" ]],
     manager_master_certs => [["$master_name","$masterhost"]],
     manager_worker_certs => [["$worker_name","$workerhost"]],
     dashboard_certs => ["$dashboardhost"],
     stage => certificates
   }
   class { 'wazuh::repo':
   stage => repo
   }
   }
   node "puppet-wazuh-indexer-node1" {
   class { 'wazuh::repo':
   stage => repo
   }
   class { 'wazuh::indexer':
     indexer_node_name => "$indexer_node1_name",
     indexer_network_host => "$node1host",
     indexer_node_max_local_storage_nodes => "$cluster_size",
     indexer_discovery_hosts => $indexer_discovery_hosts,
     indexer_cluster_initial_master_nodes => $indexer_cluster_initial_master_nodes,
     indexer_cluster_CN => $indexer_cluster_CN,
     stage => indexerdeploy
   }
   class { 'wazuh::securityadmin':
   indexer_network_host => "$node1host",
   stage => securityadmin
   }
   }
   node "puppet-wazuh-indexer-node2" {
   class { 'wazuh::repo':
   stage => repo
   }
   class { 'wazuh::indexer':
     indexer_node_name => "$indexer_node2_name",
     indexer_network_host => "$node2host",
     indexer_node_max_local_storage_nodes => "$cluster_size",
     indexer_discovery_hosts => $indexer_discovery_hosts,
     indexer_cluster_initial_master_nodes => $indexer_cluster_initial_master_nodes,
     indexer_cluster_CN => $indexer_cluster_CN,
     stage => indexerdeploy
   }
   }
   node "puppet-wazuh-indexer-node3" {
   class { 'wazuh::repo':
   stage => repo
   }
   class { 'wazuh::indexer':
     indexer_node_name => "$indexer_node3_name",
     indexer_network_host => "$node3host",
     indexer_node_max_local_storage_nodes => "$cluster_size",
     indexer_discovery_hosts => $indexer_discovery_hosts,
     indexer_cluster_initial_master_nodes => $indexer_cluster_initial_master_nodes,
     indexer_cluster_CN => $indexer_cluster_CN,
     stage => indexerdeploy
   }
   }
   node "puppet-wazuh-manager-master" {
   class { 'wazuh::repo':
   stage => repo
   }
   class { 'wazuh::manager':
     ossec_cluster_name => 'wazuh-cluster',
     ossec_cluster_node_name => 'wazuh-master',
     ossec_cluster_node_type => 'master',
     ossec_cluster_key => '01234567890123456789012345678912',
     ossec_cluster_bind_addr => "$masterhost",
     ossec_cluster_nodes => ["$masterhost"],
     ossec_cluster_disabled => 'no',
     stage => manager
   }
   class { 'wazuh::filebeat_oss':
     filebeat_oss_indexer_ip => "$node1host",
     wazuh_node_name => "$master_name",
     stage => manager
   }
   }
   node "puppet-wazuh-manager-worker" {
   class { 'wazuh::repo':
   stage => repo
   }
   class { 'wazuh::manager':
     ossec_cluster_name => 'wazuh-cluster',
     ossec_cluster_node_name => 'wazuh-worker',
     ossec_cluster_node_type => 'worker',
     ossec_cluster_key => '01234567890123456789012345678912',
     ossec_cluster_bind_addr => "$masterhost",
     ossec_cluster_nodes => ["$masterhost"],
     ossec_cluster_disabled => 'no',
     stage => manager
   }
   class { 'wazuh::filebeat_oss':
     filebeat_oss_indexer_ip => "$node1host",
     wazuh_node_name => "$worker_name",
     stage => manager
   }
   }
   node "puppet-wazuh-dashboard" {
   class { 'wazuh::repo':
   stage => repo,
   }
   class { 'wazuh::dashboard':
     indexer_server_ip  => "$node1host",
     manager_api_host   => "$masterhost",
     stage => dashboard
   }
   }
   

   Where:

   • WAZUH_INDEXER_NODE1 is the hostname of the Wazuh indexer node1.

   • WAZUH_INDEXER_NODE2 is the hostname of the Wazuh indexer node2.

   • WAZUH_INDEXER_NODE3 is the hostname of the Wazuh indexer node3.

   • WAZUH_MANAGER_MASTER is the hostname of the Wazuh manager master node.

   • WAZUH_MANAGER_WORKER is the hostname of the Wazuh manager worker node.

   • WAZUH_DASHBOARD is the hostname of the Wazuh dashboard.

   Note

   ossec_cluster_key is a unique 32-character-long key. You can generate a unique key with the command openssl rand -hex 16.

   The wazuh::certificates class must be applied on the Puppet server (puppet-server) where the Wazuh module is installed. This is necessary because the archives module distributes files to all servers in the Wazuh stack deployment.

   If you need more Wazuh indexer nodes, add new variables. For example, WAZUH_INDEXER_NODE4. Add them to the following arrays:

   • indexer_discovery_hosts

   • indexer_cluster_initial_master_nodes

   • indexer_cluster_CN

   • indexer_certs

   In addition, you need to add a new node instance similar to WAZUH_INDEXER_NODE2 or WAZUH_INDEXER_NODE3. Unlike the example for WAZUH_INDEXER_NODE1, these instances don't run securityadmin.

   In case you need to add a Wazuh manager worker server, add a new variable such as WAZUH_MANAGER_WORKER2. Add the variable to the manager_worker_certs array. For example, ['worker',"$worker2host"]. Then, replicate the node instance WAZUH_MANAGER_WORKER with the new server.

3. Trigger a Puppet run on the Puppet server to generate the Wazuh certificates. Skip this step if you want the stack to run on the specified node once the run interval time, as set in puppet.conf elapses:

   # puppet agent -t
   

4. Perform a Puppet run on the Puppet agents to start the deployment of the Wazuh stack. Skip this step if you want the stack to run on the specified node once the run interval time, as set in puppet.conf elapses:

   # puppet agent -t
   

Indexer users

• admin user:

  node "<PUPPET_AGENT_NODE_NAME>" {
    class { 'wazuh::filebeat_oss':
      filebeat_oss_elastic_password  => '<NEW_PASSWORD>'
    }
  }
  

• kibanaserver user:

  node "<PUPPET_AGENT_NODE_NAME>" {
    class { 'wazuh::dashboard':
      dashboard_password => '<NEW_PASSWORD>'
    }
  }
  

Wazuh API users

• wazuh-wui user:

  node "<PUPPET_AGENT_NODE_NAME>" {
    class { 'wazuh::dashboard':
      dashboard_wazuh_api_credentials => '<NEW_PASSWORD>'
    }
  }