Offline installation

Installing the Wazuh manager

1. Run the following commands to import the Wazuh key and install the Wazuh manager.

   RPMDEB

   # rpm --import ./wazuh_files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-packages/wazuh-manager*.rpm
   

2. Enable and start the Wazuh manager service.

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

3. Run the following command to verify the Wazuh manager status is active.

   SystemdSysV Init

   # systemctl status wazuh-manager
   

Installing Elasticsearch

1. Run the following command to install Open Distro for Elasticsearch.

   RPMDEB

   # rpm -ivh ./opendistro-packages/*.rpm > opendistro_output.txt
   

2. Move a copy of the configuration files to the appropriate location.

   cp ./opendistro_files/elasticsearch/elasticsearch.yml /etc/elasticsearch/ &&\
   cp ./opendistro_files/elasticsearch/roles.yml /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ &&\
   cp ./opendistro_files/elasticsearch/roles_mapping.yml /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ &&\
   cp ./opendistro_files/elasticsearch/internal_users.yml /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ &&\
   cp ./opendistro_files/elasticsearch/wazuh-cert-tool.sh ~ &&\
   cp ./opendistro_files/elasticsearch/instances.yml ~
   

3. Remove the demo certificates.

   # rm /etc/elasticsearch/esnode-key.pem /etc/elasticsearch/esnode.pem /etc/elasticsearch/kirk-key.pem /etc/elasticsearch/kirk.pem /etc/elasticsearch/root-ca.pem -f
   

4. Run wazuh-cert-tool.sh to create the new certificates.

   # bash ~/wazuh-cert-tool.sh
   

5. Move the certificates to the appropriate location.

   # mkdir /etc/elasticsearch/certs/
   # mv ~/certs/elasticsearch* /etc/elasticsearch/certs/
   # mv ~/certs/admin* /etc/elasticsearch/certs/
   # cp ~/certs/root-ca* /etc/elasticsearch/certs/
   

6. Recommended action - Remove Open Distro for Elasticsearch performance analyzer plugin

   The Open Distro for Elasticsearch performance analyzer plugin is installed by default and can have a negative impact on system resources. We recommend removing it with the following command.

   # /usr/share/elasticsearch/bin/elasticsearch-plugin remove opendistro-performance-analyzer
   

7. Enable and start the Elasticsearch service.

   Warning

   Add the following configuration to mitigate Apache Log4j2 Remote Code Execution (RCE) vulnerability - CVE-2021-44228 - ESA-2021-31.

   # mkdir -p /etc/elasticsearch/jvm.options.d
   # echo '-Dlog4j2.formatMsgNoLookups=true' > /etc/elasticsearch/jvm.options.d/disabledlog4j.options
   # chmod 2750 /etc/elasticsearch/jvm.options.d/disabledlog4j.options
   # chown root:elasticsearch /etc/elasticsearch/jvm.options.d/disabledlog4j.options
   

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable elasticsearch
   # systemctl start elasticsearch
   

8. Run the Elasticsearch securityadmin script to load the new certificates information and start the cluster.

   # export JAVA_HOME=/usr/share/elasticsearch/jdk/ && /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -nhnv -cacert /etc/elasticsearch/certs/root-ca.pem -cert /etc/elasticsearch/certs/admin.pem -key /etc/elasticsearch/certs/admin-key.pem
   

9. Run the following command to check that the installation is successful.

   # curl -XGET https://localhost:9200 -u admin:admin -k
   

   Expand the output to see an example response.

   {
     "name" : "node-1",
     "cluster_name" : "elasticsearch",
     "cluster_uuid" : "RpYwqJ5CRdS1ZFI5QQERRA",
     "version" : {
       "number" : "7.10.2",
       "build_flavor" : "oss",
       "build_type" : "rpm",
       "build_hash" : "747e1cc71def077253878a59143c1f785afa92b9",
       "build_date" : "2021-01-13T00:42:12.435326Z",
       "build_snapshot" : false,
       "lucene_version" : "8.7.0",
       "minimum_wire_compatibility_version" : "6.8.0",
       "minimum_index_compatibility_version" : "6.0.0-beta1"
     },
     "tagline" : "You Know, for Search"
   }
   

Installing Filebeat

1. Run the following command to install Filebeat.

   RPMDEB

   # rpm -ivh ./wazuh-packages/filebeat*.rpm
   

2. Move a copy of the configuration files to the appropriate location.

   cp ./wazuh_files/filebeat/filebeat.yml /etc/filebeat/ &&\
   cp ./wazuh_files/filebeat/wazuh-template.json /etc/filebeat/ &&\
   chmod go+r /etc/filebeat/wazuh-template.json
   

3. Edit /etc/filebeat/wazuh-template.json and change to "1" the value for "index.number_of_shards" as this is a single-node installation.

   {
     ...
     "settings": {
       ...
       "index.number_of_shards": "1",
       ...
     },
     ...
   }
   

4. Install the Wazuh module for Filebeat.

   # tar -xzf ./wazuh_files/filebeat/wazuh-filebeat-module.tar.gz -C /usr/share/filebeat/module
   

5. Copy the Elasticsearch certificates into /etc/filebeat/certs.

   # mkdir /etc/filebeat/certs
   # cp ~/certs/root-ca.pem /etc/filebeat/certs/
   # mv ~/certs/filebeat* /etc/filebeat/certs/
   

6. Enable and start the Filebeat service.

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

7. Run the following command to make sure Filebeat is successfully installed.

   # filebeat test output
   

   Expand the output to see an example response.

   elasticsearch: https://127.0.0.1:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1
       dial up... OK
     TLS...
       security: server's certificate chain verification is enabled
       handshake... OK
       TLS version: TLSv1.3
       dial up... OK
     talk to server... OK
     version: 7.10.2
   

   To check only one shard has been configured, you can run the following command.

   # curl -k -u admin:admin "https://localhost:9200/_template/wazuh?pretty&filter_path=wazuh.settings.index.number_of_shards"
   

   Expand the output to see an example response.

   {
     "wazuh" : {
       "settings" : {
         "index" : {
           "number_of_shards" : "1"
         }
       }
     }
   }
   

Installing Kibana

1. Run the following command to install Kibana.

   RPMDEB

   # rpm -ivh ./opendistro-kibana-packages/opendistroforelasticsearch-kibana*.rpm
   

2. Move a copy of the configuration files to the appropriate location.

   # cp ./opendistro_files/kibana/kibana.yml /etc/kibana/
   

   Note

   server.host: 0.0.0.0 in /etc/kibana/kibana.yml means that Kibana can be accessed from the outside and accepts all the available IP addresses of the host. This value can be changed for a specific IP address if needed.

3. Create the /usr/share/kibana/data directory.

   # mkdir /usr/share/kibana/data
   # chown -R kibana:kibana /usr/share/kibana/data
   

4. Replace </path/to/installation/folder/> with your installation folder path and run the following command to install the Wazuh Kibana plugin.

   # /usr/share/kibana/bin/kibana-plugin install --allow-root file://</path/to/installation/folder/>wazuh_files/kibana/wazuh_kibana.zip
   

5. Copy the Elasticsearch certificates into /etc/kibana/certs.

   # mkdir /etc/kibana/certs
   # cp ~/certs/root-ca.pem /etc/kibana/certs/
   # mv ~/certs/kibana* /etc/kibana/certs/
   # chown kibana:kibana /etc/kibana/certs/*
   

6. Link Kibana socket to privileged port 443.

   # setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node
   

7. Enable and start the Kibana service.

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable kibana
   # systemctl start kibana
   

8. Access the web interface.

   • URL: https://<wazuh_server_ip>

   • Username: admin

   • Password: admin

Upon the first access to Kibana, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser or, for increased security, the root-ca.pem file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.

To uninstall all the components of the all-in-one installation, see the Uninstalling Wazuh section.