Wazuh Docker deployment

Single-node Deployment

1. Clone the Wazuh repository to your system:

   # git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.11
   

   Then enter into the single-node directory to execute all the commands described below within this directory.

2. Provide a group of certificates for each node in the stack to secure communication between the nodes. You have two alternatives to provide these certificates:

   • Generate self-signed certificates for each cluster node.

     We have created a Docker image to automate certificate generation using the Wazuh certs gen tool.

     If your system uses a proxy, add the following to the generate-indexer-certs.yml file. If not, skip this particular step:

     environment:
       - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
     

     A completed example looks like:

     # Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
     version: '3'
     
     services:
       generator:
         image: wazuh/wazuh-certs-generator:0.0.1
         hostname: wazuh-certs-generator
         volumes:
           - ./config/wazuh_indexer_ssl_certs/:/certificates/
           - ./config/certs.yml:/config/certs.yml
         environment:
           - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
     

     Execute the following command to get the desired certificates:

     # docker-compose -f generate-indexer-certs.yml run --rm generator
     

     This saves the certificates into the config/wazuh_indexer_ssl_certs directory.

   • Provide your own certificates for each node.

     In case you have your own certificates, provision them as follows in the config/wazuh_indexer_ssl_certs directory:

     Wazuh indexer:

     config/wazuh_indexer_ssl_certs/root-ca.pem
     config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
     config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
     config/wazuh_indexer_ssl_certs/admin.pem
     config/wazuh_indexer_ssl_certs/admin-key.pem
     

     Wazuh manager:

     config/wazuh_indexer_ssl_certs/root-ca-manager.pem
     config/wazuh_indexer_ssl_certs/wazuh.manager.pem
     config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
     

     Wazuh dashboard:

     config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
     config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
     config/wazuh_indexer_ssl_certs/root-ca.pem
     

3. Start the Wazuh single-node deployment using docker-compose:

   • Foreground:

     # docker-compose up
     

   • Background:

     # docker-compose up -d
     

   The default username and password for the Wazuh dashboard are admin and SecretPassword. For additional security, you can change the default password for the Wazuh indexer admin user.

Multi-node deployment

1. Clone the Wazuh repository to your system:

   $ git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.11
   

   Then enter into the multi-node directory to execute all the commands described below within this directory.

2. Provide a group of certificates for each node in the stack to secure communications between the nodes. You have two alternatives to provide these certificates:

   • Generate self-signed certificates for each cluster node.

     We have created a Docker image to automate certificate generation using the Wazuh certs gen tool.

     If your system uses a proxy, add the following to the generate-indexer-certs.yml file. If not, skip this particular step:

     environment:
       - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
     

     A completed example looks like:

     # Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
     version: '3'
     
     services:
       generator:
         image: wazuh/wazuh-certs-generator:0.0.1
         hostname: wazuh-certs-generator
         volumes:
           - ./config/wazuh_indexer_ssl_certs/:/certificates/
           - ./config/certs.yml:/config/certs.yml
         environment:
           - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
     

     Execute the following command to get the desired certificates:

     # docker-compose -f generate-indexer-certs.yml run --rm generator
     

     This saves the certificates into the config/wazuh_indexer_ssl_certs directory.

   • Provide your own certificates for each node.

     In case you have your own certificates, provision them as follows:

     Wazuh indexer:

     config/wazuh_indexer_ssl_certs/root-ca.pem
     config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem
     config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem
     config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem
     config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem
     config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem
     config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem
     config/wazuh_indexer_ssl_certs/admin.pem
     config/wazuh_indexer_ssl_certs/admin-key.pem
     

     Wazuh manager:

     config/wazuh_indexer_ssl_certs/root-ca-manager.pem
     config/wazuh_indexer_ssl_certs/wazuh.master.pem
     config/wazuh_indexer_ssl_certs/wazuh.master-key.pem
     config/wazuh_indexer_ssl_certs/wazuh.worker.pem
     config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem
     

     Wazuh dashboard:

     config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
     config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
     config/wazuh_indexer_ssl_certs/root-ca.pem
     

3. Start the Wazuh multi-node deployment using docker-compose:

   • Foreground:

     # docker-compose up
     

   • Background:

     # docker-compose up -d
     

   The default username and password for the Wazuh dashboard are admin and SecretPassword. For additional security, you can change the default password for the Wazuh indexer admin user.

Build docker images locally

You can modify and build the Wazuh manager, indexer, and dashboard images locally.

1. Clone the Wazuh repository to your system:

   # git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.11
   

2. For versions up to 4.3.4, enter into the build-docker-images directory and build the Wazuh manager, indexer, and dashboard images:

   # docker-compose build
   

   For version 4.3.5 and above, run the image creation script:

   # build-docker-images/build-images.sh
   

Change the password of an existing user

You can change the default password of an existing user to improve security. For example, you can change the default password of the Wazuh indexer admin user.

Perform the following steps from your single-node directory. If you have a multi-node deployment, you must adapt them and perform them from your multi-node directory.

1. Stop the deployment stack if it’s running:

   # docker-compose stop
   

2. Run this command to generate a hash of your new password. Once the container launches, input the new password and press enter:

   # docker run --rm -ti wazuh/wazuh-indexer:4.3.11 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh
   

3. Copy the generated hash. Replace the current admin user hash in the /single-node/config/wazuh_indexer/internal_users.yml file.

4. Change all occurrences of the default INDEXER_PASSWORD in the docker-compose.yml file to the new password.

5. Start the deployment stack:

   # docker-compose start
   

6. Run docker ps and note the name of the Wazuh indexer container.

7. Run docker exec -it single-node-wazuh.indexer-1 bash to enter the container. single-node-wazuh.indexer-1 is the container name obtained in the previous step.

8. Set the following variables:

   export INSTALLATION_DIR=/usr/share/wazuh-indexer
   export OPENSEARCH_PATH_CONF=${INSTALLATION_DIR}/config
   CACERT=$OPENSEARCH_PATH_CONF/certs/root-ca.pem
   KEY=$OPENSEARCH_PATH_CONF/certs/admin-key.pem
   CERT=$OPENSEARCH_PATH_CONF/certs/admin.pem
   export JAVA_HOME=/usr/share/wazuh-indexer/jdk
   

9. Run the securityadmin.sh script to apply all changes:

   # bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9300 -icl
   

10. Exit the Wazuh indexer container and login with the new credentials on the Wazuh dashboard.