Installing the Wazuh manager step-by-step

Adding the Wazuh repository

Installing the Wazuh manager

1. Install the Wazuh manager package.

   APTYumDNF

   # apt-get -y install wazuh-manager
   

Deploying certificates

1. Replace <MANAGER_NODE_NAME> with your Wazuh manager node certificate name, the same used in config.yml when creating the certificates. In our case, the node name is, manager. Then move the certificates to their corresponding location:

   # NODE_NAME=<MANAGER_NODE_NAME>
   

   # mkdir /var/wazuh-manager/etc/certs
   # tar -xf ./wazuh-certificates.tar -C /var/wazuh-manager/etc/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
   # mv -n /var/wazuh-manager/etc/certs/$NODE_NAME.pem /var/wazuh-manager/etc/certs/manager.pem
   # mv -n /var/wazuh-manager/etc/certs/$NODE_NAME-key.pem /var/wazuh-manager/etc/certs/manager-key.pem
   # chmod 500 /var/wazuh-manager/etc/certs
   # chmod 400 /var/wazuh-manager/etc/certs/*
   # chown -R root:root /var/wazuh-manager/etc/certs
   

Configuring the Wazuh indexer connection

1. Save the Wazuh indexer username and password into the Wazuh manager keystore using the wazuh-manager-keystore tool. Replace <WAZUH_INDEXER_USERNAME> and <WAZUH_INDEXER_PASSWORD> with the Wazuh indexer username and password:

   # echo '<WAZUH_INDEXER_USERNAME>' | /var/wazuh-manager/bin/wazuh-manager-keystore -f indexer -k username
   # echo '<WAZUH_INDEXER_PASSWORD>' | /var/wazuh-manager/bin/wazuh-manager-keystore -f indexer -k password
   

   Note

   The default step-by-step installation credentials are admin:admin.

2. Edit /var/wazuh-manager/etc/wazuh-manager.conf file to configure the indexer connection.

   By default, the indexer settings have one host configured. It's set to 127.0.0.1 as highlighted below.

   <indexer>
     <hosts>
       <host>https://127.0.0.1:9200</host>
     </hosts>
     <ssl>
       <certificate_authorities>
         <ca>/var/wazuh-manager/etc/certs/root-ca.pem</ca>
       </certificate_authorities>
       <certificate>/var/wazuh-manager/etc/certs/manager.pem</certificate>
       <key>/var/wazuh-manager/etc/certs/manager-key.pem</key>
     </ssl>
   </indexer>
   

   • Replace 127.0.0.1 with your Wazuh indexer node IP address or hostname. You can find this value in the Wazuh indexer config file /etc/wazuh-indexer/opensearch.yml

   • Ensure the Wazuh manager certificate and key name match the certificate files in /var/wazuh-manager/etc/certs.

   If you are running a Wazuh indexer cluster infrastructure, add a <host> entry for each one of your Wazuh indexer nodes. For example, in a two-node configuration:

   <hosts>
     <host>https://10.0.0.1:9200</host>
     <host>https://10.0.0.2:9200</host>
   </hosts>
   

   The Wazuh manager prioritizes reporting to the first Wazuh indexer node in the list. It switches to the next node in case it is not available.

Starting the Wazuh manager

1. Enable and start the Wazuh manager service.

   SystemdSysV Init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

2. Run the following command to verify the Wazuh manager status:

   SystemdSysV init

   # systemctl status wazuh-manager
   

Your Wazuh manager node is now successfully installed. Repeat this stage of the installation process for every Wazuh manager node in your Wazuh cluster, then proceed with configuring the Wazuh cluster. If you want a Wazuh manager single-node cluster, everything is set and you can proceed directly with Installing the Wazuh dashboard step by step.

Configuring the Wazuh manager master node

1. Edit the following settings in the /var/wazuh-manager/etc/wazuh-manager.conf file and configure the necessary parameters:

   <cluster>
     <name>wazuh</name>
     <node_name>master-node</node_name>
     <node_type>master</node_type>
     <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
     <port>1516</port>
     <bind_addr>0.0.0.0</bind_addr>
     <nodes>
       <node><WAZUH_MASTER_NODE_ADDRESS></node>
     </nodes>
     <hidden>no</hidden>
     <disabled>no</disabled>
   </cluster>
   

   Parameters to be configured:

   name	It indicates the name of the cluster.
   node_name	It indicates the name of the current node.
   node_type	It specifies the role of the node. It has to be set to master.
   key	Key that is used to encrypt communication between cluster nodes. The key must be 32 characters long and the same for all of the nodes in the cluster. The following command can be used to generate a random key: openssl rand -hex 16.
   port	It indicates the destination port for cluster communication.
   bind_addr	It is the network IP to which the node is bound to listen for incoming requests (0.0.0.0 for any IP).
   nodes	It is the address of the master node and can be either an IP or a DNS. This parameter must be specified in all nodes, including the master itself.
   hidden	It shows or hides the cluster information in the generated alerts.
   disabled	It indicates whether the node is enabled or disabled in the cluster. This option must be set to no.

2. Restart the Wazuh manager.

   SystemdSysV Init

   # systemctl restart wazuh-manager
   

Configuring the Wazuh manager worker nodes

1. Configure the cluster node by editing the following settings in the /var/wazuh-manager/etc/wazuh-manager.conf file and configure the necessary parameters:

   <cluster>
       <name>wazuh</name>
       <node_name>worker-node</node_name>
       <node_type>worker</node_type>
       <key>c98b62a9b6169ac5f67dae55ae4a9088</key>
       <port>1516</port>
       <bind_addr>0.0.0.0</bind_addr>
       <nodes>
           <node><WAZUH_MASTER_ADDRESS></node>
       </nodes>
       <hidden>no</hidden>
       <disabled>no</disabled>
   </cluster>
   

   Parameters to be configured:

   name	It indicates the name of the cluster.
   node_name	It indicates the name of the current node. Each node of the cluster must have a unique name.
   node_type	It specifies the role of the node. It has to be set as worker.
   key	The key created previously for the master node. It has to be the same for all the nodes.
   nodes	It has to specify the address of the master node and can be either an IP or a DNS.
   disabled	It indicates whether the node is enabled or disabled in the cluster. It has to be set to no.

2. Restart the Wazuh manager.

   SystemdSysV Init

   # systemctl restart wazuh-manager
   

Repeat these configuration steps for every Wazuh manager worker node in your cluster.

Testing Wazuh manager cluster

Run the following command to verify that the Wazuh cluster is enabled and all the nodes are connected:

# /var/wazuh-manager/bin/cluster_control -l

An example output of the command looks as follows:

NAME         TYPE    VERSION  ADDRESS
master-node  master  5.0.0    10.0.0.3
worker-node1 worker  5.0.0    10.0.0.4
worker-node2 worker  5.0.0    10.0.0.5

Note that the IP addresses 10.0.0.3, 10.0.0.4, and 10.0.0.5 are used as examples.