auth

disabled

Disables the enrollment service entirely. When the <auth> block is present but this option is not set, the service starts (disabled=no).

port

TCP port on which the enrollment service listens for incoming requests.

ipv6

Enables IPv6 support for the enrollment service.

use_source_ip

Register agents using their source IP address of the enrollment request instead of any.

purge

Removes existing keys for an agent when it enrolls again using the same name.

use_password

Require agents to provide a shared enrollment password.

When enabled, the password is read from /var/wazuh-manager/etc/authd.pass. If the file does not exist, wazuh-manager-authd generates a random password on start, stores it in that file, and reuses it on later starts. If the file exists but is empty or invalid, wazuh-manager-authd does not start.

In a Wazuh manager cluster, the enrollment password is maintained on the master node and distributed to worker nodes. A worker node rejects enrollment until it receives the file.

Agent-side setup: The Wazuh installer generates a configuration that sets use_password to yes by default. Agents must supply the enrollment password, or the manager rejects their enrollment request. First, retrieve the password from the manager:

$ sudo cat /var/wazuh-manager/etc/authd.pass

We recommend providing it through the WAZUH_REGISTRATION_PASSWORD install variable. This variable writes etc/authd.pass and sets its ownership and permissions automatically:

# WAZUH_MANAGER="<WAZUH_MANAGER_IP_ADDRESS>" WAZUH_REGISTRATION_PASSWORD="<password>" apt install ./wazuh-agent.deb

To add it to an already installed agent, write the file manually. The agent daemon (wazuh-agentd) runs as the wazuh user, so the file must be readable by that user:

$ echo "<PASSWORD>" | sudo tee /var/ossec/etc/authd.pass
$ sudo chown root:wazuh /var/ossec/etc/authd.pass
$ sudo chmod 640 /var/ossec/etc/authd.pass

The agent reads the password from etc/authd.pass (relative to its install directory, typically /var/ossec/etc/authd.pass) at startup.

Password rotation: The generated password persists across restarts. To rotate it (for example after a security incident), delete /var/wazuh-manager/etc/authd.pass on the master and restart wazuh-manager-authd. wazuh-manager-authd generates a new random password, persists it, and distributes it to workers automatically. It logs the reuse of an existing password at INFO level on every start.

remote_enrollment

Controls whether the enrollment service accepts requests over the network (port 1515). Disable to restrict enrollment to the local socket only.

ciphers

OpenSSL cipher string used for TLS connections to the enrollment service.

ssl_agent_ca

Path to the CA certificate used to verify agent client certificates during mutual TLS.

ssl_verify_host

Verify that the CN of the agent certificate matches the Wazuh agent's IP address. Requires ssl_agent_ca to be set.

ssl_manager_cert

Path to the Wazuh manager's TLS certificate presented to agents during enrollment.

ssl_manager_key

Path to the private key corresponding to ssl_manager_cert.

ssl_auto_negotiate

Allows the TLS handshake to negotiate the highest mutually supported protocol version.

force

The <force> element configures the conditions under which an existing agent entry can be replaced during enrollment.

<force>
  <enabled>yes</enabled>
  <key_mismatch>yes</key_mismatch>
  <disconnected_time enabled="yes">1h</disconnected_time>
  <after_registration_time>1h</after_registration_time>
</force>

<!-- Enable the check, require 2h disconnection -->
<disconnected_time enabled="yes">2h</disconnected_time>
<!-- Disable the check entirely -->
<disconnected_time enabled="no">0</disconnected_time>

agents/allow_higher_versions

Accept enrollment from agents running a newer Wazuh version than the manager.

<agents>
  <allow_higher_versions>no</allow_higher_versions>
</agents>