Cluster configuration

Connecting the Wazuh manager and Wazuh dashboard to the cluster

Configure the Wazuh manager and dashboard components of an existing deployment to connect and communicate with a new Wazuh indexer node.

["https://10.0.0.10:9200", "https://10.0.0.11:9200", "https://10.0.0.12:9200"]

Certificates deployment

Wazuh uses certificates to establish confidentiality and encrypt communications between its central components and between the Wazuh indexer cluster nodes. Follow these steps to create and deploy the certificates.

1. Download the certificates tool and the configuration file:

   # curl -sO https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-certs-tool-5.0.0-beta5.sh
   # curl -o config.yml https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/config-5.0.0-beta5.yml
   

2. Edit config.yml and replace the node names and IP values with the corresponding names and IP addresses of all the Wazuh indexer, Wazuh manager, and Wazuh dashboard nodes. Add as many node fields as your deployment requires.

3. Run the certificates tool to create the certificates:

   # bash ./wazuh-certs-tool-5.0.0-beta5.sh -A
   

4. Compress all the necessary files and copy the archive to every node in your deployment. You can use the scp utility or any other secure file transfer method available in your environment:

   # tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
   # scp ./wazuh-certificates.tar <USERNAME>@<TARGET_ENDPOINT_IP>:.
   

5. On each Wazuh indexer node, deploy the certificates. Replace <INDEXER_NODE_NAME> with the name of the node you are configuring as defined in config.yml:

   # NODE_NAME=<INDEXER_NODE_NAME>
   # mkdir -p /etc/wazuh-indexer/certs
   # tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
   # mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
   # mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
   # chmod 500 /etc/wazuh-indexer/certs
   # chmod 400 /etc/wazuh-indexer/certs/*
   # chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
   

6. Follow these steps to deploy the certificates for the Wazuh manager and the Wazuh dashboard nodes.

   Note

   Store the root CA certificate and key securely, as they are required to sign certificates for new nodes. If you won't install any other Wazuh components on the node, remove the wazuh-certificates.tar file for security after deploying the certificates using the command: rm -rf ./wazuh-certificates.tar.

Wazuh indexer cluster tuning

A Wazuh indexer installed from the package reserves 1 GB of JVM heap regardless of how much memory the node has. A node deployed with the installation assistant receives about a quarter of the node's memory instead, so an all-in-one deployment starts with a different value. Both allocations can be insufficient for multi-node clusters, where shard recovery after a node restart requires more memory than the parent circuit breaker allows. When that happens, shard recovery fails repeatedly and the cluster can remain in a red state. Check the current value before changing it.

Set the JVM heap size on every Wazuh indexer node, including nodes added to the cluster later, before starting the Wazuh indexer service for the first time.

1. Edit /etc/wazuh-indexer/jvm.options on every node and set the initial and maximum heap size to half of the node's RAM. The values must be identical so the JVM does not resize the heap at runtime:

   -Xms4g
   -Xmx4g
   

2. Confirm the values were applied:

   # grep -E '^-Xm[sx]' /etc/wazuh-indexer/jvm.options
   

   The command output looks similar to this:

   -Xms4g
   -Xmx4g
   

3. Confirm that memory locking is enabled in /etc/wazuh-indexer/opensearch.yml on every node. The Wazuh indexer ships the setting already enabled, so do not add a second copy.

   # grep 'bootstrap.memory_lock' /etc/wazuh-indexer/opensearch.yml
   

   The command output looks similar to this:

   bootstrap.memory_lock: true
   

4. Confirm that the service is allowed to lock unlimited memory:

   # systemctl show wazuh-indexer -p LimitMEMLOCK
   

   The command output looks similar to this:

   LimitMEMLOCK=infinity
   

   If it is not configured, create the systemd drop-in below:

   # mkdir -p /etc/systemd/system/wazuh-indexer.service.d
   # printf '[Service]\nLimitMEMLOCK=infinity\n' | tee /etc/systemd/system/wazuh-indexer.service.d/wazuh-indexer.conf
   # systemctl daemon-reload
   

   Note

   Apply these settings before starting the Wazuh indexer service. If the service is already running, restart the nodes one at a time and wait for the cluster to return to a green state between restarts.

Initializing the cluster security

Apply the Wazuh indexer cluster tuning settings on every node, then start the Wazuh indexer service on every node, and initialize the security configuration once for the whole cluster.

1. Enable and start the Wazuh indexer service on each node:

   # systemctl daemon-reload
   # systemctl enable wazuh-indexer
   # systemctl start wazuh-indexer
   

2. Run the indexer-security-init.sh script on any Wazuh indexer node to load the new certificate information and initialize the multi-node cluster:

   # /usr/share/wazuh-indexer/bin/indexer-security-init.sh
   

   Note

   You only have to initialize the cluster once. There is no need to run this command on every node, and you do not need to run it again when new nodes join the cluster.

The Wazuh indexer users are defined in /etc/wazuh-indexer/opensearch-security/internal_users.yml. The default credentials are admin:admin. Change the password with the Wazuh password tool on any Wazuh indexer node. The password must have a length between 8 and 64 characters and contain at least one uppercase letter, one lowercase letter, a number, and one of the following symbols: .*+?-.

# curl -sO https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-passwords-tool-5.0.0-beta5.sh
# bash wazuh-passwords-tool-5.0.0-beta5.sh -u admin -p <NEW_PASSWORD>