Offline installation guide

Prerequisites

• Install curl, tar, openssl, and gnupg on every offline host before the installation. On RPM systems, gnupg is gnupg2. Also install the package that provides setcap: libcap on RPM systems or libcap2-bin on DEB systems. For the step-by-step method on DEB systems, also install binutils, which provides ar for the package signature check. The installation assistant stops with --offline-installation when gnupg is missing, because it checks the signature of every package.

• The installation methods list the operating system packages they need, and wazuh-offline.tar.gz doesn't include them. For example, the assisted method requires gawk, which isn't a required package on Debian and Ubuntu, so a minimal image can lack it. If a listed package is missing and you have no local package mirror, download it on a system with Internet access. That system must run the same operating system version. Copy it with the other files, and install it on the offline host:

  • DEB: apt-get download downloads only the package you name, and dpkg -i fails when one of its dependencies is missing. To list the packages that the offline host lacks, run apt-get -s install <PACKAGE> | awk '/^Inst/ {print $2}' on the offline host. Download them with apt-get download <PACKAGES> on the system with Internet access. Copy them, then run dpkg -i *.deb in their directory on the offline host. If the offline host has no package lists, download the dependencies that dpkg -i names in its error too.

  • RPM: run dnf download --resolve --destdir <DIRECTORY> <PACKAGE>, then run rpm -ivh <DIRECTORY>/*.rpm on the offline host to install every file it downloaded. --resolve skips dependencies already installed on the download system. Add --alldeps if that system has packages the offline host lacks.

• On the download system, the installation assistant needs curl, gawk, and openssl for the -g command. It also needs tar, grep, sed, coreutils, and procps. If one is missing, the assistant names it and stops. Add the -id|--install-dependencies option to the -dw and -g commands to install the missing packages. The assistant removes them when it finishes.

Download the packages and configuration files

Run the Wazuh installation assistant on any Linux system with Internet access to download all files needed for offline installation. Choose the package format (RPM or DEB) and architecture (x86_64/AMD64 or AARCH64/ARM64).

1. Run the following commands on any Linux system with Internet access to download and prepare the Wazuh installation assistant.

   # curl -sO https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-install-5.0.0-rc2.sh
   # chmod 744 wazuh-install-5.0.0-rc2.sh
   

2. Download packages by architecture and format:

   RPMDEB

   x86_64 / AMD64

   # ./wazuh-install-5.0.0-rc2.sh -dw rpm -da x86_64 -d pre-release
   

   AARCH64 / ARM64

   # ./wazuh-install-5.0.0-rc2.sh -dw rpm -da aarch64 -d pre-release
   

   Where:

   • -dw|--download-wazuh sets the package format.

   • -da|--download-arch sets the architecture.

   • -d|--development pre-release downloads the release candidate packages from the pre-release repository.

   The assistant downloads the Wazuh indexer, Wazuh manager, and Wazuh dashboard packages and the Wazuh GPG key. It packs them into wazuh-offline.tar.gz in the current directory, about 1.05 GB for DEB and 1.25 GB for RPM. The file doesn't include operating system dependencies. The output shows INFO: Creating wazuh-offline.tar.gz with all packages. when it packs the file.

   Note

   For an all-in-one deployment, skip to step 6. The Wazuh packages create the root CA, the certificates, and the passwords during the installation, so config.yml and wazuh-install-files.tar aren't used. Steps 3 to 5 are only for a distributed deployment.

3. Download the certificate configuration file.

   # curl -o config.yml https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/config-5.0.0-rc2.yml
   

4. Edit the config.yml file to prepare for certificate creation. Replace the node names and IP addresses with the corresponding values. Do this for all the Wazuh manager, Wazuh indexer, and Wazuh dashboard nodes. Add as many node fields as needed. If there is more than one Wazuh manager node, set node_type to master on one node and to worker on the others. Don't use 127.0.0.1 for a Wazuh manager node. Its agent listener certificate would name only loopback addresses, so no agent could verify it, and the next step fails.

   nodes:
     # Wazuh indexer nodes
     indexer:
       - name: indexer
         ip: "<indexer-node-ip>"
       #- name: indexer-2
       #  ip: "<indexer-node-ip>"
       #- name: indexer-3
       #  ip: "<indexer-node-ip>"
   
     # Wazuh manager nodes
     # If there is more than one Wazuh manager
     # node, each one must have a node_type
     manager:
       - name: manager
         ip: "<wazuh-manager-ip>"
       #  node_type: master
       #- name: manager-2
       #  ip: "<wazuh-manager-ip>"
       #  node_type: worker
       #- name: manager-3
       #  ip: "<wazuh-manager-ip>"
       #  node_type: worker
   
     # Wazuh dashboard nodes
     dashboard:
       - name: dashboard
         ip: "<dashboard-node-ip>"
   
     # ip and dns both accept a list, for a node reachable at more than one address.
     # Every item reaches the certificate of the node; the first one is the address
     # the components are configured with.
     #- name: manager-2
     #  ip:
     #    - "<wazuh-manager-ip>"
     #    - "<wazuh-manager-second-ip>"
     #  dns:
     #    - "<wazuh-manager-name>"
   
     # Optional. Only for a proxy that TERMINATES the agents' TLS session: it issues the
     # certificate that proxy serves, from the same root-ca the agents pin. A layer 4
     # passthrough load balancer terminates nothing and needs --agent-san with its
     # address instead, so that address reaches the listener certificate of every
     # manager node.
     #load_balancer:
     #  - name: lb
     #    dns:
     #      - "<load-balancer-name>"
     #    ip:
     #      - "<load-balancer-ip>"
   

   Each node needs an ip, a dns, or both, and each accepts a list. The certificate of the node includes every value.

5. Run the following command to create the certificates and the passwords. The command reads config.yml from the directory of the installation assistant and copies it into wazuh-install-files.tar.

   # ./wazuh-install-5.0.0-rc2.sh -g
   

   If Wazuh agents reach a Wazuh manager through an address that isn't in config.yml, add it with -as|--agent-san <ALTERNATE_ADDRESS>, once per address. Examples are a load balancer, a NAT address, or a public DNS name. Enrollment tokens can only be created for an address in the agent listener certificate. For example, the following command adds a NAT address and a public DNS name to the agent listener certificate of every Wazuh manager node:

   # ./wazuh-install-5.0.0-rc2.sh -g -as 203.0.113.10 -as wazuh.example.com
   

   Note

   The -g option keeps the root CA, its private key root-ca.key, and the five passwords in the wazuh-ca directory next to the installation assistant, or in the directory set in the WAZUH_CA_DIR environment variable. Only root-ca.pem goes into wazuh-install-files.tar.

   Back up the wazuh-ca directory. You need it to add nodes and to renew certificates. A later -g run from the same directory reuses this root CA and these passwords. Remove the previous wazuh-install-files.tar first, because -g doesn't overwrite it.

   To give another deployment its own root CA and passwords, run -g from another directory or with another WAZUH_CA_DIR.

   The wazuh-install-files.tar archive contains the private keys for all nodes and the five passwords in credentials.env. Copy this file only to the Wazuh nodes that require it during installation, and remove it immediately after installation is complete.

6. Copy the following files to the same directory on each host where you install Wazuh. For an all-in-one deployment, copy only the script and wazuh-offline.tar.gz.

   • wazuh-install-5.0.0-rc2.sh

   • wazuh-offline.tar.gz

   • wazuh-install-files.tar, only for a distributed deployment

   For example, run the following command with scp. Replace <USER>, <OFFLINE_HOST_IP>, and <DIRECTORY>. Leave out wazuh-install-files.tar for an all-in-one deployment.

   # scp wazuh-install-5.0.0-rc2.sh wazuh-offline.tar.gz wazuh-install-files.tar <USER>@<OFFLINE_HOST_IP>:<DIRECTORY>
   

   On each offline host, run the installation commands from that directory.

Next steps

After the Wazuh files are ready and copied to the specified hosts, install the Wazuh components.

• Install Wazuh components using the assisted method: the installation assistant installs and configures each component with one command. Use it unless you need to place every file and setting yourself.

• Install Wazuh components step by step: install each package and configure the certificates and settings yourself.

• Install Wazuh agents on hosts without Internet access: install Wazuh agents on offline hosts.