Install Wazuh components using the assisted method

All-in-one offline installation

Use the Wazuh assisted installation method to install and configure the Wazuh indexer, Wazuh manager, and Wazuh dashboard on one 64-bit (x86_64/AMD64 or AARCH64/ARM64) host.

Make sure that copies of wazuh-install-5.0.0-rc2.sh and wazuh-offline.tar.gz are placed in your working directory.

Install the following dependencies from your local package mirror, installation media, or copied packages (see Prerequisites) before you run the assistant on this host.

1. Run the following command to install all the central components on this host. -a|--all-in-one installs the Wazuh indexer, Wazuh manager, and Wazuh dashboard. --offline-installation installs them from wazuh-offline.tar.gz in the same directory as the script:

   # bash wazuh-install-5.0.0-rc2.sh --offline-installation -a
   

   If Wazuh agents reach this host through an address it doesn't have, add the address with -as, once per address. Examples are a NAT address or a public DNS name. For example:

   # bash wazuh-install-5.0.0-rc2.sh --offline-installation -a -as 203.0.113.10 -as wazuh.example.com
   

   If scripts or a Wazuh dashboard on other hosts will call the Wazuh manager API through an address this host can't detect, such as a public IP address or DNS name, add -ap|--api-san <MANAGER_API_ADDRESS>. Replace <MANAGER_API_ADDRESS> with that address. The API then keeps listening on all network interfaces, and this address is added to its certificate. Repeat -ap for each address, for example, -ap 203.0.113.20 -ap api.example.com. You can combine -as and -ap.

   After the installation completes, the output shows the access credentials and a message confirming the installation was successful. There is one You can access line per address of the Wazuh dashboard certificate. In an interactive terminal, the Password: line shows the admin password, followed by the command that prints it again.

   INFO: --- Summary ---
   INFO: You can access the web interface https://<WAZUH_DASHBOARD_ADDRESS>:443
   INFO:     User: admin (Wazuh dashboard login and Wazuh indexer administrator)
   INFO:     Password: <ADMIN_PASSWORD>
   INFO:     To read the password again, run:
   INFO:         sudo grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' /etc/wazuh-indexer/export/credentials.env | cut -d= -f2-
   INFO: The passwords of the other users are in /etc/wazuh-indexer/export/credentials.env and /etc/wazuh-manager/export/credentials.env.
   INFO: --- Next steps ---
   INFO: To enroll agents, use Deploy new agent in the Wazuh dashboard, or create an enrollment token on this server:
   INFO:     sudo /var/wazuh-manager/bin/wazuh-manager-authd --create-enrollment-token --address <WAZUH_MANAGER_ADDRESS>
   INFO: For more information, see https://documentation.wazuh.com/5.0/installation-guide/wazuh-agent/index.html
   INFO: Installation finished.
   

2. Access the Wazuh web interface with your admin user credentials. This is the administrator account for the Wazuh indexer, and it allows you to access the Wazuh dashboard.

   • URL: https://<WAZUH_DASHBOARD_ADDRESS>

   • Username: admin

   • Password: the WAZUH_INDEXER_ADMIN_PASSWORD value in /etc/wazuh-indexer/export/credentials.env.

   When you first access the Wazuh dashboard, your browser displays a warning that a trusted authority did not issue the certificate. To trust it, import the Wazuh dashboard CA, /etc/wazuh-dashboard/export/ca.pem, into the browser's certificate manager. Only root can read it. Run sudo cat /etc/wazuh-dashboard/export/ca.pem on this host, and save the output as ca.pem on the computer that runs the browser. You can also add an exception in the browser's advanced options.

3. If you configured API access with the -ap option in step 1, skip this step. By default, the assistant makes the Wazuh manager API listen only on this host (127.0.0.1 and ::1). If scripts or a Wazuh dashboard on other hosts need to access the Wazuh manager API, set host: ['0.0.0.0', '::'] in /var/wazuh-manager/api/configuration/api.yaml to allow external connections. Then run the following command to restart the Wazuh manager:

   # systemctl restart wazuh-manager
   

   The Wazuh manager API clients must then use this host's name or IP address.

If a firewall is active on this host, allow incoming connections to 443/TCP for the Wazuh dashboard and to 1517/TCP for Wazuh 5.x agents. Wazuh 4.x agents use 1514/TCP and 1515/TCP.

Next, continue with Securing your Wazuh installation, which removes the installation files, and then read Running Wazuh offline. It lists the log messages that are expected without Internet access and explains how to update the detection content.

Multi-node offline installation

Make sure that copies of wazuh-install-files.tar and wazuh-offline.tar.gz, created in Download the packages and configuration files, are in the working directory of every node.

On every node, the assistant also needs systemd, grep, tar, coreutils, sed, gawk, curl, and procps (procps-ng on RPM systems). Install any that are missing, together with each component's dependencies below.