Installing the Wazuh dashboard using the assisted installation method

Install and configure the Wazuh dashboard on a 64-bit (x86_64/AMD64 or AARCH64/ARM64) architecture using the assisted installation method. Wazuh dashboard is a flexible and intuitive web interface for mining and visualizing security data.

Wazuh dashboard installation

Download the Wazuh installation assistant. Skip this step if the Wazuh installation assistant is already in your working directory:
```
# curl -sO https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-install-5.0.0-rc2.sh
```
Run the Wazuh installation assistant with the option --wazuh-dashboard and the node name to install and configure the Wazuh dashboard. The node name must be the same one used in config.yml for the initial configuration, for example, dashboard:

Note

Make sure that a copy of wazuh-install-files.tar, created in Initial configuration of the Wazuh indexer assisted installation, is in your working directory.
```
# bash wazuh-install-5.0.0-rc2.sh --wazuh-dashboard dashboard -id -d pre-release
```
The default Wazuh web user interface port is 443, used by the Wazuh dashboard. To use another port after the installation, set server.port in /etc/wazuh-dashboard/opensearch_dashboards.yml to the new port and restart the Wazuh dashboard service.

When the installation finishes, the assistant prints the address of the Wazuh dashboard, the username, the command that shows the password, and how to enroll agents:

The command output looks similar to this:
```
INFO: Wazuh dashboard web application initialized.
INFO: --- Summary ---
INFO: You can access the web interface https://<WAZUH_DASHBOARD_ADDRESS>:443
INFO:     User: admin (Wazuh dashboard login and Wazuh indexer administrator)
INFO:     Password: to read it from wazuh-install-files.tar, run:
INFO:         sudo tar -xOf wazuh-install-files.tar wazuh-install-files/credentials.env | grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' | cut -d= -f2-
INFO: The passwords of the other users are in wazuh-install-files/credentials.env of wazuh-install-files.tar.
INFO: --- Next steps ---
INFO: To enroll agents, use Deploy new agent in the Wazuh dashboard, or create an enrollment token on the Wazuh manager (the master node in a cluster):
INFO:     sudo /var/wazuh-manager/bin/wazuh-manager-authd --create-enrollment-token --address <WAZUH_MANAGER_ADDRESS>
INFO: For more information, see https://documentation.wazuh.com/5.0/installation-guide/wazuh-agent/index.html
INFO: Installation finished.
```
The assistant prints one URL for each address in the Wazuh dashboard certificate. Use the one your browser can reach.

To trust the certificate in your browser, import wazuh-install-files/root-ca.pem from wazuh-install-files.tar. It is the same file as /etc/wazuh-dashboard/certs/indexer-ca.pem on this node: the assistant creates no separate Wazuh dashboard CA. Keep a copy of the file before Securing your Wazuh installation removes the archive.

You have now installed and configured the Wazuh dashboard.

Get the admin password. On a Wazuh indexer node, run the following command:

# grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' /etc/wazuh-indexer/export/credentials.env | cut -d= -f2-

On a host without the Wazuh indexer, read it from wazuh-install-files.tar instead:

# tar -xOf wazuh-install-files.tar wazuh-install-files/credentials.env | grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' | cut -d= -f2-

Access the Wazuh web interface with your admin user credentials. This is the default administrator account for the Wazuh indexer and it allows you to access the Wazuh dashboard.
- URL: https://<WAZUH_DASHBOARD_ADDRESS>
- Username: admin
- Password: the password from step 3
The browser warns that the certificate wasn't issued by a trusted authority, because Wazuh creates its own certificate authority. Add an exception in the browser, or, for better security, import wazuh-install-files/root-ca.pem into the browser's certificate manager. You can also configure a certificate from a trusted authority.

Securing your Wazuh installation

After every component is installed and running, each component stores the passwords it needs in its own keystore or database. The components don't need the password files after the installation, and deleting them doesn't affect running or restarted components. If you keep them, keep them readable by root only. The components check them at every start and refuse to start if one has the wrong owner or permissions. wazuh-install-files.tar holds all five passwords. On each node, the installation assistant writes the passwords that node's components need to local.env in the component's directory, for example /etc/wazuh-indexer/local.env. The Wazuh indexer and Wazuh manager also keep a copy in export/credentials.env, and the wazuh-ca directory beside the installation assistant holds all five.

Log in to the Wazuh dashboard. A successful login shows that the Wazuh dashboard reaches the Wazuh indexer. Then open the menu and go to Dashboard management > Server API. In the API connection card, the Host is the address of the Wazuh manager master node, and the Status is Online. This shows that the Wazuh dashboard reaches the Wazuh manager. If the Status is Offline, check that the wazuh-manager service runs on the master node and that the Wazuh dashboard host reaches port 55000/TCP. Also check that the Wazuh manager API certificate lists the address in the Host field. To list the addresses in the certificate, run this command on the master node:
```
# openssl x509 -in /etc/wazuh-manager/certs/apid.pem -noout -ext subjectAltName
```
Also check that /etc/wazuh-dashboard/certs/manager-ca.pem exists on the Wazuh dashboard host, and run journalctl -u wazuh-dashboard -n 50 to see the cause. Then click Refresh.
Store the five passwords in a safe place. The credentials.env file in wazuh-install-files.tar holds all five. Run the following command to show them:
```
# tar -xOf wazuh-install-files.tar wazuh-install-files/credentials.env
```
Remove the installation files and the copies of the passwords. On every node except the one where you ran --generate-config-files, run the following command from the directory where you ran the installation assistant:
```
# rm -rf ./wazuh-install-files.tar ./config.yml ./artifact_urls_5.0.0-rc2.yaml ./wazuh-install-5.0.0-rc2.sh
```
On the host where you ran --generate-config-files, keep config.yml with the wazuh-ca directory. You need both to add nodes or issue certificates again. Run this command there instead:
```
# rm -f ./wazuh-install-files.tar ./artifact_urls_5.0.0-rc2.yaml
```
The passwords of each component stay in local.env and export/credentials.env in its configuration directory, readable by root only.
Only the host where you ran --generate-config-files keeps the root CA private key, in the wazuh-ca directory beside the installation assistant. Back up the whole directory securely: its root-ca.key and credentials.env are what you need to add nodes or renew certificates later. After you change a password on another host, update wazuh-ca/credentials.env too. To add a node, don't run --generate-config-files again: it creates a new cluster key. On every node, the components hold only root-ca.pem. Run the following command to check:
```
# ls -A /etc/wazuh-indexer/ca /etc/wazuh-manager/ca 2>/dev/null
```
If the command lists root-ca.key, remove it there. Don't remove the key from the wazuh-ca directory, because you need it to add nodes or renew certificates later:
```
# rm -f /etc/wazuh-indexer/ca/root-ca.key /etc/wazuh-manager/ca/root-ca.key /etc/wazuh-manager/ca/root-ca.srl
```

Editing local.env after installation doesn't change any password. To change a password after installation, see the password management documentation.

Disable Wazuh updates

The installation assistant installs the Wazuh packages from downloaded files and doesn't add a Wazuh package repository, so there is no repository to disable.

Next steps

All the Wazuh central components are successfully installed.

Install the Wazuh indexer

Install the Wazuh manager

Install the Wazuh dashboard

The Wazuh environment is now ready, and you can proceed with installing the Wazuh agent on the endpoints to be monitored. To perform this action, see the Wazuh agent section.