Installing the Wazuh dashboard step-by-step

Installing package dependencies

1. Install the following packages if missing. Amazon Linux 2023 already has the curl command, so don't install the curl package there:

   APTYumDNF

   # apt-get install -y tar curl
   

Adding the Wazuh repository

Deploying certificates and passwords

Do this before installing the package. The package then uses these files and passwords instead of generating its own.

1. Replace <DASHBOARD_NODE_NAME> with your Wazuh dashboard node name, the same one used in the config.yml file to create the certificates. In our case, the node name is dashboard. Then place the passwords, this node's certificates, the Wazuh indexer root CA, and the Wazuh manager CA:

   # NODE_NAME=<DASHBOARD_NODE_NAME>
   # umask 022
   # mkdir wazuh-certificates
   # tar -xf wazuh-certificates.tar -C wazuh-certificates
   # install -d -m 0750 /etc/wazuh-dashboard /etc/wazuh-dashboard/certs
   # install -m 0600 /dev/null /etc/wazuh-dashboard/local.env
   # grep -E '^(WAZUH_INDEXER_KIBANASERVER_PASSWORD|WAZUH_MANAGER_WUI_PASSWORD)=' wazuh-certificates/credentials.env > /etc/wazuh-dashboard/local.env
   # install -m 0640 wazuh-certificates/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
   # install -m 0640 wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
   # install -m 0640 wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/indexer-ca.pem
   # install -m 0640 wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/manager-ca.pem
   # rm -rf wazuh-certificates
   

   The Wazuh dashboard uses manager-ca.pem to verify the Wazuh manager API. The Wazuh manager master node took its certificates from the same archive, so the archive's root CA verifies it. If the master node is the first Wazuh indexer node, the Wazuh manager package issued its own certificates instead. In that case, replace manager-ca.pem with the master node's /etc/wazuh-manager/export/ca.pem. Only root can read that file. Run sudo cat /etc/wazuh-manager/export/ca.pem on the master node, save the output as manager-ca.pem in the working directory of this node, and run:

   # install -m 0640 manager-ca.pem /etc/wazuh-dashboard/certs/manager-ca.pem
   

   The wazuh-dashboard user does not exist yet. When the package is installed, it keeps these files and gives them their owner.

2. Recommended action: If no other Wazuh components will be installed on this node, remove the wazuh-certificates.tar file.

   # rm -f ./wazuh-certificates.tar
   

Installing the Wazuh dashboard

1. Install the Wazuh dashboard package:

   APTYumDNF

   # apt-get -y install wazuh-dashboard=5.0.0-1
   

   Release candidate packages carry the version of the final release, 5.0.0-1. Only their file names show the RC stage, for example wazuh-dashboard_5.0.0-rc2_amd64.deb, so dpkg -l and rpm -q show 5.0.0-1.

Configuring the Wazuh dashboard

1. Edit the /etc/wazuh-dashboard/opensearch_dashboards.yml file. The package ships it pre-filled with single-host values, so change only opensearch.hosts and wazuh_core.hosts.default.url, and leave the rest of the file as shipped:

   1. server.host: The package sets 0.0.0.0, which accepts connections on every address of the host. You don't need to change it.

   2. opensearch.hosts: The package sets https://localhost:9200. Replace it with the URL of the Wazuh indexer node, using the address you set in network.host in Configuring the Wazuh indexer. If you set network.host to one IP address, the Wazuh indexer listens only on that address. Then localhost fails, even when the Wazuh indexer runs on this host. If you left the package default, https://localhost:9200 works.

      server.host: 0.0.0.0
      server.port: 443
      opensearch.hosts: https://<WAZUH_INDEXER_ADDRESS>:9200
      opensearch.ssl.verificationMode: full
      

      Keep the opensearch.ssl.certificateAuthorities value that the package ships, /etc/wazuh-dashboard/certs/indexer-ca.pem.

      For a Wazuh indexer cluster, list every node:

      opensearch.hosts: ["https://10.0.0.2:9200", "https://10.0.0.3:9200", "https://10.0.0.4:9200"]
      

   3. wazuh_core.hosts.default.url: The Wazuh manager master node. Replace <WAZUH_MASTER_ADDRESS> with the IP address or DNS name of the master node. If the Wazuh manager master node is on this host, keep the shipped value, https://localhost.

   4. Edit the block that the package shipped, and don't add a second one or a password line. The host in url must be in the Wazuh manager API certificate. To list its addresses, run this command on the master node:

      # openssl x509 -in /etc/wazuh-manager/certs/apid.pem -noout -ext subjectAltName
      

      wazuh_core.hosts:
        default:
          url: https://<WAZUH_MASTER_ADDRESS>
          port: 55000
          username: wazuh-internal-client
          run_as: true
          ca: '/etc/wazuh-dashboard/certs/manager-ca.pem'
      

      Note

      Firewalls can block communication between Wazuh components on different hosts. Refer to the Required ports section and make sure the necessary ports are open.

Starting the Wazuh dashboard service

1. Enable and start the Wazuh dashboard service. The package neither enables nor starts it:

   Systemd

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

2. Run the following command to verify the Wazuh dashboard status. Check that the output shows Active: active (running):

   Systemd

   # systemctl status wazuh-dashboard
   

   If the service fails to start, run journalctl -u wazuh-dashboard. A MISSING WAZUH_INDEXER_KIBANASERVER_PASSWORD or MISSING WAZUH_MANAGER_WUI_PASSWORD line means that the password isn't in /etc/wazuh-dashboard/local.env. A MISSING /etc/wazuh-dashboard/certs/indexer-ca.pem line means that the CA isn't there. An UNSAFE line means that a file or directory has the wrong owner or mode. Don't change the owner of /etc/wazuh-dashboard/certs to wazuh-dashboard. To repair it, run:

   # chown -R root:wazuh-dashboard /etc/wazuh-dashboard/certs
   # chmod 0750 /etc/wazuh-dashboard/certs
   # chmod 0640 /etc/wazuh-dashboard/certs/*.pem
   

   Repeat Deploying certificates and passwords if a file is missing. Then run systemctl reset-failed wazuh-dashboard, because the service stops after three failed starts, and start the service again.

3. Get the admin password. On the Wazuh indexer node where you ran indexer-security-init.sh, run the following command:

   # grep '^WAZUH_INDEXER_ADMIN_PASSWORD=' /etc/wazuh-indexer/export/credentials.env | cut -d= -f2-
   

4. Access the Wazuh web interface with your admin user credentials. This is the default administrator account for the Wazuh indexer, and it allows you to access the Wazuh dashboard.

   • URL: https://<WAZUH_DASHBOARD_ADDRESS>

   • Username: admin

   • Password: the password from step 3

   The browser warns that the certificate wasn't issued by a trusted authority, because Wazuh creates its own certificate authority. Add an exception in the browser, or, for better security, import the CA that issued the certificate into the browser's certificate manager. If you followed Deploying certificates and passwords, it's the root CA of wazuh-certificates.tar, also at /etc/wazuh-dashboard/certs/indexer-ca.pem. If you skipped that section, the Wazuh dashboard package issued the certificate, and its CA is /etc/wazuh-dashboard/export/ca.pem. Only root can read these files. Run sudo cat with the file's path on this host, and save the output as ca.pem on the computer that runs the browser. You can also configure a certificate from a trusted authority.