Wazuh Docker deployment

Single-node Deployment

1. Clone the Wazuh repository to your system:

   $ git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.6 --depth=1
   

   Then enter into the single-node directory. All the commands described below are executed within this directory. For additional security, the default password for the Wazuh indexer administrator user can be changed.

2. Secure traffic between the deployment nodes using certificates:

   To secure communication between the nodes, you need to provide a group of certificates for each node in the stack. There are two alternatives to provide these certificates:

   1. Generate self-signed certificates for each node of the cluster.

      We have created a Docker image to automate certificate generation using the Wazuh certs gen tool. If your system uses a proxy, add the following to the generate-indexer-certs.yml file. If not, skip this particular step:

      environment:
        - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
      

      A completed example looks like:

      # Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
      version: '3'
      
      services:
        generator:
          image: wazuh/wazuh-certs-generator:0.0.1
          hostname: wazuh-certs-generator
          volumes:
            - ./config/wazuh_indexer_ssl_certs/:/certificates/
            - ./config/certs.yml:/config/certs.yml
          environment:
            - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
      

      Modify the file config/certs.yml and execute the following command to obtain the desired certificates:

      $ docker-compose -f generate-indexer-certs.yml run --rm generator
      

      This will save the certificates into the config/wazuh_indexer_ssl_certs directory.

   2. Provide your own certificates for each node.

      In the case of having your own certificates, they must be provisioned as follows:

      Wazuh Indexer:

      config/wazuh_indexer_ssl_certs/root-ca.pem
      config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem
      config/wazuh_indexer_ssl_certs/wazuh.indexer.pem
      config/wazuh_indexer_ssl_certs/admin.pem
      config/wazuh_indexer_ssl_certs/admin-key.pem
      

      Wazuh Manager:

      config/wazuh_indexer_ssl_certs/root-ca-manager.pem
      config/wazuh_indexer_ssl_certs/wazuh.manager.pem
      config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem
      

      Wazuh Dashboard:

      config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
      config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
      config/wazuh_indexer_ssl_certs/root-ca.pem
      

3. Check that there is a docker-compose.yml file. Start Wazuh using docker-compose:

   1. Foreground:

      $ docker-compose up
      

   2. Background:

      $ docker-compose up -d
      

   The default username and password for the Wazuh dashboard are “admin” and “SecretPassword”.

Multi-node deployment

1. Clone the Wazuh repository to your system:

   $ git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.6 --depth=1
   

Then enter into the multi-node directory, all the commands described below are executed within this directory. For additional security, the default password for the Wazuh indexer admin user can be changed.

2. Secure traffic between the deployment nodes using certificates:

   To secure communications between the nodes, you need to provide a group of certificates for each node in the stack. There are two alternatives to provide these certificates:

   1. Generate self-signed certificates for each node of the cluster.

      We have created a Docker image to automate certificate generation using the Wazuh certs gen tool. If your system uses a proxy, add the following to the generate-indexer-certs.yml file. If not skip to skip this particular step:

      environment:
        - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
      

      A completed example looks like:

      # Wazuh App Copyright (C) 2021 Wazuh Inc. (License GPLv2)
      version: '3'
      
      services:
        generator:
          image: wazuh/wazuh-certs-generator:0.0.1
          hostname: wazuh-certs-generator
          volumes:
            - ./config/wazuh_indexer_ssl_certs/:/certificates/
            - ./config/certs.yml:/config/certs.yml
          environment:
            - HTTP_PROXY=YOUR_PROXY_ADDRESS_OR_DNS
      

      Modify the file config/certs.yml and execute the following command to obtain the desired certificates:

      $ docker-compose -f generate-indexer-certs.yml run --rm generator
      

      This will save the certificates into the config/wazuh_indexer_ssl_certs directory.

   2. Provide your own certificates for each node.

      In the case of having your own certificates, they must be provisioned as follows:

      Wazuh Indexer:

      config/wazuh_indexer_ssl_certs/root-ca.pem
      config/wazuh_indexer_ssl_certs/wazuh1.indexer-key.pem
      config/wazuh_indexer_ssl_certs/wazuh1.indexer.pem
      config/wazuh_indexer_ssl_certs/wazuh2.indexer-key.pem
      config/wazuh_indexer_ssl_certs/wazuh2.indexer.pem
      config/wazuh_indexer_ssl_certs/wazuh3.indexer-key.pem
      config/wazuh_indexer_ssl_certs/wazuh3.indexer.pem
      config/wazuh_indexer_ssl_certs/admin.pem
      config/wazuh_indexer_ssl_certs/admin-key.pem
      

      Wazuh Manager:

      config/wazuh_indexer_ssl_certs/root-ca-manager.pem
      config/wazuh_indexer_ssl_certs/wazuh.master.pem
      config/wazuh_indexer_ssl_certs/wazuh.master-key.pem
      config/wazuh_indexer_ssl_certs/wazuh.worker.pem
      config/wazuh_indexer_ssl_certs/wazuh.worker-key.pem
      

      Wazuh Dashboard:

      config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem
      config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem
      config/wazuh_indexer_ssl_certs/root-ca.pem
      

3. Check that there is a docker-compose.yml file. Start Wazuh using docker-compose:

   1. Foreground:

      $ docker-compose up
      

   2. Background:

      $ docker-compose up -d
      

   The default username and password for the Wazuh dashboard are “admin” and “SecretPassword”.

Build docker images locally

The Wazuh manager, indexer, and dashboard images can be modified and built locally.

1. Clone the Wazuh repository to your system:

$ git clone https://github.com/wazuh/wazuh-docker.git -b v4.3.6 --depth=1

2. Enter into the build-docker-images directory and build the Wazuh manager, indexer, and dashboard images:

$  docker-compose build

Customize default users

You can customize users on the Wazuh indexer container by mounting your own internal_users.yml. The default password for the Wazuh indexer administrator user can be changed to provide additional security:

- ./config/wazuh-indexer/internal_users.yml:/usr/share/wazuh-indexer/plugins/opensearch-security/securityconfig/internal_users.yml

It is possible to generate a hash using the same Docker image, type in a secure password when prompted and replace the hash in internal_users.yml:

docker run --rm -ti wazuh/wazuh-indexer:4.3.6 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh