Offline installation

Installing the Wazuh indexer

1. Run the following commands to install the Wazuh indexer.

   RPMDEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-indexer*.rpm
   

2. Run the following commands replacing <indexer-node-name> with the name of the Wazuh indexer node you are configuring as defined in config.yml. For example, node-1. This deploys the SSL certificates to encrypt communications between the Wazuh central components.

   # NODE_NAME=<indexer-node-name>
   

   # mkdir /etc/wazuh-indexer/certs
   # mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
   # mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
   # mv wazuh-certificates/admin-key.pem /etc/wazuh-indexer/certs/
   # mv wazuh-certificates/admin.pem /etc/wazuh-indexer/certs/
   # cp wazuh-certificates/root-ca.pem /etc/wazuh-indexer/certs/
   # chmod 500 /etc/wazuh-indexer/certs
   # chmod 400 /etc/wazuh-indexer/certs/*
   # chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
   

   Here you move the node certificate and key files, such as node-1.pem and node-1-key.pem, to their corresponding certs folder. They're specific to the node and are not required on the other nodes. However, note that the root-ca.pem certificate isn't moved but copied to the certs folder. This way, you can continue deploying it to other component folders in the next steps.

3. Edit /etc/wazuh-indexer/opensearch.yml and replace the following values:

   1. network.host: Sets the address of this node for both HTTP and transport traffic. The node will bind to this address and will also use it as its publish address. Accepts an IP address or a hostname.

      Use the same node address set in config.yml to create the SSL certificates.

   2. node.name: Name of the Wazuh indexer node as defined in the config.yml file. For example, node-1.

   3. cluster.initial_master_nodes: List of the names of the master-eligible nodes. These names are defined in the config.yml file. Uncomment the node-2 and node-3 lines, change the names, or add more lines, according to your config.yml definitions.

      cluster.initial_master_nodes:
      - "node-1"
      - "node-2"
      - "node-3"
      

   4. discovery.seed_hosts: List of the addresses of the master-eligible nodes. Each element can be either an IP address or a hostname. You may leave this setting commented if you are configuring the Wazuh indexer as a single-node. For multi-node configurations, uncomment this setting and set your master-eligible nodes addresses.

      discovery.seed_hosts:
        - "10.0.0.1"
        - "10.0.0.2"
        - "10.0.0.3"
      

   5. plugins.security.nodes_dn: List of the Distinguished Names of the certificates of all the Wazuh indexer cluster nodes. Uncomment the lines for node-2 and node-3 and change the common names (CN) and values according to your settings and your config.yml definitions.

      plugins.security.nodes_dn:
      - "CN=node-1,OU=Wazuh,O=Wazuh,L=California,C=US"
      - "CN=node-2,OU=Wazuh,O=Wazuh,L=California,C=US"
      - "CN=node-3,OU=Wazuh,O=Wazuh,L=California,C=US"
      

4. Enable and start the Wazuh indexer service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-indexer
   # systemctl start wazuh-indexer
   

5. For multi-node clusters, repeat the previous steps on every Wazuh indexer node.

6. When all Wazuh indexer nodes are running, run the Wazuh indexer indexer-security-init.sh script on any Wazuh indexer node to load the new certificates information and start the cluster.

   # /usr/share/wazuh-indexer/bin/indexer-security-init.sh
   

7. Run the following command to check that the installation is successful. Note that this command uses localhost, set your Wazuh indexer address if necessary.

   # curl -XGET https://localhost:9200 -u admin:admin -k
   

   Expand the output to see an example response.

   {
     "name" : "node-1",
     "cluster_name" : "wazuh-cluster",
     "cluster_uuid" : "095jEW-oRJSFKLz5wmo5PA",
     "version" : {
       "number" : "7.10.2",
       "build_type" : "rpm",
       "build_hash" : "db90a415ff2fd428b4f7b3f800a51dc229287cb4",
       "build_date" : "2023-06-03T06:24:25.112415503Z",
       "build_snapshot" : false,
       "lucene_version" : "9.6.0",
       "minimum_wire_compatibility_version" : "7.10.0",
       "minimum_index_compatibility_version" : "7.0.0"
     },
     "tagline" : "The OpenSearch Project: https://opensearch.org/"
   }
   

Installing the Wazuh server

Installing the Wazuh dashboard

1. Run the following commands to install the Wazuh dashboard.

   RPMDEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-dashboard*.rpm
   

2. Replace <dashboard-node-name> with your Wazuh dashboard node name, the same used in config.yml to create the certificates. For example, dashboard. Then, move the certificates to their corresponding location.

   # NODE_NAME=<dashboard-node-name>
   

   # mkdir /etc/wazuh-dashboard/certs
   # mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
   # mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
   # cp wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/
   # chmod 500 /etc/wazuh-dashboard/certs
   # chmod 400 /etc/wazuh-dashboard/certs/*
   # chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
   

3. Edit the /etc/wazuh-dashboard/opensearch_dashboards.yml file and replace the following values:

   1. server.host: This setting specifies the host of the back end server. To allow remote users to connect, set the value to the IP address or DNS name of the Wazuh dashboard. The value 0.0.0.0 will accept all the available IP addresses of the host.

   2. opensearch.hosts: The URLs of the Wazuh indexer instances to use for all your queries. The Wazuh dashboard can be configured to connect to multiple Wazuh indexer nodes in the same cluster. The addresses of the nodes can be separated by commas. For example, ["https://10.0.0.2:9200", "https://10.0.0.3:9200","https://10.0.0.4:9200"]

         server.host: 0.0.0.0
         server.port: 443
         opensearch.hosts: https://localhost:9200
         opensearch.ssl.verificationMode: certificate
      

4. Enable and start the Wazuh dashboard.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

5. Only for distributed deployments: Edit the file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and replace the url value with the IP address or hostname of the Wazuh server master node.

   hosts:
     - default:
         url: https://localhost
         port: 55000
         username: wazuh-wui
         password: wazuh-wui
         run_as: false
   

6. Run the following command to verify the Wazuh dashboard service is active.

   SystemdSysV init

   # systemctl status wazuh-dashboard
   

7. Access the web interface.

   • URL: https://<wazuh_server_ip>

   • Username: admin

   • Password: admin

Upon the first access to the Wazuh dashboard, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser or, for increased security, the root-ca.pem file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.