Offline installation

Installing the Wazuh manager

1. Run the following commands to import the Wazuh key and install the Wazuh manager.

   RPM

   DEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-manager*.rpm
   

   # dpkg -i ./wazuh-offline/wazuh-packages/wazuh-manager*.deb
   

2. Enable and start the Wazuh manager service.

   Systemd

   SysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-manager
   # systemctl start wazuh-manager
   

   Choose one option according to your operating system:

   1. RPM-based operating system:

   # chkconfig --add wazuh-manager
   # service wazuh-manager start
   

   2. Debian-based operating system:

   # update-rc.d wazuh-manager defaults 95 10
   # service wazuh-manager start
   

3. Run the following command to verify that the Wazuh manager status is active.

   Systemd

   SysV init

   # systemctl status wazuh-manager
   

   # service wazuh-manager status
   

Installing Filebeat

Filebeat must be installed and configured on the same server as the Wazuh manager.

1. Run the following command to install Filebeat.

   RPM

   DEB

   # rpm -ivh ./wazuh-offline/wazuh-packages/filebeat*.rpm
   

   # dpkg -i ./wazuh-offline/wazuh-packages/filebeat*.deb
   

2. Move a copy of the configuration files to the appropriate location. Ensure to type “yes” at the prompt to overwrite /etc/filebeat/filebeat.yml.

   # cp ./wazuh-offline/wazuh-files/filebeat.yml /etc/filebeat/ &&\
   cp ./wazuh-offline/wazuh-files/wazuh-template.json /etc/filebeat/ &&\
   chmod go+r /etc/filebeat/wazuh-template.json
   

3. Edit /etc/filebeat/wazuh-template.json and change to "1" the value for "index.number_of_shards" for a single-node installation. This value can be changed based on the user requirement when performing a distributed installation.

   {
     ...
     "settings": {
       ...
       "index.number_of_shards": "1",
       ...
     },
     ...
   }
   

4. Edit the /etc/filebeat/filebeat.yml configuration file and replace the following value:

   1. hosts: The list of Wazuh indexer nodes to connect to. You can use either IP addresses or hostnames. By default, the host is set to localhost hosts: ["127.0.0.1:9200"]. Replace it with your Wazuh indexer address accordingly.

      If you have more than one Wazuh indexer node, you can separate the addresses using commas. For example, hosts: ["10.0.0.1:9200", "10.0.0.2:9200", "10.0.0.3:9200"]

       # Wazuh - Filebeat configuration file
       output.elasticsearch:
       hosts: ["10.0.0.1:9200"]
       protocol: https
       username: ${username}
       password: ${password}
      

5. Create a Filebeat keystore to securely store authentication credentials.

   # filebeat keystore create
   

6. Add the username and password admin:admin to the secrets keystore.

   # echo admin | filebeat keystore add username --stdin --force
   # echo admin | filebeat keystore add password --stdin --force
   

7. Install the Wazuh module for Filebeat.

   # tar -xzf ./wazuh-offline/wazuh-files/wazuh-filebeat-0.2.tar.gz -C /usr/share/filebeat/module
   

8. Replace <server-node-name> with your Wazuh server node certificate name, the same used in config.yml when creating the certificates. For example, wazuh-1. Then, move the certificates to their corresponding location.

   # NODE_NAME=<server-node-name>
   

   # mkdir /etc/filebeat/certs
   # mv -n wazuh-certificates/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
   # mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
   # cp wazuh-certificates/root-ca.pem /etc/filebeat/certs/
   # chmod 500 /etc/filebeat/certs
   # chmod 400 /etc/filebeat/certs/*
   # chown -R root:root /etc/filebeat/certs
   

9. Enable and start the Filebeat service.

   Systemd

   SysV init

   # systemctl daemon-reload
   # systemctl enable filebeat
   # systemctl start filebeat
   

   Choose one option according to the operating system used.

   1. RPM-based operating system:

   # chkconfig --add filebeat
   # service filebeat start
   

   2. Debian-based operating system:

   # update-rc.d filebeat defaults 95 10
   # service filebeat start
   

10. Run the following command to make sure Filebeat is successfully installed.

    # filebeat test output
    

    Expand the output to see an example response.

    elasticsearch: https://127.0.0.1:9200...
      parse url... OK
      connection...
        parse host... OK
        dns lookup... OK
        addresses: 127.0.0.1
        dial up... OK
      TLS...
        security: server's certificate chain verification is enabled
        handshake... OK
        TLS version: TLSv1.3
        dial up... OK
      talk to server... OK
      version: 7.10.2
    

    To check the number of shards that have been configured, you can run the following command. Note that this command uses localhost, set your Wazuh indexer address if necessary.

    # curl -k -u admin:admin "https://localhost:9200/_template/wazuh?pretty&filter_path=wazuh.settings.index.number_of_shards"
    

    Expand the output to see an example response.

    {
      "wazuh" : {
        "settings" : {
          "index" : {
            "number_of_shards" : "1"
          }
        }
      }
    }
    

Your Wazuh server node is now successfully installed. Repeat the steps of this installation process stage for every Wazuh server node in your cluster, expand the Wazuh cluster configuration for multi-node deployment section below, and carry on then with configuring the Wazuh cluster. If you want a Wazuh server single-node cluster, everything is set and you can proceed directly with the Wazuh dashboard installation.

Wazuh cluster configuration for multi-node deployment

Installing the Wazuh dashboard

1. Run the following commands to install the Wazuh dashboard.

   RPM

   DEB

   # rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
   # rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-dashboard*.rpm
   

   # dpkg -i ./wazuh-offline/wazuh-packages/wazuh-dashboard*.deb
   

2. Replace <dashboard-node-name> with your Wazuh dashboard node name, the same used in config.yml to create the certificates. For example, dashboard. Then, move the certificates to their corresponding location.

   # NODE_NAME=<dashboard-node-name>
   

   # mkdir /etc/wazuh-dashboard/certs
   # mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
   # mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
   # cp wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/
   # chmod 500 /etc/wazuh-dashboard/certs
   # chmod 400 /etc/wazuh-dashboard/certs/*
   # chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
   

3. Edit the /etc/wazuh-dashboard/opensearch_dashboards.yml file and replace the following values:

   1. server.host: This setting specifies the host of the back end server. To allow remote users to connect, set the value to the IP address or DNS name of the Wazuh dashboard. The value 0.0.0.0 will accept all the available IP addresses of the host.

   2. opensearch.hosts: The URLs of the Wazuh indexer instances to use for all your queries. The Wazuh dashboard can be configured to connect to multiple Wazuh indexer nodes in the same cluster. The addresses of the nodes can be separated by commas. For example, ["https://10.0.0.2:9200", "https://10.0.0.3:9200","https://10.0.0.4:9200"]

         server.host: 0.0.0.0
         server.port: 443
         opensearch.hosts: https://localhost:9200
         opensearch.ssl.verificationMode: certificate
      

4. Enable and start the Wazuh dashboard.

   Systemd

   SysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

   Choose one option according to your operating system:

   1. RPM-based operating system:

   # chkconfig --add wazuh-dashboard
   # service wazuh-dashboard start
   

   2. Debian-based operating system:

   # update-rc.d wazuh-dashboard defaults 95 10
   # service wazuh-dashboard start
   

5. Only for distributed deployments: Edit the file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and replace the url value with the IP address or hostname of the Wazuh server master node.

   hosts:
     - default:
         url: https://localhost
         port: 55000
         username: wazuh-wui
         password: wazuh-wui
         run_as: false
   

6. Run the following command to verify the Wazuh dashboard service is active.

   Systemd

   SysV init

   # systemctl status wazuh-dashboard
   

   # service wazuh-dashboard status
   

7. Access the web interface.

   • URL: https://<wazuh_server_ip>

   • Username: admin

   • Password: admin

Upon the first access to the Wazuh dashboard, the browser shows a warning message stating that the certificate was not issued by a trusted authority. An exception can be added in the advanced options of the web browser or, for increased security, the root-ca.pem file previously generated can be imported to the certificate manager of the browser. Alternatively, a certificate from a trusted authority can be configured.