Deploying Wazuh agents on Linux endpoints

Add the Wazuh repository

Add the Wazuh repository to download the official packages.

# apt-get install gnupg apt-transport-https
# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
# echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

Deploy a Wazuh agent

1. To deploy the Wazuh agent on your endpoint, select your package manager and edit the WAZUH_MANAGER variable to contain your Wazuh manager IP address or hostname.

   Yum

   APT

   ZYpp

   APK

   # WAZUH_MANAGER="10.0.0.2" yum install wazuh-agent
   

   For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.

   Note

   Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Wazuh agent enrollment section.

   # WAZUH_MANAGER="10.0.0.2" apt-get install wazuh-agent
   

   For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.

   Note

   Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Wazuh agent enrollment section.

   # WAZUH_MANAGER="10.0.0.2" zypper install wazuh-agent
   

   For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.

   Note

   Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Wazuh agent enrollment section.

   1. Install the Wazuh agent:

      # apk add wazuh-agent
      

   2. Edit the agent configuration to add the address of your Wazuh manager:

      # export WAZUH_MANAGER="10.0.0.2" && sed -i "s|MANAGER_IP|$WAZUH_MANAGER|g" /var/ossec/etc/ossec.conf
      

      For more customization options, like agent name or group, see the Linux/Unix endpoint configuration page. For more security options, check the Additional security options section.

2. Enable and start the Wazuh agent service.

   Systemd

   SysV init

   No service manager

   # systemctl daemon-reload
   # systemctl enable wazuh-agent
   # systemctl start wazuh-agent
   

   Choose one option according to your operating system.

   1. RPM-based operating systems:

   # chkconfig --add wazuh-agent
   # service wazuh-agent start
   

   2. Debian-based operating systems:

   # update-rc.d wazuh-agent defaults 95 10
   # service wazuh-agent start
   

   On some system, like Alpine Linux, you need to start the agent manually:

   # /var/ossec/bin/wazuh-control start
   

The deployment process is now complete, and the Wazuh agent is successfully running on your Linux system.

• Recommended action - Disable Wazuh updates

  Compatibility between the Wazuh agent and the Wazuh manager is guaranteed when the Wazuh manager version is later than or equal to that of the Wazuh agent. Therefore, we recommend disabling the Wazuh repository to prevent accidental upgrades. To do so, use the following command:

  Yum

  APT

  ZYpp

  APK

  # sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
  

  # sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
  # apt-get update
  

  Alternatively, you can set the package state to hold. This action stops updates but you can still upgrade it manually using apt-get install.

  # echo "wazuh-agent hold" | dpkg --set-selections
  

  # sed -i "s/^enabled=1/enabled=0/" /etc/zypp/repos.d/wazuh.repo
  

  # sed -i "s|^https://packages.wazuh.com|#https://packages.wazuh.com|g" /etc/apk/repositories
  

Uninstall a Wazuh agent

To uninstall the agent, run the following commands:

1. Remove the Wazuh agent installation.

   Yum

   APT

   ZYpp

   APK

   # yum remove wazuh-agent
   

   Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. If you want to completely remove all files, delete the /var/ossec folder.

   # apt-get remove wazuh-agent
   

   Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. If you want to completely remove all files, run the following command:

   # apt-get remove --purge wazuh-agent
   

   # zypper remove wazuh-agent
   

   Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. If you want to completely remove all files, delete the /var/ossec folder.

   # apk del wazuh-agent
   

2. Disable the Wazuh agent service.

   Systemd

   SysV init

   No service manager

   # systemctl disable wazuh-agent
   # systemctl daemon-reload
   

   Choose one option according to your operating system.

   1. RPM-based operating systems:

   # chkconfig wazuh-agent off
   # chkconfig --del wazuh-agent
   

   2. Debian-based operating systems:

   # update-rc.d -f wazuh-agent remove
   

   No action required.

The Wazuh agent is now completely removed from your Linux endpoint.