Wazuh Installation: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(3 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
−
=Vorbereitung=
+
= Wazuh Installation =
−
*hostname
 
−
wazuh.lab.internal
 
−
*hostname -i
 
−
192.168.168.99
 
−
*apt install -y curl gpg
 
−
=Webseite=
 
−
*https://documentation.wazuh.com/current/quickstart.html
 
−
=Installing Wazuh=
 
−
*'''Vorher neuste Version checken'''
 
  
−
*apt install -y curl gpg
+
== Vorbereitung ==
−
*curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i
+
 
−
<pre>
+
;Hostname setzen
 +
* hostnamectl set-hostname wazuh.lab.int
 +
 
 +
;IP prüfen
 +
* hostname -i
 +
 
 +
;Abhängigkeiten installieren
 +
* apt install -y curl gpg
 +
 
 +
== Hardware-Anforderungen ==
 +
 
 +
{| class="wikitable"
 +
! Agents !! CPU !! RAM !! Storage (90 Tage)
 +
|-
 +
| 1–25 || 4 vCPU || 8 GB || 50 GB
 +
|-
 +
| 25–50 || 8 vCPU || 8 GB || 100 GB
 +
|-
 +
| 50–100 || 8 vCPU || 8 GB || 200 GB
 +
|}
 +
 
 +
== Installation ==
 +
 
 +
;Neuste Version prüfen
 +
* https://documentation.wazuh.com/current/quickstart.html
 +
 
 +
;Installationsscript herunterladen und ausführen (aktuell: 4.14)
 +
* curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
 +
 
 +
Nach der Installation wird das Passwort angezeigt:
 
<pre>
 
<pre>
−
05/06/2024 14:47:43 INFO: Starting Wazuh installation assistant. Wazuh version: 4.7.5
+
INFO: --- Summary ---
−
05/06/2024 14:47:43 INFO: Verbose logging redirected to /var/log/wazuh-install.log
+
INFO: You can access the web interface https://<WAZUH_DASHBOARD_IP_ADDRESS>
−
05/06/2024 14:47:49 INFO: --- Dependencies ----
 
−
05/06/2024 14:47:49 INFO: Installing gawk.
 
−
05/06/2024 14:47:52 WARNING: Hardware and system checks ignored.
 
−
05/06/2024 14:47:52 INFO: Wazuh web interface port will be 443.
 
−
05/06/2024 14:47:55 INFO: --- Dependencies ----
 
−
05/06/2024 14:47:55 INFO: Installing apt-transport-https.
 
−
05/06/2024 14:47:56 INFO: Installing software-properties-common.
 
−
05/06/2024 14:48:29 INFO: Wazuh repository added.
 
−
05/06/2024 14:48:29 INFO: --- Configuration files ---
 
−
05/06/2024 14:48:29 INFO: Generating configuration files.
 
−
05/06/2024 14:48:31 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
 
−
05/06/2024 14:48:31 INFO: --- Wazuh indexer ---
 
−
05/06/2024 14:48:31 INFO: Starting Wazuh indexer installation.
 
−
05/06/2024 14:49:40 INFO: Wazuh indexer installation finished.
 
−
05/06/2024 14:49:40 INFO: Wazuh indexer post-install configuration finished.
 
−
05/06/2024 14:49:40 INFO: Starting service wazuh-indexer.
 
−
05/06/2024 14:49:54 INFO: wazuh-indexer service started.
 
−
05/06/2024 14:49:54 INFO: Initializing Wazuh indexer cluster security settings.
 
−
05/06/2024 14:50:05 INFO: Wazuh indexer cluster initialized.
 
−
05/06/2024 14:50:05 INFO: --- Wazuh server ---
 
−
05/06/2024 14:50:05 INFO: Starting the Wazuh manager installation.
 
−
05/06/2024 14:53:38 INFO: Wazuh manager installation finished.
 
−
05/06/2024 14:53:38 INFO: Starting service wazuh-manager.
 
−
05/06/2024 14:54:02 INFO: wazuh-manager service started.
 
−
05/06/2024 14:54:02 INFO: Starting Filebeat installation.
 
−
05/06/2024 14:54:10 INFO: Filebeat installation finished.
 
−
05/06/2024 14:54:11 INFO: Filebeat post-install configuration finished.
 
−
05/06/2024 14:54:11 INFO: Starting service filebeat.
 
−
05/06/2024 14:54:12 INFO: filebeat service started.
 
−
05/06/2024 14:54:12 INFO: --- Wazuh dashboard ---
 
−
05/06/2024 14:54:12 INFO: Starting Wazuh dashboard installation.
 
−
05/06/2024 15:05:27 INFO: Wazuh dashboard installation finished.
 
−
05/06/2024 15:05:27 INFO: Wazuh dashboard post-install configuration finished.
 
−
05/06/2024 15:05:27 INFO: Starting service wazuh-dashboard.
 
−
05/06/2024 15:05:28 INFO: wazuh-dashboard service started.
 
−
05/06/2024 15:06:11 INFO: Initializing Wazuh dashboard web application.
 
−
05/06/2024 15:06:12 INFO: Wazuh dashboard web application initialized.
 
−
05/06/2024 15:06:12 INFO: --- Summary ---
 
−
05/06/2024 15:06:12 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
 
 
     User: admin
 
     User: admin
−
     Password: WtB+D5jis?jJLJdsc.7iV1vCD?0+h+aw
+
     Password: <ADMIN_PASSWORD>
−
05/06/2024 15:06:12 INFO: --- Dependencies ----
+
INFO: Installation finished.
−
05/06/2024 15:06:12 INFO: Removing gawk.
 
−
05/06/2024 15:06:20 INFO: Installation finished.
 
−
root@wazuh:~#
 
 
</pre>
 
</pre>
  
−
=Passwort ändern=
+
;Alle Passwörter anzeigen (in wazuh-install-files.tar gespeichert)
−
*/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start
+
* sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt
 +
 
 +
== Zugang ==
 +
* https://192.168.168.99
 +
* User: admin
 +
* Passwort: siehe Installation
 +
 
 +
== Passwort ändern ==
 +
* /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start
 +
 
 +
== Repository deaktivieren (empfohlen) ==
 +
Nach der Installation das Repo deaktivieren um ungewollte Updates zu verhindern:
 +
* sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
 +
* apt update
 +
 
 +
[[Kategorie:WAZUH]]

Aktuelle Version vom 7. April 2026, 14:05 Uhr

Wazuh Installation

Vorbereitung

Hostname setzen
  • hostnamectl set-hostname wazuh.lab.int
IP prüfen
  • hostname -i
Abhängigkeiten installieren
  • apt install -y curl gpg

Hardware-Anforderungen

Agents CPU RAM Storage (90 Tage)
1–25 4 vCPU 8 GB 50 GB
25–50 8 vCPU 8 GB 100 GB
50–100 8 vCPU 8 GB 200 GB

Installation

Neuste Version prüfen
Installationsscript herunterladen und ausführen (aktuell
4.14)

Nach der Installation wird das Passwort angezeigt: 

INFO: --- Summary ---
INFO: You can access the web interface https://<WAZUH_DASHBOARD_IP_ADDRESS>
    User: admin
    Password: <ADMIN_PASSWORD>
INFO: Installation finished.
Alle Passwörter anzeigen (in wazuh-install-files.tar gespeichert)
  • sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Zugang

Passwort ändern

  • /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start

Repository deaktivieren (empfohlen)

Nach der Installation das Repo deaktivieren um ungewollte Updates zu verhindern:

  • sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
  • apt update
Abgerufen von „http://wiki.ixheim.de/index.php?title=Wazuh_Installation&oldid=68457“