Wazuh Installation: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
← Zum vorherigen Versionsunterschied
Keine Bearbeitungszusammenfassung
 
(2 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
=Vorbereitung=
= Wazuh Installation =
*hostname
wazuh.lab.internal
*hostname -i
192.168.168.99
*apt install -y curl gpg
=Webseite=
*https://documentation.wazuh.com/current/quickstart.html
=Installing Wazuh=
*'''Vorher neuste Version checken'''


*apt install -y curl gpg
== Vorbereitung ==
*curl -sO https://packages.wazuh.com/4.11/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i
 
<pre>
;Hostname setzen
* hostnamectl set-hostname wazuh.lab.int
 
;IP prüfen
* hostname -i
 
;Abhängigkeiten installieren
* apt install -y curl gpg
 
== Hardware-Anforderungen ==
 
{| class="wikitable"
! Agents !! CPU !! RAM !! Storage (90 Tage)
|-
| 1–25 || 4 vCPU || 8 GB || 50 GB
|-
| 25–50 || 8 vCPU || 8 GB || 100 GB
|-
| 50–100 || 8 vCPU || 8 GB || 200 GB
|}
 
== Installation ==
 
;Neuste Version prüfen
* https://documentation.wazuh.com/current/quickstart.html
 
;Installationsscript herunterladen und ausführen (aktuell: 4.14)
* curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
 
Nach der Installation wird das Passwort angezeigt:
<pre>
<pre>
05/06/2024 14:47:43 INFO: Starting Wazuh installation assistant. Wazuh version: 4.7.5
INFO: --- Summary ---
05/06/2024 14:47:43 INFO: Verbose logging redirected to /var/log/wazuh-install.log
INFO: You can access the web interface https://<WAZUH_DASHBOARD_IP_ADDRESS>
05/06/2024 14:47:49 INFO: --- Dependencies ----
05/06/2024 14:47:49 INFO: Installing gawk.
05/06/2024 14:47:52 WARNING: Hardware and system checks ignored.
05/06/2024 14:47:52 INFO: Wazuh web interface port will be 443.
05/06/2024 14:47:55 INFO: --- Dependencies ----
05/06/2024 14:47:55 INFO: Installing apt-transport-https.
05/06/2024 14:47:56 INFO: Installing software-properties-common.
05/06/2024 14:48:29 INFO: Wazuh repository added.
05/06/2024 14:48:29 INFO: --- Configuration files ---
05/06/2024 14:48:29 INFO: Generating configuration files.
05/06/2024 14:48:31 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.
05/06/2024 14:48:31 INFO: --- Wazuh indexer ---
05/06/2024 14:48:31 INFO: Starting Wazuh indexer installation.
05/06/2024 14:49:40 INFO: Wazuh indexer installation finished.
05/06/2024 14:49:40 INFO: Wazuh indexer post-install configuration finished.
05/06/2024 14:49:40 INFO: Starting service wazuh-indexer.
05/06/2024 14:49:54 INFO: wazuh-indexer service started.
05/06/2024 14:49:54 INFO: Initializing Wazuh indexer cluster security settings.
05/06/2024 14:50:05 INFO: Wazuh indexer cluster initialized.
05/06/2024 14:50:05 INFO: --- Wazuh server ---
05/06/2024 14:50:05 INFO: Starting the Wazuh manager installation.
05/06/2024 14:53:38 INFO: Wazuh manager installation finished.
05/06/2024 14:53:38 INFO: Starting service wazuh-manager.
05/06/2024 14:54:02 INFO: wazuh-manager service started.
05/06/2024 14:54:02 INFO: Starting Filebeat installation.
05/06/2024 14:54:10 INFO: Filebeat installation finished.
05/06/2024 14:54:11 INFO: Filebeat post-install configuration finished.
05/06/2024 14:54:11 INFO: Starting service filebeat.
05/06/2024 14:54:12 INFO: filebeat service started.
05/06/2024 14:54:12 INFO: --- Wazuh dashboard ---
05/06/2024 14:54:12 INFO: Starting Wazuh dashboard installation.
05/06/2024 15:05:27 INFO: Wazuh dashboard installation finished.
05/06/2024 15:05:27 INFO: Wazuh dashboard post-install configuration finished.
05/06/2024 15:05:27 INFO: Starting service wazuh-dashboard.
05/06/2024 15:05:28 INFO: wazuh-dashboard service started.
05/06/2024 15:06:11 INFO: Initializing Wazuh dashboard web application.
05/06/2024 15:06:12 INFO: Wazuh dashboard web application initialized.
05/06/2024 15:06:12 INFO: --- Summary ---
05/06/2024 15:06:12 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
     User: admin
     User: admin
     Password: WtB+D5jis?jJLJdsc.7iV1vCD?0+h+aw
     Password: <ADMIN_PASSWORD>
05/06/2024 15:06:12 INFO: --- Dependencies ----
INFO: Installation finished.
05/06/2024 15:06:12 INFO: Removing gawk.
05/06/2024 15:06:20 INFO: Installation finished.
root@wazuh:~#
</pre>
</pre>


=Passwort ändern=
;Alle Passwörter anzeigen (in wazuh-install-files.tar gespeichert)
*/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start
* sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt
 
== Zugang ==
* https://192.168.168.99
* User: admin
* Passwort: siehe Installation
 
== Passwort ändern ==
* /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start
 
== Repository deaktivieren (empfohlen) ==
Nach der Installation das Repo deaktivieren um ungewollte Updates zu verhindern:
* sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
* apt update
 
[[Kategorie:WAZUH]]

Aktuelle Version vom 7. April 2026, 14:05 Uhr

Wazuh Installation

Vorbereitung

Hostname setzen
  • hostnamectl set-hostname wazuh.lab.int
IP prüfen
  • hostname -i
Abhängigkeiten installieren
  • apt install -y curl gpg

Hardware-Anforderungen

Agents CPU RAM Storage (90 Tage)
1–25 4 vCPU 8 GB 50 GB
25–50 8 vCPU 8 GB 100 GB
50–100 8 vCPU 8 GB 200 GB

Installation

Neuste Version prüfen
Installationsscript herunterladen und ausführen (aktuell
4.14)

Nach der Installation wird das Passwort angezeigt: 

INFO: --- Summary ---
INFO: You can access the web interface https://<WAZUH_DASHBOARD_IP_ADDRESS>
    User: admin
    Password: <ADMIN_PASSWORD>
INFO: Installation finished.
Alle Passwörter anzeigen (in wazuh-install-files.tar gespeichert)
  • sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Zugang

Passwort ändern

  • /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 123-Start

Repository deaktivieren (empfohlen)

Nach der Installation das Repo deaktivieren um ungewollte Updates zu verhindern:

  • sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
  • apt update
Abgerufen von „https://wiki.ixheim.de/index.php?title=Wazuh_Installation&oldid=68457“