Skip to content

wazuh Setup

In this tutorial we're going to setup wazuh, an open source EDR:

Initial Setup

For the minimum requirements, please check wazuh's system requirements page for that:

[ 10.0.0.101/16 ] [ /dev/pts/0 ] [~]
→ ssh wazuh
The authenticity of host '10.0.0.180 (10.0.0.180)' can't be established.
ECDSA key fingerprint is SHA256:4UFX+pjoqh93S+OLKQo8/rfDX/Rs2S6TGu9VgG7EGtQ.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.0.180' (ECDSA) to the list of known hosts.
Linux wazuh 5.4.143-1-pve #1 SMP PVE 5.4.143-1 (Tue, 28 Sep 2021 09:10:37 +0200) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@wazuh:~# apt update -y ; apt upgrade -y ; apt autoremove -y

root@wazuh:~# apt install curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg -y

root@wazuh:~# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -

root@wazuh:~# echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

root@wazuh:~# apt-get update

root@wazuh:~#  apt-get install wazuh-manager

root@wazuh:~# systemctl daemon-reload

root@wazuh:~# systemctl enable wazuh-manager --now

root@wazuh:~# systemctl status wazuh-manager
* wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2022-04-07 16:18:04 UTC; 12s ago
  Process: 1879 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
    Tasks: 127 (limit: 7372)
   Memory: 196.9M
   CGroup: /system.slice/wazuh-manager.service
           |-1933 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           |-1972 /var/ossec/bin/wazuh-authd
           |-1988 /var/ossec/bin/wazuh-db
           |-2011 /var/ossec/bin/wazuh-execd
           |-2026 /var/ossec/bin/wazuh-analysisd
           |-2087 /var/ossec/bin/wazuh-syscheckd
           |-2103 /var/ossec/bin/wazuh-remoted
           |-2142 /var/ossec/bin/wazuh-logcollector
           |-2186 /var/ossec/bin/wazuh-monitord
           `-2237 /var/ossec/bin/wazuh-modulesd

Apr 07 16:17:56 wazuh env[1879]: Started wazuh-execd...
Apr 07 16:17:56 wazuh env[1879]: 2022/04/07 16:17:56 wazuh-analysisd: ERROR: Could not set resource limit for file descriptors to 458752: Operation not permitted (1)
Apr 07 16:17:57 wazuh env[1879]: Started wazuh-analysisd...
Apr 07 16:17:58 wazuh env[1879]: Started wazuh-syscheckd...
Apr 07 16:17:59 wazuh env[1879]: Started wazuh-remoted...
Apr 07 16:18:00 wazuh env[1879]: Started wazuh-logcollector...
Apr 07 16:18:01 wazuh env[1879]: Started wazuh-monitord...
Apr 07 16:18:02 wazuh env[1879]: Started wazuh-modulesd...
Apr 07 16:18:04 wazuh env[1879]: Completed.
Apr 07 16:18:04 wazuh systemd[1]: Started Wazuh manager.

Now that's done we setup elasticsearch:

root@wazuh:~# apt install elasticsearch-oss opendistroforelasticsearch

moot@wazuh:~# curl -so /etc/elasticsearch/elasticsearch.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/7.x/elasticsearch_all_in_one.yml
root@wazuh:~# curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles.yml
root@wazuh:~# curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles_mapping.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/roles_mapping.yml
root@wazuh:~# curl -so /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml https://packages.wazuh.com/resources/4.2/open-distro/elasticsearch/roles/internal_users.yml

root@wazuh:~# rm /etc/elasticsearch/esnode-key.pem /etc/elasticsearch/esnode.pem /etc/elasticsearch/kirk-key.pem /etc/elasticsearch/kirk.pem /etc/elasticsearch/root-ca.pem -f
root@wazuh:~# curl -so ~/wazuh-cert-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/wazuh-cert-tool.sh
root@wazuh:~# curl -so ~/instances.yml https://packages.wazuh.com/resources/4.2/open-distro/tools/certificate-utility/instances_aio.yml

root@wazuh:~# bash ~/wazuh-cert-tool.sh
04/07/2022 18:42:41 INFO: Configuration file found. Creating certificates...
04/07/2022 18:42:41 INFO: Creating the Elasticsearch certificates...
04/07/2022 18:42:42 INFO: Creating Wazuh server certificates...
04/07/2022 18:42:42 INFO: Creating Kibana certificate...
04/07/2022 18:42:42 INFO: Certificates creation finished. They can be found in ~/certs.

root@wazuh:~# mkdir /etc/elasticsearch/certs/
root@wazuh:~# mv ~/certs/elasticsearch* /etc/elasticsearch/certs/
root@wazuh:~# mv ~/certs/admin* /etc/elasticsearch/certs/
root@wazuh:~# cp ~/certs/root-ca* /etc/elasticsearch/certs/
root@wazuh:~# mkdir -p /etc/elasticsearch/jvm.options.d
root@wazuh:~# echo '-Dlog4j2.formatMsgNoLookups=true' > /etc/elasticsearch/jvm.options.d/disabledlog4j.options
root@wazuh:~# chmod 2750 /etc/elasticsearch/jvm.options.d/disabledlog4j.options
root@wazuh:~# chown root:elasticsearch /etc/elasticsearch/jvm.options.d/disabledlog4j.options

root@wazuh:~# systemctl daemon-reload
root@wazuh:~# systemctl enable elasticsearch --now
Synchronizing state of elasticsearch.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable elasticsearch
Created symlink /etc/systemd/system/multi-user.target.wants/elasticsearch.service -> /usr/lib/systemd/system/elasticsearch.service.

Then we run elasticsearch securityadmin to load the new certificates information and start the cluster:

root@wazuh:~# export JAVA_HOME=/usr/share/elasticsearch/jdk/ && /usr/share/elasticsearch/plugins/opendistro_security/tools/securityadmin.sh -cd /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/ -nhnv -cacert /etc/elasticsearch/certs/root-ca.pem -cert /etc/elasticsearch/certs/admin.pem -key /etc/elasticsearch/certs/admin-key.pem
Open Distro Security Admin v7
Will connect to localhost:9300
 ... done
Connected as CN=admin,OU=Docu,O=Wazuh,L=California,C=US
Elasticsearch Version: 7.10.2
Open Distro Security Version: 1.13.1.0
Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ...
Clustername: elasticsearch
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/
Will update '_doc/config' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/config.yml
   SUCC: Configuration for 'config' created or updated
Will update '_doc/roles' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles.yml
   SUCC: Configuration for 'roles' created or updated
Will update '_doc/rolesmapping' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/roles_mapping.yml
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '_doc/internalusers' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml
   SUCC: Configuration for 'internalusers' created or updated
Will update '_doc/actiongroups' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/action_groups.yml
   SUCC: Configuration for 'actiongroups' created or updated
Will update '_doc/tenants' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/tenants.yml
   SUCC: Configuration for 'tenants' created or updated
Will update '_doc/nodesdn' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/nodes_dn.yml
   SUCC: Configuration for 'nodesdn' created or updated
Will update '_doc/whitelist' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/whitelist.yml
   SUCC: Configuration for 'whitelist' created or updated
Will update '_doc/audit' with /usr/share/elasticsearch/plugins/opendistro_security/securityconfig/audit.yml
   SUCC: Configuration for 'audit' created or updated
Done with success

And then we check that the installation is successful:

root@wazuh:~# curl -XGET https://localhost:9200 -u admin:admin -k
{
  "name" : "node-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "ZDjVBV2HSXKHuJLKlGaGiQ",
  "version" : {
    "number" : "7.10.2",
    "build_flavor" : "oss",
    "build_type" : "deb",
    "build_hash" : "747e1cc71def077253878a59143c1f785afa92b9",
    "build_date" : "2021-01-13T00:42:12.435326Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Then we install filebeat:

root@wazuh:~# apt-get install filebeat
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  filebeat
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 22.1 MB of archives.
After this operation, 73.6 MB of additional disk space will be used.
Get:1 https://packages.wazuh.com/4.x/apt stable/main amd64 filebeat amd64 7.10.2 [22.1 MB]
Fetched 22.1 MB in 8s (2905 kB/s)
Selecting previously unselected package filebeat.
(Reading database ... 42497 files and directories currently installed.)
Preparing to unpack .../filebeat_7.10.2_amd64.deb ...
Unpacking filebeat (7.10.2) ...
Setting up filebeat (7.10.2) ...
Processing triggers for systemd (241-7~deb10u8) ...
root@wazuh:~# curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/resources/4.2/open-distro/filebeat/7.x/filebeat_all_in_one.yml

root@wazuh:~#
root@wazuh:~# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.2/extensions/elasticsearch/7.x/wazuh-template.json
root@wazuh:~# chmod go+r /etc/filebeat/wazuh-template.json
root@wazuh:~# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
wazuh/
wazuh/module.yml
wazuh/archives/
wazuh/archives/config/
wazuh/archives/config/archives.yml
wazuh/archives/ingest/
wazuh/archives/ingest/pipeline.json
wazuh/archives/manifest.yml
wazuh/alerts/
wazuh/alerts/config/
wazuh/alerts/config/alerts.yml
wazuh/alerts/ingest/
wazuh/alerts/ingest/pipeline.json
wazuh/alerts/manifest.yml
wazuh/_meta/
wazuh/_meta/config.yml
wazuh/_meta/fields.yml
wazuh/_meta/docs.asciidoc
root@wazuh:~# mkdir /etc/filebeat/certs
root@wazuh:~# cp ~/certs/root-ca.pem /etc/filebeat/certs/
root@wazuh:~# mv ~/certs/filebeat* /etc/filebeat/certs/
root@wazuh:~# systemctl daemon-reload
root@wazuh:~# systemctl enable filebeat
Synchronizing state of filebeat.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable filebeat
Created symlink /etc/systemd/system/multi-user.target.wants/filebeat.service -> /lib/systemd/system/filebeat.service.
root@wazuh:~# systemctl start filebeat

Then we test filebeat:

root@wazuh:~# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.10.2

Then we install kibana:

root@wazuh:~# apt-get install opendistroforelasticsearch-kibana
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  opendistroforelasticsearch-kibana
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 234 MB of archives.
After this operation, 692 MB of additional disk space will be used.
Get:1 https://packages.wazuh.com/4.x/apt stable/main amd64 opendistroforelasticsearch-kibana amd64 1.13.2 [234 MB]
Fetched 234 MB in 42s (5540 kB/s)
Selecting previously unselected package opendistroforelasticsearch-kibana.
(Reading database ... 42816 files and directories currently installed.)
Preparing to unpack .../opendistroforelasticsearch-kibana_1.13.2_amd64.deb ...
Unpacking opendistroforelasticsearch-kibana (1.13.2) ...
Setting up opendistroforelasticsearch-kibana (1.13.2) ...
chown: cannot access '/usr/share/kibana/optimize': No such file or directory
no optimize folder
Processing triggers for systemd (241-7~deb10u8) ...

root@wazuh:~# curl -so /etc/kibana/kibana.yml https://packages.wazuh.com/resources/4.2/open-distro/kibana/7.x/kibana_all_in_one.yml
root@wazuh:~# mkdir /usr/share/kibana/data
root@wazuh:~# chown -R kibana:kibana /usr/share/kibana/data
root@wazuh:~# cd /usr/share/kibana
root@wazuh:/usr/share/kibana# sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.6_7.10.2-1.zip
Attempting to transfer from https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.2.6_7.10.2-1.zip
Transferring 33013640 bytes....................
Transfer complete
Retrieving metadata from plugin archive
Extracting plugin archive
Extraction complete
Plugin installation complete

root@wazuh:/usr/share/kibana# mkdir /etc/kibana/certs
root@wazuh:/usr/share/kibana# cp ~/certs/root-ca.pem /etc/kibana/certs/
root@wazuh:/usr/share/kibana# mv ~/certs/kibana* /etc/kibana/certs/
root@wazuh:/usr/share/kibana# chown kibana:kibana /etc/kibana/certs/*
root@wazuh:/usr/share/kibana# setcap 'cap_net_bind_service=+ep' /usr/share/kibana/node/bin/node
root@wazuh:/usr/share/kibana# systemctl daemon-reload
root@wazuh:/usr/share/kibana# systemctl enable kibana --now
Synchronizing state of kibana.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable kibana
Created symlink /etc/systemd/system/multi-user.target.wants/kibana.service -> /etc/systemd/system/kibana.service.

And from there we simply access the wazuh web interface at https://ip/ :

change the admin password here:

Now that's done we're going to install the wazuh agent where we need it, for this tutorial i'll install it on my local nextcloud server:

[ 10.0.0.10/16 ] [ /dev/pts/18 ] [Github/blog/servers]
→ ssh home
Last login: Thu Apr  7 18:09:18 2022 from 10.0.0.10

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -

OK

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

deb https://packages.wazuh.com/4.x/apt/ stable main

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ apt-get update

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ WAZUH_MANAGER="10.0.0.180" apt-get install wazuh-agent

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ systemctl daemon-reload

[ 10.0.0.101/16 ] [ /dev/pts/2 ] [~]
→ systemctl enable --now wazuh-agent


Nihilist
Donate XMR to Nihilist:
8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8