Wazuh on Ubuntu 20.04

Wazuh is an open-source security monitoring platform: host intrusion detection, log analysis, file integrity monitoring and vulnerability detection, with a Kibana-based dashboard on top. This is a single-host install of Wazuh 4.2 on Ubuntu 20.04, where the manager, indexer and dashboard all run on one box. That is fine for a lab or a small estate; split the roles once you are collecting from more than a handful of agents.

At this version (4.2) Wazuh shipped on Open Distro for Elasticsearch, and the whole thing goes on with one unattended script.

Install the server

As root on a clean 20.04 host, pull down the unattended installer and run it:

curl -so ~/unattended-installation.sh https://packages.wazuh.com/resources/4.2/open-distro/unattended-installation/unattended-installation.sh
bash ~/unattended-installation.sh

It works through the stack in order and tells you as it goes:

Starting the installation...
Installing the Wazuh manager...
Installing Open Distro for Elasticsearch...
Configuring Elasticsearch...
Creating the Elasticsearch certificates...
Installing Filebeat...
Installing Open Distro for Kibana...
Generating random passwords...
Installation finished

The passwords are shown once

At the end it prints a block of randomly generated passwords, one per internal user, and this is the only time you see them. Capture the whole block into your password manager before you close the terminal:

The password for admin          <generated-shown-once>
The password for wazuh          <generated-shown-once>
The password for kibanaserver   <generated-shown-once>
The password for kibanaro       <generated-shown-once>
The password for logstash       <generated-shown-once>

The certificates it generated land in ~/certs. The dashboard is then reachable over HTTPS at the server's address, and you log in with the admin password from that block:

https://<server-address>

If you ever lose those passwords, Wazuh ships a password-change tool that regenerates them and updates the config files, but it is far less painful to save them the first time.

Enrol an agent

On each machine you want to monitor, install the agent and point it at the manager. Pass the manager's address in the environment so the agent registers against the right server:

curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.2.1-1_amd64.deb
sudo WAZUH_MANAGER='192.0.2.10' WAZUH_AGENT_GROUP='default' dpkg -i ./wazuh-agent.deb

Then enable and start it:

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

The agent will appear in the dashboard within a minute or two.

Lock down the ports

The dashboard and the manager's enrolment and reporting ports should not be open to the world. Restrict them to the addresses you actually manage from. With firewalld:

firewall-cmd --zone=internal --add-source=192.0.2.0/24 --permanent
firewall-cmd --reload

Or, if the host runs ufw, allow SSH only from your admin network:

ufw allow from 192.0.2.0/24 to any port 22

Today

Wazuh 4.2 and its Open Distro base are well out of date. From 4.3 onwards Wazuh dropped Open Distro for its own Wazuh indexer and dashboard (both OpenSearch-derived), and the installer was replaced by wazuh-install.sh, which takes a -a flag for the same all-in-one deployment. The ideas here, one script to stand it up, a one-time password block to capture, agents enrolled with WAZUH_MANAGER, carry straight over; only the package base and the script name have changed.