---
title: "Wazuh on Ubuntu 20.04"
date: "2021-09-22"
path: "/210-wazuh-on-ubuntu-20-04.html"
section: "/ramblings"
description: "Installing the Wazuh 4.2 all-in-one stack on Ubuntu 20.04 with the unattended installer, then enrolling an agent."
---

Wazuh is an open-source security monitoring platform: host intrusion detection, log analysis, file integrity monitoring and vulnerability detection, with a Kibana-based dashboard on top. This is a single-host install of Wazuh 4.2 on Ubuntu 20.04, where the manager, indexer and dashboard all run on one box. That is fine for a lab or a small estate; split the roles once you are collecting from more than a handful of agents.

At this version (4.2) Wazuh shipped on Open Distro for Elasticsearch, and the whole thing goes on with one unattended script.

## Install the server

As root on a clean 20.04 host, pull down the unattended installer and run it:

```bash
curl -so ~/unattended-installation.sh https://packages.wazuh.com/resources/4.2/open-distro/unattended-installation/unattended-installation.sh
bash ~/unattended-installation.sh
```

It works through the stack in order and tells you as it goes:

```text
Starting the installation...
Installing the Wazuh manager...
Installing Open Distro for Elasticsearch...
Configuring Elasticsearch...
Creating the Elasticsearch certificates...
Installing Filebeat...
Installing Open Distro for Kibana...
Generating random passwords...
Installation finished
```

## The passwords are shown once

At the end it prints a block of randomly generated passwords, one per internal user, and this is the only time you see them. Capture the whole block into your password manager before you close the terminal:

```text
The password for admin          <generated-shown-once>
The password for wazuh          <generated-shown-once>
The password for kibanaserver   <generated-shown-once>
The password for kibanaro       <generated-shown-once>
The password for logstash       <generated-shown-once>
```

The certificates it generated land in `~/certs`. The dashboard is then reachable over HTTPS at the server's address, and you log in with the `admin` password from that block:

```text
https://<server-address>
```

If you ever lose those passwords, Wazuh ships a password-change tool that regenerates them and updates the config files, but it is far less painful to save them the first time.

## Enrol an agent

On each machine you want to monitor, install the agent and point it at the manager. Pass the manager's address in the environment so the agent registers against the right server:

```bash
curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.2.1-1_amd64.deb
sudo WAZUH_MANAGER='192.0.2.10' WAZUH_AGENT_GROUP='default' dpkg -i ./wazuh-agent.deb
```

Then enable and start it:

```bash
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent
```

The agent will appear in the dashboard within a minute or two.

## Lock down the ports

The dashboard and the manager's enrolment and reporting ports should not be open to the world. Restrict them to the addresses you actually manage from. With firewalld:

```bash
firewall-cmd --zone=internal --add-source=192.0.2.0/24 --permanent
firewall-cmd --reload
```

Or, if the host runs ufw, allow SSH only from your admin network:

```bash
ufw allow from 192.0.2.0/24 to any port 22
```

## Today

Wazuh 4.2 and its Open Distro base are well out of date. From 4.3 onwards Wazuh dropped Open Distro for its own Wazuh indexer and dashboard (both OpenSearch-derived), and the installer was replaced by `wazuh-install.sh`, which takes a `-a` flag for the same all-in-one deployment. The ideas here, one script to stand it up, a one-time password block to capture, agents enrolled with `WAZUH_MANAGER`, carry straight over; only the package base and the script name have changed.