69 lines
2.1 KiB
Markdown
69 lines
2.1 KiB
Markdown
# Wazuh Server Configuration
|
|
|
|
## Network Configuration
|
|
- Set hostname: `sudo hostnamectl hostname wazuh-charlotte`
|
|
- Configure static IP with netplan by editing `/etc/netplan/00-installer-config.yaml`:
|
|
```yaml
|
|
network:
|
|
ethernets:
|
|
ens160:
|
|
addresses:
|
|
- 172.16.200.10/28
|
|
nameservers:
|
|
addresses: [172.16.200.2]
|
|
routes:
|
|
- to: default
|
|
via: 172.16.200.2
|
|
version: 2
|
|
```
|
|
- Apply netplan configuration:
|
|
```
|
|
sudo netplan apply
|
|
```
|
|
|
|
## Wazuh Installation
|
|
> **IMPORTANT**: Take a snapshot before installation
|
|
|
|
Run the single-node installation command:
|
|
```
|
|
curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh && sudo bash ./wazuh-install.sh -a -i
|
|
```
|
|
> Note: The `-i` flag ignores minimum requirements of 2 CPU and 4 GB RAM
|
|
|
|
**IMPORTANT**: Save the auto-generated password shown after installation, you will need it later.
|
|
|
|
## Accessing the Wazuh Dashboard
|
|
- Try accessing the dashboard at: http://172.16.200.10/app/login
|
|
- Login with the auto-generated credentials
|
|
|
|
## Wazuh Agent Management
|
|
1. Create a new agent group:
|
|
- Wazuh dropdown > Management > Groups > Create a new group called "linux"
|
|
|
|
2. Deploy a new agent:
|
|
- Wazuh dropdown > Agents > Deploy a new agent
|
|
- Configuration options:
|
|
- OS: Redhat/CentOS
|
|
- Version: CentOS 6 or higher (works on Rocky 8)
|
|
- Architecture: x86_64
|
|
- Server IP: 172.16.200.10
|
|
- Agent Group: Linux
|
|
|
|
3. The web interface will generate an installation command for your agents
|
|
|
|
## Firewall Requirements
|
|
Ensure these ports are open:
|
|
- **1514/TCP** for agent communication
|
|
- **1515/TCP** for enrollment via automatic agent request
|
|
- **55000/TCP** for enrollment via Wazuh server API
|
|
|
|
## Agent Directory Structure
|
|
Wazuh agent files are stored in `/var/ossec/`. Key directories include:
|
|
- `/var/ossec/etc/` - Configuration files
|
|
- `/var/ossec/etc/ossec.conf` - agent IP settings
|
|
- `/var/ossec/logs/` - Log files
|
|
- `/var/ossec/queue/` - Communication queue
|
|
- `/var/ossec/agentless/` - Agentless monitoring
|
|
|
|
## Viewing Security Events
|
|
Dropdown > Modules > Security Events
|