Wondering how to Install Wazuh Server on CentOS 7? We will help you with it.
Wazuh is a free, open-source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance.
Here at Bobcares, we handle requests from our customers to Install Wazuh Server on CentOS 7 as a part of Server Management Services.
Today, let us see how our Support techs resolve this issue for our customers.
Install Wazuh Server on CentOS 7
In this article, let us see Distributed architecture installation.
Wazuh manager and Elastic Stack are managed on the same platform by single-host implementations.
* Wazuh server: Runs the API and Wazuh Manager. The data from deployed agents are collected and analyzed.
* Elastic Stack: Runs Elasticsearch, Filebeat and Kibana (including Wazuh). It reads, parses, indexes and stores Wazuh manager alert data.
* Wazuh agent: Runs on the host monitored, collecting log and configuration data, and detecting intrusions and anomalies.
Today, let us see how our support Techs install Wazuh.
1. Installing Wazuh Server
Let us set the hostname first. Launch Terminal and enter the following command:
# hostnamectl set-hostname wazuh-server
Copy Code
Firstly, update CentOS and packages:
# yum update -y
Copy Code
Next, install NTP and check its service status.
# yum install ntp
# systemctl status ntpd
Copy Code
If the service is not started, start it using below command:
# systemctl start ntpd
Copy Code
Then, enable NTP on system boot:
# systemctl enable ntpd
Copy Code
Next, modify firewall rules to allow NTP service. Run the following commands to enable service.
# firewall-cmd –add-service=ntp –zone=public –permanent
# firewall-cmd –reload
Copy Code
Installing Wazuh Manager
Let us add key:
# rpm –import https://packages.wazuh.com/key/GPG-KEY-WAZUH
Copy Code
Edit the Wazuh repository:
# vim /etc/yum.repos.d/wazuh.repo
Copy Code
Add the following content to the file.
[wazuh_repo]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/3.x/yum/
protect=1
Copy Code
Save and exit the file.
List the repositories using the repolist command.
# yum repolist
Copy Code
Firstly, install the Wazuh manager using the below command:
# yum install wazuh-manager -y
Copy Code
Then, install Wazuh Manager and check the status of it.
# systemctl status wazuh-manager
Copy Code
Installing the Wazuh API
NodeJS >= 4.6.1 is required to run the Wazuh API.
Copy Code
Then, add the official NodeJS repository:
# curl –silent –location https://rpm.nodesource.com/setup_8.x | bash –
install NodeJS:
# yum install nodejs -y
Copy Code
Install the Wazuh API. It will update NodeJS if it is required:
# yum install wazuh-api
Copy Code
Then, check the status of wazuh-api.
# systemctl status wazuh-api
Copy Code
Change the default credentials manually using the following commands:
# cd /var/ossec/api/configuration/auth
Copy Code
Set a password for the user.
# node htpasswd -Bc -C 10 user bob
Copy Code
Restart API.
# systemctl restart wazuh-api
Copy Code
If we need it, we can change the port manually. The file /var/ossec/api/configuration/config.js contains the parameter:
// TCP Port used by the API.
config.port = “55000”;
Copy Code
We are not changing the default port.
Installing Filebeat
Filebeat is the tool on the Wazuh server that securely forwards alerts and archived events to Elasticsearch. To install it, run the following command:
# rpm –import https://packages.elastic.co/GPG-KEY-elasticsearch
Copy Code
Setup repository:
# vim /etc/yum.repos.d/elastic.repo
Copy Code
Add the following contents to the server:
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
Copy Code
Install Filebeat:
# yum install filebeat-7.5.1
Copy Code
Download the Filebeat configuration file from the Wazuh repository. This is pre-configured to forward Wazuh alerts to Elasticsearch:
# curl -so /etc/filebeat/filebeat.yml https://raw.githubusercontent.com/wazuh/wazuh/v3.11.0/extensions/filebeat/7.x/filebeat.yml
Copy Code
Change file Permissions:
# chmod go+r /etc/filebeat/filebeat.yml
Copy Code
Download the alerts template for Elasticsearch:
# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v3.11.0/extensions/elasticsearch/7.x/wazuh-template.json
# chmod go+r /etc/filebeat/wazuh-template.json
Copy Code
Download the Wazuh module for Filebeat:
# curl -s https://packages.wazuh.com/3.x/filebeat/wazuh-filebeat-0.1.tar.gz | sudo tar -xvz -C /usr/share/filebeat/module
Copy Code
Add Elasticsearch server IP. Edit “filebeat.yml.”
# vim /etc/filebeat/filebeat.yml
Copy Code
Then, modify the following line.
output.elasticsearch.hosts: [‘http://ELASTIC_SERVER_IP:9200′]
Copy Code
Next, enable and start the Filebeat service:
# systemctl daemon-reload
# systemctl enable filebeat.service
# systemctl start filebeat.service
Copy Code
2. Installing Elastic Stack
We can configure second CentOS server with ELK.
Do the configurations on elastic stack server.
Firstly, let us set hostname.
# hostnamectl set-hostname elk
Copy Code
Then, update the system:
# yum update -y
Copy Code
Installing ELK
Install Elastic Stack with RPM packages and then add the Elastic repository and its GPG key:
# rpm –import https://packages.elastic.co/GPG-KEY-elasticsearch
Copy Code
Later, create a repository file:
# vim /etc/yum.repos.d/elastic.repo
Copy Code
Then, add the following content to the file:
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
Copy Code
Installing Elasticsearch
Firstly, Install the Elasticsearch package:
# yum install elasticsearch-7.5.1
Copy Code
Elasticsearch listens by default on the loopback interface (localhost). Configure Elasticsearch to listen to a non-loopback address by editing /etc/elasticsearch/elasticsearch.yml and uncommenting network.host configuration. Adjust the IP value we want to connect to:
network.host: 0.0.0.0
Change firewall rules.
# firewall-cmd –permanent –zone=public –add-rich-rule=’
rule family=”ipv4″
source address=”34.232.210.23/32″
port protocol=”tcp” port=”9200″ accept’
Copy Code
Next, reload firewall rules:
# firewall-cmd –reload
Copy Code
The further configuration will be necessary for the elastic search configuration file.
Edit the “elasticsearch.yml” file.
# vim /etc/elasticsearch/elasticsearch.yml
Copy Code
Change or edit “node.name” and “cluster.initial_master_nodes”.
node.name: <node_name>
cluster.initial_master_nodes: [“<node_name>”]
Copy Code
Enable and start the Elasticsearch service:
# systemctl daemon-reload
Copy Code
Firstly, enable on system boot.
# systemctl enable elasticsearch.service
Copy Code
Then, start elastic search service.
# systemctl start elasticsearch.service
Check the status of the elastic search.
Copy Code
systemctl status elasticsearch.service
Next, check the log file for any issues.
# tail -f /var/log/elasticsearch/elasticsearch.log
Copy Code
Once Elasticsearch is up and running, we need to load the Filebeat template. Run the following command on the Wazuh server:
filebeat setup –index-management -E setup.template.json.enabled=false
Copy Code
Installing Kibana
Firstly, Install the Kibana package:
# yum install kibana-7.5.1
Copy Code
Install the Wazuh app plugin for Kibana:
# sudo -u kibana /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.11.0_7.5.1.zip
Copy Code
Kibana Plugin is needed to modify Kibana configurations to access Kibana from the outside.
Edit the Kibana configuration file.
#vim /etc/kibana/kibana.yml
Copy Code
Change the following line.
server.host: “0.0.0.0”
Configure the URLs of the Elasticsearch instances.
elasticsearch.hosts: [“http://localhost:9200”]
Copy Code
Then, enable and start the Kibana service:
# systemctl daemon-reload
# systemctl enable kibana.service
# systemctl start kibana.service
Copy Code
Adding Wazuh API to Kibana Configurations
Edit “wazuh.yml.”
# vim /usr/share/kibana/plugins/wazuh/wazuh.yml
Copy Code
Then, edit hostname, username and password.
Finally, save and exit the file and restart the Kibana service.
# systemctl restart kibana.service
Copy Code
We installed the Wazuh server and the ELK server. Now we are going to add hosts using an agent.
3. Installing Wazuh agent
I. Adding Ubuntu Server
a. Firstly, nstalling needed packages
# apt-get install curl apt-transport-https lsb-release gnupg2
Copy Code
Install the Wazuh repository GPG key:
# curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add –
Copy Code
Add the repository and then update repositories.
# echo “deb https://packages.wazuh.com/3.x/apt/ stable main” | tee /etc/apt/sources.list.d/wazuh.list
# apt-get update
Copy Code
b. Then, installing the Wazuh agent
Below command adds “WAZUH_MANAGER” IP to wazuh-agent configuration automatically when installing it.
WAZUH_MANAGER=”52.91.79.65″ apt-get install wazuh-agent
Copy Code
II. Adding CentOS host
Add the Wazuh repository.
# rpm –import http://packages.wazuh.com/key/GPG-KEY-WAZUH
Copy Code
Next, edit and add to the repository:
vim /etc/yum.repos.d/wazuh.rep
Copy Code
Then, add the following contents:
[wazuh_repo]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=Wazuh repository
baseurl=https://packages.wazuh.com/3.x/yum/
protect=1
Copy Code
Then, install the agent.
WAZUH_MANAGER=”52.91.79.65″ yum install wazuh-agent
Copy Code
4. Accessing Wazuh Dashboard
Firstly, browse Kibana using the IP.
http://IP or hostname:5601/
Copy Code
Then, you will see the interface.
Then, click on “Wazuh” Icon to go to its Dashboard. We will see “Wazuh” Dashboard.
Finally, here we can see connected agents, security information management, etc. When we click on security events; we can see a graphical view of events.
Common error: Install Wazuh Server on CentOS 7
While compiling Wazuh server, it results in the error given below:
CC libwazuhext.so cc: error: external/libffi/server/.libs/libffi.a: No such file or directory make: *** [libwazuhext.so] Error 1
Cause for Error while Installing Wazuh Server on CentOS 7
The installer is compiling the libffi library, but the Wazuh’s Makefile is defining a parameter that conflicts with the libffi’s Makefile.
Solution
Replace this line:
LIBFFI_LIB = $(EXTERNAL_LIBFFI)server/.libs/libffi.a
Copy Code
With:
LIBFFI_LIB = $(EXTERNAL_LIBFFI)$(TARGET)/.libs/libffi.a
Copy Code
This script should fix the issue and recompile:
cd src
sed -i ‘s,LIBFFI_LIB = $(EXTERNAL_LIBFFI)server/.libs/libffi.a,LIBFFI_LIB = $(EXTERNAL_LIBFFI)$(TARGET)/.libs/libffi.a,’ Makefile
make clean
cd ..
sudo ./install.sh
Copy Code
[ Need any further assistance in analyzing logs with Nagios Log Server? – We’re available 24*7]
Conclusion
In short, Wazuh is a free, open-source and enterprise-ready security monitoring solution for threat detection, integrity monitoring, incident response and compliance. Today, we saw how our Support Engineers install it.
0 Comments