Installation Ubuntu 24.04 avec SSH accès root
apt update
apt upgrade
Réservation d'adresse sur DHCP 192.168.7.50 :
192.168.7.82
Root ozetjsCL01
ayrilys ozetjsCL01
Proc 20 CU
RAM 16 Go
Disque : 500 Go
Installation Wazuh procédure détaillée ou step by step version 4.12.0-1
Préconfiguration : installation Wazuh-Indexer step by step
https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/step-by-step.html
Création des certificats
curl -sO https://packages.wazuh.com/4.12/wazuh-certs-tool.sh
curl -sO https://packages.wazuh.com/4.12/config.yml
Modification de config.yml avec Indexer IP 192.168.7.82 noeud : viroflaywazuh1 et manager : 192.168.7.82
Lancement du script
bash ./wazuh-certs-tool.sh -A
Compression des fichiers
tar -cvf ./wazuh-certificates.tar -C ./wazuh-certificates/ .
rm -rf ./wazuh-certificates
Installation d'un package si manquant
apt-get install debconf adduser procps
Installation des repositionary
apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
apt-get update
Installation Indexer
apt-get -y install wazuh-indexer
Configuration de l'Indexer
nano /etc/wazuh-indexer/opensearch.yml
Déploiement des certificats :
NODE_NAME=indexer
mkdir /etc/wazuh-indexer/certs
tar -xf ./wazuh-certificates.tar -C /etc/wazuh-indexer/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./admin.pem ./admin-key.pem ./root-ca.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
mv -n /etc/wazuh-indexer/certs/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
chmod 500 /etc/wazuh-indexer/certs
chmod 400 /etc/wazuh-indexer/certs/*
chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
Démarrage des services
systemctl daemon-reload
systemctl enable wazuh-indexer
systemctl start wazuh-indexer
Initialisation
/usr/share/wazuh-indexer/bin/indexer-security-init.sh
Test
curl -k -u admin:admin https://192.168.7.82:9200
curl -k -u admin:admin https://192.168.7.82:9200/_cat/nodes?v
Installation et configuration du serveur
https://documentation.wazuh.com/current/installation-guide/wazuh-server/step-by-step.html
Installation dans le dossier de travail /root user : root
Installation des dépendances :
sudo apt install vim curl apt-transport-https unzip wget libcap2-bin software-properties-common lsb-release gnupg2 -y
Ajout du dépôt Wazuh :
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --dearmor | sudo tee /usr/share/keyrings/wazuh.gpg > /dev/nullecho "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update
Installation Wazuh Manager
apt-get -y install wazuh-manager
Installation Filebeat
apt-get -y install filebeat
Configuration Filebeat
Fichier de préconfiguration
curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/4.12/tpl/wazuh/filebeat/filebeat.yml
Modification de /etc/filebeat/filebeat.yml avec Hosts 192.168.7.82
Création de Filebeat Keystore
filebeat keystore create
Ajout du compte admin par défaut
echo admin | filebeat keystore add username --stdin --force
echo admin | filebeat keystore add password --stdin —force
Ajout des modèles d'alerte dans Wazuh Indexer :
curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v4.12.0/extensions/elasticsearch/7.x/wazuh-template.json
chmod go+r /etc/filebeat/wazuh-template.json
Installation des modules Wazuh dans Filebeat:
curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
Déploiement des certificats avec le nom de serveur : wazuh.ayrilys.fr
Ajout de l'enregistrement A wazuh.ayrilys.fr A 192.168.7.82
Nom du noeud 1 : viroflaywazuh1
Télécharger wget https://example.com/path/to/wazuh-certificates.tar dans le répertoire de travail /root
NODE_NAME=viroflaywazuh1
mkdir /etc/filebeat/certs
tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
chmod 500 /etc/filebeat/certs
chmod 400 /etc/filebeat/certs/*
chown -R root:root /etc/filebeat/certs
Configuration des user mots de passe admin
admin
YMtDguaJu3n5u6.eCXbnA2HTz*QUHAxM
echo 'admin' | /var/ossec/bin/wazuh-keystore -f indexer -k username
echo 'YMtDguaJu3n5u6.eCXbnA2HTz*QUHAxM' | /var/ossec/bin/wazuh-keystore -f indexer -k password
Modification /var/ossec/etc/ossec.conf
nano /var/ossec/etc/ossec.conf
Modifier l'IP dans Inexer/Host
Démarrage des service Wazuh Manager
systemctl daemon-reload
systemctl enable wazuh-manager
systemctl start wazuh-manager
systemctl status wazuh-manager
Démarrage des services Filebeat
systemctl daemon-reload
systemctl enable filebeat
systemctl start filebeat
Test Filebeat
filebeat test output
Installation du tableau de bord
apt-get install debhelper tar curl libcap2-bin #debhelper version 9 or later
Ajout Wazuh repository
apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
apt update
Installation du Dashboard
apt-get -y install wazuh-dashboard
Configuration du Dashboard
nano /etc/wazuh-dashboard/opensearch_dashboards.yml
Déploiement des certificats
NODE_NAME=dashboard
mkdir /etc/wazuh-dashboard/certs
tar -xf ./wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
mv -n /etc/wazuh-dashboard/certs/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
mv -n /etc/wazuh-dashboard/certs/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
chmod 500 /etc/wazuh-dashboard/certs
chmod 400 /etc/wazuh-dashboard/certs/*
chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
Démarrage des services du Dashboard
systemctl daemon-reload
systemctl enable wazuh-dashboard
systemctl start wazuh-dashboard
Edite config
nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
Désactivation des mises à jour
sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
apt update
Changement des identifiants par défaut
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh --api --change-all --admin-user wazuh --admin-password wazuh