Raspberry Pi Clients

[kgoode517]

Wanted to share how to add beats, and wazuh agents 100% confirmed and currently running on several different versions of Rasbian both armhf and arm64. Wauzh needs a manually compiling of a deb package like so git clone https://github.com/wazuh/wazuh-packages && cd wazuh-packages/debs && git checkout legacy. Then ./generate_debian_package.sh -b v3.13.4 --packages-branch legacy -t agent -a arm64 -p /var/ossec then a simple of dpkg -i for the generated deb. switch arm64 for armhf for 32bit pis. All beats can be installed as arm64 debs directly from elastic for 32 bit Raspbian Filebeat and Metric beat can be installed from https://github.com/vrince/arm-beats. Pursuing osquery for arm64 with the osquery team but temporarly lost intrest will continue working with them and will report back. Would love if this can be added to the docs.

[jctello]

Hi @kgoode517, Wazuh provides pre-compiled installers for Raspbian OS for various architectures, for example to match the version included in Security Onion v2.3 which is Wazuh v3.13.1:

• AMD64
• arm64
• armhf

This is indirectly suggested here: https://docs.securityonion.net/en/2.3/wazuh.html#adding-agents

I agree that it would be nice to include this directly in the console's download page.

[kgoode517]

@jctello can you confirm these precompiled debs worked for you? Every time I've had to compile from source to get it to be able to communicate with the manager.

[jctello]

Hi @kgoode517 yes,
At Wazuh they have a set of automated tests for each release candidate that is packaged which include installation and communication verification (for example here for the upcoming 4.3.10 ).
Just to verify I ran the following command on a Raspberry Pi 4 running Debian 11 Bullseye on an aarch64 architecture:

curl -so wazuh-agent_3.13.1-1_arm64.deb https://packages.wazuh.com/3.x/apt/pool/main/w/wazuh-agent/wazuh-agent_3.13.1-1_arm64.deb && sudo WAZUH_MANAGER='192.168.68.153' dpkg -i ./wazuh-agent_3.13.1-1_arm64.deb && sudo systemctl daemon-reload && sudo systemctl enable wazuh-agent && sudo systemctl start wazuh-agent

The agent installed and registered without issue and started reporting after a minute.

It is crucial to run so-allow beforehand on the Security Onion machine to allow the Wazuh agent and Wazuh registration service for an IP range containing the machine to be monitored (I directly used the 0.0.0.0/0 range for this test).

[kgoode517]

Awesome, thank you for confirming. I'll definitely do it this way instead next time I need to add an agent.