Skip to content

Commit 5bb74e2

Browse files
javimedjavimed
committed
{WiP} Update the installation guide
1 parent 3037f98 commit 5bb74e2

File tree

6 files changed

+105
-114
lines changed

6 files changed

+105
-114
lines changed

‎source/_templates/installations/filebeat/opensearch/configure_filebeat.rst‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,17 @@
11
.. Copyright (C) 2015, Wazuh, Inc.
22
3-
#. ``hosts``: The list of Wazuh indexer nodes to connect to. You can use either IP addresses or hostnames. By default, the host is set to localhost ``hosts: ["127.0.0.1:9200"]``. Replace it with your Wazuh indexer address accordingly.
4-
5-
If you have more than one Wazuh indexer node, you can separate the addresses using commas. For example, ``hosts: ["10.0.0.1:9200", "10.0.0.2:9200", "10.0.0.3:9200"]``
3+
#. ``hosts``: The list of Wazuh indexer nodes to connect to. You can use either IP addresses or hostnames. By default, the host is set to localhost ``hosts: ["127.0.0.1:9200"]``. Replace your Wazuh indexer IP address accordingly.
64

7-
.. code-block:: yaml
5+
If you have more than one Wazuh indexer node, you can separate the addresses using commas. For example, ``hosts: ["10.0.0.1:9200", "10.0.0.2:9200", "10.0.0.3:9200"]``
6+
7+
.. code-block:: yaml
88
:emphasize-lines: 3
99
10-
# Wazuh - Filebeat configuration file
11-
output.elasticsearch:
12-
hosts: ["10.0.0.1:9200"]
13-
protocol: https
14-
username: ${username}
15-
password: ${password}
16-
10+
# Wazuh - Filebeat configuration file
11+
output.elasticsearch:
12+
hosts: ["10.0.0.1:9200"]
13+
protocol: https
14+
username: ${username}
15+
password: ${password}
1716
1817
.. End of include file

‎source/_templates/installations/filebeat/opensearch/copy_certificates_filebeat_wazuh_cluster.rst‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,16 @@
22
33
.. code-block:: console
44
5-
# NODE_NAME=<SERVER_NODE_NAME>
5+
# NODE_NAME=<SERVER_NODE_NAME>
66
77
.. code-block:: console
8-
9-
# mkdir /etc/filebeat/certs
10-
# tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
11-
# mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
12-
# mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
13-
# chmod 500 /etc/filebeat/certs
14-
# chmod 400 /etc/filebeat/certs/*
15-
# chown -R root:root /etc/filebeat/certs
16-
8+
9+
# mkdir /etc/filebeat/certs
10+
# tar -xf ./wazuh-certificates.tar -C /etc/filebeat/certs/ ./$NODE_NAME.pem ./$NODE_NAME-key.pem ./root-ca.pem
11+
# mv -n /etc/filebeat/certs/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
12+
# mv -n /etc/filebeat/certs/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
13+
# chmod 500 /etc/filebeat/certs
14+
# chmod 400 /etc/filebeat/certs/*
15+
# chown -R root:root /etc/filebeat/certs
16+
1717
.. End of copy_certificates_filebeat_wazuh_cluster.rst

‎source/_templates/installations/manager/configure_indexer_connection.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ By default, the indexer settings have one host configured. It's set to ``0.0.0.0
2323

2424
- Ensure the Filebeat certificate and key name match the certificate files in ``/etc/filebeat/certs``.
2525

26-
If you are running a cluster infrastructure, add a ``<host>`` entry for each one of your nodes. For example, in a two-node configuration:
26+
If you are running a Wazuh indexer cluster infrastructure, add a ``<host>`` entry for each one of your nodes. For example, in a two-node configuration:
2727

2828
.. code-block:: xml
2929
@@ -32,6 +32,6 @@ If you are running a cluster infrastructure, add a ``<host>`` entry for each one
3232
<host>https://10.0.0.2:9200</host>
3333
</hosts>
3434
35-
Vulnerability detection prioritizes reporting to the first node in the list. It switches to the next node in case it is not available.
35+
The Wazuh server prioritizes reporting to the first Wazuh indexer node in the list. It switches to the next node in case it is not available.
3636

3737
.. End of include file

‎source/_templates/installations/manager/configure_wazuh_worker_node.rst‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
.. Copyright (C) 2015, Wazuh, Inc.
22
3-
Configure the cluster node by editing the following settings in the ``/var/ossec/etc/ossec.conf`` file.
3+
Configure the cluster node by editing the following settings in the ``/var/ossec/etc/ossec.conf`` file and configure the necessary parameters:
44

55
.. code-block:: xml
66
7-
<cluster>
8-
<name>wazuh</name>
9-
<node_name>worker-node</node_name>
10-
<node_type>worker</node_type>
11-
<key>c98b62a9b6169ac5f67dae55ae4a9088</key>
12-
<port>1516</port>
13-
<bind_addr>0.0.0.0</bind_addr>
14-
<nodes>
15-
<node><WAZUH_MASTER_ADDRESS></node>
16-
</nodes>
17-
<hidden>no</hidden>
18-
<disabled>no</disabled>
19-
</cluster>
7+
<cluster>
8+
<name>wazuh</name>
9+
<node_name>worker-node</node_name>
10+
<node_type>worker</node_type>
11+
<key>c98b62a9b6169ac5f67dae55ae4a9088</key>
12+
<port>1516</port>
13+
<bind_addr>0.0.0.0</bind_addr>
14+
<nodes>
15+
<node><WAZUH_MASTER_ADDRESS></node>
16+
</nodes>
17+
<hidden>no</hidden>
18+
<disabled>no</disabled>
19+
</cluster>
2020
2121
Parameters to be configured:
2222

‎source/_templates/installations/manager/restart_wazuh_manager.rst‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,17 @@
22
33
.. tabs::
44

5+
.. group-tab:: Systemd
56

6-
.. group-tab:: Systemd
7+
.. code-block:: console
78
9+
# systemctl restart wazuh-manager
810
9-
.. code-block:: console
11+
.. group-tab:: SysV init
1012

11-
# systemctl restart wazuh-manager
13+
.. code-block:: console
1214
13-
14-
.. group-tab:: SysV init
15-
16-
.. code-block:: console
17-
18-
# service wazuh-manager restart
15+
# service wazuh-manager restart
1916
2017
.. End of include file
2118

‎source/installation-guide/wazuh-server/step-by-step.rst‎

Lines changed: 63 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,15 @@ Install and configure the Wazuh server as a single-node or multi-node cluster fo
1010

1111
The installation process is divided into two stages.
1212

13-
#. Wazuh server node installation
14-
15-
#. Cluster configuration for multi-node deployment
13+
#. `Wazuh server node installation`_
14+
#. `Cluster configuration for multi-node deployment`_
1615

1716
.. note:: You need root user privileges to run all the commands described below.
1817

19-
1. Wazuh server node installation
20-
----------------------------------
21-
.. raw:: html
18+
Wazuh server node installation
19+
------------------------------
2220

23-
<div class="accordion-section open">
21+
Follow these steps to install a single-node or multi-node cluster Wazuh server.
2422

2523
Adding the Wazuh repository
2624
^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -102,52 +100,53 @@ Installing Filebeat
102100
Configuring Filebeat
103101
^^^^^^^^^^^^^^^^^^^^
104102

105-
#. Download the preconfigured Filebeat configuration file.
103+
#. Download the preconfigured Filebeat configuration file.
106104

107-
.. code-block:: console
105+
.. code-block:: console
108106
109-
# curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/tpl/wazuh/filebeat/filebeat.yml
107+
# curl -so /etc/filebeat/filebeat.yml https://packages.wazuh.com/|WAZUH_CURRENT_MINOR|/tpl/wazuh/filebeat/filebeat.yml
110108
111109
112-
#. Edit the ``/etc/filebeat/filebeat.yml`` configuration file and replace the following value:
110+
#. Edit the ``/etc/filebeat/filebeat.yml`` configuration file and replace the following value:
113111

114-
.. include:: /_templates/installations/filebeat/opensearch/configure_filebeat.rst
112+
.. include:: /_templates/installations/filebeat/opensearch/configure_filebeat.rst
115113

116-
#. Create a Filebeat keystore to securely store authentication credentials.
114+
#. Create a Filebeat keystore to securely store authentication credentials.
117115

118-
.. code-block:: console
116+
.. code-block:: console
119117
120-
# filebeat keystore create
118+
# filebeat keystore create
121119
122-
#. Add the default username and password ``admin``:``admin`` to the secrets keystore.
120+
#. Add the default username and password ``admin``:``admin`` to the secrets keystore.
123121

124-
.. code-block:: console
122+
.. code-block:: console
125123
126-
# echo admin | filebeat keystore add username --stdin --force
127-
# echo admin | filebeat keystore add password --stdin --force
124+
# echo admin | filebeat keystore add username --stdin --force
125+
# echo admin | filebeat keystore add password --stdin --force
128126
129-
#. Download the alerts template for the Wazuh indexer.
127+
#. Download the alerts template for the Wazuh indexer.
130128

131-
.. code-block:: console
129+
.. code-block:: console
132130
133-
# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v|WAZUH_CURRENT|/extensions/elasticsearch/7.x/wazuh-template.json
134-
# chmod go+r /etc/filebeat/wazuh-template.json
131+
# curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/v|WAZUH_CURRENT|/extensions/elasticsearch/7.x/wazuh-template.json
132+
# chmod go+r /etc/filebeat/wazuh-template.json
135133
136-
#. Install the Wazuh module for Filebeat.
134+
#. Install the Wazuh module for Filebeat.
137135

138-
.. code-block:: console
136+
.. code-block:: console
139137
140-
# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
138+
# curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.4.tar.gz | tar -xvz -C /usr/share/filebeat/module
141139
142140
Deploying certificates
143141
^^^^^^^^^^^^^^^^^^^^^^
144142

145-
.. note::
146-
Make sure that a copy of the ``wazuh-certificates.tar`` file, created during the initial configuration step, is placed in your working directory.
143+
.. note::
144+
145+
Make sure that a copy of the ``wazuh-certificates.tar`` file, created during the initial configuration step, is placed in your working directory.
147146

148-
#. Replace ``<SERVER_NODE_NAME>`` with your Wazuh server node certificate name, the same one used in ``config.yml`` when creating the certificates. Then, move the certificates to their corresponding location.
147+
#. Replace ``<SERVER_NODE_NAME>`` with your Wazuh server node certificate name, the same one used in ``config.yml`` when creating the certificates. Then, move the certificates to their corresponding location.
149148

150-
.. include:: /_templates/installations/filebeat/opensearch/copy_certificates_filebeat_wazuh_cluster.rst
149+
.. include:: /_templates/installations/filebeat/opensearch/copy_certificates_filebeat_wazuh_cluster.rst
151150

152151
Configuring the Wazuh indexer connection
153152
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
@@ -156,7 +155,7 @@ Configuring the Wazuh indexer connection
156155

157156
You can skip this step if you are not going to use the vulnerability detection capability.
158157

159-
#. Save the Wazuh indexer username and password into the Wazuh manager keystore using the wazuh-keystore tool:
158+
#. Save the Wazuh indexer username and password into the Wazuh manager keystore using the wazuh-keystore tool. Replace ``<WAZUH_INDEXER_USERNAME>`` and ``<WAZUH_INDEXER_PASSWORD>`` with the Wazuh indexer username and password:
160159

161160
.. code-block:: console
162161
@@ -185,36 +184,35 @@ Starting the Wazuh manager
185184
Starting the Filebeat service
186185
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
187186

188-
#. Enable and start the Filebeat service.
189-
190-
.. include:: /_templates/installations/filebeat/common/enable_filebeat.rst
187+
#. Enable and start the Filebeat service.
191188

192-
#. Run the following command to verify that Filebeat is successfully installed.
189+
.. include:: /_templates/installations/filebeat/common/enable_filebeat.rst
193190

194-
.. code-block:: console
191+
#. Run the following command to verify that Filebeat is successfully installed.
195192

196-
# filebeat test output
193+
.. code-block:: console
197194
198-
Expand the output to see an example response.
195+
# filebeat test output
199196
200-
.. code-block:: none
201-
:class: output accordion-output
197+
Expand the output to see an example response.
202198

203-
elasticsearch: https://127.0.0.1:9200...
204-
parse url... OK
205-
connection...
206-
parse host... OK
207-
dns lookup... OK
208-
addresses: 127.0.0.1
209-
dial up... OK
210-
TLS...
211-
security: server's certificate chain verification is enabled
212-
handshake... OK
213-
TLS version: TLSv1.3
214-
dial up... OK
215-
talk to server... OK
216-
version: 7.10.2
199+
.. code-block:: none
200+
:class: output accordion-output
217201
202+
elasticsearch: https://127.0.0.1:9200...
203+
parse url... OK
204+
connection...
205+
parse host... OK
206+
dns lookup... OK
207+
addresses: 127.0.0.1
208+
dial up... OK
209+
TLS...
210+
security: server's certificate chain verification is enabled
211+
handshake... OK
212+
TLS version: TLSv1.3
213+
dial up... OK
214+
talk to server... OK
215+
version: 7.10.2
218216
219217
Your Wazuh server node is now successfully installed. Repeat this stage of the installation process for every Wazuh server node in your Wazuh cluster, then proceed with configuring the Wazuh cluster. If you want a Wazuh server single-node cluster, everything is set and you can proceed directly with :doc:`../wazuh-dashboard/step-by-step`.
220218

@@ -223,11 +221,8 @@ Disable Wazuh updates
223221

224222
.. include:: /_templates/installations/disable-wazuh-updates.rst
225223

226-
2. Cluster configuration for multi-node deployment
227-
--------------------------------------------------
228-
.. raw:: html
229-
230-
<div class="accordion-section">
224+
Cluster configuration for multi-node deployment
225+
-----------------------------------------------
231226

232227
After completing the installation of the Wazuh server on every node, you need to configure one server node only as the master and the rest as workers.
233228

@@ -236,33 +231,33 @@ After completing the installation of the Wazuh server on every node, you need to
236231
Configuring the Wazuh server master node
237232
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
238233

239-
#. Edit the following settings in the ``/var/ossec/etc/ossec.conf`` configuration file.
234+
#. Edit the following settings in the ``/var/ossec/etc/ossec.conf`` file and configure the necessary parameters:
240235

241-
.. include:: /_templates/installations/manager/configure_wazuh_master_node.rst
236+
.. include:: /_templates/installations/manager/configure_wazuh_master_node.rst
242237

243-
#. Restart the Wazuh manager.
238+
#. Restart the Wazuh manager.
244239

245-
.. include:: /_templates/installations/manager/restart_wazuh_manager.rst
240+
.. include:: /_templates/installations/manager/restart_wazuh_manager.rst
246241

247242
.. _wazuh_server_worker_nodes:
248243

249244
Configuring the Wazuh server worker nodes
250245
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
251246

252-
#. .. include:: /_templates/installations/manager/configure_wazuh_worker_node.rst
247+
#. .. include:: /_templates/installations/manager/configure_wazuh_worker_node.rst
253248

254-
#. Restart the Wazuh manager.
249+
#. Restart the Wazuh manager.
255250

256-
.. include:: /_templates/installations/manager/restart_wazuh_manager.rst
251+
.. include:: /_templates/installations/manager/restart_wazuh_manager.rst
257252

258253
Repeat these configuration steps for every Wazuh server worker node in your cluster.
259254

260255
Testing Wazuh server cluster
261256
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
262257

263-
To verify that the Wazuh cluster is enabled and all the nodes are connected, execute the following command:
258+
Run the following command to verify that the Wazuh cluster is enabled and all the nodes are connected:
264259

265-
.. code-block:: console
260+
.. code-block:: console
266261
267262
# /var/ossec/bin/cluster_control -l
268263

0 commit comments

Comments
 (0)