Coder Social home page Coder Social logo

Comments (1)

davidcr01 avatar davidcr01 commented on June 3, 2024

Update Report

I could not reproduce the problem. I followed the steps given in the documentation: https://documentation-dev.wazuh.com/v4.8.0-rc1/deployment-options/offline-installation.html

Installation log 
[root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-install.sh && bash ./wazuh-install.sh -dw rpm
07/05/2024 14:56:15 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0
07/05/2024 14:56:15 INFO: Verbose logging redirected to /var/log/wazuh-install.log
07/05/2024 14:56:17 INFO: Verifying that your system meets the recommended minimum hardware requirements.
07/05/2024 14:56:23 INFO: --- Download Packages ---
07/05/2024 14:56:23 INFO: Starting Wazuh packages download.
07/05/2024 14:56:23 INFO: Downloading Wazuh rpm packages for x86_64.
07/05/2024 14:56:28 INFO: The manager package was downloaded.
07/05/2024 14:56:29 INFO: The filebeat package was downloaded.
07/05/2024 14:56:39 INFO: The indexer package was downloaded.
07/05/2024 14:56:43 INFO: The dashboard package was downloaded.
07/05/2024 14:56:43 INFO: The packages are in wazuh-offline/wazuh-packages
07/05/2024 14:56:43 INFO: Downloading configuration files and assets.
07/05/2024 14:56:43 INFO: The resource https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH was downloaded.
07/05/2024 14:56:43 INFO: The resource https://packages-dev.wazuh.com/4.8/tpl/wazuh/filebeat/filebeat.yml was downloaded.
07/05/2024 14:56:44 INFO: The resource https://raw.githubusercontent.com/wazuh/wazuh/4.8.0/extensions/elasticsearch/7.x/wazuh-template.json was downloaded.
07/05/2024 14:56:44 INFO: The resource https://packages-dev.wazuh.com/pre-release/filebeat/wazuh-filebeat-0.4.tar.gz was downloaded.
07/05/2024 14:56:44 INFO: The configuration files and assets are in wazuh-offline.tar.gz
07/05/2024 14:57:58 INFO: You can follow the installation guide here https://documentation.wazuh.com/current/deployment-options/offline-installation.html
[root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/config.yml
[root@ip-172-31-34-52 ec2-user]# sed -i -e '0,/<indexer-node-ip>/ s/<indexer-node-ip>/127.0.0.1/' config.yml
[root@ip-172-31-34-52 ec2-user]# sed -i -e '0,/<wazuh-manager-ip>/ s/<wazuh-manager-ip>/127.0.0.1/' config.yml
[root@ip-172-31-34-52 ec2-user]# sed -i -e '0,/<dashboard-node-ip>/ s/<dashboard-node-ip>/127.0.0.1/' config.yml
[root@ip-172-31-34-52 ec2-user]# cat config.yml 
nodes:
  # Wazuh indexer nodes
  indexer:
    - name: node-1
      ip: "127.0.0.1"
    #- name: node-2
    #  ip: "<indexer-node-ip>"
    #- name: node-3
    #  ip: "<indexer-node-ip>"

  # Wazuh server nodes
  # If there is more than one Wazuh server
  # node, each one must have a node_type
  server:
    - name: wazuh-1
      ip: "127.0.0.1"
    #  node_type: master
    #- name: wazuh-2
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker
    #- name: wazuh-3
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker

  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: "127.0.0.1"[root@ip-172-31-34-52 ec2-user]# curl -sO https://packages-dev.wazuh.com/4.8/wazuh-certs-tool.sh
[root@ip-172-31-34-52 ec2-user]# chmod 744 wazuh-certs-tool.sh
[root@ip-172-31-34-52 ec2-user]# ./wazuh-certs-tool.sh --all
07/05/2024 14:59:01 INFO: Generating the root certificate.
07/05/2024 14:59:01 INFO: Generating Admin certificates.
07/05/2024 14:59:01 INFO: Admin certificates created.
07/05/2024 14:59:01 INFO: Generating Wazuh indexer certificates.
07/05/2024 14:59:01 INFO: Wazuh indexer certificates created.
07/05/2024 14:59:01 INFO: Generating Filebeat certificates.
07/05/2024 14:59:01 INFO: Wazuh Filebeat certificates created.
07/05/2024 14:59:01 INFO: Generating Wazuh dashboard certificates.
07/05/2024 14:59:01 INFO: Wazuh dashboard certificates created.
[root@ip-172-31-34-52 ec2-user]# tar xf wazuh-offline.tar.gz
[root@ip-172-31-34-52 ec2-user]# ls -l wazuh-offline/wazuh-packages/
total 1363696
-rw------- 1 root root  21808122 May  7 14:56 filebeat-oss-7.10.2-x86_64.rpm
-rw------- 1 root root 286053840 May  7 14:56 wazuh-dashboard-4.8.0-1.x86_64.rpm
-rw------- 1 root root 778825404 May  7 14:56 wazuh-indexer-4.8.0-1.x86_64.rpm
-rw------- 1 root root 309730892 May  7 14:56 wazuh-manager-4.8.0-1.x86_64.rpm
[root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
[root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-indexer*.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:wazuh-indexer-4.8.0-1            ################################# [100%]
Created opensearch keystore in /etc/wazuh-indexer/opensearch.keystore
[root@ip-172-31-34-52 ec2-user]# NODE_NAME=node-1
[root@ip-172-31-34-52 ec2-user]# mkdir /etc/wazuh-indexer/certs
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-indexer/certs/indexer.pem
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-indexer/certs/indexer-key.pem
[root@ip-172-31-34-52 ec2-user]# mv wazuh-certificates/admin-key.pem /etc/wazuh-indexer/certs/
[root@ip-172-31-34-52 ec2-user]# mv wazuh-certificates/admin.pem /etc/wazuh-indexer/certs/
[root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/wazuh-indexer/certs/
[root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/wazuh-indexer/certs
[root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/wazuh-indexer/certs/*
[root@ip-172-31-34-52 ec2-user]# chown -R wazuh-indexer:wazuh-indexer /etc/wazuh-indexer/certs
[root@ip-172-31-34-52 ec2-user]# nano /etc/wazuh-indexer/opensearch.yml 
[root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload
[root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-indexer
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-indexer.service to /usr/lib/systemd/system/wazuh-indexer.service.
[root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-indexer
[root@ip-172-31-34-52 ec2-user]# /usr/share/wazuh-indexer/bin/indexer-security-init.sh
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 127.0.0.1:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.10.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: wazuh-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index does not exists, attempt to create it ... done (0-all replicas)
Populate config from /etc/wazuh-indexer/opensearch-security/
Will update '/config' with /etc/wazuh-indexer/opensearch-security/config.yml 
   SUCC: Configuration for 'config' created or updated
Will update '/roles' with /etc/wazuh-indexer/opensearch-security/roles.yml 
   SUCC: Configuration for 'roles' created or updated
Will update '/rolesmapping' with /etc/wazuh-indexer/opensearch-security/roles_mapping.yml 
   SUCC: Configuration for 'rolesmapping' created or updated
Will update '/internalusers' with /etc/wazuh-indexer/opensearch-security/internal_users.yml 
   SUCC: Configuration for 'internalusers' created or updated
Will update '/actiongroups' with /etc/wazuh-indexer/opensearch-security/action_groups.yml 
   SUCC: Configuration for 'actiongroups' created or updated
Will update '/tenants' with /etc/wazuh-indexer/opensearch-security/tenants.yml 
   SUCC: Configuration for 'tenants' created or updated
Will update '/nodesdn' with /etc/wazuh-indexer/opensearch-security/nodes_dn.yml 
   SUCC: Configuration for 'nodesdn' created or updated
Will update '/whitelist' with /etc/wazuh-indexer/opensearch-security/whitelist.yml 
   SUCC: Configuration for 'whitelist' created or updated
Will update '/audit' with /etc/wazuh-indexer/opensearch-security/audit.yml 
   SUCC: Configuration for 'audit' created or updated
Will update '/allowlist' with /etc/wazuh-indexer/opensearch-security/allowlist.yml 
   SUCC: Configuration for 'allowlist' created or updated
SUCC: Expected 10 config types for node {"updated_config_types":["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"],"updated_config_size":10,"message":null} is 10 (["allowlist","tenants","rolesmapping","nodesdn","audit","roles","whitelist","internalusers","actiongroups","config"]) due to: null
Done with success
[root@ip-172-31-34-52 ec2-user]# curl -XGET https://127.0.0.1:9200 -u admin:admin -k
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "_duT-TOWQMq4BjLtIYV6ZQ",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "eee49cb340edc6c4d489bcd9324dda571fc8dc03",
    "build_date" : "2023-09-20T23:54:29.889267151Z",
    "build_snapshot" : false,
    "lucene_version" : "9.7.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}
[root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
[root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-manager*.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:wazuh-manager-4.8.0-1            ################################# [100%]
[root@ip-172-31-34-52 ec2-user]# /var/ossec/bin/wazuh-keystore -f indexer -k username -v admin
[root@ip-172-31-34-52 ec2-user]# /var/ossec/bin/wazuh-keystore -f indexer -k password -v admin
[root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload
[root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-manager
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-manager.service to /usr/lib/systemd/system/wazuh-manager.service.
[root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-manager
[root@ip-172-31-34-52 ec2-user]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
   Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2024-05-07 15:04:21 UTC; 5s ago
  Process: 8460 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/wazuh-manager.service
           ├─8519 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─8560 /var/ossec/bin/wazuh-authd
           ├─8577 /var/ossec/bin/wazuh-db
           ├─8604 /var/ossec/bin/wazuh-execd
           ├─8606 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─8609 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─8612 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
           ├─8628 /var/ossec/bin/wazuh-analysisd
           ├─8640 /var/ossec/bin/wazuh-syscheckd
           ├─8688 /var/ossec/bin/wazuh-remoted
           ├─8725 /var/ossec/bin/wazuh-logcollector
           ├─8745 /var/ossec/bin/wazuh-monitord
           ├─8766 /var/ossec/bin/wazuh-modulesd
           ├─9077 sh -c  yum check-updates --security | grep "No packages"
           ├─9079 /usr/bin/python /usr/bin/yum check-updates --security
           └─9080 grep No packages

May 07 15:04:14 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-syscheckd...
May 07 15:04:15 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-remoted...
May 07 15:04:16 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-logcollector...
May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-monitord...
May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: 2024/05/07 15:04:18 wazuh-modulesd:router: INFO: Load...le.
May 07 15:04:18 ip-172-31-34-52.ec2.internal env[8460]: 2024/05/07 15:04:18 wazuh-modulesd:content_manager: I...le.
May 07 15:04:19 ip-172-31-34-52.ec2.internal env[8460]: Started wazuh-modulesd...
May 07 15:04:21 ip-172-31-34-52.ec2.internal env[8460]: Completed.
May 07 15:04:21 ip-172-31-34-52.ec2.internal systemd[1]: Started Wazuh manager.
May 07 15:04:21 ip-172-31-34-52.ec2.internal crontab[9025]: (root) LIST (root)
Hint: Some lines were ellipsized, use -l to show in full.
[root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/filebeat*.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:filebeat-7.10.2-1                ################################# [100%]
[root@ip-172-31-34-52 ec2-user]# cp ./wazuh-offline/wazuh-files/filebeat.yml /etc/filebeat/ &&\
> cp ./wazuh-offline/wazuh-files/wazuh-template.json /etc/filebeat/ &&\
> chmod go+r /etc/filebeat/wazuh-template.json
cp: overwrite ‘/etc/filebeat/filebeat.yml’? y
[root@ip-172-31-34-52 ec2-user]# nano /etc/filebeat/filebeat.yml
[root@ip-172-31-34-52 ec2-user]# filebeat keystore create
Created filebeat keystore
[root@ip-172-31-34-52 ec2-user]# echo admin | filebeat keystore add username --stdin --force
Successfully updated the keystore
[root@ip-172-31-34-52 ec2-user]# echo admin | filebeat keystore add password --stdin --force
Successfully updated the keystore
[root@ip-172-31-34-52 ec2-user]# tar -xzf ./wazuh-offline/wazuh-files/wazuh-filebeat-0.4.tar.gz -C /usr/share/filebeat/module
[root@ip-172-31-34-52 ec2-user]# ls wazuh-offline/wazuh-files/wazuh-
wazuh-filebeat-0.4.tar.gz  wazuh-template.json        
[root@ip-172-31-34-52 ec2-user]# NODE_NAME=wazuh-1
[root@ip-172-31-34-52 ec2-user]# mkdir /etc/filebeat/certs
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/filebeat/certs/filebeat.pem
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/filebeat/certs/filebeat-key.pem
[root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/filebeat/certs/
[root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/filebeat/certs
[root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/filebeat/certs/*
[root@ip-172-31-34-52 ec2-user]# chown -R root:root /etc/filebeat/certs
[root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload
[root@ip-172-31-34-52 ec2-user]# systemctl enable filebeat
Created symlink from /etc/systemd/system/multi-user.target.wants/filebeat.service to /usr/lib/systemd/system/filebeat.service.
[root@ip-172-31-34-52 ec2-user]# systemctl start filebeat
[root@ip-172-31-34-52 ec2-user]# filebeat test output
elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.10.2
[root@ip-172-31-34-52 ec2-user]# rpm --import ./wazuh-offline/wazuh-files/GPG-KEY-WAZUH
[root@ip-172-31-34-52 ec2-user]# rpm -ivh ./wazuh-offline/wazuh-packages/wazuh-dashboard*.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:wazuh-dashboard-4.8.0-1          ################################# [100%]
[root@ip-172-31-34-52 ec2-user]# NODE_NAME=dashboard
[root@ip-172-31-34-52 ec2-user]# mkdir /etc/wazuh-dashboard/certs
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME.pem /etc/wazuh-dashboard/certs/dashboard.pem
[root@ip-172-31-34-52 ec2-user]# mv -n wazuh-certificates/$NODE_NAME-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
[root@ip-172-31-34-52 ec2-user]# cp wazuh-certificates/root-ca.pem /etc/wazuh-dashboard/certs/
[root@ip-172-31-34-52 ec2-user]# chmod 500 /etc/wazuh-dashboard/certs
[root@ip-172-31-34-52 ec2-user]# chmod 400 /etc/wazuh-dashboard/certs/*
[root@ip-172-31-34-52 ec2-user]# chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
[root@ip-172-31-34-52 ec2-user]# nano /etc/wazuh-dashboard/opensearch_dashboards.yml
[root@ip-172-31-34-52 ec2-user]# systemctl daemon-reload
[root@ip-172-31-34-52 ec2-user]# systemctl enable wazuh-dashboard
Created symlink from /etc/systemd/system/multi-user.target.wants/wazuh-dashboard.service to /etc/systemd/system/wazuh-dashboard.service.
[root@ip-172-31-34-52 ec2-user]# systemctl start wazuh-dashboard
[root@ip-172-31-34-52 ec2-user]# nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
[root@ip-172-31-34-52 ec2-user]# nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
[root@ip-172-31-34-52 ec2-user]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
   Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2024-05-07 15:10:29 UTC; 41s ago
 Main PID: 6938 (node)
   CGroup: /system.slice/wazuh-dashboard.service
           └─6938 /usr/share/wazuh-dashboard/node/fallback/bin/node --no-warnings --max-http-header-size=65536 -...

May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:39 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-...pm
May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:40 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:41 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
May 07 15:10:42 ip-172-31-34-52.ec2.internal opensearch-dashboards[6938]: {"type":"log","@timestamp":"2024-05-..."}
Hint: Some lines were ellipsized, use -l to show in full.

Screenshot from 2024-05-07 17-12-29

image

I recommend to follow the steps given in the documentation and log into the Wazuh dashboard in a incognito window.

from wazuh-packages.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.