Deployment Overview of Wazuh on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

• Operating System: Ubuntu (APT package manager required).

• Privileges: Root or sudo access is required for package installation and service management.

• Network/Ports:

• 443 (External HTTPS access)

• 8080 (Internal Dashboard access)

• 9200 (Indexer API)

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain template based on the server ID.

File and Directory Structure¶

The following directories are used for application data, configurations, and certificates:

• /opt/wazuh: Main application directory containing installation scripts and configuration files.

• /root/nginx: Contains the Docker Compose configuration for the Nginx proxy.

• /data/nginx/user_conf.d: Stores Nginx virtual host configuration files.

• /data/nginx/nginx-certbot.env: Environment file for Certbot settings.

Application installation process¶

The application is installed using a combination of an official installation script and manual service orchestration:

1. System Preparation: The system packages are updated via apt.

2. Installation Script Acquisition: The official Wazuh installation script (wazuh-install.sh) is downloaded to /opt/wazuh.

3. Configuration Generation:

4. A custom config.yml file is placed in /opt/wazuh.

5. The command ./wazuh-install.sh --generate-config-files is executed to prepare the cluster environment.

6. Component Installation:

7. Wazuh Indexer: Installed via --wazuh-indexer node-1.

8. Cluster Initialization: The cluster is started using --start-cluster.

9. Wazuh Server: Installed via --wazuh-server wazuh-1.

10. Wazuh Dashboard: Installed via --wazuh-dashboard dashboard -p 8080.

Access Rights and Security¶

• Firewall: The application relies on an Nginx proxy to handle external HTTPS traffic.

• Credentials: Administrative credentials (specifically for the admin user) are extracted during installation and stored in /opt/wazuh/password.

• Repository Security: The Wazuh APT repository is disabled after installation via sed to prevent unauthorized version changes through standard package updates.

Databases¶

The deployment includes a distributed indexing engine (Wazuh Indexer) which serves as the primary data store for security events and logs. It is configured as part of the local cluster.

Docker Containers and Their Deployment¶

A single Nginx container is deployed to manage SSL termination and proxying:

• Nginx Proxy

• Image: jonasal/nginx-certbot:latest

• Ports: Uses host network mode.

• Volumes:

• nginx_secrets:/etc/letsencrypt (SSL certificates)

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d (Configuration files)

• Environment Variables: [email protected]

• Restart Policy: unless-stopped

Custom Scripts and Additional Setup¶

The following actions are performed to finalize the environment:

• Credential Extraction: A script parses wazuh-install-files/wazuh-passwords.txt to extract the admin password for the indexer.

• Nginx Configuration Modification: The Nginx configuration is modified to include a proxy_pass directive, routing traffic from the external domain to the internal dashboard on port 8080.

Application Update Instructions¶

To update the main application components:

1. For the Nginx proxy:

   cd /root/nginx && docker compose pull && docker compose up -d
   

2. For the Wazuh core components, manual intervention via the official installation scripts may be required depending on the specific version release.

Location of configuration files and data¶

• Main Configuration: /opt/wazuh/config.yml

• Passwords: /opt/wazuh/password

• Nginx User Configs: /data/nginx/user_conf.d/

Available ports for connection¶

Starting and Stopping the application¶

• Nginx Proxy:

• Start: docker compose start -d (in /root/nginx)

• Stop: docker compose stop (in /root/nginx)