Wazuh Dashboard Installation - Manual Install
Team: Wazuh-Dashboard · Published to class
Category: Installments · Last updated 2025-12-02 09:12 · by sierra3382
Wazuh Dashboard Installation Attempt (First Try)
This documentation outlines the first unassisted attempt at installing the Wazuh Dashboard. The team did not yet know that installation should not be done manually.
Dashboard group members involved: Jared W., Nathan P., Levi E., and Sierra S.
The installation was not completed due to several issues, but the steps taken are documented below.
⚠️ Important Note
All commands must be run as the root user.
1. Install Required Packages
apt-get install debhelper tar curl libcap2-bin
Prepares the environment with essential utilities for software packaging and system setup.
2. Add the Wazuh Repository
Install required tools
apt-get install gnupg apt-transport-https
This command installs two important tools on a Debian/Ubuntu system: gnupg, which allows the system to handle GPG keys for verifying software sources, and apt-transport-https, which enables APT to securely download packages over HTTPS.
Add the Wazuh GPG key
url -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
This downloads the Wazuh GPG key, imports it into a special keyring file, and then sets the correct permissions on that key so your system can securely verify Wazuh packages.
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
This writes a new repository entry into /etc/apt/sources.list.d/wazuh.list, telling your system to use the Wazuh repo and to verify its packages with the GPG key we added earlier.
apt-get update
This downloads the latest information about what software is available from all configured repositories.
3. Installing the Dashboard Package
apt-get -y install wazuh-dashboard
This downloads the dashboard package from the repositories you configured and sets up the web interface used to view and manage Wazuh security data.
4. Configuring the Dashboard
Edit the “nano” /etc/wazuh-dashboard/opensearch_dashboards.yml file and replace the following values:
server.host: This setting specifies the host of the Wazuh dashboard server.
Server host = replace 0.0.0.0 with 10.3.120.4
^^ This was a mistake, read the documentation and thought we needed to put the actual IP instead of just 0.0.0.0
Opensearch.hosts: The URLs of the Wazuh indexer instances to use for all your queries.
Opensearch host = https://10.3.120.3"
**Make sure to take away local host **
5. Deploying Certificates
We were having some trouble with the directory and where everything is. We do not have “wazuh-certificates.tar”
We used a scp command from the server host to send a copy of the file to the dashboard host so that we have it.
scp/home/administrator/wazuh-certificates.tar adminstrator@10.3.120.5:/home/administrator/
The following commands are then used back in dashboard:
mkdir /etc/wazuh-dashboard/certs
tar -xf ./wazuh-certificates.tar -C /etc/wazuh-dashboard/certs/ ./dashboard.pem ./dashboard-key.pem ./root-ca.pem
^^We had some trouble with this command
mv -n /etc/wazuh-dashboard/certs/dashboard.pem /etc/wazuh-dashboard/certs/dashboard.pem
mv -n /etc/wazuh-dashboard/certs/dashboard-key.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
chmod 500 /etc/wazuh-dashboard/certs
chmod 400 /etc/wazuh-dashboard/certs/*
chown -R wazuh-dashboard:wazuh-dashboard /etc/wazuh-dashboard/certs
These commands set up and secure the SSL/TLS certificates for the Wazuh Dashboard, ensuring the service can use them safely while keeping them protected from other users.
6. Starting the Dashboard Service
systemctl daemon-reload
systemctl enable wazuh-dashboard
systemctl start wazuh-dashboard
These commands reload systemd so it recognizes any new or updated service files, then enable the Wazuh Dashboard to start automatically on boot, and finally start the dashboard service right now.
Nano /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
Replace url with url: https://10.3.120.4
We created a file because we could not find it
We went out to the Dashboard URL, and we can confirm it is active, but we are getting an error message **
“Wazuh dashboard server is not ready yet”
We believe the indexer is using a different certificate compared to the server and dashboard.
Indexer team needs to be contacted so we can communicate with them so they can use the same certificate.
This is the end of the documentation. We have since figured out what the issue was and continued to work through it, but this is a documentation of what the first go-around looked like.