Wazuh Debian Installation Instructions

!THIS INSTALLATION REQUIRES ROOT ACCESS!

Ensure you are logged in as root by using sudo su.

Add repository to APT:

• Add the GPG Key For the Repository:
  • curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg
• Add the Repository to /etc/apt/sources.list.d:
  • echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list
• Ensure the Changes Applied Correctly:
  • apt-get update

Install Dependencies and Configure Wazuh:

• Install Dependencies:
  • apt-get install gnupg apt-transport-https
• Install wazuh-agent:
  • WAZUH_MANAGER="10.3.120.4" apt-get install wazuh-agent

Modify configuration file

The default port in the configuration for the server is incorrect and needs to be manually changed.

• Access Configuration File:
  • nano /var/ossec/etc/ossec.conf
  • Navigate to "<port>1514</port\>" in <ossec_config> and change the port number to 1515
  • Use Ctrl + S to write changes
• Start and Enable wazuh-agent Service:
  • Run systemctl daemon-reload to add the service to daemon
  • Use systemctl start wazuh-agent, then systemctl enable wazuh-agent to start the service and add a symlink.
• Check Status Of wazuh-agent Service:
  • systemctl status wazuh-agent
  • Ensure functionality by checking program logs using cat /var/ossec/logs/ossec.log, if Unable to connect to enrollment service error is present, retry all steps in order from this section.