c-bordon
commented
11 months ago Update report
Reviewing the code I was able to identify that the -i option does not prevent port validation, port validation is performed whenever the offline option is not chosen.
The debate remains open to define whether it is necessary to open the OS and hardware skip in 2 options, although the message is clear, by choosing the -i option the user is agreeing to install on a system that is not recommended or with incomplete hardware requirements.
The problem occurs because the port validation we perform is about whether the port is not in use, at the moment we do not validate port blocking by firewalld or any other option external to the host.
I'm going to check if we can add some type of post-installation validation to check that the port is listening correctly.
I used the installation assistant to perform a distributed deployment of Wazuh. I had to use the
ignoreoption to install it on Rocky Linux 8. However, this caused the installation assistant not to check the ports, and deployments that seem to be working fine, such as the server, was failing as Filebeat was unable to communicate with the Indexer.Shall the server installation include testing the Filebeat output and warning the user if it fails?
Shall we have different
ignoreoptions? For instance,ignore-os, which would enable installations on non-recommended operating systems while still verifying the ports and hardware requirements.We need to inform the user about the need to open the necessary ports on each component so the deployment can work as expected regardless if the
ignoreoption is used.Steps to reproduce
Vagrant box:
generic/rocky8Vagranfile
``` server_ip = "192.168.56.2" indexer_ip = "192.168.56.3" dashboard_ip = "192.168.56.4" agent_ip = "192.168.56.5" Vagrant.configure("2") do |config| config.vm.define "server" do |server| server.vm.box = "generic/rocky8" server.vm.network :private_network, ip: "#{server_ip}" server.vm.provider "virtualbox" do |pmv| pmv.memory = 1024 pmv.cpus = 1 pmv.linked_clone=true end server.vm.hostname = "server" end config.vm.define "indexer" do |indexer| indexer.vm.box = "generic/rocky8" indexer.vm.network :private_network, ip: "#{indexer_ip}" indexer.vm.provider "virtualbox" do |pmv| pmv.memory = 4096 pmv.cpus = 2 pmv.linked_clone=true end indexer.vm.hostname = "indexer" end config.vm.define "dashboard" do |dashboard| dashboard.vm.box = "generic/rocky8" dashboard.vm.network :private_network, ip: "#{dashboard_ip}" dashboard.vm.provider "virtualbox" do |pmv| pmv.memory = 4096 pmv.cpus = 2 pmv.linked_clone=true end dashboard.vm.hostname = "dashboard" end config.vm.define "agent" do |agent| agent.vm.box = "generic/rocky8" agent.vm.network :private_network, ip: "#{agent_ip}" agent.vm.provider "virtualbox" do |pmv| pmv.memory = 1024 pmv.cpus = 1 pmv.linked_clone=true end agent.vm.hostname = "agent" end end ```Download the installation assistant on each node:
Edit the configuration file and create the installation files.
Configuration file (config.yml)
```yml nodes: # Wazuh indexer nodes indexer: - name: node-1 ip: "192.168.56.3" #- name: node-2 # ip: "Copy
wazuh-install-files.taron each node.Install the Wazuh indexer on its corresponding node and initialize the cluster:
9200on the Wazuh indexer node:Note that in addition to opening ports
9200and9300for the Wazuh indexer, it might be necessary to open port443for the Wazuh dashboard and ports55000,1514,1515and1516for the Wazuh server. Not knowing which ports to open could lead to issues that the user may struggle to resolve.