davidcr01
commented
5 months ago Update Report
Testing - AIO
With the new Wazuh manager package created, the following test has been performed:
Show installation log
```console root@ubuntu22:/home/vagrant# bash wazuh-install.sh -a -i -v 01/02/2024 10:40:44 DEBUG: Checking root permissions. 01/02/2024 10:40:44 DEBUG: Checking sudo package. /usr/bin/sudo 01/02/2024 10:40:44 INFO: Starting Wazuh installation assistant. Wazuh version: 4.8.0 01/02/2024 10:40:44 INFO: Verbose logging redirected to /var/log/wazuh-install.log 01/02/2024 10:40:44 DEBUG: APT package manager will be used. 01/02/2024 10:40:44 DEBUG: Checking system distribution. 01/02/2024 10:40:44 DEBUG: Detected distribution name: ubuntu 01/02/2024 10:40:44 DEBUG: Detected distribution version: 22 01/02/2024 10:40:44 DEBUG: Checking Wazuh installation. 01/02/2024 10:40:46 DEBUG: Installing check dependencies. Hit:1 https://mirrors.edge.kernel.org/ubuntu jammy InRelease Hit:2 https://mirrors.edge.kernel.org/ubuntu jammy-updates InRelease Hit:3 https://mirrors.edge.kernel.org/ubuntu jammy-backports InRelease Hit:4 https://mirrors.edge.kernel.org/ubuntu jammy-security InRelease Reading package lists... 01/02/2024 10:40:52 DEBUG: Checking system architecture. 01/02/2024 10:40:52 WARNING: Hardware and system checks ignored. 01/02/2024 10:40:52 INFO: Wazuh web interface port will be 443. 01/02/2024 10:40:52 DEBUG: Checking ports availability. 01/02/2024 10:40:54 DEBUG: Installing prerequisites dependencies. Hit:1 https://mirrors.edge.kernel.org/ubuntu jammy InRelease Hit:2 https://mirrors.edge.kernel.org/ubuntu jammy-updates InRelease Hit:3 https://mirrors.edge.kernel.org/ubuntu jammy-backports InRelease Hit:4 https://mirrors.edge.kernel.org/ubuntu jammy-security InRelease Reading package lists... 01/02/2024 10:40:58 DEBUG: Checking curl tool version. 01/02/2024 10:40:58 DEBUG: Adding the Wazuh repository. gpg: keyring '/usr/share/keyrings/wazuh.gpg' created gpg: key 96B3EE5F29111145: public key "Wazuh.com (Wazuh Signing Key)It has been observed the following error:
Will create 'wazuh' index template
ERROR: /etc/wazuh-indexer/wazuh-template.json not found
Will create index templates to configure the alias
SUCC: 'wazuh-alerts' template created or updated
SUCC: 'wazuh-archives' template created or updated
Will create the 'rollover_policy' policy
SUCC: 'rollover_policy' policy created
Will create initial indices for the aliases
SUCC: 'wazuh-alerts' write index created
SUCC: 'wazuh-archives' write index created
SUCC: Indexer ISM initialization finished successfully.This error is related to the ISM script execution. It seems that the wazuh-template.json is not included in the Wazuh indexer package. This is reproduced because the deployment is using an old Wazuh indexer package
The health-check was completely successfully:
Errors
I noticed the following errors in the ossec.log file:
2024/02/01 10:44:56 keystore: ERROR: Could not find key 'password at column 'indexer'.
2024/02/01 10:44:56 keystore: ERROR: Could not find key 'password at column 'indexer'.
2024/02/01 10:44:56 wazuh-modulesd:vulnerability-scanner: ERROR: VulnerabilityScannerFacade::start: Could not find key 'password at column 'indexer'.This error is generated because the indexer password is inserted after the Wazuh dashboard installation when the passwords change. To avoid this, the password will be inserted when the Wazuh manager is installed, but this password will be overwritten when changing the passwords.
After a new test, this error is not generated anymore:
root@ubuntu22:/home/vagrant# cat /var/ossec/logs/ossec.log | grep ERROR
root@ubuntu22:/home/vagrant# nano wazuh-installCommit: https://github.com/wazuh/wazuh-packages/pull/2802/commits/a1386cc9f776217fe0efa9343a0e56a3fc85aab8
Description
Related: https://github.com/wazuh/internal-devel-requests/issues/707
Due to the refactoring of the Vulnerability Detector module, the configuration of the indexer has changed. These changes in the WIA and WPT were done here: https://github.com/wazuh/wazuh-packages/pull/2777. Now, these changes must be modified again.
We can assume that the
usernameand thepasswordtag will be removed from theossec.conffile in this issue, so it is not necessary to remove them explicitly in the mentioned tool.Changes
The following code should be removed: https://github.com/wazuh/wazuh-packages/blob/e2ff0288f6a734a93446e590fddbc52d97511da1/unattended_installer/passwords_tool/passwordsFunctions.sh#L60
It should be replaced to a call to the
wazuh-keystoretool in order to change the password of the indexer user.As the WPT is inserted in the WIA, the only change must be done in the WPT and it will be propagated to the WIA.
With further details of the new tool, the chages may change and be more precise.