wazuh / wazuh-splunk

Wazuh - Splunk App
https://wazuh.com
GNU General Public License v2.0
50 stars 27 forks source link

Agent deploy command for macOS #1406

Closed AlexRuiz7 closed 1 year ago

AlexRuiz7 commented 1 year ago

Description

The command to start the agent on macOS should be run by root, so we need to add sudo as part of the command.

The command

/Library/Ossec/bin/wazuh-control start

should be

sudo /Library/Ossec/bin/wazuh-control start

Also, the package name is going to be updated. We must update the installation command with the new name when it is available.

AlexRuiz7 commented 1 year ago

Update

Due to some optimizations in terms of usability and macOS availability of certain commands, the final specs about CLI installation command are

Examples:

sudo echo "WAZUH_MANAGER='1.1.1.1' && WAZUH_MANAGER_PORT='7777' && WAZUH_PROTOCOL='udp' && WAZUH_REGISTRATION_SERVER='2.2.2.2' && WAZUH_REGISTRATION_PORT='8888' && WAZUH_REGISTRATION_PASSWORD='password' && WAZUH_KEEP_ALIVE_INTERVAL='10' && WAZUH_TIME_RECONNECT='10' && WAZUH_REGISTRATION_CA='/Library/Ossec/etc/testsslmanager.cert' && WAZUH_REGISTRATION_CERTIFICATE='/Library/Ossec/etc/testsslmanager.cert' && WAZUH_REGISTRATION_KEY='/Library/Ossec/etc/testsslmanager.key' && WAZUH_AGENT_NAME='test-agent' && WAZUH_AGENT_GROUP='test-group' && ENROLLMENT_DELAY='10'" > /tmp/wazuh_envs && sudo installer -pkg wazuh-agent-4.4.3-0.commitb384726.pkg -target /

Originally posted by @jnasselle in https://github.com/wazuh/wazuh-kibana-app/issues/5466#issuecomment-1559922195