fdalmaup
commented
2 years ago Environment installation 🟢
Each component was installed using the Installation assistant.
Initial configuration
🟢 wazuh-install.sh
curl -sO https://packages-dev.wazuh.com/4.3/wazuh-install.sh🟢 config.yml
curl -sO https://packages-dev.wazuh.com/4.3/config.yml[root@localhost ~]# cat config.yml
nodes:
# Wazuh indexer nodes
indexer:
- name: node-1
ip: <indexer-node-ip>
# - name: node-2
# ip: <indexer-node-ip>
# - name: node-3
# ip: <indexer-node-ip>
# Wazuh server nodes
# Use node_type only with more than one Wazuh manager
server:
- name: wazuh-1
ip: <wazuh-manager-ip>
# node_type: master
# - name: wazuh-2
# ip: <wazuh-manager-ip>
# node_type: worker
# Wazuh dashboard nodes
dashboard:
- name: dashboard
ip: <dashboard-node-ip>🟢 bash wazuh-install.sh --generate-config-files
[root@localhost ~]# bash wazuh-install.sh --generate-config-files
16/08/2022 14:18:24 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.7
16/08/2022 14:18:24 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/08/2022 14:18:27 INFO: --- Configuration files ---
16/08/2022 14:18:27 INFO: Generating configuration files.
16/08/2022 14:18:28 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key, certificates, and passwords necessary for installation.🟢 Wazuh-install-file.tar generated
[root@localhost ~]# ls -l
total 160
-rw------- 1 root root 10677 ago 16 14:18 wazuh-install-files.tar
-rw-r--r-- 1 root root 148481 ago 16 14:16 wazuh-install.shWazuh indexer
🟢 Wazuh indexer installation
[root@localhost ~]# bash wazuh-install.sh --wazuh-indexer node-1
16/08/2022 14:29:39 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.7
16/08/2022 14:29:39 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/08/2022 14:29:45 INFO: Wazuh development repository added.
16/08/2022 14:29:45 INFO: --- Wazuh indexer ---
16/08/2022 14:29:45 INFO: Starting Wazuh indexer installation.
16/08/2022 14:30:36 INFO: Wazuh indexer installation finished.
16/08/2022 14:30:36 INFO: Wazuh indexer post-install configuration finished.
16/08/2022 14:30:36 INFO: Starting service wazuh-indexer.
16/08/2022 14:30:52 INFO: wazuh-indexer service started.
16/08/2022 14:30:52 INFO: Initializing Wazuh indexer cluster security settings.
16/08/2022 14:30:54 INFO: Wazuh indexer cluster initialized.
16/08/2022 14:30:54 INFO: Installation finished.[root@localhost ~]# bash wazuh-install.sh --start-cluster
16/08/2022 14:31:27 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.7
16/08/2022 14:31:27 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/08/2022 14:31:37 INFO: Wazuh indexer cluster security configuration initialized.
16/08/2022 14:31:56 INFO: Wazuh indexer cluster started.
Indexer status
[root@localhost ~]# systemctl status wazuh-indexer
● wazuh-indexer.service - Wazuh-indexer
Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; vendor preset: disabled)
Active: active (running) since mar 2022-08-16 14:30:52 UTC; 4min 50s ago
Docs: https://documentation.wazuh.com
Main PID: 3762 (java)
CGroup: /system.slice/wazuh-indexer.service
└─3762 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=t...
ago 16 14:30:36 localhost systemd[1]: Starting Wazuh-indexer...
ago 16 14:30:49 localhost systemd-entrypoint[3762]: WARNING: An illegal reflective access operation has occurred
ago 16 14:30:49 localhost systemd-entrypoint[3762]: WARNING: Illegal reflective access by io.protostuff.runtime.PolymorphicThrowableSchema (file:/usr/share/wazuh-indexer/plugins/...wable.cause
ago 16 14:30:49 localhost systemd-entrypoint[3762]: WARNING: Please consider reporting this to the maintainers of io.protostuff.runtime.PolymorphicThrowableSchema
ago 16 14:30:49 localhost systemd-entrypoint[3762]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
ago 16 14:30:49 localhost systemd-entrypoint[3762]: WARNING: All illegal access operations will be denied in a future release
ago 16 14:30:52 localhost systemd[1]: Started Wazuh-indexer.
Hint: Some lines were ellipsized, use -l to show in full.Wazuh server
🟢 Server and filebeat installation
[root@localhost ~]# bash wazuh-install.sh --wazuh-server wazuh-1
16/08/2022 14:36:39 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.7
16/08/2022 14:36:39 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/08/2022 14:36:45 INFO: Wazuh development repository added.
16/08/2022 14:36:45 INFO: --- Wazuh server ---
16/08/2022 14:36:45 INFO: Starting the Wazuh manager installation.
16/08/2022 14:37:06 INFO: Wazuh manager installation finished.
16/08/2022 14:37:06 INFO: Starting service wazuh-manager.
16/08/2022 14:37:21 INFO: wazuh-manager service started.
16/08/2022 14:37:21 INFO: Starting Filebeat installation.
16/08/2022 14:37:32 INFO: Filebeat installation finished.
16/08/2022 14:37:33 INFO: Filebeat post-install configuration finished.
16/08/2022 14:37:42 INFO: Starting service filebeat.
16/08/2022 14:37:43 INFO: filebeat service started.
16/08/2022 14:37:43 INFO: Installation finished.Server status
[root@localhost ~]# systemctl status wazuh-manager
● wazuh-manager.service - Wazuh manager
Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; vendor preset: disabled)
Active: active (running) since mar 2022-08-16 17:58:31 UTC; 25s ago
CGroup: /system.slice/wazuh-manager.service
├─7023 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─7065 /var/ossec/bin/wazuh-authd
├─7087 /var/ossec/bin/wazuh-db
├─7099 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─7102 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh-apid.py
├─7117 /var/ossec/bin/wazuh-execd
├─7132 /var/ossec/bin/wazuh-analysisd
├─7176 /var/ossec/bin/wazuh-syscheckd
├─7191 /var/ossec/bin/wazuh-remoted
├─7224 /var/ossec/bin/wazuh-logcollector
├─7247 /var/ossec/bin/wazuh-monitord
└─7270 /var/ossec/bin/wazuh-modulesd
ago 16 17:58:22 localhost env[6967]: Started wazuh-execd...
ago 16 17:58:23 localhost env[6967]: Started wazuh-analysisd...
ago 16 17:58:25 localhost env[6967]: Started wazuh-syscheckd...
ago 16 17:58:26 localhost env[6967]: Started wazuh-remoted...
ago 16 17:58:27 localhost env[6967]: Started wazuh-logcollector...
ago 16 17:58:28 localhost env[6967]: Started wazuh-monitord...
ago 16 17:58:29 localhost crontab[7351]: (root) LIST (root)
ago 16 17:58:29 localhost env[6967]: Started wazuh-modulesd...
ago 16 17:58:31 localhost env[6967]: Completed.
ago 16 17:58:31 localhost systemd[1]: Started Wazuh manager.Filebeat status
[root@localhost ~]# systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: active (running) since mar 2022-08-16 14:37:40 UTC; 1min 18s ago
Docs: https://www.elastic.co/products/beats/filebeat
Main PID: 7494 (filebeat)
CGroup: /system.slice/filebeat.service
└─7494 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /va...
ago 16 14:37:40 localhost systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..Wazuh dashboard
🟢 Wazuh dashboard installation
[root@localhost ~]# bash wazuh-install.sh --wazuh-dashboard dashboard
16/08/2022 18:00:45 INFO: Starting Wazuh installation assistant. Wazuh version: 4.3.7
16/08/2022 18:00:45 INFO: Verbose logging redirected to /var/log/wazuh-install.log
16/08/2022 18:00:51 INFO: Wazuh development repository added.
dashboard
16/08/2022 18:00:51 INFO: --- Wazuh dashboard ----
16/08/2022 18:00:51 INFO: Starting Wazuh dashboard installation.
16/08/2022 18:01:43 INFO: Wazuh dashboard installation finished.
16/08/2022 18:01:43 INFO: Wazuh dashboard post-install configuration finished.
16/08/2022 18:01:43 INFO: Starting service wazuh-dashboard.
16/08/2022 18:01:43 INFO: wazuh-dashboard service started.
16/08/2022 18:02:04 INFO: Initializing Wazuh dashboard web application.
16/08/2022 18:02:05 INFO: Wazuh dashboard web application initialized.
16/08/2022 18:02:05 INFO: --- Summary ---
16/08/2022 18:02:05 INFO: You can access the web interface https://<private_ip>
User: <user>
Password: <password>
16/08/2022 18:02:05 INFO: Installation finished.Wazuh dashboard status
[root@localhost ~]# systemctl status wazuh-dashboard
● wazuh-dashboard.service - wazuh-dashboard
Loaded: loaded (/etc/systemd/system/wazuh-dashboard.service; enabled; vendor preset: disabled)
Active: active (running) since mar 2022-08-16 18:01:49 UTC; 2min 38s ago
Main PID: 9357 (node)
CGroup: /system.slice/wazuh-dashboard.service
└─9357 /usr/share/wazuh-dashboard/bin/../node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/bin/../src/cli/dist -c /etc/wazuh-dashboard/...
ago 16 18:01:55 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:01:55Z","tags":["info","plugins-system"],"pid":9357,"message":"Starting [42] plug...able,expres
ago 16 18:01:55 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:01:55Z","tags":["listening","info"],"pid":9357,"message":"Server running at https...24.20:443"}
ago 16 18:01:56 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:01:56Z","tags":["info","http","server","OpenSearchDashboards"],"pid":9357,"messag...24.20:443"}
ago 16 18:01:56 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:01:56Z","tags":["error","opensearch","data"],"pid":9357,"message":"[ResponseError...nse Error"}
ago 16 18:01:56 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:01:56Z","tags":["error","opensearch","data"],"pid":9357,"message":"[ResponseError...nse Error"}
ago 16 18:02:05 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:02:05Z","tags":["info","branding"],"pid":9357,"message":"logo default config is n... invalid."}
ago 16 18:02:05 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:02:05Z","tags":["info","branding"],"pid":9357,"message":"mark default config is n... invalid."}
ago 16 18:02:05 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:02:05Z","tags":["info","branding"],"pid":9357,"message":"loadingLogo default conf... invalid."}
ago 16 18:02:05 localhost opensearch-dashboards[9357]: {"type":"log","@timestamp":"2022-08-16T18:02:05Z","tags":["info","branding"],"pid":9357,"message":"favicon config is not fo... invalid."}
ago 16 18:02:05 localhost opensearch-dashboards[9357]: {"type":"response","@timestamp":"2022-08-16T18:02:04Z","tags":[],"pid":9357,"method":"get","statusCode":200,"req":{"url":"/status","me...
Hint: Some lines were ellipsized, use -l to show in full.
The following issue aims to run the specified test for the current release candidate, report the results, and open new issues for any encountered errors.
Test information
Environment
Test description
Best effort to test Wazuh indexer package. Think critically and at least review/test:
Test report procedure
Any failing test must be properly addressed with a new issue, detailing the error and the possible cause.
An extended report of the test results must be attached as a ZIP or TXT file. Please attach any documents, screenshots, or tables to the issue update with the results. This report can be used by the auditors to dig deeper into any possible failures and details.
Conclusions
All tests have been executed and the results can be found here.
Auditors validation
The definition of done for this one is the validation of the conclusions and the test results from all auditors.
All checks from below must be accepted in order to close this issue.