Wazuh Installation Guide

Prerequisites#

• Minimum Hardware: 4GB RAM and 2 CPU cores (the indexer is memory-hungry — all-in-one installs below this are unreliable).
• OS: Rocky Linux 9 (Manager & Agent)

1. Setup Wazuh Manager#

Update System and Install Requirements#

sudo dnf update -y
sudo dnf install -y nano curl unzip wget

Configure Firewall#

Ensure the necessary ports are open for the Wazuh Manager to receive agent traffic and dashboard access.

# 1514/TCP — agent communication
sudo firewall-cmd --permanent --add-port=1514/tcp
# 1515/TCP — automatic agent enrollment (authd)
sudo firewall-cmd --permanent --add-port=1515/tcp
# 443/TCP — Wazuh dashboard (the web UI defaults to 443, not 5601)
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Install Wazuh (All-in-One)#

Download and execute the official Wazuh installation assistant. This installs the Manager, Indexer, and Dashboard.

curl -so wazuh-install.sh https://packages.wazuh.com/4.14/wazuh-install.sh
sudo bash wazuh-install.sh -a

Note: -a (all-in-one) installs the indexer, server and dashboard together. Pin the version in the URL as above for a reproducible install — the 4.x path always serves whatever is newest. Add -i only if you need to skip the assistant's health check and hardware validation, since it will otherwise stop you from deploying onto an undersized host.

Verify Services#

Ensure all components are actively running:

sudo systemctl status wazuh-manager
sudo systemctl status wazuh-indexer
sudo systemctl status filebeat
sudo systemctl status wazuh-dashboard

Access Dashboard#

1. Obtain the generated dashboard password:

   sudo tar -O -xf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

   Copy

2. Navigate to https://<MANAGER_IP> in your browser (the dashboard listens on 443).
3. Log in using admin and the generated password.

Tip

Once every component is installed, Wazuh recommends disabling its package repository so a routine dnf update never upgrades the stack underneath your agents:

sudo sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

Copy

2. Setup Wazuh Agent#

Install Agent Package#

sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
sudo tee /etc/yum.repos.d/wazuh.repo <<EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
priority=1
EOF

export WAZUH_MANAGER="<MANAGER_IP>"
sudo dnf install -y wazuh-agent

Note: Enterprise Linux 9 and later use priority=1 in the repo file — protect=1 is the EL8-and-earlier form. The 4.x base URL is intentional here: it tracks the latest 4.x agent so a fresh endpoint enrols against a current manager.

Configure and Start Agent#

The WAZUH_MANAGER deployment variable above already writes the manager address into the configuration. Verify it, and edit /var/ossec/etc/ossec.conf only if you are pointing the agent at a different manager or protocol:

sudo nano /var/ossec/etc/ossec.conf

The relevant <client> section should look like this:

<client>
  <server>
    <address><MANAGER_IP></address>
    <port>1514</port>
    <protocol>tcp</protocol>
  </server>
</client>

Start and enable the agent:

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Verify Connection#

On the Wazuh Manager, check if the agent successfully connected:

sudo /var/ossec/bin/agent_control -l

You should also see the agent listed as Active in the Wazuh Dashboard under Agents.

Need Help with Your Infrastructure?#

If you're looking to implement a similar security setup, migrate your infrastructure, or need a robust DevOps solution, feel free to reach out!

Contact Me:

• GitHub
• LinkedIn
• Email