Wazuh部署

Wazuh由部署到受监视系统的端点安全代理和管理服务器组成，管理服务器收集和分析代理收集的数据。此外，Wazuh已与Elastic Stack完全集成，提供了搜索引擎和数据可视化工具，使用户可以浏览其安全警报。

Wazuh提供的功能包括日志数据分析，入侵和恶意软件检测，文件完整性监视，配置评估，漏洞检测以及对法规遵从性的支持。

本次将部署一套分布式Wazuh方案：

wazuh-master启用全功能组件；ElasticStack将使用官方基本授权，不启用X-pack和加密连接；Linux版本Agent将安装到Kibana主机和ElasticSearch主机上，不再额外安装示例主机；各个功能组件采用单节点部署；Wazuh使用4.1.5版本，搭配官方指定7.11.2ElasticStack版本。部署方案

部署拓扑

网络地址

系统角色版本网络地址ElasticSearch7.11.2192.168.248.146Kibana7.11.2192.168.248.145WazuhMaster4.1.5192.168.248.150WazuhAgent4.1.5192.168.248.1

部署实施

# 安装前置软件
yum install -y zip unzip curl
# 导入秘钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
# 增加官方源
cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
# 安装软件
yum makecache
yum upgrade -y
yum install -y elasticsearch-7.11.2

# 导入配置文件
mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml-bak
touch /etc/elasticsearch/elasticsearch.yml
cat > /etc/elasticsearch/elasticsearch.yml << EOF
cluster.name: elastic
node.name: elasticnode1
network.host: 192.168.248.146
cluster.initial_master_nodes: ["elasticnode1"]

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
EOF

# 开通防火墙
firewall-cmd --permanent --add-service=elasticsearch 
firewall-cmd --reload

# 启动服务
systemctl daemon-reload
systemctl enable elasticsearch
systemctl start elasticsearch

# 校验服务
# 使用其他主机访问es环境
curl -XGET http://192.168.248.146:9200
{
  "name" : "elasticnode1",
  "cluster_name" : "elastic",
  "cluster_uuid" : "ahjxhVEHREKNmBAfjcuyNw",
  "version" : {
    "number" : "7.11.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "3e5a16cfec50876d20ea77b075070932c6464c7d",
    "build_date" : "2021-03-06T05:54:38.141101Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

# 禁用软件源，避免非控升级组件
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

10.Kibana的安装

# 安装前置软件
yum install -y zip unzip curl
# 导入源秘钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
# 增加官方源
cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

# 安装软件
yum makecache
yum upgrade -y
yum install -y kibana-7.11.2

# 修改配置文件
cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml-bak
cat >> /etc/kibana/kibana.yml << EOF
server.port: 5601
server.host: "localhost"
server.name: "kibana"
i18n.locale: "en"
elasticsearch.hosts: ["http://192.168.248.146:9200"]
kibana.index: ".kibana"
kibana.defaultAppId: "home"
EOF

# 创建数据目录
mkdir /usr/share/kibana/data
chown -R kibana:kibana /usr/share/kibana

# 离线安装插件
wget https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.1.5_7.11.2-1.zip
cp ./wazuh_kibana-4.1.5_7.11.2-1.zip /tmp
cd /usr/share/kibana
sudo -u kibana /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuh_kibana-4.1.5_7.11.2-1.zip

# 配置服务
systemctl daemon-reload
systemctl enable kibana
systemctl start kibana

# 禁用软件源，避免非控升级组件
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

# 配置反向代理
yum install -y nginx
systemctl enable --now nginx
vim /etc/ngix/nginx.conf.default
# 在server{}中添加配置项
​```
        proxy_redirect           off;
        proxy_set_header         X-Real-IP $remote_addr;
        proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header         Host $http_host;

        location / {
                proxy_pass http://localhost:5601/;
        }
​```
nginx -s reload

# 登录kibana之后选择wazuh插件
# 返回控制台修改插件配置文件
sed -i ‘:s/localhost/192.168.248.150/g’ /usr/share/kibana/data/wazuh/config/wazuh.yml

11.WazuhMaster的安装

# 安装前置软件
yum install -y zip unzip curl
# 导入秘钥
rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

# 配置官方软件源
cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF

cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

# 安装软件
yum makecache
yum upgrade -y

yum install -y wazuh-manager
yum install filebeat-7.11.2

# 配置Filebeat
mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml-bak
touch /etc/filebeat/filebeat.yml

cat > /etc/filebeat/filebeat.yml< 
12.WazuhAgent的安装(Linux)
 
# 在es节点和kibana节点上安装
sudo WAZUH_MANAGER='192.168.248.150' WAZUH_AGENT_GROUP='default' yum install -y https://packages.wazuh.com/4.x/yum/wazuh-agent-4.1.5-1.x86_64.rpm

# 启动服务
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent
 
13.WazuhAgent的安装(Windows)
 
# 使用管理员权限打开powershell控制台
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.1.5-1.msi -OutFile wazuh-agent.msi; ./wazuh-agent.msi /q WAZUH_MANAGER='192.168.248.150' WAZUH_REGISTRATION_SERVER='192.168.248.150' WAZUH_AGENT_GROUP='default'