Wazuh部署之部署_wazuh已与elastic stack

作者：Monodyee | 2024-02-16 00:50:13

踩

wazuh已与elastic stack

Wazuh由部署到受监视系统的端点安全代理和管理服务器组成，管理服务器收集和分析代理收集的数据。此外，Wazuh已与Elastic Stack完全集成，提供了搜索引擎和数据可视化工具，使用户可以浏览其安全警报。

Wazuh提供的功能包括日志数据分析，入侵和恶意软件检测，文件完整性监视，配置评估，漏洞检测以及对法规遵从性的支持。

本次将部署一套分布式Wazuh方案：

wazuh-master启用全功能组件；
ElasticStack将使用官方基本授权，不启用X-pack和加密连接；
Linux版本Agent将安装到Kibana主机和ElasticSearch主机上，不再额外安装示例主机；
各个功能组件采用单节点部署；
Wazuh使用4.1.5版本，搭配官方指定7.11.2ElasticStack版本。
部署方案
部署拓扑
网络地址

系统角色版本网络地址
ElasticSearch 7.11.2 192.168.248.146
Kibana 7.11.2 192.168.248.145
WazuhMaster 4.1.5 192.168.248.150
WazuhAgent 4.1.5 192.168.248.1

系统角色	版本	网络地址
ElasticSearch	7.11.2	192.168.248.146
Kibana	7.11.2	192.168.248.145
WazuhMaster	4.1.5	192.168.248.150
WazuhAgent	4.1.5	192.168.248.1

部署实施


# 安装前置软件
yum install -y zip unzip curl
# 导入秘钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
# 增加官方源
cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
# 安装软件
yum makecache
yum upgrade -y
yum install -y elasticsearch-7.11.2
 
# 导入配置文件
mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml-bak
touch /etc/elasticsearch/elasticsearch.yml
cat > /etc/elasticsearch/elasticsearch.yml << EOF
cluster.name: elastic
node.name: elasticnode1
network.host: 192.168.248.146
cluster.initial_master_nodes: ["elasticnode1"]
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
EOF
 
# 开通防火墙
firewall-cmd --permanent --add-service=elasticsearch 
firewall-cmd --reload
 
# 启动服务
systemctl daemon-reload
systemctl enable elasticsearch
systemctl start elasticsearch
 
# 校验服务
# 使用其他主机访问es环境
curl -XGET http://192.168.248.146:9200
{
  "name" : "elasticnode1",
  "cluster_name" : "elastic",
  "cluster_uuid" : "ahjxhVEHREKNmBAfjcuyNw",
  "version" : {
    "number" : "7.11.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "3e5a16cfec50876d20ea77b075070932c6464c7d",
    "build_date" : "2021-03-06T05:54:38.141101Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}
 
# 禁用软件源，避免非控升级组件
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

10.Kibana的安装


# 安装前置软件
yum install -y zip unzip curl
# 导入源秘钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
# 增加官方源
cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
 
# 安装软件
yum makecache
yum upgrade -y
yum install -y kibana-7.11.2
 
# 修改配置文件
cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml-bak
cat >> /etc/kibana/kibana.yml << EOF
server.port: 5601
server.host: "localhost"
server.name: "kibana"
i18n.locale: "en"
elasticsearch.hosts: ["http://192.168.248.146:9200"]
kibana.index: ".kibana"
kibana.defaultAppId: "home"
EOF
 
# 创建数据目录
mkdir /usr/share/kibana/data
chown -R kibana:kibana /usr/share/kibana
 
# 离线安装插件
wget https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.1.5_7.11.2-1.zip
cp ./wazuh_kibana-4.1.5_7.11.2-1.zip /tmp
cd /usr/share/kibana
sudo -u kibana /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuh_kibana-4.1.5_7.11.2-1.zip
 
# 配置服务
systemctl daemon-reload
systemctl enable kibana
systemctl start kibana
 
# 禁用软件源，避免非控升级组件
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
 
# 配置反向代理
yum install -y nginx
systemctl enable --now nginx
vim /etc/ngix/nginx.conf.default
# 在server{}中添加配置项
```
        proxy_redirect           off;
        proxy_set_header         X-Real-IP $remote_addr;
        proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header         Host $http_host;
 
        location / {
                proxy_pass http://localhost:5601/;
        }
```
nginx -s reload
 
# 登录kibana之后选择wazuh插件
# 返回控制台修改插件配置文件
sed -i ‘:s/localhost/192.168.248.150/g’ /usr/share/kibana/data/wazuh/config/wazuh.yml

11.WazuhMaster的安装


# 安装前置软件
yum install -y zip unzip curl
# 导入秘钥
rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
 
# 配置官方软件源
cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-$releasever - Wazuh
baseurl=https://packages.wazuh.com/4.x/yum/
protect=1
EOF
 
cat > /etc/yum.repos.d/elastic.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
 
# 安装软件
yum makecache
yum upgrade -y
 
yum install -y wazuh-manager
yum install filebeat-7.11.2
 
# 配置Filebeat
mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml-bak
touch /etc/filebeat/filebeat.yml
 
cat > /etc/filebeat/filebeat.yml<<EOF
filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: false
setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false
output.elasticsearch.hosts: ['http://192.168.248.146:9200']
EOF
 
# 导入filebeat的wazuh日志模板
curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.1/extensions/elasticsearch/7.x/wazuh-template.json
chmod go+r /etc/filebeat/wazuh-template.json
 
# 导入filebeat的wazuh日志模型
curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
 
# 配置防火墙规则
firewall-cmd --permanent --add-port={1514/tcp,1515/tcp,55000/tcp}
firewall-cmd --reload
 
# 禁用软件源，避免非控升级组件
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
 
# 启动服务
systemctl daemon-reload
systemctl enable --now wazuh-manager
systemctl enable --now filebeat
 
# 验证Filebeat
filebeat test output
···
elasticsearch: http://192.168.248.146:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.248.146
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK
  version: 7.11.2
  ···
# 刷新kibana

12.WazuhAgent的安装(Linux)


# 在es节点和kibana节点上安装
sudo WAZUH_MANAGER='192.168.248.150' WAZUH_AGENT_GROUP='default' yum install -y https://packages.wazuh.com/4.x/yum/wazuh-agent-4.1.5-1.x86_64.rpm
 
# 启动服务
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

13.WazuhAgent的安装(Windows)


# 使用管理员权限打开powershell控制台
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.1.5-1.msi -OutFile wazuh-agent.msi; ./wazuh-agent.msi /q WAZUH_MANAGER='192.168.248.150' WAZUH_REGISTRATION_SERVER='192.168.248.150' WAZUH_AGENT_GROUP='default'

声明：本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：【wpsshop博客】