Cyber Security: Wazuh Agent Install - Revision history

Unknown user at 03:14, 7 September 2023

2023-09-07T03:14:32Z

← Older revision		Revision as of 03:14, 7 September 2023
Line 5:		Line 5:
	Agent run di host yang ingin Anda pantau dan berkomunikasi dengan server Wazuh, mengirimkan data hampir secara real-time melalui saluran terenkripsi dan diautentikasi.		Agent run di host yang ingin Anda pantau dan berkomunikasi dengan server Wazuh, mengirimkan data hampir secara real-time melalui saluran terenkripsi dan diautentikasi.

	~~Penerapan~~ agent Wazuh pada sistem Linux menggunakan variabel penerapan yang memfasilitasi tugas penginstalan, pendaftaran, dan konfigurasi agen. Atau, jika Anda ingin mengunduh langsung paket agen Wazuh, lihat bagian daftar packages https://documentation.wazuh.com/current/installation-guide/packages-list.html		Pada kesempatan ini, hanya akan diberikan catatan untuk deploy agent Wazuh pada sistem Linux menggunakan variabel penerapan yang memfasilitasi tugas penginstalan, pendaftaran, dan konfigurasi agen. Atau, jika Anda ingin menginstalasi di berbagai OS lainnya dan mengunduh langsung paket agen Wazuh, lihat bagian daftar packages https://documentation.wazuh.com/current/installation-guide/packages-list.html

	Catatan Anda memerlukan hak pengguna root untuk menjalankan semua perintah yang dijelaskan di bawah ini.		Catatan Anda memerlukan hak pengguna root untuk menjalankan semua perintah yang dijelaskan di bawah ini.


	==Tambahkan Wazuh repository==		==Tambahkan Wazuh repository==

	Tambahkan ~~repositori~~ Wazuh untuk mengunduh paket resmi.		Tambahkan repository Wazuh untuk mengunduh paket resmi.

	Install GPG key:		Install GPG key:

	curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \| gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg		curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \| gpg --no-default-keyring --keyring
			gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

	Tambahkan repository:		Tambahkan repository:
Line 28:		Line 27:
	==Deploy Wazuh agent==		==Deploy Wazuh agent==

	Untuk men-deploy Wazuh agent pada endpoint, pilih package manager dan edit WAZUH_MANAGER variable agar berisi Wazuh manager IP address atau hostname.		Untuk men-deploy Wazuh agent pada endpoint, pilih package manager dan edit WAZUH_MANAGER variable agar berisi Wazuh manager IP address atau hostname, misalnya 192.168.0.187.

			WAZUH_MANAGER="192.168.0.187" apt-get -y install wazuh-agent

	WAZUH_MANAGER=~~"10~~.0.0.~~2" apt~~-~~get install~~ wazuh-agent		atau bisa juga di ambil dari dashboard Wazuh > menu Setup Agent seperti,

			curl -so wazuh-agent.deb https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.4.5-1_amd64.deb && sudo WAZUH_MANAGER='192.168.0.187' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='agent-187' dpkg -i ./wazuh-agent.deb

			Pastikan konfigurasi MANAGER IP di wazuh agent, di file /var/ossec/etc/ossec.conf sudah benar.

			<ossec_config>
			<client>
			<server>
			<address>192.168.0.187</address>
			<port>1514</port>
			<protocol>tcp</protocol>
			</server>
			<config-profile>ubuntu, ubuntu22, ubuntu22.04</config-profile>
			<notify_time>10</notify_time>
			<time-reconnect>60</time-reconnect>
			<auto_restart>yes</auto_restart>
			<crypto_method>aes</crypto_method>
			</client>

	Untuk opsi penerapan tambahan seperti nama agen, grup agen, dan password pendaftaran, lihat bagian Variabel penerapan untuk Linux https://documentation.wazuh.com/current/user-manual/deployment-variables/deployment-variables-linux.html		Untuk opsi penerapan tambahan seperti nama agen, grup agen, dan password pendaftaran, lihat bagian Variabel penerapan untuk Linux https://documentation.wazuh.com/current/user-manual/deployment-variables/deployment-variables-linux.html
Line 36:		Line 55:
	Catatan Selain itu, jika Anda ingin menginstal agen tanpa mendaftarkannya, abaikan variabel penerapan. Untuk mempelajari lebih lanjut tentang berbagai metode pendaftaran, lihat bagian pendaftaran agent Wazuh https://documentation.wazuh.com/current/user-manual/agent-enrollment/index.html		Catatan Selain itu, jika Anda ingin menginstal agen tanpa mendaftarkannya, abaikan variabel penerapan. Untuk mempelajari lebih lanjut tentang berbagai metode pendaftaran, lihat bagian pendaftaran agent Wazuh https://documentation.wazuh.com/current/user-manual/agent-enrollment/index.html

	Aktifkan dan mulai service agent Wazuh.		Aktifkan dan mulai service agent Wazuh:

	systemctl daemon-reload		systemctl daemon-reload
	systemctl enable wazuh-agent		systemctl enable wazuh-agent
	systemctl start wazuh-agent		systemctl start wazuh-agent
			systemctl status wazuh-agent

	Proses deployment selesai, dan Wazuh agent berhasil jalan di Linux system.		Proses deployment selesai, dan Wazuh agent berhasil jalan di Linux system.
Line 57:		Line 77:
	==Uninstall Wazuh agent==		==Uninstall Wazuh agent==

	~~Untuk~~ uninstall agent, run command berikut:		Jika diperlukan, untuk uninstall agent, run command berikut:

	apt-get remove wazuh-agent		apt-get remove wazuh-agent
Line 65:		Line 85:
	apt-get remove --purge wazuh-agent		apt-get remove --purge wazuh-agent

	Disable Wazuh agent service.		Disable Wazuh agent service:

	systemctl disable wazuh-agent		systemctl disable wazuh-agent
Line 71:		Line 91:

	Sekarang, Wazuh agent berhasil di uninstall secara penuh dari Linux endpoint.		Sekarang, Wazuh agent berhasil di uninstall secara penuh dari Linux endpoint.


	==Referensi==		==Referensi==

Unknown user: /* Uninstall Wazuh agent */

2023-07-14T10:10:04Z

Uninstall Wazuh agent

← Older revision		Revision as of 10:10, 14 July 2023
Line 61:		Line 61:
	apt-get remove wazuh-agent		apt-get remove wazuh-agent

	~~Some files are marked as configuration files~~. ~~Due to this designation~~, ~~the package manager does not remove these files from the filesystem~~. ~~If you want to completely remove all files~~, ~~run the following command~~:		Beberapa file ditandai sebagai file konfigurasi. Karena penunjukan ini, pengelola paket tidak menghapus file-file ini dari sistem file. Jika Anda ingin menghapus semua file sepenuhnya, jalankan perintah berikut:

	apt-get remove --purge wazuh-agent		apt-get remove --purge wazuh-agent

	Disable ~~the~~ Wazuh agent service.		Disable Wazuh agent service.

	systemctl disable wazuh-agent		systemctl disable wazuh-agent
	systemctl daemon-reload		systemctl daemon-reload

	~~The~~ Wazuh agent ~~is now completely removed from your~~ Linux endpoint.		Sekarang, Wazuh agent berhasil di uninstall secara penuh dari Linux endpoint.


	==Referensi==		==Referensi==

Unknown user: /* Recommended action - Disable Wazuh updates */

2023-07-14T10:08:41Z

Recommended action - Disable Wazuh updates

← Older revision		Revision as of 10:08, 14 July 2023
Line 44:		Line 44:
	Proses deployment selesai, dan Wazuh agent berhasil jalan di Linux system.		Proses deployment selesai, dan Wazuh agent berhasil jalan di Linux system.

	==Recommended ~~action -~~ Disable Wazuh ~~updates~~==		==Recommended Disable Wazuh update==

	Compatibility between the Wazuh agent and the Wazuh manager is guaranteed when the Wazuh manager version is later than or equal to that of the Wazuh agent. Therefore, we recommend disabling the Wazuh repository to prevent accidental upgrades. To do so, use the following command:

			Kompatibilitas antara agent Wazuh dan manajer Wazuh dijamin ketika versi manajer Wazuh lebih baru atau sama dengan versi agen Wazuh. Oleh karena itu, kami menyarankan untuk menonaktifkan repositori Wazuh untuk mencegah upgrade yang tidak disengaja. Untuk melakukannya, gunakan perintah berikut:

	sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list		sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
	apt-get update		apt-get update

	~~Alternatively~~, ~~you can set the package state to~~ hold. ~~This action stops updates but you can still~~ upgrade ~~it manually using~~ apt-get install.		Atau, Anda dapat mengatur status paket untuk di hold. Tindakan ini menghentikan upgrade tetapi Anda masih dapat upgrade secara manual menggunakan apt-get install.

	echo "wazuh-agent hold" \| dpkg --set-selections		echo "wazuh-agent hold" \| dpkg --set-selections

Unknown user at 09:48, 14 July 2023

2023-07-14T09:48:22Z

← Older revision		Revision as of 09:48, 14 July 2023
Line 1:		Line 1:
	Sumber: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html		Sumber: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html

	==~~Deploying~~ Wazuh ~~agents on~~ Linux ~~endpoints~~==		==Deploy Wazuh agent pada Linux endpoint==

	Agent run di host yang ingin Anda pantau dan berkomunikasi dengan server Wazuh, mengirimkan data hampir secara real-time melalui saluran terenkripsi dan diautentikasi.		Agent run di host yang ingin Anda pantau dan berkomunikasi dengan server Wazuh, mengirimkan data hampir secara real-time melalui saluran terenkripsi dan diautentikasi.
Line 10:		Line 10:


	==~~Add the~~ Wazuh repository==		==Tambahkan Wazuh repository==

	~~Add the~~ Wazuh ~~repository to download the official packages~~.		Tambahkan repositori Wazuh untuk mengunduh paket resmi.

	Install ~~the~~ GPG key:		Install GPG key:

	curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \| gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg		curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \| gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

	~~Add the~~ repository:		Tambahkan repository:

	echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \| tee -a /etc/apt/sources.list.d/wazuh.list		echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \| tee -a /etc/apt/sources.list.d/wazuh.list

	Update ~~the~~ package ~~information~~:		Update package:

	apt-get update		apt-get update

	~~Note~~		==Deploy Wazuh agent==

	~~For Debian 7, 8~~, ~~and Ubuntu 14 systems import the GCP key and add the~~ Wazuh ~~repository (steps 1 and 2) using the following commands~~.		Untuk men-deploy Wazuh agent pada endpoint, pilih package manager dan edit WAZUH_MANAGER variable agar berisi Wazuh manager IP address atau hostname.

	~~apt-get install gnupg apt-transport-https~~		WAZUH_MANAGER="10.0.0.2" apt-get install wazuh-agent
	~~curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \| apt-key add -~~
	~~echo~~ "~~deb https://packages~~.~~wazuh~~.~~com/4~~.x/apt~~/ stable main" \| tee~~ -~~a /etc/apt/sources.list.d/~~wazuh~~.list~~

	~~==Deploy a Wazuh agent==~~		Untuk opsi penerapan tambahan seperti nama agen, grup agen, dan password pendaftaran, lihat bagian Variabel penerapan untuk Linux https://documentation.wazuh.com/current/user-manual/deployment-variables/deployment-variables-linux.html

	~~To deploy the~~ Wazuh agent ~~on your endpoint, select your package manager and edit the WAZUH_MANAGER variable to contain your Wazuh manager IP address or hostname~~.		Catatan Selain itu, jika Anda ingin menginstal agen tanpa mendaftarkannya, abaikan variabel penerapan. Untuk mempelajari lebih lanjut tentang berbagai metode pendaftaran, lihat bagian pendaftaran agent Wazuh https://documentation.wazuh.com/current/user-manual/agent-enrollment/index.html

	~~WAZUH_MANAGER="10.0.0.2" apt-get install wazuh-agent~~		Aktifkan dan mulai service agent Wazuh.

	~~For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.~~

	~~Note Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Wazuh~~ agent ~~enrollment section.~~
	~~Enable and start the~~ Wazuh ~~agent service~~.

	systemctl daemon-reload		systemctl daemon-reload
Line 49:		Line 42:
	systemctl start wazuh-agent		systemctl start wazuh-agent

	~~The~~ deployment ~~process is now complete~~, ~~and the~~ Wazuh agent ~~is successfully running on your~~ Linux system.		Proses deployment selesai, dan Wazuh agent berhasil jalan di Linux system.

	==Recommended action - Disable Wazuh updates==		==Recommended action - Disable Wazuh updates==
Line 63:		Line 56:
	echo "wazuh-agent hold" \| dpkg --set-selections		echo "wazuh-agent hold" \| dpkg --set-selections

	==Uninstall a Wazuh agent==		==Uninstall Wazuh agent==

	~~To uninstall the agent, run the following commands:~~

	~~Remove the Wazuh~~ agent ~~installation.~~		Untuk uninstall agent, run command berikut:

	apt-get remove wazuh-agent		apt-get remove wazuh-agent

Unknown user at 09:32, 14 July 2023

2023-07-14T09:32:43Z

← Older revision		Revision as of 09:32, 14 July 2023
Line 3:		Line 3:
	==Deploying Wazuh agents on Linux endpoints==		==Deploying Wazuh agents on Linux endpoints==

	~~The agent runs on the~~ host ~~you want to monitor and communicates with the~~ Wazuh ~~server~~, ~~sending~~ data ~~in near~~ real-time ~~through an encrypted and authenticated channel~~.		Agent run di host yang ingin Anda pantau dan berkomunikasi dengan server Wazuh, mengirimkan data hampir secara real-time melalui saluran terenkripsi dan diautentikasi.

	~~The deployment of a~~ Wazuh ~~agent on a~~ Linux ~~system uses deployment variables that facilitate the task of installing~~, ~~registering~~, ~~and configuring the agent~~. ~~Alternatively~~, ~~if you want to download the~~ Wazuh ~~agent package directly~~, ~~see the~~ packages list ~~section~~.		Penerapan agent Wazuh pada sistem Linux menggunakan variabel penerapan yang memfasilitasi tugas penginstalan, pendaftaran, dan konfigurasi agen. Atau, jika Anda ingin mengunduh langsung paket agen Wazuh, lihat bagian daftar packages https://documentation.wazuh.com/current/installation-guide/packages-list.html

			Catatan Anda memerlukan hak pengguna root untuk menjalankan semua perintah yang dijelaskan di bawah ini.

	~~Note You need root user privileges to run all the commands described below.~~

	==Add the Wazuh repository==		==Add the Wazuh repository==

Unknown user: Created page with "Sumber: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html ==Deploying Wazuh agents on Linux endpoints== The agent runs on..."

2023-07-14T09:30:01Z

Created page with "Sumber: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html ==Deploying Wazuh agents on Linux endpoints== The agent runs on..."

New page

Sumber: https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html

==Deploying Wazuh agents on Linux endpoints==

The agent runs on the host you want to monitor and communicates with the Wazuh server, sending data in near real-time through an encrypted and authenticated channel.

The deployment of a Wazuh agent on a Linux system uses deployment variables that facilitate the task of installing, registering, and configuring the agent. Alternatively, if you want to download the Wazuh agent package directly, see the packages list section.

Note You need root user privileges to run all the commands described below.

==Add the Wazuh repository==

Add the Wazuh repository to download the official packages.

Install the GPG key:

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && chmod 644 /usr/share/keyrings/wazuh.gpg

Add the repository:

echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

Update the package information:

apt-get update

Note

For Debian 7, 8, and Ubuntu 14 systems import the GCP key and add the Wazuh repository (steps 1 and 2) using the following commands.

apt-get install gnupg apt-transport-https
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | apt-key add -
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee -a /etc/apt/sources.list.d/wazuh.list

==Deploy a Wazuh agent==

To deploy the Wazuh agent on your endpoint, select your package manager and edit the WAZUH_MANAGER variable to contain your Wazuh manager IP address or hostname.

WAZUH_MANAGER="10.0.0.2" apt-get install wazuh-agent

For additional deployment options such as agent name, agent group, and registration password, see the Deployment variables for Linux section.

Note Alternatively, if you want to install an agent without registering it, omit the deployment variables. To learn more about the different registration methods, see the Wazuh agent enrollment section.
Enable and start the Wazuh agent service.

systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent

The deployment process is now complete, and the Wazuh agent is successfully running on your Linux system.

==Recommended action - Disable Wazuh updates==

Compatibility between the Wazuh agent and the Wazuh manager is guaranteed when the Wazuh manager version is later than or equal to that of the Wazuh agent. Therefore, we recommend disabling the Wazuh repository to prevent accidental upgrades. To do so, use the following command:

sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
apt-get update

Alternatively, you can set the package state to hold. This action stops updates but you can still upgrade it manually using apt-get install.

echo "wazuh-agent hold" | dpkg --set-selections

==Uninstall a Wazuh agent==

To uninstall the agent, run the following commands:

Remove the Wazuh agent installation.

apt-get remove wazuh-agent

Some files are marked as configuration files. Due to this designation, the package manager does not remove these files from the filesystem. If you want to completely remove all files, run the following command:

apt-get remove --purge wazuh-agent

Disable the Wazuh agent service.

systemctl disable wazuh-agent
systemctl daemon-reload

The Wazuh agent is now completely removed from your Linux endpoint.

==Referensi==

* https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-linux.html

==Pranala Menarik==

* [[Cyber Security]]