本次将部署一套分布式Wazuh方案,实现其基本功能。其中:

  1. wazuh-master启用全功能组件;
  2. ElasticStack将使用官方基本授权,不启用X-pack和加密连接;
  3. Linux版本Agent将安装到Kibana主机和ElasticSearch主机上,不再额外安装示例主机;
  4. 各个功能组件采用单节点部署;
  5. Wazuh使用4.1.5版本,搭配官方指定7.11.2ElasticStack版本。

部署方案

  1. 部署拓扑

    topo

  2. 网络地址

    系统角色 版本 网络地址
    ElasticSearch 7.11.2 192.168.248.146
    Kibana 7.11.2 192.168.248.145
    WazuhMaster 4.1.5 192.168.248.150
    WazuhAgent 4.1.5 192.168.248.1

部署实施

  1. ElasticSearch的安装

    # 安装前置软件
    yum install -y zip unzip curl
    # 导入秘钥
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
    # 增加官方源
    cat > /etc/yum.repos.d/elastic.repo << EOF
    [elasticsearch-7.x]
    name=Elasticsearch repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    autorefresh=1
    type=rpm-md
    EOF
    # 安装软件
    yum makecache
    yum upgrade -y
    yum install -y elasticsearch-7.11.2

    # 导入配置文件
    mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml-bak
    touch /etc/elasticsearch/elasticsearch.yml
    cat > /etc/elasticsearch/elasticsearch.yml << EOF
    cluster.name: elastic
    node.name: elasticnode1
    network.host: 192.168.248.146
    cluster.initial_master_nodes: ["elasticnode1"]

    path.data: /var/lib/elasticsearch
    path.logs: /var/log/elasticsearch
    EOF

    # 开通防火墙
    firewall-cmd --permanent --add-service=elasticsearch
    firewall-cmd --reload

    # 启动服务
    systemctl daemon-reload
    systemctl enable elasticsearch
    systemctl start elasticsearch

    # 校验服务
    # 使用其他主机访问es环境
    curl -XGET http://192.168.248.146:9200
    {
    "name" : "elasticnode1",
    "cluster_name" : "elastic",
    "cluster_uuid" : "ahjxhVEHREKNmBAfjcuyNw",
    "version" : {
    "number" : "7.11.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "3e5a16cfec50876d20ea77b075070932c6464c7d",
    "build_date" : "2021-03-06T05:54:38.141101Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
    },
    "tagline" : "You Know, for Search"
    }

    # 禁用软件源,避免非控升级组件
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
  2. Kibana的安装

    # 安装前置软件
    yum install -y zip unzip curl
    # 导入源秘钥
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
    # 增加官方源
    cat > /etc/yum.repos.d/elastic.repo << EOF
    [elasticsearch-7.x]
    name=Elasticsearch repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    autorefresh=1
    type=rpm-md
    EOF

    # 安装软件
    yum makecache
    yum upgrade -y
    yum install -y kibana-7.11.2

    # 修改配置文件
    cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml-bak
    cat >> /etc/kibana/kibana.yml << EOF
    server.port: 5601
    server.host: "localhost"
    server.name: "kibana"
    i18n.locale: "zh-CN"
    elasticsearch.hosts: ["http://192.168.248.146:9200"]
    kibana.index: ".kibana"
    kibana.defaultAppId: "home"
    server.defaultRoute : "/app/wazuh"
    EOF

    # 创建数据目录
    mkdir /usr/share/kibana/data
    chown -R kibana:kibana /usr/share/kibana

    # 离线安装插件
    wget https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.1.5_7.11.2-1.zip
    cp ./wazuh_kibana-4.1.5_7.11.2-1.zip /tmp
    cd /usr/share/kibana
    sudo -u kibana /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuh_kibana-4.1.5_7.11.2-1.zip

    # 配置服务
    systemctl daemon-reload
    systemctl enable kibana
    systemctl start kibana

    # 禁用软件源,避免非控升级组件
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

    # 配置反向代理
    yum install -y nginx
    systemctl enable --now nginx
    vim /etc/ngix/nginx.conf.default
    # 在server{}中添加配置项
    ​```
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;

    location / {
    proxy_pass http://localhost:5601/;
    }
    ​```
    nginx -s reload

    # 登录kibana之后选择wazuh插件
    # 返回控制台修改插件配置文件
    sed -i ‘:s/localhost/192.168.248.150/g’ /usr/share/kibana/data/wazuh/config/wazuh.yml

    wazuh

  3. WazuhMaster的安装

    # 安装前置软件
    yum install -y zip unzip curl
    # 导入秘钥
    rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

    # 配置官方软件源
    cat > /etc/yum.repos.d/wazuh.repo << EOF
    [wazuh]
    gpgcheck=1
    gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
    enabled=1
    name=EL-$releasever - Wazuh
    baseurl=https://packages.wazuh.com/4.x/yum/
    protect=1
    EOF

    cat > /etc/yum.repos.d/elastic.repo << EOF
    [elasticsearch-7.x]
    name=Elasticsearch repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    autorefresh=1
    type=rpm-md
    EOF

    # 安装软件
    yum makecache
    yum upgrade -y

    yum install -y wazuh-manager
    yum install filebeat-7.11.2

    # 配置Filebeat
    mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml-bak
    touch /etc/filebeat/filebeat.yml

    cat > /etc/filebeat/filebeat.yml<<EOF
    filebeat.modules:
    - module: wazuh
    alerts:
    enabled: true
    archives:
    enabled: false

    setup.template.json.enabled: true
    setup.template.json.path: '/etc/filebeat/wazuh-template.json'
    setup.template.json.name: 'wazuh'
    setup.template.overwrite: true
    setup.ilm.enabled: false

    output.elasticsearch.hosts: ['http://192.168.248.146:9200']
    EOF

    # 导入filebeat的wazuh日志模板
    curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.1/extensions/elasticsearch/7.x/wazuh-template.json
    chmod go+r /etc/filebeat/wazuh-template.json

    # 导入filebeat的wazuh日志模型
    curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module

    # 配置防火墙规则
    firewall-cmd --permanent --add-port={1514/tcp,1515/tcp,55000/tcp}
    firewall-cmd --reload

    # 禁用软件源,避免非控升级组件
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
    sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

    # 启动服务
    systemctl daemon-reload
    systemctl enable --now wazuh-manager
    systemctl enable --now filebeat

    # 验证Filebeat
    filebeat test output
    ···
    elasticsearch: http://192.168.248.146:9200...
    parse url... OK
    connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.248.146
    dial up... OK
    TLS... WARN secure connection disabled
    talk to server... OK
    version: 7.11.2
    ···
    # 刷新kibana
  4. WazuhAgent的安装(Linux)

    # 在es节点和kibana节点上安装
    sudo WAZUH_MANAGER='192.168.248.150' WAZUH_AGENT_GROUP='default' yum install -y https://packages.wazuh.com/4.x/yum/wazuh-agent-4.1.5-1.x86_64.rpm

    # 启动服务
    sudo systemctl daemon-reload
    sudo systemctl enable wazuh-agent
    sudo systemctl start wazuh-agent
  5. WazuhAgent的安装(Windows)

    # 使用管理员权限打开powershell控制台
    Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.1.5-1.msi -OutFile wazuh-agent.msi; ./wazuh-agent.msi /q WAZUH_MANAGER='192.168.248.150' WAZUH_REGISTRATION_SERVER='192.168.248.150' WAZUH_AGENT_GROUP='default'


未完待续……