Wazuh部署

Posted 2022-02-16 ordersyhack

Wazuh由部署到受监视系统的端点安全代理和管理服务器组成，管理服务器收集和分析代理收集的数据。此外，Wazuh已与Elastic Stack完全集成，提供了搜索引擎和数据可视化工具，使用户可以浏览其安全警报。

Wazuh提供的功能包括日志数据分析，入侵和恶意软件检测，文件完整性监视，配置评估，漏洞检测以及对法规遵从性的支持。

本次将部署一套分布式Wazuh方案：

1. wazuh-master启用全功能组件；
2. ElasticStack将使用官方基本授权，不启用X-pack和加密连接；
3. Linux版本Agent将安装到Kibana主机和ElasticSearch主机上，不再额外安装示例主机；
4. 各个功能组件采用单节点部署；
5. Wazuh使用4.1.5版本，搭配官方指定7.11.2ElasticStack版本。
6. 部署方案

7. 部署拓扑

   

8. 网络地址

   系统角色	版本	网络地址
   ElasticSearch	7.11.2	192.168.248.146
   Kibana	7.11.2	192.168.248.145
   WazuhMaster	4.1.5	192.168.248.150
   WazuhAgent	4.1.5	192.168.248.1

9. 部署实施

   # 安装前置软件
   yum install -y zip unzip curl
   # 导入秘钥
   rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
   # 增加官方源
   cat > /etc/yum.repos.d/elastic.repo << EOF
   [elasticsearch-7.x]
   name=Elasticsearch repository for 7.x packages
   baseurl=https://artifacts.elastic.co/packages/7.x/yum
   gpgcheck=1
   gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
   enabled=1
   autorefresh=1
   type=rpm-md
   EOF
   # 安装软件
   yum makecache
   yum upgrade -y
   yum install -y elasticsearch-7.11.2
   
   # 导入配置文件
   mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml-bak
   touch /etc/elasticsearch/elasticsearch.yml
   cat > /etc/elasticsearch/elasticsearch.yml << EOF
   cluster.name: elastic
   node.name: elasticnode1
   network.host: 192.168.248.146
   cluster.initial_master_nodes: ["elasticnode1"]
   
   path.data: /var/lib/elasticsearch
   path.logs: /var/log/elasticsearch
   EOF
   
   # 开通防火墙
   firewall-cmd --permanent --add-service=elasticsearch 
   firewall-cmd --reload
   
   # 启动服务
   systemctl daemon-reload
   systemctl enable elasticsearch
   systemctl start elasticsearch
   
   # 校验服务
   # 使用其他主机访问es环境
   curl -XGET http://192.168.248.146:9200
   
     "name" : "elasticnode1",
     "cluster_name" : "elastic",
     "cluster_uuid" : "ahjxhVEHREKNmBAfjcuyNw",
     "version" : 
       "number" : "7.11.2",
       "build_flavor" : "default",
       "build_type" : "rpm",
       "build_hash" : "3e5a16cfec50876d20ea77b075070932c6464c7d",
       "build_date" : "2021-03-06T05:54:38.141101Z",
       "build_snapshot" : false,
       "lucene_version" : "8.7.0",
       "minimum_wire_compatibility_version" : "6.8.0",
       "minimum_index_compatibility_version" : "6.0.0-beta1"
     ,
     "tagline" : "You Know, for Search"
   
   
   # 禁用软件源，避免非控升级组件
   sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

   10.Kibana的安装

   # 安装前置软件
   yum install -y zip unzip curl
   # 导入源秘钥
   rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
   # 增加官方源
   cat > /etc/yum.repos.d/elastic.repo << EOF
   [elasticsearch-7.x]
   name=Elasticsearch repository for 7.x packages
   baseurl=https://artifacts.elastic.co/packages/7.x/yum
   gpgcheck=1
   gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
   enabled=1
   autorefresh=1
   type=rpm-md
   EOF
   
   # 安装软件
   yum makecache
   yum upgrade -y
   yum install -y kibana-7.11.2
   
   # 修改配置文件
   cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml-bak
   cat >> /etc/kibana/kibana.yml << EOF
   server.port: 5601
   server.host: "localhost"
   server.name: "kibana"
   i18n.locale: "en"
   elasticsearch.hosts: ["http://192.168.248.146:9200"]
   kibana.index: ".kibana"
   kibana.defaultAppId: "home"
   EOF
   
   # 创建数据目录
   mkdir /usr/share/kibana/data
   chown -R kibana:kibana /usr/share/kibana
   
   # 离线安装插件
   wget https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana-4.1.5_7.11.2-1.zip
   cp ./wazuh_kibana-4.1.5_7.11.2-1.zip /tmp
   cd /usr/share/kibana
   sudo -u kibana /usr/share/kibana/bin/kibana-plugin install file:///tmp/wazuh_kibana-4.1.5_7.11.2-1.zip
   
   # 配置服务
   systemctl daemon-reload
   systemctl enable kibana
   systemctl start kibana
   
   # 禁用软件源，避免非控升级组件
   sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
   
   # 配置反向代理
   yum install -y nginx
   systemctl enable --now nginx
   vim /etc/ngix/nginx.conf.default
   # 在server中添加配置项
   ​```
           proxy_redirect           off;
           proxy_set_header         X-Real-IP $remote_addr;
           proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header         Host $http_host;
   
           location / 
                   proxy_pass http://localhost:5601/;
           
   ​```
   nginx -s reload
   
   # 登录kibana之后选择wazuh插件
   # 返回控制台修改插件配置文件
   sed -i ‘:s/localhost/192.168.248.150/g’ /usr/share/kibana/data/wazuh/config/wazuh.yml

   11.WazuhMaster的安装

   # 安装前置软件
   yum install -y zip unzip curl
   # 导入秘钥
   rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
   rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
   
   # 配置官方软件源
   cat > /etc/yum.repos.d/wazuh.repo << EOF
   [wazuh]
   gpgcheck=1
   gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH
   enabled=1
   name=EL-$releasever - Wazuh
   baseurl=https://packages.wazuh.com/4.x/yum/
   protect=1
   EOF
   
   cat > /etc/yum.repos.d/elastic.repo << EOF
   [elasticsearch-7.x]
   name=Elasticsearch repository for 7.x packages
   baseurl=https://artifacts.elastic.co/packages/7.x/yum
   gpgcheck=1
   gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
   enabled=1
   autorefresh=1
   type=rpm-md
   EOF
   
   # 安装软件
   yum makecache
   yum upgrade -y
   
   yum install -y wazuh-manager
   yum install filebeat-7.11.2
   
   # 配置Filebeat
   mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml-bak
   touch /etc/filebeat/filebeat.yml
   
   cat > /etc/filebeat/filebeat.yml<<EOF
   filebeat.modules:
     - module: wazuh
       alerts:
         enabled: true
       archives:
         enabled: false
   
   setup.template.json.enabled: true
   setup.template.json.path: '/etc/filebeat/wazuh-template.json'
   setup.template.json.name: 'wazuh'
   setup.template.overwrite: true
   setup.ilm.enabled: false
   
   output.elasticsearch.hosts: ['http://192.168.248.146:9200']
   EOF
   
   # 导入filebeat的wazuh日志模板
   curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/4.1/extensions/elasticsearch/7.x/wazuh-template.json
   chmod go+r /etc/filebeat/wazuh-template.json
   
   # 导入filebeat的wazuh日志模型
   curl -s https://packages.wazuh.com/4.x/filebeat/wazuh-filebeat-0.1.tar.gz | tar -xvz -C /usr/share/filebeat/module
   
   # 配置防火墙规则
   firewall-cmd --permanent --add-port=1514/tcp,1515/tcp,55000/tcp
   firewall-cmd --reload
   
   # 禁用软件源，避免非控升级组件
   sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo
   sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo
   
   # 启动服务
   systemctl daemon-reload
   systemctl enable --now wazuh-manager
   systemctl enable --now filebeat
   
   # 验证Filebeat
   filebeat test output
   ···
   elasticsearch: http://192.168.248.146:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 192.168.248.146
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK
     version: 7.11.2
     ···
   # 刷新kibana

   12.WazuhAgent的安装(Linux)

   # 在es节点和kibana节点上安装
   sudo WAZUH_MANAGER='192.168.248.150' WAZUH_AGENT_GROUP='default' yum install -y https://packages.wazuh.com/4.x/yum/wazuh-agent-4.1.5-1.x86_64.rpm
   
   # 启动服务
   sudo systemctl daemon-reload
   sudo systemctl enable wazuh-agent
   sudo systemctl start wazuh-agent

   13.WazuhAgent的安装(Windows)

   # 使用管理员权限打开powershell控制台
   Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.1.5-1.msi -OutFile wazuh-agent.msi; ./wazuh-agent.msi /q WAZUH_MANAGER='192.168.248.150' WAZUH_REGISTRATION_SERVER='192.168.248.150' WAZUH_AGENT_GROUP='default'