Installation in ubuntu 18.

04 servers 2

IP plan 2

Wazuh server: 172.16.7.25: 2

Wazuh server Installation 2
Filebeat Installation 3

ELK server: 172.16.7.26 5

Install Elasticsearch 5
Install Kibana: 6
Set up the wazuh App: 7
Secure ELK using X-Pack 8
 Installation in ubuntu 18.04 servers

1. IP plan
a. Wazuh server: 172.16.7.25
b. ELK server: 172.16.7.26
c. Agent installed on ubuntu Client : 172.16.7.24

2. Wazuh server: 172.16.7.25:

Wazuh server Installation

a. Prerequisites:
i. # apt-get update
ii. # ​apt-get install curl apt-transport-https
lsb-release gnupg2
b. Install the GPG key
i. # curl -s
https://packages.wazuh.com/key/GPG-KEY-WAZUH |
apt-key add -
c. Add the repository:
i. # echo "deb https://packages.wazuh.com/3.x/apt/
stable main" | tee -a
/etc/apt/sources.list.d/wazuh.list

d. Update the package information:

i. #​ ​apt-get update
e. Install the Wazuh manager:
 i. #​ ​apt-get install wazuh-manager
f. Check for service status
i. #​ ​systemctl status wazuh-manager
g. Add official NodeJS repository:
i. #​ ​curl -sL https://deb.nodesource.com/setup_10.x |
bash -
h. Install NodeJS
i. #​ ​apt-get install nodejs
i. Install the Wazuh API
i. #​ ​apt-get install wazuh-api
j. Check for service status
i. # systemctl status wazuh-api
k. Secure the wazuh API (enable https with self signed cert and set username and
password for API connection)
i. # /var/ossec/api/scripts/configure_api.sh
l. Restart service
i. # systemctl restart wazuh-api
m. Test wazuh server is running properly:
i. https:​//172.16.7.25​:55000

Filebeat Installation

n. Add the Elastic repository and its GPG key:

i. # apt-get install curl apt-transport-https

ii. # curl -s
https://artifacts.elastic.co/GPG-KEY-elasticsearc
h | apt-key add -
iii. # echo "deb
https://artifacts.elastic.co/packages/7.x/apt
 stable main" | tee
/etc/apt/sources.list.d/elastic-7.x.list
iv. # apt-get update

o. Install Filebeat:

i. # apt-get install filebeat​=​7.9.1

p. Download the Filebeat config file from the Wazuh repository. This is
pre-configured to forward Wazuh alerts to Elasticsearch:

i. # ​curl -so /etc/filebeat/filebeat.yml

https://raw.githubusercontent.com/wazuh/wazuh/v3.
13.2/extensions/filebeat/7.x/filebeat.yml

q. Download the alerts template for Elasticsearch:

i. # ​curl -so /etc/filebeat/wazuh-template.json

https://raw.githubusercontent.com/wazuh/wazuh/v3.
13.2/extensions/elasticsearch/7.x/wazuh-template.
json

r. Download the Wazuh module for Filebeat:

i. # curl -s
https://packages.wazuh.com/3.x/filebeat/wazuh-fil
ebeat-0.1.tar.gz | sudo tar -xvz -C
/usr/share/filebeat/module

s. Edit the file /etc/filebeat/filebeat.yml and replace with the IP address or the
hostname of the Elasticsearch server. For example:

i. # ​vi /etc/filebeat/filebeat.yml
output.elasticsearch.hosts:
[​'http://172.16.7.26:9200'​]

t. Enable and start the Filebeat service:

i. # systemctl daemon-reload
 ii. # systemctl enable filebeat.service
iii. # systemctl start filebeat.service

u. Once Elasticsearch is up and running, load the Filebeat template by running

following command on wazuh server.

i. # filebeat setup --index-management -E

setup.template.json.enabled=false

3. ELK server: 172.16.7.26

Install Elasticsearch

a. Add the Elastic repository and its GPG key:

i. # rpm --import
https://artifacts.elastic.co/GPG-KEY-elasticsearc
h

ii. # cat > /etc/yum.repos.d/elastic.repo << EOF

[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x
/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elast
icsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
b. Install the Elasticsearch package:

i. # yum install elasticsearch-7.9.1

c. Elasticsearch will only listen on the loopback interface (localhost) by default.
Configure Elasticsearch to listen to a non-loopback address by editing the file
/etc/elasticsearch/elasticsearch.yml​ and uncommenting the setting ​network.host​.
Change the value to the IP you want to bind it to:

i. # vi ​/etc/elasticsearch/elasticsearch.yml
network.host:​ ​172.16.7.26
http.port: ​9200
d. Add or edit (if commented) the following lines in the file
/etc/elasticsearch/elasticsearch.yml:
i. # vi ​/etc/elasticsearch/elasticsearch.yml
node.name:​ ​wazuh
cluster.initial_master_nodes:​ [​"wazuh"​]

e. Enable and start the Elasticsearch service:

i. # systemctl daemon-reload
ii. # systemctl enable elasticsearch.service
iii. # systemctl start elasticsearch.service
f. Ensure elasticsearch is running
i. http:​//172.16.7.26​:9200
g. Now, in wazuh server(​172.16.7.25​) load the filebeat template, as mentioned
earlier in filebeat installation.

Install Kibana:

h. Install the Kibana package:

i. # ​yum install kibana-7.9.1

 i. Update the optimize and plugins directories permissions:

i. # ​chown -R kibana:kibana
/usr/share/kibana/optimize
ii. # ​chown -R kibana:kibana
/usr/share/kibana/plugins

j. Install the Wazuh app plugin for Kibana from URL:

i. # cd /usr/share/kibana/
ii. # sudo -u kibana bin/kibana-plugin install
https://packages.wazuh.com/wazuhapp/wazuhapp-3.13
.2_7.9.1.zip

k. Configure Kibana to listen on its network interface IP :

i. # vi /etc/kibana/kibana.yml
server.port: ​5601
server.host:​ ​"172.16.7.26"
server.name:​ "wazuh kibana"
elasticsearch.hosts:
["​http://172.16.7.26:9200​"]

l. Enable and start the Kibana service:

i. #​ systemctl daemon-reload
ii. # systemctl enable kibana.service
iii. # systemctl start kibana.service

4. Set up the wazuh App:

In the elk server edit the following file as per api user and password you have set and
provide wazuh server ip address and port:
 a. # vi /usr/share/kibana/optimize/wazuh/config/wazuh.yml
hosts​:
​- ​default​:
​url​:​ ​https://172.16.7.25
​port​:​ ​55000
​user​:​ ​wazuh
​password​:​ ​eiytdvdR5?yu5

5. Secure ELK using X-Pack

Configure the instance you want to secure:
a. # vi ​/usr/share/elasticsearch/instances.yml
instances​:
- ​name​: ​"wazuh"
​ip​:
- ​"172.16.7.25"
- ​name​: ​"elasticsearch"
​ip​:
- ​"172.16.7.26"
- ​name​: ​"kibana"
​ip​:
- ​"172.16.7.26"

b. Generate the Certificates:

i. #
/usr/share/elasticsearch/bin/elasticsearch-certut
il cert --pem --in instances.yml --out certs.zip
--keep-ca-key
c. Extract the certificates:
i. # unzip /usr/share/elasticsearch/certs.zip -d
/usr/share/elasticsearch/

d. Configure elastic search instance

i. # mkdir /etc/elasticsearch/certs/ca -p
ii. # ​cp ca/ca.crt /etc/elasticsearch/certs/ca
iii. # ​cp elasticsearch/elasticsearch.crt
/etc/elasticsearch/certs
 iv. # ​cp elasticsearch/elasticsearch.key
/etc/elasticsearch/certs
v. # ​chown -R elasticsearch:
/etc/elasticsearch/certs
vi. # ​chmod -R ​770​ /etc/elasticsearch/certs
vii. Add following to end of
/etc/elasticsearch/elasticsearch.yml

xpack.security.transport.ssl.enabled​: true
xpack.security.transport.ssl.verification_mo
de​: certificate
xpack.security.transport.ssl.key​:
/etc/elasticsearch/certs/elasticsearch.key
xpack.security.transport.ssl.certificate​:
/etc/elasticsearch/certs/elasticsearch.crt
xpack.security.transport.ssl.certificate_aut
horities​: [
"/etc/elasticsearch/certs/ca/ca.crt"​ ]

xpack.security.http.ssl.enabled​: true
xpack.security.http.ssl.verification_mode​:
certificate
xpack.security.http.ssl.key​:
/etc/elasticsearch/certs/elasticsearch.key
xpack.security.http.ssl.certificate​:
/etc/elasticsearch/certs/elasticsearch.crt
xpack.security.http.ssl.certificate_authorit
ies​: [ ​"/etc/elasticsearch/certs/ca/ca.crt"
]

viii. Restart the service

#​ ​systemctl restart elasticsearch
e. Configure Kibana Instance:
i. # mkdir /etc/kibana/certs/ca -p
ii. # cd /usr/share/elasticsearch/
iii. # cp ca/ca.crt /etc/kibana/certs/ca
iv. # cp kibana/kibana.crt /etc/kibana/certs
v. # cp kibana/kibana.key /etc/kibana/certs
vi. # chown -R kibana: /etc/kibana/certs
vii. # chmod -R 770 /etc/kibana/certs
viii. Make following changes to ​/etc/kibana/kibana.yml
 elasticsearch.hosts​:
[​"https://172.16.7.26:9200"​]
elasticsearch.ssl.certificateAuthorities​:
[​"/etc/kibana/certs/ca/ca.crt"​]
elasticsearch.ssl.certificate​:
"/etc/kibana/certs/kibana.crt"
elasticsearch.ssl.key​:
"/etc/kibana/certs/kibana.key"

server.ssl.enabled​: true
server.ssl.certificate​:
"/etc/kibana/certs/kibana.crt"
server.ssl.key​:
"/etc/kibana/certs/kibana.key"
ix. Restart the service
# systemctl restart kibana
f. Configure Filebeat installed on wazuh server
Copy certificates and keys from elk server to wazuh server
​ # cd /usr/share/elasticsearch
# scp -r ca wazuh [email protected]:/home/wazuh
g. Configure the filebeat
i. # mkdir /etc/filebeat/certs/ca -p
ii. # cd /home/wazuh
iii. # cp ca/ca.crt /etc/filebeat/certs/ca
iv. # cp wazuh-manager/wazuh.crt /etc/filebeat/certs
v. # cp wazuh-manager/wazuh.key /etc/filebeat/certs
vi. # chmod 770 -R /etc/filebeat/certs
vii. Make the following changes to /etc/filebeat/filebeat.yml:
output.elasticsearch.hosts​:
[​'172.16.7.26:9200'​]
output.elasticsearch.protocol​: https
output.elasticsearch.ssl.certificate​:
"/etc/filebeat/certs/wazuh.crt"
output.elasticsearch.ssl.key​:
"/etc/filebeat/certs/wazuh.key"
output.elasticsearch.ssl.certificate_authori
ties​: [​"/etc/filebeat/certs/ca/ca.crt"​]
h. Restart the service:
#​ ​systemctl restart filebeat

i. Add Authentication for Elastic Stack:

i. # vi ​/etc/elasticsearch/elasticsearch.yml
 ​xpack.security.enabled​: true

j. Restart Elasticsearch
i. # systemctl restart elasticsearch
k. Auto generate credentials for all prebuilt users and roles
#
/usr/share/elasticsearch/bin/elasticsearch-setup-passw
ords auto

Changed password for user elastic

PASSWORD elastic = He7FY50syQ4dI9oWRIqA

**** Note down the passwords*******

l. Setup the credentials for filebeat and Kibana

i. # vi /etc/filebeat/filebeat.yml
output.elasticsearch.username​: ​"elastic"
output.elasticsearch.password​:
"​He7FY50syQ4dI9oWRIqA​"
ii. Restart filebeat
# systemctl restart filebeat

iii. # vi /etc/kibana/kibana.yml
xpack.security.enabled​: true
elasticsearch.username​: ​"elastic"
elasticsearch.password​:
"​He7FY50syQ4dI9oWRIqA​”

iv. Restart Kibana

# systemctl restart kibana