Guides - Deploying Wazuh through the Linode Marketplace

Wazuh provides a security solution for monitoring your infrastructure and detecting threats, intrusion attempts, system anomalies, poorly configured applications, and unauthorized user actions. It also provides a framework for incident response and regulatory compliance.

Deploying a Marketplace App

The Linode Marketplace allows you to easily deploy software on a Compute Instance using the Cloud Manager. See Get Started with Marketplace Apps for complete steps.

1. Log in to the Cloud Manager and select the Marketplace link from the left navigation menu. This displays the Linode Create page with the Marketplace tab pre-selected.

2. Under the Select App section, select the app you would like to deploy.

3. Complete the form by following the steps and advice within the Creating a Compute Instance guide. Depending on the Marketplace App you selected, there may be additional configuration options available. See the Configuration Options section below for compatible distributions, recommended plans, and any additional configuration options available for this Marketplace App.

4. Click the Create Linode button. Once the Compute Instance has been provisioned and has fully powered on, wait for the software installation to complete. If the instance is powered off or restarted before this time, the software installation will likely fail.

To verify that the app has been fully installed, see Get Started with Marketplace Apps > Verify Installation. Once installed, follow the instructions within the Getting Started After Deployment section to access the application and start using it.

Note

Estimated deployment time: Wazuh should be fully installed within 10-15 minutes after the Compute Instance has finished provisioning.

Configuration Options

• Supported distributions: Ubuntu 20.04 LTS
• Recommended plan: All plan types and sizes can be used, though an 8GB (or higher) Instance is recommended for production.

Wazuh Options

• Email address (required): Enter the email address to use for generating the SSL certificates.

Limited User (Optional)

You can optionally fill out the following fields to automatically create a limited user for your new Compute Instance. This is recommended for most deployments as an additional security measure. This account will be assigned to the sudo group, which provides elevated permission when running commands with the sudo prefix.

• Limited sudo user: Enter your preferred username for the limited user.
• Password for the limited user: Enter a strong password for the new user.
• SSH public key for the limited user: If you wish to login as the limited user through public key authentication (without entering a password), enter your public key here. See Creating an SSH Key Pair and Configuring Public Key Authentication on a Server for instructions on generating a key pair.
• Disable root access over SSH: To block the root user from logging in over SSH, select Yes (recommended). You can still switch to the root user once logged in and you can also log in as root through Lish.

Custom Domain (Optional)

If you wish to access your application using a custom domain, fill out the following fields.

• Linode API Token: If you wish to use the Linode’s DNS Manager to manage DNS records for your custom domain, create a Linode API Personal Access Token on your account with Read/Write access to Domains. If this is provided along with the subdomain and domain fields (outlined below), the installation attempts to create DNS records via the Linode API. See Get an API Access Token. If you do not provide this field, you need to manually configure your DNS records through your DNS provider and point them to the IP address of the new instance.
• Subdomain: The subdomain you wish to use, such as www for www.example.com.
• Domain: The domain name you wish to use, such as example.com.

Getting Started after Deployment

Accessing the Wazuh App

1. Open a web browser and navigate to the domain you created in the beginning of your deployment. You can also use your Compute Instance’s rDNS, which may look like 203-0-113-0.ip.linodeusercontent.com. See the Managing IP Addresses guide for information on viewing and setting the rDNS value.

2. In the login screen that appears, enter admin as the username and admin as the password. Since the default admin user is set to read-only, you need to follow the steps below to reset the admin password.

   1. Log in to your Compute Instance over SSH. See Connecting to a Remote Server Over SSH for assistance.

   2. Run the Wazuh Password reset tool that has been preloaded onto your instance in the root directory:

      bash /root/wazuh-passwords-tool.sh -a
      

   3. After the tool finishes running, it outputs all of the new passwords for each system. Record these credentials.

   4. You are now able to log in to your Wazuh instance with your new admin credentials.

Now that you’ve accessed your Wazuh instance, you need to configure a Wazuh Agent on the server you’d like to monitor with Wazuh.

For more documentation on Wazuh, check out the official Wazuh documentation to learn how to further utilize your instance.

Note

Currently, Linode does not manage software and systems updates for Marketplace Apps. It is up to the user to perform routine maintenance on software deployed in this fashion.

More Information

You may wish to consult the following resources for additional information on this topic. While these are provided in the hope that they will be useful, please note that we cannot vouch for the accuracy or timeliness of externally hosted materials.

• Wazuh