{"id":805,"date":"2018-10-18T14:14:16","date_gmt":"2018-10-18T14:14:16","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=805"},"modified":"2020-06-17T08:12:13","modified_gmt":"2020-06-17T08:12:13","slug":"how-to-deploy-wazuh-agnet-with-ansible","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-deploy-wazuh-agnet-with-ansible\/","title":{"rendered":"How to deploy wazuh-agent with Ansible"},"content":{"rendered":"

Note<\/span>: For windows ports 5986 and 1515 must be open along with configureansiblescript.ps(powershell script) must have been setup for ansible to be able to communicate and deploy the wazuh-agent to windows machines.<\/strong><\/p>\n

.<\/span><\/span><\/p>\n

In order to deploy the wazuh-agent to a large group of servers that span windows, ubuntu, centos type distros with ansible. Some tweaks need to be made on the wazuh manager and ansible server<\/p>\n

.<\/span><\/span><\/p>\n

This is done on the <\/em>wazuh-manager<\/em><\/strong> server<\/em><\/p>\n

\/var\/ossec\/etc\/ossec.conf \u2013 inside this file the following need to be edited for registrations to have the proper ip of the hosts being registered<\/em><\/p>\n

<auth><\/p>\n

<disabled>no<\/disabled><\/p>\n

<port>1515<\/port><\/p>\n

<use_source_ip>yes<\/use_source_ip><\/strong><\/p>\n

<force_insert>yes<\/force_insert><\/p>\n

<force_time>0<\/force_time><\/p>\n

<purge>yes<\/purge><\/p>\n

\u00a0\u00a0\u00a0\u00a0<use_password>yes<\/use_password><\/strong><\/p>\n

<limit_maxagents>no<\/limit_maxagents><\/p>\n

\u00a0\u00a0\u00a0\u00a0<ciphers>HIGH:!ADH:!EXP:!MD5:RC4:3DES:!CAMELLIA:@STRENGTH<\/ciphers><\/strong><\/p>\n

\u00a0\u00a0\u00a0\u00a0<!– <ssl_agent_ca><\/ssl_agent_ca> –><\/p>\n

<ssl_verify_host>no<\/ssl_verify_host><\/p>\n

<ssl_manager_cert>\/var\/ossec\/etc\/sslmanager.cert<\/ssl_manager_cert><\/p>\n

<ssl_manager_key>\/var\/ossec\/etc\/sslmanager.key<\/ssl_manager_key><\/p>\n

<ssl_auto_negotiate>yes<\/ssl_auto_negotiate><\/p>\n

<\/auth><\/p>\n

To enable authd on wazuh-manager<\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>\/var\/ossec\/bin\/ossec-control enable authd<\/em><\/div>\n<\/div>\n<\/div>\n

Now on your ansible server<\/p>\n

\n
\n
1.<\/span>You need to download the git repository with ansible playbooks for wazuh<\/div>\n<\/div>\n
\n
2.<\/span>git clone <\/em>https:\/\/github.com\/wazuh\/wazuh-ansible<\/em><\/a> <–do this in home directory \/home\/nicktailor<\/em><\/div>\n<\/div>\n
\n
3.<\/span>Next you will see them setup as roles that you would call in your playbook<\/em><\/div>\n

.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n

\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 7 root root 97 Sep 21 13:45 ansible-role-elasticsearch<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 8 root root 110 Sep 21 13:45 ansible-role-filebeat<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 7 root root 97 Sep 21 13:45 ansible-role-kibana<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 7 root root 97 Sep 21 13:45 ansible-role-logstash<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 8 root root 109 Sep 21 13:45 ansible-wazuh-agent<\/em><\/strong>\uf0df this is the role one you want to copy to \/etc\/ansible\/roles<\/em><\/strong><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 8 root root 167 Sep 21 13:45 ansible-wazuh-manager<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 8 root root 163 Sep 21 13:45 .git<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 163 Sep 21 13:45 .gitignore<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>drwxr-x— 2 root root 22 Sep 21 13:45 meta<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 1060 Sep 21 13:45 README.md<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 350 Sep 21 13:45 wazuh-agent.yml\uf0dfthis is the playbook you want to copy to \/etc\/ansible\/playbooks<\/em><\/strong><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 460 Sep 21 13:45 wazuh-elastic_stack-distributed.yml<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 322 Sep 21 13:45 wazuh-elastic_stack-single.yml<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 121 Sep 21 13:45 wazuh-elastic.yml<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 107 Sep 21 13:45 wazuh-kibana.yml<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 106 Sep 21 13:45 wazuh-logstash.yml<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>-rw-r—– 1 root root 159 Sep 21 13:45 wazuh-manager.yml<\/em><\/div>\n<\/div>\n<\/div>\n
\n
\n
4.<\/span>You need to copy the role over to your ansible roles directory<\/em><\/div>\n
\n
\n
a.<\/span>cp -r ansible-wazuh-manger \/etc\/ansible\/roles<\/em><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
5.<\/span>next copy the playbook to your playbook directory<\/em><\/div>\n
\n
\n
b.<\/span>cp wazuh-agent.yml \/etc\/ansible\/playbooks<\/em><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
6.<\/span>Next you need to update the following file with the ip address of the wazuh-manager<\/em><\/div>\n
\n
\n
c.<\/span>\/etc\/ansible\/roles\/ansible-wazuh-agent\/defaults# cat main.yml<\/em><\/div>\n

wazuh_managers:<\/em><\/p>\n

\u00a0\u00a0<\/em>– address: 10.79.240.160<\/em><\/strong><\/p>\n

port: 1514<\/em><\/p>\n

protocol: tcp<\/em><\/p>\n

\u00a0\u00a0\u00a0\u00a0api_port: 55000<\/em><\/p>\n

\u00a0\u00a0\u00a0\u00a0api_proto: ‘http’<\/em><\/p>\n

\u00a0\u00a0\u00a0\u00a0api_user: null<\/em><\/p>\n

wazuh_profile: null<\/em><\/p>\n

wazuh_auto_restart: ‘yes’<\/em><\/p>\n

wazuh_agent_authd:<\/em><\/p>\n

\u00a0\u00a0enable: true<\/em><\/strong><\/p>\n

port: 1515<\/em><\/p>\n

Next section in main.yml<\/em><\/p>\n

\u00a0\u00a0openscap:<\/em><\/p>\n

\u00a0\u00a0\u00a0\u00a0<\/em>disable: ‘no’<\/em><\/strong><\/p>\n

timeout: 1800<\/em><\/p>\n

interval: ‘1d’<\/em><\/p>\n

\u00a0\u00a0\u00a0\u00a0scan_on_start: ‘yes’<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n
7.<\/span>Now you need to add the password you setup on the wazuh-manager for the api user to the ansible authd section:<\/em><\/div>\n
\n
\n
d.<\/span>\/etc\/ansible\/roles\/ansible-wazuh-agent\/vars# cat authd_pass.yml <\/em><\/div>\n<\/div>\n<\/div>\n

# We recommend the use of Ansible Vault to protect Wazuh, api, agentless and authd credentials.<\/em><\/strong><\/p>\n

authd_pass: ‘password’<\/em><\/strong><\/p>\n

\n
\n
e.<\/span>Save the file authd_pass.yml<\/div>\n

.<\/span><\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n
8.<\/span>Next you need to have the hosts listed in your hosts file in ansible \/etc\/ansible\/hosts-whatever<\/div>\n
\n
\n
f.<\/span>Not that for windows machines you will need to ensure the are also listed in \/etc\/hosts. The reason is authd using Kerberos has issues sometimes with dns resolution when attempting open a connection via winrm on port 5986.<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
9.<\/span>Next you must list your hosts in the ansible host file as such<\/div>\n
\n
\n
g.<\/span>\/etc\/ansible\/hosts-linux<\/div>\n
\n
\n
i.<\/span>[linux]<\/div>\n<\/div>\n
\n
ii.<\/span>Server1.nicktailor.com<\/div>\n<\/div>\n
\n
iii.<\/span>Server2.nicktailor.com<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
h.<\/span>\/etc\/ansible\/hosts-windows<\/div>\n
\n
\n
iv.<\/span>[windows]<\/div>\n<\/div>\n
\n
v.<\/span>Server1-w.nicktailor.com<\/div>\n<\/div>\n
\n
vi.<\/span>Server2-2.nicktailor.com<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

Test communication to windows machines via ansible run the following from \/etc\/ansible<\/em><\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>ansible windows -i \/etc\/ansible\/hosts-windows -m ping<\/em><\/div>\n<\/div>\n
\n
\u2022<\/span>\u00a0<\/span>ansible gsdprdint -i \/etc\/ansible\/hosts-prod-linux -m ping –vault-password-file \/etc\/ansible\/vaultpw.txt -u ansiblenick -k -K<\/em><\/div>\n<\/div>\n<\/div>\n

How to run he playbook on linux machines, run from \/etc\/ansible\/playbook\/<\/em><\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>ansible-playbook mars -i \/etc\/ansible\/hosts-prod-linux \/etc\/ansible\/playbooks\/wazuh-agent.yml –vault-password-file \/etc\/ansible\/vaultpw.txt -u ansiblenick -k -K<\/em><\/div>\n<\/div>\n<\/div>\n

How to run playbook on windows<\/strong><\/p>\n

\n
\n
\u2022<\/span>\u00a0<\/span>ansible-playbook -i \/etc\/ansible\/hosts-windows \/etc\/ansible\/playbooks\/wazuh-agent.yml –vault-password-file \/etc\/ansible\/vaultpw.txt -u ansiblenickt -k -K<\/em><\/div>\n<\/div>\n<\/div>\n

.<\/span><\/span><\/p>\n

Ansible playbook-roles-tasks breakdown<\/span><\/strong><\/p>\n

:\/etc\/ansible\/playbooks# cat <\/em><\/span>wazuh-agent.<\/em><\/span>yml<\/em><\/span>\uf0dfplaybook file<\/p>\n

– hosts: all:!wazuh-manager<\/p>\n

roles:<\/p>\n

– ansible-wazuh-agent\uf0dfroles that is called<\/p>\n

vars:<\/p>\n

\u00a0\u00a0\u00a0\u00a0wazuh_managers:<\/p>\n

– address: 192.168.10.10<\/p>\n

port: 1514<\/p>\n

protocol: udp<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0api_port: 55000<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0api_proto: ‘http’<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0api_user: ansible<\/p>\n

\u00a0\u00a0\u00a0\u00a0wazuh_agent_authd:<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0enable: true<\/p>\n

port: 1515<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ssl_agent_ca: null<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ssl_auto_negotiate: ‘no<\/p>\n

.<\/span><\/span><\/p>\n

Roles:<\/em> ansible-wazuh-agent<\/p>\n

:\/etc\/ansible\/roles\/ansible-wazuh-agent\/tasks# cat Linux.yml<\/p>\n

—<\/p>\n

– import_tasks: “RedHat.yml”<\/p>\n

when: ansible_os_family == “RedHat”<\/p>\n

.<\/span><\/span><\/p>\n

– import_tasks: “Debian.yml”<\/p>\n

when: ansible_os_family == “Debian”<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Install wazuh-agent<\/p>\n

\u00a0\u00a0become: yes<\/p>\n

package: name=wazuh-agent state=present<\/p>\n

async: 90<\/p>\n

poll: 15<\/p>\n

tags:<\/p>\n

– init<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Check if client.keys exists<\/p>\n

\u00a0\u00a0become: yes<\/p>\n

stat: path=\/var\/ossec\/etc\/client.keys<\/p>\n

register: check_keys<\/p>\n

tags:<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

This task I added. If the client.keys file exists the registration on linux simply skips over when the playbook runs. You may want to disable this later, however when deploying to new machines probably best to have it active<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

– name: empty client key file<\/em><\/strong><\/p>\n

\u00a0\u00a0become: yes<\/em><\/strong><\/p>\n

command: rm -f \/var\/ossec\/etc\/client.keys<\/em><\/strong><\/p>\n

command: touch \/var\/ossec\/etc\/client.keys<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Agent registration via authd<\/p>\n

block:<\/p>\n

– name: Retrieving authd Credentials<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0include_vars: authd_pass.yml<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– authd<\/p>\n

.<\/span><\/span><\/p>\n

– name: Copy CA, SSL key and cert for authd<\/p>\n

copy:<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0src: “{{ item }}”<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0dest: “\/var\/ossec\/etc\/{{ item | basename }}”<\/p>\n

mode: 0644<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0with_items:<\/p>\n

– “{{ wazuh_agent_authd.ssl_agent_ca }}”<\/p>\n

– “{{ wazuh_agent_authd.ssl_agent_cert }}”<\/p>\n

– “{{ wazuh_agent_authd.ssl_agent_key }}”<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– authd<\/p>\n

when:<\/p>\n

– wazuh_agent_authd.ssl_agent_ca is not none<\/p>\n

.<\/span><\/span><\/p>\n

This section below is the most important section as this what registers the machine to wazuh, if this section is skipped its usually due to client.keys file. I have made adjustments from the original git repository as I found it had some issues.<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0– name: Linux | Register agent (via authd)<\/em><\/strong><\/p>\n

shell: ><\/em><\/strong><\/p>\n

\/var\/ossec\/bin\/agent-auth<\/em><\/strong><\/p>\n

-m {{ wazuh_managers.0.address }}<\/em><\/strong><\/p>\n

-p {{ wazuh_agent_authd.port }}<\/em><\/strong><\/p>\n

{% if authd_pass is defined %}-P {{ authd_pass }}{% endif %}<\/em><\/strong><\/p>\n

{% if wazuh_agent_authd.ssl_agent_ca is not none %}<\/em><\/strong><\/p>\n

-v “\/var\/ossec\/etc\/{{ wazuh_agent_authd.ssl_agent_ca | basename }}”<\/em><\/strong><\/p>\n

-x “\/var\/ossec\/etc\/{{ wazuh_agent_authd.ssl_agent_cert | basename }}”<\/em><\/strong><\/p>\n

-k “\/var\/ossec\/etc\/{{ wazuh_agent_authd.ssl_agent_key | basename }}”<\/em><\/strong><\/p>\n

{% endif %}<\/em><\/strong><\/p>\n

{% if wazuh_agent_authd.ssl_auto_negotiate == ‘yes’ %}-a{% endif %}<\/em><\/strong><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0become: yes<\/em><\/strong><\/p>\n

register: agent_auth_output<\/em><\/strong><\/p>\n

when:<\/em><\/strong><\/p>\n

– check_keys.stat.size == 0<\/em><\/strong><\/p>\n

– wazuh_managers.0.address is not none<\/em><\/strong><\/p>\n

tags:<\/em><\/strong><\/p>\n

– config<\/em><\/strong><\/p>\n

– authd<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Verify agent registration<\/p>\n

shell: echo {{ agent_auth_output }} | grep “Valid key created”<\/p>\n

when:<\/p>\n

– check_keys.stat.size == 0<\/p>\n

– wazuh_managers.0.address is not none<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– authd<\/p>\n

.<\/span><\/span><\/p>\n

when: wazuh_agent_authd.enable == true<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Agent registration via rest-API<\/p>\n

block:<\/p>\n

.<\/span><\/span><\/p>\n

– name: Retrieving rest-API Credentials<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0include_vars: api_pass.yml<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– api<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Create the agent key via rest-API<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0uri:<\/p>\n

url: “{{ wazuh_managers.0.api_proto }}:\/\/{{ wazuh_managers.0.address }}:{{ wazuh_managers.0.api_port }}\/agents\/”<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0validate_certs: no<\/p>\n

method: POST<\/p>\n

body: {“name”:”{{ inventory_hostname }}”}<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0body_format: json<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0status_code: 200<\/p>\n

\u00a0\u00a0\u00a0 headers:<\/p>\n

Content-Type: “application\/json”<\/p>\n

user: “{{ wazuh_managers.0.api_user }}”<\/p>\n

password: “{{ api_pass }}”<\/p>\n

register: newagent_api<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0changed_when: newagent_api.json.error == 0<\/p>\n

when:<\/p>\n

– check_keys.stat.size == 0<\/p>\n

– wazuh_managers.0.address is not none<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0become: no<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– api<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Retieve new agent data via rest-API<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0uri:<\/p>\n

url: “{{ wazuh_managers.0.api_proto }}:\/\/{{ wazuh_managers.0.address }}:{{ wazuh_managers.0.api_port }}\/agents\/{{ newagent_api.json.data.id }}”<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0validate_certs: no<\/p>\n

method: GET<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return_content: yes<\/p>\n

user: “{{ wazuh_managers.0.api_user }}”<\/p>\n

password: “{{ api_pass }}”<\/p>\n

when:<\/p>\n

– check_keys.stat.size == 0<\/p>\n

– wazuh_managers.0.address is not none<\/p>\n

– newagent_api.json.error == 0<\/p>\n

register: newagentdata_api<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0delegate_to: localhost<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0become: no<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– api<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Register agent (via rest-API)<\/p>\n

command: \/var\/ossec\/bin\/manage_agents<\/p>\n

environment:<\/p>\n

OSSEC_ACTION: i<\/p>\n

OSSEC_AGENT_NAME: ‘{{ newagentdata_api.json.data.name }}’<\/p>\n

OSSEC_AGENT_IP: ‘{{ newagentdata_api.json.data.ip }}’<\/p>\n

OSSEC_AGENT_ID: ‘{{ newagent_api.json.data.id }}’<\/p>\n

OSSEC_AGENT_KEY: ‘{{ newagent_api.json.data.key }}’<\/p>\n

OSSEC_ACTION_CONFIRMED: y<\/p>\n

register: manage_agents_output<\/p>\n

when:<\/p>\n

– check_keys.stat.size == 0<\/p>\n

– wazuh_managers.0.address is not none<\/p>\n

– newagent_api.changed<\/p>\n

tags:<\/p>\n

– config<\/p>\n

– api<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0notify: restart wazuh-agent<\/p>\n

.<\/span><\/span><\/p>\n

when: wazuh_agent_authd.enable == false<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Vuls integration deploy (runs in background, can take a while)<\/p>\n

command: \/var\/ossec\/wodles\/vuls\/deploy_vuls.sh {{ ansible_distribution|lower }} {{ ansible_distribution_major_version|int }}<\/p>\n

\u00a0\u00a0args:<\/p>\n

creates: \/var\/ossec\/wodles\/vuls\/config.toml<\/p>\n

async: 3600<\/p>\n

poll: 0<\/p>\n

when:<\/p>\n

– wazuh_agent_config.vuls.disable != ‘yes’<\/p>\n

– ansible_distribution == ‘Redhat’ or ansible_distribution == ‘CentOS’ or ansible_distribution == ‘Ubuntu’ or ansible_distribution == ‘Debian’ or ansible_distribution == ‘Oracle’<\/p>\n

tags:<\/p>\n

– init<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Installing agent configuration (ossec.conf)<\/p>\n

\u00a0\u00a0become: yes<\/p>\n

template: src=var-ossec-etc-ossec-agent.conf.j2<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0dest=\/var\/ossec\/etc\/ossec.conf<\/p>\n

owner=root<\/p>\n

group=ossec<\/p>\n

mode=0644<\/p>\n

\u00a0\u00a0notify: restart wazuh-agent<\/p>\n

\u00a0\u00a0tags:<\/p>\n

– init<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

– name: Linux | Ensure Wazuh Agent service is restarted and enabled<\/p>\n

\u00a0\u00a0become: yes<\/p>\n

service:<\/p>\n

name: wazuh-agent<\/p>\n

enabled: yes<\/p>\n

state: restarted<\/p>\n

.<\/span><\/span><\/p>\n

– import_tasks: “RMRedHat.yml”<\/p>\n

when: ansible_os_family == “RedHat”<\/p>\n

.<\/span><\/span><\/p>\n

– import_tasks: “RMDebian.yml”<\/p>\n

when: ansible_os_family == “Debian”<\/p>\n

.<\/span><\/span><\/p>\n

Windows- tasks<\/span><\/strong><\/p>\n

Note: This section only works if your ansible is configured to communicate with Windows machines. It requires that port 5986 from ansible to windows is open and then port 1515 from the window machine to the wazuh-manager is open.<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

Problems: When using authd and Kerberos for windows ensure you have the host name listed in \/etc\/hosts on the ansible server to help alleviate agent deployment issues. Its script does not seem to handle well when you have more than 5 or 6 clients at a time at least in my experience.<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

Either I had to rejoint the windows machine to the domain or remove the client.keys file. I have updated this task to include the task to remove the client.keys file before it check to see if it exists. You do need to play with it a bit sometimes. I have also added a section that adds the wazuh-agent as a service and restarts it upon deployment as I found it sometimes skipped this entirely.<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

:\/etc\/ansible\/roles\/ansible-<\/em><\/span>wazuh<\/em><\/span>-agent\/tasks# cat <\/em><\/span>Windows.yml<\/em><\/span><\/p>\n

—<\/p>\n

– name: Windows | Get current installed version<\/p>\n

\u00a0\u00a0win_shell: “{{ wazuh_winagent_config.install_dir }}ossec-agent.exe -h”<\/p>\n

\u00a0\u00a0args:<\/p>\n

removes: “{{ wazuh_winagent_config.install_dir }}ossec-agent.exe”<\/p>\n

register: agent_version<\/p>\n

\u00a0\u00a0failed_when: False<\/p>\n

\u00a0\u00a0changed_when: False<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Check Wazuh agent version installed<\/p>\n

\u00a0\u00a0set_fact: correct_version=true<\/p>\n

when:<\/p>\n

– agent_version.stdout is defined<\/p>\n

– wazuh_winagent_config.version in agent_version.stdout<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Downloading windows Wazuh agent installer<\/p>\n

\u00a0\u00a0win_get_url:<\/p>\n

\u00a0\u00a0\u00a0\u00a0dest: C:\\wazuh-agent-installer.msi<\/p>\n

url: “{{ wazuh_winagent_config.repo }}wazuh-agent-{{ wazuh_winagent_config.version }}-{{ wazuh_winagent_config.revision }}.msi”<\/p>\n

when:<\/p>\n

– correct_version is not defined<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Verify the downloaded Wazuh agent installer<\/p>\n

\u00a0\u00a0win_stat:<\/p>\n

path: C:\\wazuh-agent-installer.msi<\/p>\n

\u00a0\u00a0\u00a0\u00a0get_checksum: yes<\/p>\n

\u00a0\u00a0\u00a0\u00a0checksum_algorithm: md5<\/p>\n

register: installer_md5<\/p>\n

when:<\/p>\n

– correct_version is not defined<\/p>\n

\u00a0\u00a0failed_when:<\/p>\n

– installer_md5.stat.checksum != wazuh_winagent_config.md5<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Install Wazuh agent<\/p>\n

\u00a0\u00a0win_package:<\/p>\n

path: C:\\wazuh-agent-installer.msi<\/p>\n

arguments: APPLICATIONFOLDER={{ wazuh_winagent_config.install_dir }}<\/p>\n

when:<\/p>\n

– correct_version is not defined<\/p>\n

.<\/span><\/span><\/p>\n

This section was added. If it was present registrations would skip<\/em><\/strong><\/p>\n

– name: Remove a file, if present<\/em><\/strong><\/p>\n

\u00a0\u00a0win_file:<\/em><\/strong><\/p>\n

path: C:\\wazuh-agent\\client.keys<\/em><\/strong><\/p>\n

state: absent<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

This section was added for troubleshooting purposes<\/em><\/strong><\/p>\n

#- name: Touch a file (creates if not present, updates modification time if present)<\/em><\/strong><\/p>\n

# win_file:<\/em><\/strong><\/p>\n

# path: C:\\wazuh-agent\\client.keys<\/em><\/strong><\/p>\n

# state: touch<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Check if client.keys exists<\/p>\n

\u00a0\u00a0win_stat: path=”{{ wazuh_winagent_config.install_dir }}client.keys”<\/p>\n

register: check_windows_key<\/p>\n

\u00a0\u00a0notify: restart wazuh-agent windows<\/p>\n

tags:<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

– name: Retrieving authd Credentials<\/p>\n

\u00a0\u00a0include_vars: authd_pass.yml<\/p>\n

tags:<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Register agent<\/p>\n

\u00a0\u00a0win_shell: ><\/p>\n

\u00a0\u00a0\u00a0\u00a0{{ wazuh_winagent_config.install_dir }}agent-auth.exe<\/p>\n

-m {{ wazuh_managers.0.address }}<\/p>\n

-p {{ wazuh_agent_authd.port }}<\/p>\n

{% if authd_pass is defined %}-P {{ authd_pass }}{% endif %}<\/p>\n

\u00a0\u00a0args:<\/p>\n

\u00a0\u00a0\u00a0\u00a0chdir: “{{ wazuh_winagent_config.install_dir }}”<\/p>\n

register: agent_auth_output<\/p>\n

\u00a0\u00a0notify: restart wazuh-agent windows<\/p>\n

when:<\/p>\n

– wazuh_agent_authd.enable == true<\/p>\n

– check_windows_key.stat.exists == false<\/p>\n

– wazuh_managers.0.address is not none<\/p>\n

tags:<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Installing agent configuration (ossec.conf)<\/p>\n

\u00a0\u00a0win_template:<\/p>\n

\u00a0\u00a0\u00a0\u00a0src: var-ossec-etc-ossec-agent.conf.j2<\/p>\n

\u00a0\u00a0\u00a0\u00a0dest: “{{ wazuh_winagent_config.install_dir }}ossec.conf”<\/p>\n

\u00a0\u00a0notify: restart wazuh-agent windows<\/p>\n

tags:<\/p>\n

– config<\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Delete downloaded Wazuh agent installer file<\/p>\n

\u00a0\u00a0win_file:<\/p>\n

path: C:\\wazuh-agent-installer.msi<\/p>\n

state: absent<\/p>\n

.<\/span><\/span><\/p>\n

These section was added as the service sometimes was not created and the agent was not restarted upon deployment which resulted in a non active client In kibana<\/em><\/strong><\/p>\n

– name: Create a new service<\/em><\/strong><\/p>\n

\u00a0\u00a0win_service:<\/em><\/strong><\/p>\n

name: wazuh-agent<\/em><\/strong><\/p>\n

path: C:\\wazuh-agent\\ossec-agent.exe<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

– name: Windows | Wazuh-agent Restart<\/em><\/strong><\/p>\n

\u00a0\u00a0win_service:<\/em><\/strong><\/p>\n

name: wazuh-agent<\/em><\/strong><\/p>\n

state: restarted<\/em><\/strong><\/p>\n

.<\/span><\/span><\/p>\n

.<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Note: For windows ports 5986 and 1515 must be open along with configureansiblescript.ps(powershell script) must have been setup for ansible to be able to communicate and deploy the wazuh-agent to windows machines. . In order to deploy the wazuh-agent to a large group of servers that span windows, ubuntu, centos type distros with ansible. Some tweaks need to be madeRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51,56],"tags":[],"class_list":["post-805","post","type-post","status-publish","format-standard","hentry","category-ansible","category-wazuh"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=805"}],"version-history":[{"count":12,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/805\/revisions"}],"predecessor-version":[{"id":1061,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/805\/revisions\/1061"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}