MVP - Ansible - Roles: wazuh-agent role

[YisDav]

Description

The ansible role for Wazuh agent (roles/wazuh-agent) is a refactored and simplified proposal that allows the installation of the agent (pointing to one or several Wazuh server instances) on multiple, the ones listed in the Wazuh agent tier 1.

For better description, please read the parent commit (#1493).

Tasks

• Develop the Wazuh agent role. The playbook must work with every OS, version, and architecture supported (Agent tier 1) by Wazuh.
• Test the role with all the chosen Wazuh agent tier 1 OSs.

[YisDav]

Update

An update was made to the history of the branches, in order to bring the changes of the working branch (enhancement/1496-wazuh-ansible-spike-implementation-plan) in a fluid way, since these changes are the basis for this issue.

[YisDav]

Update

OS list

OS	Version	Architecture	Available in AWS (official)	Test performed
Ubuntu	24.04	aarch64	Yes	No
Debian	12	x86_64	Yes	No
Redhat	9	aarch64	Yes	No
CentOS Stream	8	x86_64	Requires Suscription	No
Amazon Linux	2023	x86_64	Yes	No
Windows	11	x86_64	Yes	No
MacOS	15 (Sequoia)	x86_64	Yes	No
MacOS	15 (Sequoia)	aarch64	Yes	No

Current status description

Some preliminary test were performed on Ubuntu aarch64, Redhat aarch64, Amazon Linux x86_64 and Windows x86_64, with Wazuh 5.0.0 packages. Also, it was deployed an Ubuntu x86_64 with Wazuh AIO 5.0.0 (manual installation).

These results were found:

• For Windows: Change in the service name of the agent from Wazuh (in the 4.10.1 version) to Wazuh Agent (in the 5.0.0 version)
• For Linux:
  • Required changes to adjust the enrollment method as in Ubuntu aarch64, the installation doesn't recognize the environment variables for agent registration.
  • Fix in ansible tasks, to include force: yes instead of recurse: yes

There are still not packages available for 5.0.0 in arm architectures.
This affects tests on Ubuntu aarch64, Redhat aarch64, and MacOS aarch64

Considerations

• Filebeat: Filebeat tasks will no longer be required.
• Certificates:
  • Server:
    • Certificates path is going to change from /etc/filebeat/certs/ to /etc/wazuh-server/certs/
    • Now, these following certificates are required to start the service, otherwise it fails:
      • indexer-key.pem
      • private-key.pem
      • root-ca.pem
      • server.pem
      • indexer.pem
      • public-key.pem
      • server-key.pem
    • The file /var/ossec/etc/ossec.conf no longer exists. It is replaced by /etc/wazuh-server/wazuh-server.yml
• Agent:
  • Wazuh Agent name in windows now is Wazuh Agent
  • The file /var/ossec/etc/ossec.conf no longer exists, as a replacement migh be used /etc/wazuh-agent/wazuh-agent.yml.
• Dashboard: The configuration file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml does no longer exists

New certificates generation process

The new certificates required by wazuh server are:

• private-key.pem
• public-key.pem (planned to be removed)

This is still an active topic, is being discussed here.

# JWT key files generation
openssl ecparam -name secp256k1 -genkey -noout -out /etc/wazuh-server/certs/private-key.pem
openssl ec -in /etc/wazuh-server/certs/private-key.pem -pubout -out /etc/wazuh-server/certs/public-key.pem
# Change owner
chown wazuh-server:wazuh-server /etc/wazuh-server/certs/*