Update

An update was made to the history of the branches, in order to bring the changes of the working branch (enhancement/1496-wazuh-ansible-spike-implementation-plan) in a fluid way, since these changes are the basis for this issue.

Update

OS list

Current status description

Some preliminary test were performed on Ubuntu aarch64, Redhat aarch64, Amazon Linux x86_64 and Windows x86_64, with Wazuh 5.0.0 packages. Also, it was deployed an Ubuntu x86_64 with Wazuh AIO 5.0.0 (manual installation).

These results were found:

• For Windows: Change in the service name of the agent from Wazuh (in the 4.10.1 version) to Wazuh Agent (in the 5.0.0 version)
• For Linux:
  • Required changes to adjust the enrollment method as in Ubuntu aarch64, the installation doesn't recognize the environment variables for agent registration.
  • Fix in ansible tasks, to include force: yes instead of recurse: yes

There are still not packages available for 5.0.0 in arm architectures.
This affects tests on Ubuntu aarch64, Redhat aarch64, and MacOS aarch64

Considerations

• Filebeat: Filebeat tasks will no longer be required.
• Certificates:
  • Server:
    • Certificates path is going to change from /etc/filebeat/certs/ to /etc/wazuh-server/certs/
    • Now, these following certificates are required to start the service, otherwise it fails:
      • indexer-key.pem
      • private-key.pem
      • root-ca.pem
      • server.pem
      • indexer.pem
      • public-key.pem
      • server-key.pem
    • The file /var/ossec/etc/ossec.conf no longer exists. It is replaced by /etc/wazuh-server/wazuh-server.yml
• Agent:
  • Wazuh Agent name in windows now is Wazuh Agent
  • The file /var/ossec/etc/ossec.conf no longer exists, as a replacement migh be used /etc/wazuh-agent/wazuh-agent.yml.
• Dashboard: The configuration file /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml does no longer exists

New certificates generation process

The new certificates required by wazuh server are:

• private-key.pem
• public-key.pem (planned to be removed)

This is still an active topic, is being discussed here.

# JWT key files generation
openssl ecparam -name secp256k1 -genkey -noout -out /etc/wazuh-server/certs/private-key.pem
openssl ec -in /etc/wazuh-server/certs/private-key.pem -pubout -out /etc/wazuh-server/certs/public-key.pem
# Change owner
chown wazuh-server:wazuh-server /etc/wazuh-server/certs/*