Install Wazuh Agent in PVE

A

adeel.ctl

New Member
Apr 29, 2024
4
0
1
I have been trying to install the Wazuh agent in my PVE-7, and after trying max I have no option to post a thread here. The errors are given below


Hit:1 http://ftp.debian.org/debian bullseye InRelease
Get:2 http://security.debian.org bullseye-security InRelease [48.4 kB]
Ign:3 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable InRelease
Get:4 http://ftp.debian.org/debian bullseye-updates InRelease [44.1 kB]
Err:5 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release
404 Not Found [IP: 3.161.104.23 443]
Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 144.217.225.162 443]
Reading package lists... Done
E: The repository 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bullseye/InRelease 401 Unauthorized [IP: 144.217.225.162 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bullseye InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
 
Hi,

adeel.ctl said:
Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 144.217.225.162 443]
Reading package lists... Done
Click to expand...
Do you have subscription in your Proxmox VE server?

adeel.ctl said:
Err:5 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release
404 Not Found [IP: 3.161.104.23 443]
Click to expand...
I guess you have to download the deb instead of adding it in your /etc/apt/source
 
adeel.ctl said:
Ign:3 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable InRelease
Click to expand...
I am using this entry:

Code: 
~# cat /etc/apt/sources.list.d/wazuh.list
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main

And the latest release is:
Code: 
~# LANG=C apt policy wazuh-agent | head
wazuh-agent:
  Installed: (none)
  Candidate: 4.7.4-1
  Version table:
     4.7.4-1 500
        500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages

Please look up the installation documentation on how to get that "wazuh.gpg"...
 
still facing the same issue even after updating the /etc/apt/sources.list.d/wazuh.list
Do I need to get subscription to obtain this?
=============================================================================
LANG=C apt policy wazuh-agent | head

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

wazuh-agent:
Installed: (none)
Candidate: 4.7.3-1
Version table:
4.7.3-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
4.7.2-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
4.7.1-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
root@proxmox:~# apt-get update -y
Get:1 https://packages.wazuh.com/4.x/apt stable InRelease [17.3 kB]
Hit:2 http://ftp.debian.org/debian bullseye InRelease
Get:3 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages [40.1 kB]
Get:4 http://security.debian.org bullseye-security InRelease [48.4 kB]
Get:5 http://ftp.debian.org/debian bullseye-updates InRelease [44.1 kB]
Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 170.130.165.90 443]
Reading package lists... Done
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bullseye/InRelease 401 Unauthorized [IP: 170.130.165.90 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bullseye InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
 
adeel.ctl said:
This means we will have to get the subscription to avail this, correct?
Click to expand...
If you are a commercial entity: please buy a license.

If you are non-commercial/private: buy a community license if you want to get access to the enterprise repository or if you want to support Proxmox.

If you do not care: you can use _all_ functions without buying a license. This is GPL software. Just use the "pve-no-subscription" repository and disable the "enterprise"-one. This way you get the same software - just no support.

Please read "3.1.3. Proxmox VE No-Subscription Repository" - https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_package_repositories

:)
 
  • Like
Reactions: jeromehd
Installing Wazuh agent on proxmox was as simple as this. Wazuh dashboard actually provides this command via "Deploy new agent" wizard.

Code: 
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.4-1_amd64.deb && WAZUH_MANAGER=<your_wazuh_manager_ip> dpkg -i ./wazuh-agent_4.7.4-1_amd64.deb

After that

Code: 
systemctl daemon-reload
systemctl enable wazuh-agent.service
systemctl start wazuh-agent.service

In cases where it does not start, I have found that /var/ossec/etc/ossec.conf does not contain correct IP, but string MANAGER_IP. Edit this file, replace with correct IP and restart service.

EDIT:
Also wazuh requires lsb-release package. Install it before apt install lsb-release
 
Last edited:
  • Like
Reactions: Ed Brentnall, jeromehd, smuggler_dinginess005 and 2 others
liepumartins said:
Installing Wazuh agent on proxmox was as simple as this. Wazuh dashboard actually provides this command via "Deploy new agent" wizard.

Code: 
wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.4-1_amd64.deb && WAZUH_MANAGER=<your_wazuh_manager_ip> dpkg -i ./wazuh-agent_4.7.4-1_amd64.deb

After that

Code: 
systemctl daemon-reload
systemctl enable wazuh-agent.service
systemctl start wazuh-agent.service

In cases where it does not start, I have found that /var/ossec/etc/ossec.conf does not contain correct IP, but string MANAGER_IP. Edit this file, replace with correct IP and restart service.

EDIT:
Also wazuh requires lsb-release package. Install it before apt install lsb-release
Click to expand...
Thank you for this, it works as expected.
 
  • Like
Reactions: jeromehd
You must log in or register to reply here.
Top Bottom
Back