Install Wazuh Agent in PVE

[adeel.ctl]

I have been trying to install the Wazuh agent in my PVE-7, and after trying max I have no option to post a thread here. The errors are given below


Hit:1 http://ftp.debian.org/debian bullseye InRelease
Get:2 http://security.debian.org bullseye-security InRelease [48.4 kB]
Ign:3 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable InRelease
Get:4 http://ftp.debian.org/debian bullseye-updates InRelease [44.1 kB]
Err:5 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release
404 Not Found [IP: 3.161.104.23 443]
Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 144.217.225.162 443]
Reading package lists... Done
E: The repository 'https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bullseye/InRelease 401 Unauthorized [IP: 144.217.225.162 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bullseye InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

 

[Moayad]

Hi,

Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 144.217.225.162 443]
Reading package lists... Done

Do you have subscription in your Proxmox VE server?

Err:5 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable Release
404 Not Found [IP: 3.161.104.23 443]

I guess you have to download the deb instead of adding it in your /etc/apt/source

 

[UdoB]

Ign:3 https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-manager/wazuh-manager_4.7.3-1_amd64.deb stable InRelease

I am using this entry:

~# cat /etc/apt/sources.list.d/wazuh.list
deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main

And the latest release is:

~# LANG=C apt policy wazuh-agent | head
wazuh-agent:
  Installed: (none)
  Candidate: 4.7.4-1
  Version table:
     4.7.4-1 500
        500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages

Please look up the installation documentation on how to get that "wazuh.gpg"...

 

[adeel.ctl]

still facing the same issue even after updating the /etc/apt/sources.list.d/wazuh.list
Do I need to get subscription to obtain this?
=============================================================================
LANG=C apt policy wazuh-agent | head

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

wazuh-agent:
Installed: (none)
Candidate: 4.7.3-1
Version table:
4.7.3-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
4.7.2-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
4.7.1-1 500
500 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages
root@proxmox:~# apt-get update -y
Get:1 https://packages.wazuh.com/4.x/apt stable InRelease [17.3 kB]
Hit:2 http://ftp.debian.org/debian bullseye InRelease
Get:3 https://packages.wazuh.com/4.x/apt stable/main amd64 Packages [40.1 kB]
Get:4 http://security.debian.org bullseye-security InRelease [48.4 kB]
Get:5 http://ftp.debian.org/debian bullseye-updates InRelease [44.1 kB]
Err:6 https://enterprise.proxmox.com/debian/pve bullseye InRelease
401 Unauthorized [IP: 170.130.165.90 443]
Reading package lists... Done
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bullseye/InRelease 401 Unauthorized [IP: 170.130.165.90 443]
E: The repository 'https://enterprise.proxmox.com/debian/pve bullseye InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

 

[UdoB]

E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bullseye/InRelease 401 Unauthorized [IP: 170.130.165.90 443]

"3.1.3. Proxmox VE No-Subscription Repository" : https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_package_repositories

 

[adeel.ctl]

This means we will have to get the subscription to avail this, correct?

 

[UdoB]

This means we will have to get the subscription to avail this, correct?

If you are a commercial entity: please buy a license.

If you are non-commercial/private: buy a community license if you want to get access to the enterprise repository or if you want to support Proxmox.

If you do not care: you can use _all_ functions without buying a license. This is GPL software. Just use the "pve-no-subscription" repository and disable the "enterprise"-one. This way you get the same software - just no support.

Please read "3.1.3. Proxmox VE No-Subscription Repository" - https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_package_repositories

 

[adeel.ctl]

where can I get the quotes for either kind of licenses?

 

[UdoB]

https://shop.proxmox.com ;-)

 

[liepumartins]

Installing Wazuh agent on proxmox was as simple as this. Wazuh dashboard actually provides this command via "Deploy new agent" wizard.

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.7.4-1_amd64.deb && WAZUH_MANAGER='<your_wazuh_manager_ip>' dpkg -i ./wazuh-agent_4.7.4-1_amd64.deb

After that

systemctl daemon-reload
systemctl enable wazuh-agent.service
systemctl start wazuh-agent.service

In cases where it does not start, I have found that /var/ossec/etc/ossec.conf does not contain correct IP, but string MANAGER_IP. Edit this file, replace with correct IP and restart service.

EDIT:
Also wazuh requires lsb-release package. Install it before apt install lsb-release