security/wazuh-server 4.14.9 FreeBSD

Configuration

Options name: security_wazuh

USES

dos2unix

Service scripts

none

Message after installing

Wazuh server components were installed

1) Wazuh server componenets are based on Wazuh manager and Filebeat projects.
   This guide help you to adapt wazuh configuration for it works on FreeBSD
   using apps are part of ports tree. We are using an alternative way to
   configure wazuh server components on FreeBSD. It is necessary configure
   logstash between filebeat and opensearch because FreeBSD does not include
   versions lesser or equal to 7.16.x of Filebeat into ports tree.

2) Do not forget take a look to wazuh-manager post install message to configure
   the wazuh-server component.

   # pkg info -D -x wazuh-manager | less

3) Copy /usr/local/etc/wazuh-server/filebeat.yml to /usr/local/etc/beats/
   directory

4) Copy /usr/local/etc/wazuh-server/logstash.conf and /usr/local/etc/wazuh-server/wazuh-template.json
   files to /usr/local/etc/logstash/ directory

5) You can use my own version of wazuh certificates generator for generate
   root, admin, indexer, server and dashboard certificates used by wazuh
   components.

   https://people.freebsd.org/~acm/ports/wazuh/wazuh-gen-certs.tar.gz

6) Edit filebeat.yml and logstash.yml files and changes options accord to your
   setup. For example host, ssl, filter, etc. Sample files can give you a good
   guide about that.

7) Install logstash-output-opensearch plugin. Fetch it from rubygems site or opensearch github

   # cd /usr/local/logstash/bin
   # sh -c "JAVA_HOME=/usr/local/openjdk21 ./logstash-plugin install logstash-output-opensearch"

   If there are some issues installing this plugin, try installing gem file directly:

   # fetch https://rubygems.org/downloads/logstash-output-opensearch-2.0.3-java.gem -o \
     /tmp/logstash-output-opensearch-2.0.3-java.gem
   # sh -c "JAVA_HOME=/usr/local/openjdk21 ./logstash-plugin install /tmp/logstash-output-opensearch-2.0.3-java.gem"

8) Check if logstash-output-opensearch plugin was installed

   # sh -c "JAVA_HOME=/usr/local/openjdk21 ./logstash-plugin list | grep logstash-output-opensearch"

9) Add Filebeat and Logstash to /etc/rc.conf

   # sysrc filebeat_enable="YES"
   # sysrc logstash_enable="YES"

10) Current version of logstash8 uses openjdk24 by default, but it doesn't work with logstash-output-opensearch.
    Change it to openjdk21 adding the following:

   # sysrc logstash_java_home="/usr/local/openjdk21"

11) Start Filebeat and Logstash services
   
   # service filebeat start
   # service logstash start

12) You can look more useful information at the following link:

    https://documentation.wazuh.com/current/installation-guide/wazuh-server/step-by-step.html

    Take on mind wazuh arquitecture on FreeBSD is configurated not similar like
    you can read at wazuh guide. Some times you could decided configure logstash
    on another host. If it is your case you must adapt some points in this guide.

13) Enjoy it