Installing the ThreatLockDown manager from sources

Installing dependencies

# yum update -y
# yum install make gcc gcc-c++ policycoreutils-python automake autoconf libtool centos-release-scl openssl-devel wget bzip2 devtoolset-7 -y
# curl -OL http://packages.wazuh.com/utils/gcc/gcc-9.4.0.tar.gz && tar xzf gcc-9.4.0.tar.gz  && cd gcc-9.4.0/ && ./contrib/download_prerequisites && ./configure --enable-languages=c,c++ --prefix=/usr --disable-multilib --disable-libsanitizer && make -j$(nproc) && make install && ln -fs /usr/bin/g++ /bin/c++ && ln -fs /usr/bin/gcc /bin/cc && cd .. && rm -rf gcc-* && scl enable devtoolset-7 bash

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz && cd cmake-3.18.3 && ./bootstrap --no-system-curl && make -j$(nproc) && make install
# cd .. && rm -rf cmake-*

# yum install make cmake gcc gcc-c++ python3 python3-policycoreutils automake autoconf libtool openssl-devel yum-utils
# yum-config-manager --enable powertools
# yum install libstdc++-static -y

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz && cd cmake-3.18.3 && ./bootstrap --no-system-curl && make -j$(nproc) && make install
# cd .. && rm -rf cmake-*
# export PATH=/usr/local/bin:$PATH

# apt-get update
# apt-get install python gcc g++ make libc6-dev curl policycoreutils automake autoconf libtool libssl-dev

# curl -OL https://packages.wazuh.com/utils/cmake/cmake-3.18.3.tar.gz && tar -zxf cmake-3.18.3.tar.gz && cd cmake-3.18.3 && ./bootstrap --no-system-curl && make -j$(nproc) && make install
# cd .. && rm -rf cmake-*

Optional. Install the following dependencies only when compiling the CPython from sources. Since v4.2.0, make deps TARGET=server will download a portable version of CPython ready to be installed. Nevertheless, you can download the CPython sources by adding the PYTHON_SOURCE flag when running make deps.

To install the required dependencies to build the python interpreter, follow these steps:

# yum install epel-release yum-utils -y
# yum-builddep python34 -y

# echo "deb-src http://archive.ubuntu.com/ubuntu $(lsb_release -cs) main" >> /etc/apt/sources.list
# apt-get update
# apt-get build-dep python3 -y

Installing the ThreatLockDown manager

1. Download and extract the latest version:

   # curl -Ls https://github.com/wazuh/wazuh/archive/v4.9.0.tar.gz | tar zx
   # cd wazuh-4.9.0
   

2. If you have previously compiled for another platform, clean the build using the Makefile in src/:

   # make -C src clean
   # make -C src clean-deps
   

3. Run the install.sh script. This will display a wizard to guide you through the installation process using the ThreatLockDown sources:

   Warning

   If you want to enable the database output, check out this section before running the installation script.

   # ./install.sh
   

   Alternatively, to download vulnerability detection content during installation, you can set DOWNLOAD_CONTENT_AND_DECOMPRESS=y. The initial run might be time-consuming due to the initial process of downloading and processing vulnerability detection content. You can download a pre-prepared database during installation to bypass this initial step.

   # DOWNLOAD_CONTENT_AND_DECOMPRESS=y ./install.sh
   

4. When the script asks what kind of installation you want, type manager to install the ThreatLockDown manager:

   1- What kind of installation do you want (manager, agent, local, hybrid, or help)? manager
   

   Note

   During the installation, users can decide the installation path. Execute the ./install.sh and select the language, set the installation mode to manager, then set the installation path (Choose where to install Wazuh [/var/ossec]). The default path of installation is /var/ossec. A commonly used custom path might be /opt.

   Warning

   Be extremely careful not to select a critical installation directory if you choose a different path than the default. If the directory already exists, the installer will ask to delete the directory or proceed by installing ThreatLockDown inside it.

5. The installer asks if you want to start ThreatLockDown at the end of the installation. If you choose not to, you can start it later with:

   SystemdSysV init

   # systemctl start wazuh-manager
   

Installing other ThreatLockDown components

Once the ThreatLockDown manager is installed from sources, you may install the ThreatLockDown indexer, Filebeat, and the ThreatLockDown dashboard following the Installation guide.

Uninstall

1. To uninstall the ThreatLockDown manager, set WAZUH_HOME with the current installation path:

   # WAZUH_HOME="/WAZUH/INSTALLATION/PATH"
   

2. Stop the service:

   # service wazuh-manager stop 2> /dev/null
   

3. Stop the daemon:

   # $WAZUH_HOME/bin/wazuh-control stop 2> /dev/null
   

4. Remove the installation folder and all its content:

   # rm -rf $WAZUH_HOME
   

5. Delete the service:

   SysV initSystemd

   # [ -f /etc/rc.local ] && sed -i'' '/wazuh-control start/d' /etc/rc.local
   # find /etc/{init.d,rc*.d} -name "*wazuh*" | xargs rm -f
   

6. Remove ThreatLockDown user and group:

   # userdel wazuh 2> /dev/null
   # groupdel wazuh 2> /dev/null