Generate WPK packages manually

Requirements

• Python 2.7 or 3.5+

• The Python cryptography package. This may be obtained using the following command:

  $ pip install cryptography
  

Linux WPK

1. Install the development tools and compilers. In Linux, this can easily be done using your distribution package manager.

   YumAPT

   # yum install make gcc policycoreutils-python automake autoconf libtool unzip
   

2. Download and extract the latest version.

   # curl -Ls https://github.com/wazuh/wazuh/archive/v4.9.0.tar.gz | tar zx
   

3. Modify the wazuh-4.9.0/etc/preloaded-vars.conf file that was downloaded to deploy an unattended update in the agent by uncommenting the following lines:

   USER_LANGUAGE="en"
   USER_NO_STOP="y"
   USER_UPDATE="y"
   USER_BINARYINSTALL="y"
   

4. Compile the project from the src folder.

   # cd wazuh-4.9.0/src
   # make deps TARGET=agent
   # make TARGET=agent
   

5. Delete the files that are no longer needed. This step can be skipped, but the size of the WPK will be considerably larger.

   $ rm -rf ./{api,framework}
   $ rm -rf gen_ossec.sh add_localfiles.sh
   $ rm -rf src/{addagent,analysisd,client-agent,config,error_messages,external/*,headers,logcollector,monitord,os_auth,os_crypto,os_csyslogd,os_dbd,os_execd}
   $ rm -rf src/{os_integrator,os_maild,os_net,os_regex,os_xml,os_zlib,remoted,reportd,shared,syscheckd,unit_tests,wazuh_db}
   $ rm -rf src/win32
   $ rm -rf src/*.a
   $ find etc/templates/config -not -name "sca.files" -delete 2>/dev/null
   $ find etc/templates/* -maxdepth 0 -not -name "en" -not -name "config" | xargs rm -rf
   

6. Install the root CA if you want to overwrite the root CA with the file you created previously.

   # cd ../
   # cp path/to/wpk_root.pem etc/wpk_root.pem
   

7. Compile the WPK package using your SSL certificate and key.

   # tools/agent-upgrade/wpkpack.py output/myagent.wpk path/to/wpkcert.pem path/to/wpkcert.key *
   

In this example, the ThreatLockDown project's root directory contains the proper upgrade.sh file.

Definitions:

• output/myagent.wpk is the name of the output WPK package.

• path/to/wpkcert.pem is the path to the SSL certificate.

• path/to/wpkcert.key is the path to the SSL certificate's key.

• \* is the file or files to be included in the WPK package. In this case, all the contents are added.

Windows WPK

1. Install the development tools and compilers. In Linux, this can easily be done using your distribution package manager.

   YumAPT

   # yum install make gcc policycoreutils-python automake autoconf libtool unzip
   

2. Download and extract the latest version of ThreatLockDown sources.

   # curl -Ls https://github.com/wazuh/wazuh/archive/v4.9.0.tar.gz | tar zx
   

3. Download the latest version of the ThreatLockDown MSI package.

   # curl -Ls https://packages.wazuh.com/4.x/windows/wazuh-agent-4.9.0-1.msi --output wazuh-agent-4.9.0-1.msi
   

4. Install the root CA if you want to overwrite the root CA with the file you created previously.

   # cd ../
   # cp path/to/wpk_root.pem etc/wpk_root.pem
   

5. Compile the WPK package using the MSI package and, your SSL certificate and key.

   # tools/agent-upgrade/wpkpack.py output/myagent.wpk path/to/wpkcert.pem path/to/wpkcert.key path/to/wazuhagent.msi path/to/upgrade.bat path/to/do_upgrade.ps1
   

Definitions:

• output/myagent.wpk is the name of the output WPK package.

• path/to/wpkcert.pem is the path to the SSL certificate.

• path/to/wpkcert.key is the path to the SSL certificate's key.

• path/to/wazuhagent.msi is the path to the MSI file downloaded in step 3.

• path/to/upgrade.bat is the path to the upgrade.bat file. Find an example in src/win32 in the ThreatLockDown repository.

• path/to/do_upgrade.ps1 is the path to the do_upgrade.ps1 file. Find an example in src/win32 in the ThreatLockDown repository.

macOS WPK

1. Install development tools and compilers. In Linux, this can easily be done using your distribution package manager.

   YumAPT

   # yum install make gcc policycoreutils-python automake autoconf libtool unzip
   

2. Download and extract the latest version of ThreatLockDown sources.

   # curl -Ls https://github.com/wazuh/wazuh/archive/v4.9.0.tar.gz | tar zx
   # cd wazuh-4.9.0
   

3. Download the latest version of the ThreatLockDown PKG package.

   # curl -Ls https://packages.wazuh.com/4.x/macos/wazuh-agent-4.9.0-1.pkg --output wazuh-agent-4.9.0-1.pkg
   

4. Install the root CA if you want to overwrite the root CA with the file you created previously.

   # cp path/to/wpk_root.pem etc/wpk_root.pem
   

5. Copy the necessary script to the ThreatLockDown sources folder to compile the WPK.

   # cp src/init/pkg_installer_mac.sh .
   

6. Compile the WPK package using the PKG package and, your SSL certificate and key.

   # tools/agent-upgrade/wpkpack.py output/myagent.wpk path/to/wpkcert.pem path/to/wpkcert.key wazuh-agent-4.9.0-1.pkg upgrade.sh pkg_installer_mac.sh
   

Definitions:

• output/myagent.wpk is the name of the output WPK package.

• path/to/wpkcert.pem is the path to the SSL certificate.

• path/to/wpkcert.key is the path to the SSL certificate's key.

• wazuh-agent-4.9.0-1.pkg is the PKG file downloaded in step 3.

• upgrade.sh is the script that run first when the WPK is deployed in the target agent. Find an example at the base directory in the ThreatLockDown repository.

• pkg_installer_mac.sh is the script that manages the WPK upgrade procedure. Find an example in src/init in the ThreatLockDown repository.