Mad_Scientist

i am attempting to get wazuh running on my engineering server (that also hosts acouple of VM'S) in docker. I used the guide here https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html so far what i did was copy the contents of the "single node" directory, to the wazuh docker project folder created by unraid. This put the .yml file in the right spot and unraid was able to start the stack with compose manager (but it didn't do anything). If you follow the instructions at the link, you also need to generate certs and I think that's where the failure is. I get a error after the certs are generated. I'm not sure if I'm on the right track to get this working so want to check in on alternative methods before i continue down this path. this is the error I get when trying to run the certs docker compose file root@ENGINEERING-SVR:/boot/config/plugins/compose.manager/projects/wazuh# sudo docker-compose -f generate-indexer-certs.yml run --rm generator % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 26847 100 26847 0 0 476k 0 --:--:-- --:--:-- --:--:-- 476k Cert tool exists in Packages bucket 25/07/2023 14:37:26 INFO: Admin certificates created. 25/07/2023 14:37:27 INFO: Wazuh indexer certificates created. 25/07/2023 14:37:27 INFO: Wazuh server certificates created. 25/07/2023 14:37:27 INFO: Wazuh dashboard certificates created. Moving created certificates to destination directory changing certificate permissions Setting UID indexer and dashboard chown: changing ownership of '/certificates/admin-key.pem': Operation not permitted chown: changing ownership of '/certificates/admin.pem': Operation not permitted chown: changing ownership of '/certificates/root-ca-manager.key': Operation not permitted chown: changing ownership of '/certificates/root-ca-manager.pem': Operation not permitted chown: changing ownership of '/certificates/root-ca.key': Operation not permitted chown: changing ownership of '/certificates/root-ca.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.dashboard-key.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.dashboard.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.indexer-key.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.indexer.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.manager-key.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.manager.pem': Operation not permitted Setting UID for wazuh manager and worker chown: changing ownership of '/certificates/root-ca-manager.pem': Operation not permitted chown: changing ownership of '/certificates/root-ca-manager.key': Operation not permitted chown: changing ownership of '/certificates/wazuh.manager.pem': Operation not permitted chown: changing ownership of '/certificates/wazuh.manager-key.pem': Operation not permitted

could you outline the steps to get this working? I ended up copying the contents of the "single node" git download to the unraid docker projects folder. this put the .yml file in the correct place and it shows up in unraid, and the stack does start. however, the previous step of generating certs i didn manually in terminal and it failed so ultimately the stack didnt do anything.

maybe write a script that doesnt it for them. not sure if its possible.

I had this same issue. I used GPIO Group policy in windows to disable the shutdown command. The only way you can shutdown is to open command prompt as admin and type shutdown into it. when my users go to the "shutdown area" on the windows button the only option they see is "logoff". no sleep, restart, or shutdown options. Between that and the autostart vm, this isnt a problem anymore. and yes, even if autostart is on, it wont restart the vms automatically. it only does it after startup

Hello everyone. I found one other thread for this issue, and it appeared that user had a missing device and needed to remove it from the config. I do not seem to have that same problem as far as I can tell, but my VMs will still not autostart. I just updated today and this is a first startup error. I dont feel too good about posting the diagnostics download in this forum so can anyone just maybe let me know what i can check? (or i can send via pm link or something)

My plant is shutting down today for power upgrades and the main server and networking switching gear is already offline. Can i somehow shutdown the host from inside the vm?