i am attempting to get wazuh running on my engineering server (that also hosts acouple of VM'S) in docker.     I used the guide here https://documentation.wazuh.com/current/deployment-options/docker/wazuh-container.html

 

so far what i did was copy the contents of the "single node" directory, to the wazuh docker project folder created by unraid.  This put the .yml file in the right spot and unraid was able to start the stack  with compose manager (but it didn't do anything).    If you follow the instructions at the link, you also need to generate certs and I think that's where the failure is.   I get a error after the certs are generated.    

 

I'm not sure if I'm on the right track to get this working so want to check in on alternative methods before i continue down this path. 


this is the error I get when trying to run the certs docker compose  file

 

root@ENGINEERING-SVR:/boot/config/plugins/compose.manager/projects/wazuh# sudo docker-compose -f generate-indexer-certs.yml run --rm generator
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 26847  100 26847    0     0   476k      0 --:--:-- --:--:-- --:--:--  476k
Cert tool exists in Packages bucket
25/07/2023 14:37:26 INFO: Admin certificates created.
25/07/2023 14:37:27 INFO: Wazuh indexer certificates created.
25/07/2023 14:37:27 INFO: Wazuh server certificates created.
25/07/2023 14:37:27 INFO: Wazuh dashboard certificates created.
Moving created certificates to destination directory
changing certificate permissions
Setting UID indexer and dashboard
chown: changing ownership of '/certificates/admin-key.pem': Operation not permitted
chown: changing ownership of '/certificates/admin.pem': Operation not permitted
chown: changing ownership of '/certificates/root-ca-manager.key': Operation not permitted
chown: changing ownership of '/certificates/root-ca-manager.pem': Operation not permitted
chown: changing ownership of '/certificates/root-ca.key': Operation not permitted
chown: changing ownership of '/certificates/root-ca.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.dashboard-key.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.dashboard.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.indexer-key.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.indexer.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.manager-key.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.manager.pem': Operation not permitted
Setting UID for wazuh manager and worker
chown: changing ownership of '/certificates/root-ca-manager.pem': Operation not permitted
chown: changing ownership of '/certificates/root-ca-manager.key': Operation not permitted
chown: changing ownership of '/certificates/wazuh.manager.pem': Operation not permitted
chown: changing ownership of '/certificates/wazuh.manager-key.pem': Operation not permitted

 

Edited July 25, 20232 yr by Mad_Scientist

did you get this to work?

I got this working by doing the following:

1. Installed Docker Compose Manager from the CA Store by dcflachs, it installs docker compose and gives you a fancy gui for later projects.

   

2. Open Unraid's terminal and run Wazuh's git command

   git clone https://github.com/wazuh/wazuh-docker.git -b v4.12.0

3. Make a new directory for Wazuh

   mkdir /mnt/user/appdata/wazuh

4. Copy the single-node contents from the repo to my new folder

   cp -r wazuh-docker/single-node/* /mnt/user/appdata/wazuh/

5. Deleted the original git repo we downloaded

   rm -r wazuh-docker/

6. Changed into the new wazuh directory

   cd /mnt/user/appdata/wazuh

7. Ran the certs generator command from within that folder

   docker-compose -f generate-indexer-certs.yml run --rm generator

   That worked for me to generate the certs on unraid.

8. To get Wazuh working all fancy in Unraid's GUI, I then went into the Docker tab in Unraid and scrolled down to the bottom to create a new stack using the Compose Manager Plugin we installed in step 1. NOTE: Be sure to click the Advanced Dropdown and change the path to /mnt/user/appdata/wazuh to pull in all your directories and files.

9. Click the Compose Up button and you should be able to connect using https://insertwazuhdashboardaddresshere:5601.

Hope that helps!