Installing Wazuh Server on Ubuntu 26.04 LTS

Diving into cybersecurity and setting up a SIEM (Security Information and Event Management) system like Wazuh is an awesome project.

I’m going to break down the All-in-One Installation method for Ubuntu Server 26.04. We’ll use the official Wazuh Installation Assistant, but I’ll explain why we’re doing each step so you actually understand what’s happening under the hood.

Let’s get this beast running!

🛠️ Prerequisites: What You Need

Before we start, make sure your Ubuntu 26.04 server has enough juice. Wazuh’s indexing engine (OpenSearch) is a bit memory-hungry.

• CPU: Minimum 2 Cores (4 Cores recommended).
• RAM: Minimum 4 GB (8 GB is highly recommended if you plan to connect many agents).
• Storage: 50 GB+ of free space.
• Privileges: A user account with sudo access.

🚀 Step-by-Step Installation Guide

Step 1: Prep the Server

First rule of Linux administration: always start with a fresh, updated system. This prevents dependency conflicts later on.

Ubuntu Server 26.04 LTS

sudo apt update && sudo apt upgrade -y

Update server

Next, let’s install a few basic tools that the installation script will need to download files and manage keys:

sudo apt install -y curl apt-transport-https unzip wget libcap2-bin software-properties-common

Install a few basic tools

Step 2: Configure the Firewall (UFW)

A SIEM is useless if agents can’t talk to it, but you also want to keep it secure. We need to open specific ports on your firewall.

Here is what you need to open and why:

• Port 443 (HTTPS): To access the Wazuh Web Dashboard.
• Port 1514 (TCP/UDP): The main port where your agents will send their security logs to the server.
• Port 1515 (TCP): The enrollment port (when a new agent registers with the server).
• Port 55000 (TCP): The Wazuh API port (used internally by the dashboard).

Run these commands:

sudo ufw allow 443/tcp
sudo ufw allow 1514
sudo ufw allow 1515/tcp
sudo ufw allow 55000/tcp
sudo ufw reload

Update firewall rules

(Check your firewall status with sudo ufw status, If your firewall isn’t active yet , you can enable it with sudo ufw enable).

Step 3: Download & Run the Wazuh Installer

In the old days, you had to install the Indexer, the Server, and the Dashboard manually. Now, Wazuh provides an automated script that handles the heavy lifting, including generating all the internal SSL certificates so the components can talk to each other securely.

1. Download the installation script:

curl -sO https://packages.wazuh.com/4.12/wazuh-install.sh

Installation script

2. Run the script with the -a flag (which stands for All-in-One architecture):

sudo bash wazuh-install.sh -a -i

Installation process

This process will take about 5 to 15 minutes depending on your server’s internet speed and CPU. The script is automatically adding Wazuh repositories, downloading Java, setting up the OpenSearch indexer, configuring the main server, and spinning up the Node.js based dashboard. Go grab a coffee!

Step 4: Secure Your Credentials

Once the script finishes, your terminal will spit out a success message. Do not clear your screen yet!

The installer generates random, highly secure passwords for the default admin user and internal database users. It will display the Username: admin and its corresponding Password. Copy this password and save it in a password manager.

Installation Done

Forgot to save it? Don’t panic. You can always extract the passwords from the hidden archive the installer leaves behind by running:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Step 5: Access the Wazuh Dashboard

Now for the rewarding part — seeing the UI!

1. Open your favorite web browser on your laptop.
2. Type in your Ubuntu server’s IP address using HTTPS: https://<YOUR_UBUNTU_SERVER_IP>
3. Security Warning: Your browser will likely say “Warning: Potential Security Risk Ahead”. This is completely normal! The installer created a self-signed SSL certificate, which browsers don’t recognize by default. Click Advanced -> Accept the Risk and Continue (or proceed to localhost/IP).
4. Log in using:

• Username: admin - Password: (The one you saved in Step 4)

Login page

Wazuh dashboard

🧠 How Agent-Manager Communication Works

Before running commands, it helps to understand the flow. The Wazuh agent is a lightweight service that sits on your target machine (Windows, Linux, macOS). It continuously monitors logs, system calls, and file integrity, then sends that data back to your server.

• Registration (Port 1515): The agent introduces itself to the server and requests a secure cryptographic key.
• Data Flow (Port 1514): Once registered, the agent encrypts its logs and sends them to the server over this port.

Let’s break down exactly how to connect an endpoint (a client machine) to your new Wazuh manager.

🖥️ Method 1: Deploying on a Linux Endpoint (Ubuntu/Debian)

Let’s say you have another Linux server or a local Ubuntu VM you want to monitor.

Step 1: Generate the Command from the Dashboard

1. Log into your Wazuh Dashboard.

2. Click the top-left menu icon (three lines) and go to Wazuh > Agents > Deploy new agent.

3. Select Deploy new agent.

4. Choose your options:

• OS: Linux
• Architecture: amd64 (or arm64 if you're using a Raspberry Pi or Apple Silicon VM).
• Wazuh server address: Type your Ubuntu Server’s IP address (e.g., 192.168.100.133).
• Agent group: Leave it as default for now.

Step 2: Install the Agent on the Endpoint

Wazuh will generate a single-line command at the bottom of the page. Open the terminal on your target Linux machine and run it. It will look something like this:

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.12.0-1_amd64.deb && sudo WAZUH_MANAGER='192.168.100.133' WAZUH_AGENT_NAME='Server-Seattle' dpkg -i ./wazuh-agent_4.12.0-1_amd64.deb

(Note: The version number might change depending on when you downloaded the manager script).

Wazuh Agent installation on web server

Step 3: Start and Enable the Agent

The package is installed, but the background service isn’t running yet. Fire it up and set it to start automatically when the system boots:

sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

Start Wazuh agent on web server

Step 4: Verification (The Payoff)

Go back to your browser and look at your Wazuh Dashboard.

1. Navigate to Wazuh > Agents.
2. Refresh the page. You should see your newly added agent change status from Pending to Active (indicated by a green circle).

Dashboard Wazuh Server

🛠️ Troubleshooting Tip

If the agent stays disconnected, 99% of the time it’s a network/firewall issue. Run this command on your endpoint machine to test if it can actually reach the server’s ports:

• On Linux: nc -zv <WAZUH_SERVER_IP> 1514 1515

If the connection times out, double-check Step 2 of the previous guide to make sure UFW isn’t blocking incoming traffic on your server.