# Wazuh 5.0 all-in-one post-install checklist

Ubuntu 24.04. Work through this before installing the first agent.
Lesson: <https://maheshtata.com/wazuh/install-wazuh-ubuntu/>

## Verify

- [ ] Indexer answers: `curl -k -u admin https://<WAZUH_INDEXER_IP_ADDRESS>:9200`
- [ ] Manager daemons running: `/var/wazuh-manager/bin/wazuh-manager-control status`
- [ ] Dashboard service active: `systemctl status wazuh-dashboard`
- [ ] Dashboard loads in a browser at `https://<WAZUH_DASHBOARD_IP_ADDRESS>`
- [ ] No errors in `/var/wazuh-manager/logs/wazuh-manager.log`

## Credentials

- [ ] Indexer `admin` password changed
      `bash wazuh-passwords-tool-5.0.0-beta5.sh -u admin -p <NEW_PASSWORD>`
- [ ] Indexer `kibanaserver` password changed
- [ ] Manager API `wazuh` password changed
      `read -rs NEW_PASSWORD; bash wazuh-passwords-tool-5.0.0-beta5.sh -A -au wazuh -ap wazuh -u wazuh -p "$NEW_PASSWORD"; unset NEW_PASSWORD`
      (the `read -rs` prompt keeps the new password out of the shell history; `-ap wazuh` is the documented default you are replacing)
- [ ] Manager API `wazuh-wui` password changed
- [ ] New passwords stored in the team secrets store, not in a shell history

Password rules: 8 to 64 characters, at least one uppercase, one lowercase,
one number and one of `.*+?-`.

## Reachability

- [ ] `<remote><https><bind_addr>` confirmed in
      `/var/wazuh-manager/etc/wazuh-manager.conf`. Verified on 5.0.0-beta5 it
      ships as `0.0.0.0`; narrow it to an interface address if you want to
- [ ] Health check probes the prefix, not the root:
      `https://<manager>:1517/wazuh-manager/` returns
      `{"status":"ok","module":"remoted"}`
- [ ] Decided whether to keep the shipped `<remote><legacy>` block, which
      opens 1514 and 1515 for Wazuh 4.x agents
- [ ] Manager restarted after any change: `systemctl restart wazuh-manager`
- [ ] Manager log shows no configuration errors after the restart
- [ ] Firewall allows 443 from analysts, 1517 from agent subnets, 55000 from
      automation only; 9200 not reachable off the host
- [ ] NTP working on the manager and on a sample agent (agent tokens on 1517
      are short-lived and clock-sensitive)

## Hygiene

- [ ] `wazuh-install-files.tar` copied off the host and removed from the
      working directory (it contains the CA and generated passwords)
- [ ] Package repository disabled to prevent accidental upgrades:
      `sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list && apt update`
- [ ] Virtual machine snapshot taken
- [ ] Dashboard certificate replacement planned before other people use it
- [ ] Disk usage alerting configured on the indexer volume

## Decisions to record

- [ ] Event retention and findings retention, agreed and written down
      (defaults: raw events 10 minutes, normalised events 1 hour,
      findings 90 days, active responses 3 days)
- [ ] Whether Wazuh 4.x agents will be supported on the legacy channel
- [ ] Named owner for tuning during the first quarter