# wazuh-agent-linux

Companion files for the lesson **Install the Wazuh Agent on Linux**:
<https://maheshtata.com/wazuh/wazuh-agent-linux/>

Tested against: Wazuh 5.0 (beta5 documentation, Sep 2026), Ubuntu 24.04 / RHEL 9.
Not yet validated in a lab; treat every value as a starting point.

## Files

| File | What it is |
| --- | --- |
| `ossec.conf.fragment.xml` | Partial `<agent>` block for `/var/ossec/etc/ossec.conf`: manager endpoint, TLS, keepalive and enrolment. Merge it into the existing file rather than replacing the file. |
| `install-wazuh-agent.sh` | Repository setup, package install with the two documented deployment variables, service enable, repository pin and a status check. Debian/Ubuntu and RHEL-family. |

## Before you run anything

1. The repository URLs point at the Wazuh **pre-release staging** repositories
   published for the 5.0 beta, not at `packages.wazuh.com`. Re-point them at
   the general availability repository when 5.0 ships.
2. Any group named in `<enrollment><groups>` must already exist on the manager.
   Create it first:
   `/var/wazuh-manager/bin/agent_groups -a -g linux-servers -q`
3. Read the enrolment password on the manager with
   `cat /var/wazuh-manager/etc/authd.pass`.
4. Open 1517/TCP from the endpoint to the manager.

## Usage

```bash
WAZUH_MANAGER=10.0.0.2 \
WAZUH_REGISTRATION_PASSWORD='...' \
AGENT_GROUP=linux-servers \
AGENT_NAME=web-prod-01 \
  sudo -E ./install-wazuh-agent.sh
```

## What is deliberately missing

Capability configuration (`syscheck`, `sca`, `localfile`, `syscollector`) is
not in the fragment. In Wazuh 5.0 those belong in the group's shared
`agent.conf` on the manager, at
`/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf`.