Remove the Password Tool from the Installation Assistant files

[Enaraque]

Description

The objective of this PR is to remove the use of the password tool during the component installation and configuration process within the installation assistant.

Currently, when a component is installed and configured, its password is changed by default. Starting with version 5.x, this behavior will change to maintain the default passwords provided with the components. Consequently, all code related to the password tool must be removed from the installation assistant.

Most of this code is injected via builder.sh into wazuh-install.sh, so a large portion of it is removed simply by disabling this injection. However, some variables and functions have also been manually removed from the installation assistant source code.

Update to the distributed dashboard configuration file

Currently, the opensearch_dashboards.yml file for the dashboard remains hardcoded. This will change starting from 5.0 (see issue #542), but until that development is complete and to allow testing of distributed installations, the necessary hosts that were previously in wazuh.yml have been added to this file.

Deprecated code in indexer cluster initialization

Additionally, during testing, we noticed that the indexer cluster initialization still included the injection of the wazuh-template.json file, which will no longer be used as of 5.0. Therefore, the code related to this file has also been removed.

Tests 🧪

Two deployments were performed (AIO and distributed) on the same VM to verify that each installation works correctly and maintains the default passwords.

• AIO:

  Component download

   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh -a -d local
   08/01/2026 10:29:55 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 10:29:55 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 10:29:55 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 10:29:55 INFO: --- Dependencies ---
   08/01/2026 10:29:55 INFO: Installing yum-utils.
   08/01/2026 10:29:56 INFO: --- Configuration files ---
   08/01/2026 10:29:56 INFO: Generating configuration files.
   08/01/2026 10:29:56 INFO: Generating the root certificate.
   08/01/2026 10:29:56 INFO: Generating Admin certificates.
   08/01/2026 10:29:56 INFO: Generating Wazuh indexer certificates.
   08/01/2026 10:29:56 INFO: Generating Wazuh server certificates.
   08/01/2026 10:29:56 INFO: Generating Wazuh dashboard certificates.
   08/01/2026 10:29:56 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
   08/01/2026 10:29:56 INFO: --- Wazuh indexer ---
   08/01/2026 10:29:56 INFO: Downloading wazuh_indexer package: wazuh-indexer-5.0.0-latest.x86_64.rpm
   08/01/2026 10:30:14 INFO: wazuh_indexer package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-indexer-5.0.0-latest.x86_64.rpm
   08/01/2026 10:30:14 INFO: Starting Wazuh indexer installation.
   08/01/2026 10:30:30 INFO: Wazuh indexer installation finished.
   08/01/2026 10:30:30 INFO: Wazuh indexer post-install configuration finished.
   08/01/2026 10:30:30 INFO: Starting service wazuh-indexer.
   08/01/2026 10:30:48 INFO: wazuh-indexer service started.
   08/01/2026 10:30:48 INFO: Initializing Wazuh indexer cluster security settings.
   08/01/2026 10:30:57 INFO: Wazuh indexer cluster security configuration initialized.
   08/01/2026 10:30:57 INFO: Wazuh indexer cluster initialized.
   08/01/2026 10:30:57 INFO: --- Wazuh server ---
   08/01/2026 10:30:57 INFO: Downloading wazuh_manager package: wazuh-manager-5.0.0-latest.x86_64.rpm
   08/01/2026 10:31:07 INFO: wazuh_manager package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-manager-5.0.0-latest.x86_64.rpm
   08/01/2026 10:31:07 INFO: Starting the Wazuh manager installation.
   08/01/2026 10:31:54 INFO: Wazuh manager installation finished.
   08/01/2026 10:31:54 INFO: Wazuh manager vulnerability detection configuration finished.
   08/01/2026 10:31:54 INFO: Starting service wazuh-manager.
   08/01/2026 10:32:01 INFO: wazuh-manager service started.
   08/01/2026 10:32:01 INFO: --- Wazuh dashboard ---
   08/01/2026 10:32:01 INFO: Downloading wazuh_dashboard package: wazuh-dashboard-5.0.0-latest.x86_64.rpm
   08/01/2026 10:32:08 INFO: wazuh_dashboard package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-dashboard-5.0.0-latest.x86_64.rpm
   08/01/2026 10:32:08 INFO: Starting Wazuh dashboard installation.
   08/01/2026 10:34:02 INFO: Wazuh dashboard installation finished.
   08/01/2026 10:34:02 INFO: Wazuh dashboard post-install configuration finished.
   08/01/2026 10:34:02 INFO: Starting service wazuh-dashboard.
   08/01/2026 10:34:03 INFO: wazuh-dashboard service started.
   08/01/2026 10:34:03 INFO: Initializing Wazuh dashboard web application.
   08/01/2026 10:34:03 INFO: Wazuh dashboard web application not yet initialized. Waiting...
   08/01/2026 10:34:18 INFO: Wazuh dashboard web application not yet initialized. Waiting...
   08/01/2026 10:34:33 INFO: Wazuh dashboard web application not yet initialized. Waiting...
   08/01/2026 10:34:49 INFO: Wazuh dashboard web application not yet initialized. Waiting...
   08/01/2026 10:35:04 INFO: Restarting service wazuh-dashboard.
   08/01/2026 10:35:05 INFO: wazuh-dashboard service restarted.
   08/01/2026 10:35:05 INFO: Wazuh dashboard web application initialized.
   08/01/2026 10:35:05 INFO: --- Summary ---
   08/01/2026 10:35:05 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
       User: admin
       Password: admin
   08/01/2026 10:35:05 INFO: Installation finished.
   

  Service check

   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-indexer
   ● wazuh-indexer.service - wazuh-indexer
        Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 10:30:48 UTC; 5min ago
          Docs: https://documentation.wazuh.com
      Main PID: 13305 (java)
         Tasks: 136 (limit: 9340)
        Memory: 1.6G
           CPU: 4min 21.874s
        CGroup: /system.slice/wazuh-indexer.service
                └─13305 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=tru>
   
   Jan 08 10:30:33 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
   Jan 08 10:30:33 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
   Jan 08 10:30:33 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
   Jan 08 10:30:33 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAct>
   Jan 08 10:30:33 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
   Jan 08 10:30:35 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: A restricted method in java.lang.System has been called
   Jan 08 10:30:35 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
   Jan 08 10:30:35 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
   Jan 08 10:30:35 ip-172-31-47-60.ec2.internal wazuh-indexer[13305]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
   Jan 08 10:30:48 ip-172-31-47-60.ec2.internal systemd[1]: Started wazuh-indexer.service - wazuh-indexer.
   
   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-manager
   ● wazuh-manager.service - Wazuh manager
        Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 10:32:01 UTC; 4min 27s ago
         Tasks: 190 (limit: 9340)
        Memory: 3.9G
           CPU: 2min 12.843s
        CGroup: /system.slice/wazuh-manager.service
                ├─15139 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─15153 /var/ossec/bin/wazuh-authd
                ├─15162 /var/ossec/bin/wazuh-db
                ├─15178 /var/ossec/bin/wazuh-execd
                ├─15186 /var/ossec/bin/wazuh-analysisd
                ├─15318 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─15319 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─15322 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─15325 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─15375 /var/ossec/bin/wazuh-syscheckd
                ├─15383 /var/ossec/bin/wazuh-remoted
                ├─15415 /var/ossec/bin/wazuh-logcollector
                ├─15427 /var/ossec/bin/wazuh-monitord
                ├─15433 /var/ossec/bin/wazuh-modulesd
                ├─15602 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
                ├─15618 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
                └─15619 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
   
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15084]: Started wazuh-remoted...
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15084]: Started wazuh-logcollector...
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15084]: Started wazuh-monitord...
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15431]: 2026/01/08 10:31:58 wazuh-modulesd:router: INFO: Loaded router module.
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15431]: 2026/01/08 10:31:58 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15431]: 2026/01/08 10:31:58 wazuh-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
   Jan 08 10:31:58 ip-172-31-47-60.ec2.internal env[15084]: Started wazuh-modulesd...
   Jan 08 10:31:59 ip-172-31-47-60.ec2.internal env[15084]: Started wazuh-clusterd...
   Jan 08 10:32:01 ip-172-31-47-60.ec2.internal env[15084]: Completed.
   Jan 08 10:32:01 ip-172-31-47-60.ec2.internal systemd[1]: Started wazuh-manager.service - Wazuh manager.
   
   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-dashboard
   ● wazuh-dashboard.service - wazuh-dashboard
        Loaded: loaded (/usr/lib/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 10:35:05 UTC; 7min ago
      Main PID: 17797 (node)
         Tasks: 11 (limit: 9340)
        Memory: 242.1M
           CPU: 11.544s
        CGroup: /system.slice/wazuh-dashboard.service
                └─17797 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
   
   Jan 08 10:37:31 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:31Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/fa>
   Jan 08 10:37:31 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:31Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/api/ism/_indic>
   Jan 08 10:37:31 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:31Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/fa>
   Jan 08 10:37:31 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:31Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/ui/logos/wazuh>
   Jan 08 10:37:48 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:48Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/fa>
   Jan 08 10:37:48 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:48Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/api/ism/_indic>
   Jan 08 10:37:49 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:37:49Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/ui/logos/wazuh>
   Jan 08 10:39:13 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:39:13Z","tags":[],"pid":17797,"method":"get","statusCode":302,"req":{"url":"/","routePath":>
   Jan 08 10:41:14 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:41:14Z","tags":[],"pid":17797,"method":"get","statusCode":200,"req":{"url":"/app/login","ro>
   Jan 08 10:41:21 ip-172-31-47-60.ec2.internal opensearch-dashboards[17797]: {"type":"response","@timestamp":"2026-01-08T10:41:21Z","tags":[],"pid":17797,"method":"get","statusCode":401,"req":{"url":"/favicon.ico",">
   
   ``` console
   [root@ip-172-31-47-60 ec2-user]# cat  /etc/wazuh-dashboard/opensearch_dashboards.yml 
   server.host: 0.0.0.0
   opensearch.hosts: https://127.0.0.1:9200
   server.port: 443
   opensearch.ssl.verificationMode: certificate
   # opensearch.username: kibanaserver
   # opensearch.password: kibanaserver
   opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
   opensearch_security.multitenancy.enabled: false
   opensearch_security.readonly_mode.roles: ["kibana_read_only"]
   server.ssl.enabled: true
   server.ssl.key: "/etc/wazuh-dashboard/certs/wazuh-dashboard-key.pem"
   server.ssl.certificate: "/etc/wazuh-dashboard/certs/wazuh-dashboard.pem"
   opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]
   uiSettings.overrides.defaultRoute: /app/wz-home
   opensearch_security.cookie.secure: true
   # Session expiration settings
   opensearch_security.cookie.ttl: 900000
   opensearch_security.session.ttl: 900000
   opensearch_security.session.keepalive: true
   
   # Define the Wazuh server hosts
   wazuh_core.hosts:
     default:
       url: https://127.0.0.1
       port: 55000
       username: wazuh-wui
       password: wazuh-wui
       run_as: false

  Landing page

  

• Distributed:

  File generation (wazuh-install-files.tar)

   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh --generate-config-files
   08/01/2026 09:54:38 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 09:54:38 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 09:54:39 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 09:54:39 INFO: --- Configuration files ---
   08/01/2026 09:54:39 INFO: Generating configuration files.
   08/01/2026 09:54:39 INFO: Generating the root certificate.
   08/01/2026 09:54:39 INFO: Generating Admin certificates.
   08/01/2026 09:54:39 INFO: Generating Wazuh indexer certificates.
   08/01/2026 09:54:39 INFO: Generating Wazuh server certificates.
   08/01/2026 09:54:39 INFO: Generating Wazuh dashboard certificates.
   08/01/2026 09:54:39 INFO: Created wazuh-install-files.tar. It contains the Wazuh cluster key and the certificates necessary for installation.
   [ec2-user@ip-172-31-47-60 ~]$ ls
   wazuh-install-files.tar  wazuh-install.sh
   [ec2-user@ip-172-31-47-60 ~]$ sudo tar -xf wazuh-install-files.tar
   [ec2-user@ip-172-31-47-60 ~]$ ls
   wazuh-install-files  wazuh-install-files.tar  wazuh-install.sh
   [ec2-user@ip-172-31-47-60 ~]$ ls -la wazuh-install-files/
   total 76
   drwxr-xr-x. 2 root     root     16384 Jan  8 09:54 .
   drwx------. 4 ec2-user ec2-user 16384 Jan  8 09:54 ..
   -r--------. 1 root     root      1704 Jan  8 09:54 admin-key.pem
   -r--------. 1 root     root      1220 Jan  8 09:54 admin.pem
   -rw-------. 1 root     root       610 Jan  8 09:54 config.yml
   -r--------. 1 root     root      1708 Jan  8 09:54 dashboard-key.pem
   -r--------. 1 root     root      1281 Jan  8 09:54 dashboard.pem
   -r--------. 1 root     root      1704 Jan  8 09:54 node-1-key.pem
   -r--------. 1 root     root      1277 Jan  8 09:54 node-1.pem
   -r--------. 1 root     root      1704 Jan  8 09:54 root-ca.key
   -r--------. 1 root     root      1204 Jan  8 09:54 root-ca.pem
   -r--------. 1 root     root      1704 Jan  8 09:54 wazuh-1-key.pem
   -r--------. 1 root     root      1277 Jan  8 09:54 wazuh-1.pem

  Indexer installation

   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh -wi node-1 -d local
   08/01/2026 11:51:02 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 11:51:02 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 11:51:02 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 11:51:03 INFO: --- Wazuh indexer ---
   08/01/2026 11:51:03 INFO: Downloading wazuh_indexer package: wazuh-indexer-5.0.0-latest.x86_64.rpm
   08/01/2026 11:51:20 INFO: wazuh_indexer package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-indexer-5.0.0-latest.x86_64.rpm
   08/01/2026 11:51:20 INFO: Starting Wazuh indexer installation.
   08/01/2026 11:51:35 INFO: Wazuh indexer installation finished.
   08/01/2026 11:51:35 INFO: Wazuh indexer post-install configuration finished.
   08/01/2026 11:51:35 INFO: Starting service wazuh-indexer.
   08/01/2026 11:51:54 INFO: wazuh-indexer service started.
   08/01/2026 11:51:54 INFO: Initializing Wazuh indexer cluster security settings.
   08/01/2026 11:51:54 INFO: Wazuh indexer cluster initialized.
   08/01/2026 11:51:55 INFO: Installation finished.
   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh -s
   08/01/2026 11:52:16 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 11:52:16 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 11:52:16 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 11:52:21 INFO: Wazuh indexer cluster security configuration initialized.
   08/01/2026 11:52:26 INFO: Wazuh indexer cluster started.
   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-indexer
   ● wazuh-indexer.service - wazuh-indexer
        Loaded: loaded (/usr/lib/systemd/system/wazuh-indexer.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 11:51:54 UTC; 1min 10s ago
          Docs: https://documentation.wazuh.com
      Main PID: 50728 (java)
         Tasks: 129 (limit: 9340)
        Memory: 1.5G
           CPU: 2min 21.056s
        CGroup: /system.slice/wazuh-indexer.service
                └─50728 /usr/share/wazuh-indexer/jdk/bin/java -Xshare:auto -Dopensearch.networkaddress.cache.ttl=60 -Dopensearch.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStack>
   
   Jan 08 11:51:38 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: Unknown module: org.apache.arrow.memory.core specified to --add-opens
   Jan 08 11:51:39 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: A terminally deprecated method in sun.misc.Unsafe has been called
   Jan 08 11:51:39 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: sun.misc.Unsafe::objectFieldOffset has been called by net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
   Jan 08 11:51:39 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: Please consider reporting this to the maintainers of class net.bytebuddy.dynamic.loading.ClassInjector$UsingUnsafe$Dispatcher$CreationAction
   Jan 08 11:51:39 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: sun.misc.Unsafe::objectFieldOffset will be removed in a future release
   Jan 08 11:51:40 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: A restricted method in java.lang.System has been called
   Jan 08 11:51:40 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: java.lang.System::load has been called by com.sun.jna.Native in an unnamed module (file:/usr/share/wazuh-indexer/lib/jna-5.16.0.jar)
   Jan 08 11:51:40 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
   Jan 08 11:51:40 ip-172-31-47-60.ec2.internal wazuh-indexer[50728]: WARNING: Restricted methods will be blocked in a future release unless native access is enabled
   Jan 08 11:51:54 ip-172-31-47-60.ec2.internal systemd[1]: Started wazuh-indexer.service - wazuh-indexer.

  Server installation

   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh -ws wazuh-1 -d local
   08/01/2026 11:54:03 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 11:54:03 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 11:54:03 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 11:54:04 INFO: --- Wazuh server ---
   08/01/2026 11:54:04 INFO: Downloading wazuh_manager package: wazuh-manager-5.0.0-latest.x86_64.rpm
   08/01/2026 11:54:14 INFO: wazuh_manager package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-manager-5.0.0-latest.x86_64.rpm
   08/01/2026 11:54:14 INFO: Starting the Wazuh manager installation.
   08/01/2026 11:54:56 INFO: Wazuh manager installation finished.
   08/01/2026 11:54:56 INFO: Wazuh manager vulnerability detection configuration finished.
   08/01/2026 11:54:56 INFO: Starting service wazuh-manager.
   08/01/2026 11:55:03 INFO: wazuh-manager service started.
   08/01/2026 11:55:03 INFO: Installation finished.
   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-manager
   ● wazuh-manager.service - Wazuh manager
        Loaded: loaded (/usr/lib/systemd/system/wazuh-manager.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 11:55:03 UTC; 6s ago
       Process: 54372 ExecStart=/usr/bin/env /var/ossec/bin/wazuh-control start (code=exited, status=0/SUCCESS)
         Tasks: 181 (limit: 9340)
        Memory: 2.2G
           CPU: 23.843s
        CGroup: /system.slice/wazuh-manager.service
                ├─54427 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─54441 /var/ossec/bin/wazuh-authd
                ├─54450 /var/ossec/bin/wazuh-db
                ├─54466 /var/ossec/bin/wazuh-execd
                ├─54474 /var/ossec/bin/wazuh-analysisd
                ├─54648 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─54650 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─54653 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─54656 /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
                ├─54665 /var/ossec/bin/wazuh-syscheckd
                ├─54673 /var/ossec/bin/wazuh-remoted
                ├─54704 /var/ossec/bin/wazuh-logcollector
                ├─54717 /var/ossec/bin/wazuh-monitord
                ├─54723 /var/ossec/bin/wazuh-modulesd
                ├─54883 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
                ├─54900 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
                └─54901 /var/ossec/framework/python/bin/python3 /var/ossec/framework/scripts/wazuh_clusterd.py
   
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54372]: Started wazuh-remoted...
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54372]: Started wazuh-logcollector...
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54372]: Started wazuh-monitord...
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54721]: 2026/01/08 11:55:00 wazuh-modulesd:router: INFO: Loaded router module.
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54721]: 2026/01/08 11:55:00 wazuh-modulesd:content_manager: INFO: Loaded content_manager module.
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54721]: 2026/01/08 11:55:00 wazuh-modulesd:inventory-sync: INFO: Loaded Inventory sync module.
   Jan 08 11:55:00 ip-172-31-47-60.ec2.internal env[54372]: Started wazuh-modulesd...
   Jan 08 11:55:01 ip-172-31-47-60.ec2.internal env[54372]: Started wazuh-clusterd...
   Jan 08 11:55:03 ip-172-31-47-60.ec2.internal env[54372]: Completed.
   Jan 08 11:55:03 ip-172-31-47-60.ec2.internal systemd[1]: Started wazuh-manager.service - Wazuh manager.

  Dashboard installation

   [ec2-user@ip-172-31-47-60 ~]$ sudo bash ./wazuh-install.sh -wd dashboard -d local
   08/01/2026 11:55:40 INFO: Starting Wazuh installation assistant. Wazuh version: 5.0.0
   08/01/2026 11:55:40 INFO: Verbose logging redirected to /var/log/wazuh-install.log
   08/01/2026 11:55:40 INFO: Verifying that your system meets the recommended minimum hardware requirements.
   08/01/2026 11:55:40 INFO: --- Dependencies ---
   08/01/2026 11:55:40 INFO: Installing yum-utils.
   08/01/2026 11:55:41 INFO: --- Wazuh dashboard ----
   08/01/2026 11:55:41 INFO: Downloading wazuh_dashboard package: wazuh-dashboard-5.0.0-latest.x86_64.rpm
   08/01/2026 11:55:49 INFO: wazuh_dashboard package downloaded successfully: /home/ec2-user/wazuh-install-packages/wazuh-dashboard-5.0.0-latest.x86_64.rpm
   08/01/2026 11:55:49 INFO: Starting Wazuh dashboard installation.
   08/01/2026 11:57:28 INFO: Wazuh dashboard installation finished.
   08/01/2026 11:57:28 INFO: Wazuh dashboard post-install configuration finished.
   08/01/2026 11:57:28 INFO: Starting service wazuh-dashboard.
   08/01/2026 11:57:29 INFO: wazuh-dashboard service started.
   08/01/2026 11:57:29 INFO: Initializing Wazuh dashboard web application.
   08/01/2026 11:58:09 INFO: Restarting service wazuh-dashboard.
   08/01/2026 11:58:10 INFO: wazuh-dashboard service restarted.
   08/01/2026 11:58:10 INFO: Wazuh dashboard web application initialized.
   08/01/2026 11:58:10 INFO: --- Summary ---
   08/01/2026 11:58:10 INFO: You can access the web interface https://<wazuh-dashboard-ip>:443
       User: admin
       Password: admin
   08/01/2026 11:58:10 INFO: Installation finished.
   [ec2-user@ip-172-31-47-60 ~]$ sudo systemctl status wazuh-dashboard
   ● wazuh-dashboard.service - wazuh-dashboard
        Loaded: loaded (/usr/lib/systemd/system/wazuh-dashboard.service; enabled; preset: disabled)
        Active: active (running) since Thu 2026-01-08 11:58:10 UTC; 33s ago
      Main PID: 57058 (node)
         Tasks: 11 (limit: 9340)
        Memory: 300.1M
           CPU: 8.066s
        CGroup: /system.slice/wazuh-dashboard.service
                └─57058 /usr/share/wazuh-dashboard/node/bin/node --no-warnings --max-http-header-size=65536 --unhandled-rejections=warn /usr/share/wazuh-dashboard/src/cli/dist
   
   Jan 08 11:58:19 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:19Z","tags":["info","healthcheck","integrations:default-notifications-channels-and-alerting-monitors"],"pid":57058,"message":"Alerting sample monito>
   Jan 08 11:58:19 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:19Z","tags":["info","healthcheck","server-api:connection-compatibility"],"pid":57058,"message":"Server API [default] version [5.0.0] is compatible w>
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","healthcheck"],"pid":57058,"message":"Checks are ok"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","healthcheck"],"pid":57058,"message":"Set scheduled checks each 900000ms"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","plugins-system"],"pid":57058,"message":"Starting [52] plugins: [usageCollection,opensearchDashboardsUsageCollection,opensearchD>
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","plugins","wazuh","initialize"],"pid":57058,"message":"dashboard index: .kibana"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","plugins","wazuh","initialize"],"pid":57058,"message":"App revision: 00"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","plugins","wazuh","initialize"],"pid":57058,"message":"Total RAM: 7812MB"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["listening","info"],"pid":57058,"message":"Server running at https://0.0.0.0:443"}
   Jan 08 11:58:28 ip-172-31-47-60.ec2.internal opensearch-dashboards[57058]: {"type":"log","@timestamp":"2026-01-08T11:58:28Z","tags":["info","http","server","OpenSearchDashboards"],"pid":57058,"message":"http server running at https://0.0.0.0:443"}
   
   [root@ip-172-31-47-60 ec2-user]# cat  /etc/wazuh-dashboard/opensearch_dashboards.yml 
   server.port: 443
   opensearch.ssl.verificationMode: certificate
   # opensearch.username: kibanaserver
   # opensearch.password: kibanaserver
   opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"]
   opensearch_security.multitenancy.enabled: false
   opensearch_security.readonly_mode.roles: ["kibana_read_only"]
   server.ssl.enabled: true
   server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem"
   server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem"
   opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"]
   uiSettings.overrides.defaultRoute: /app/wz-home
   opensearch_security.cookie.secure: true
   # Session expiration settings
   opensearch_security.cookie.ttl: 900000
   opensearch_security.session.ttl: 900000
   opensearch_security.session.keepalive: true
   
   # Define the Wazuh server hosts
   wazuh_core.hosts:
     default:
       url: https://127.0.0.1
       port: 55000
       username: wazuh-wui
       password: wazuh-wui
       run_as: false
   server.host: 0.0.0.0
   opensearch.hosts: https://127.0.0.1:9200

  Landing page