Secure Your Self-Hosted Network with Wazuh

Подписаться 10 тыс.

Просмотров 88 тыс.

50% 1

#wazuh #selfhosted #security
Join this channel to get access to perks:
/ @techdox
Buy Me a Coffee if you enjoyed! - www.buymeacoffee.com/techdox
GiveInternet.org giveaway - dyno.gg/giveaway/39c494bb
Check out the merch here! - giveinternet.org/merch
Dive into the world of cybersecurity with our latest tutorial on Wazuh, the all-in-one free security tool that's perfect for self-hosters. 🛡️ Whether you're managing personal projects or enterprise-level deployments, understanding how to safeguard your systems is crucial.
Useful Links:
Techdox Docs - docs.techdox.nz/
Discord Channel - / discord
Wazuh Website - wazuh.com
Wazuh Documentation - documentation.wazuh.com/curre...

Наука

Опубликовано:

7 июн 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 126

@Techdox 2 месяца назад

Thanks for watching! Give Internet Merch giveaway - dyno.gg/giveaway/39c494bb Support a great cause! - giveinternet.org/techdox

@nixxblikka 2 месяца назад

Great video, in particular you are showing the features first and then the installation, not the other way round where many then forget to show functionality… good job

@jjuarez83 Месяц назад

Yeah, I like to get an idea of where I am going before I go on a trip.

@KenPryor Месяц назад

Great video! I've been using Wazuh at home for a while now, but still have much to learn.

@George-mk7lp 2 месяца назад

gonna give it a try over weekend for sure . thanks!

@Techdox 2 месяца назад

Let me know how you get on! Keen to hear other opinions on it :)

@zippi777 2 месяца назад

Hi, thanks for this usefull guide! Signed up! Greetings from Italy !

2 месяца назад

Thanks for the video, great tool!

@chrisumali9841 2 месяца назад

Thanks for the demo and info, this is Awesome. I will set it up, and be more secure. Have a great day Sir

@Techdox 2 месяца назад

Awesome, glad you liked it!

@GerardoXxX1 Месяц назад

Great video

@unifiedarray Месяц назад

Great tutorial!! How are updates though with the latest version? I heard there were issues in the past...

@Techdox Месяц назад

I personally have had no issues

@rangefreewords Месяц назад

My 5.25 bay could use a bunch of li-ion batteries in it to provide power to the small NAS built in network.

@simuman 2 месяца назад

Hi Techdoc, great video from a fellow NZder and just implemented. Any chance you can do one on Traefik, followed a few other UT tutorials but still can't get my head around it. I'm sure with the way you do your videos I'd be able to understand and it would be very helpful.

@Techdox 2 месяца назад

Traefik seems to be pretty well requested. I’ll get a video sorted for ya!

@jirehla-ab1671 2 месяца назад

@@Techdox will Wazuh work well with tailscale?

@fossdom5568 2 месяца назад

Great video, How do you make the dashboard available via Cloudflare tunnel

@Techdox 2 месяца назад

If you wanted to, you do it the same way as any other server. This would be https and then the IP address of Wazuh and that should be the config you need. Join the Discord if you need more help.

@diegodevops4151 Месяц назад

Nice video. If you could make a video for each module that would be awesome.

@Techdox Месяц назад

I would love too, but it's a bit too deep for my channel I think. Happy to answer questions you have though

@stocky9803 Месяц назад

I could never get Wazuh to work properly First instance I did up worked okay, I could add agents to it but I had to close that instance down pretty much straight away as it was all temporary data in it I've tried 3 times after that and everytime I add an agent to it nothing happens. The little add agent window just refreshes and sits there

@Techdox Месяц назад

Interesting, in this install it was done on a fresh installed VM so maybe you have conflicts? What distro are you using or how are you installing it?

@robza Месяц назад

Do you know how to inventory software with wazuh? Especially this with vulnerabilities. For example, search firefor 120 and show on which hosts it is installed? Thanks

@Techdox Месяц назад

Only if the package has a vulnerability so under Vulnerabilities, where it asks you to select an agent, look next to Inventory and select events. Here you can filter on a package name

@TylerHodges1988 19 дней назад

Here trying to figure out why Win 11 22h2 and Ubuntu 24.04 Vulns weren't showing up. I think you skipped a step here in that the agents conf files need to be edited to enable syscollector. - ill be heading to your discord now. haha

@JPEaglesandKatz 28 дней назад

unfortunately not as straightforward on a clean ubuntu 22.04.04 LTS... several errors while following the exact ubuntu install.. Agent install tosses an error.. And even after getting that to install it doesn't show up in the dashboard. I think once it fails once it leaves behind different files/folders that prevent installation to be done correctly.... It also seemed to brake the server. I do hope they update the UI/dashboard in the future because tbh, I find it rather ugly..

@GundamExia88 Месяц назад

Great video! Can this run in LXC instead of a VM?

@Techdox Месяц назад

Hey, you can deploy it as a container if you wish as well :) documentation.wazuh.com/current/deployment-options/docker/index.html

@plumduffer 2 месяца назад

Banger video as usual

@brighteduacation1297 Месяц назад

Can we get a tour of ur home lab setup and design?

@Techdox Месяц назад

Sure, it's nothing fancy :)

@bl7937 22 дня назад

How does the wazuh agent compare to an EDR solution. Do you need an EDR or Antivirus software installed alongside the wazuh agents?

@m7mmadomar 2 месяца назад

Thanks for the vido, but how to install in other port 443 ERROR: Port 443 is being used by another process. Please, check it before installing Wazuh.

@Techdox 2 месяца назад

Hey. This is why I suggested to run it on its own dedicated server to avoid classes with other services you are running :)

@reeeick 2 месяца назад

Have you every setup an open source vulnerability scanner like GVM/Openvas?

@Techdox 2 месяца назад

No I haven’t, are they worth looking into?

@reeeick 2 месяца назад

@@Techdox They are great for performing continuous scans of your network environment and catching known vulnerabilities as soon as they are disclosed

@KifKroker 13 дней назад

Yeah, this! although I would prefer a client install over a network authenticated single point server. In gvm it's optional (smb/ssh creds for authenticated scan)

@Iswimandrun Месяц назад

My excuse is supply chain attacks could make Wazuh into a giant backdoor to all connected systems.

@Techdox Месяц назад

100% fair - While no system can be entirely risk-free, using open-source solutions like Wazuh, where there is visibility into the codebase, can offer a level of reassurance. But, like anything you do your own research to see if your comfortable with it

@bangonkali Месяц назад

I have exactly the same issue. Even solar winds was susceptible to this. I think any organization large enough to become a target whether for profit or open-source or whatever are susceptible to nation backed attacks or even against another well funded and driven malicious entity.

@Iswimandrun Месяц назад

@Techdox guess you got to do layers and some of your systems should be on Wiresharked listened into local networks to validate installs and that yea you still own the systems you got the Wazuh instances and no one else is getting remote access to said instance. Probably benchmark things every time you update to insure the same or similar behavior. Idk there are probably more steps you can take to ensure your remote command and control system with Wazuh. The fact it is open source auditable and used not just by your company might have some points in more secure.

@kevincedeno8899 Месяц назад

Agreed. Supply chain attacks affect proprietary software as well, and there's less transparency.

@LinusBerglund 29 дней назад

My excuse is that I trust podman+SELinux.

@jayalyadav 2 месяца назад

Is there a way to install wazuh with portainer and caddy reverse proxy? I tried multiple times but failed

@futuregootecks Месяц назад

Not sure about wazuh specifically but the way I do it with other containers is to place it on the same docker network as caddy and then add the docker container name to the caddyfile then reload.

@viernester 2 месяца назад

Do you know if Wazuh can actually run on the Proxmox server? Tried but kept running into issues sadly.

@Techdox 2 месяца назад

Really good question, it just runs Debian so I don’t see why not, I’ll give it a try. What issues did you face?

@viernester 2 месяца назад

@@Techdox wazuh-agent service just failed to start, some of the issues i found possibly with some group membership missing. Didn't get too far after trying to mess with that, hope you have more success.

@Techdox 2 месяца назад

@@viernester I also tried and failed. Will look into it some more. Most likely missing dependencies

@NahImPro Месяц назад

@@viernesterworking fine for me on prox 8! Ensure you install on a full Ubuntu VM and not a container.

@davidmorton8170 Месяц назад

I’m not fully convinced that all the CIS linux server controls are necessary. Sure, they are stronger suggestions, but they don’t represent vulnerabilities.

@Techdox Месяц назад

100% unless your a company aiming for certification compliance, a lot of these are overkill, but still good to implement some of them

@KifKroker 13 дней назад

Hey CIS is open go and discuss there ;) but yeah most use it as a pick and choice list.

@davidmorton8170 10 дней назад

@@KifKroker The problem comes when you run into people who blindly run a security tool and assume every little reported item is serious. Especially in management.

@-someone-. 2 месяца назад

I’ve tried so many different ways to get this running on my raspberry pi 4b 8gb, but it doesn’t work. Followed about 3 different tutorials, but all fail. Hope you can address this, as I’d love to make use of wazuh and my spare pi! 🙏

@Techdox 2 месяца назад

That would be because Wazuh is not supported on ARM, which is what your Raspberry Pi uses - www.reddit.com/r/Wazuh/comments/16gwtt7/wazuhdashboard_on_rpi/

@-someone-. 2 месяца назад

@@Techdox thx, I guess the tutorials I followed were just clickbait for ads. Hopefully it gets support one day..👍

@Techdox 2 месяца назад

@@-someone-. yeah, especially for agents

@-someone-. 2 месяца назад

@@Techdox have you tried? doesn’t the “linux agents” cover pi’s.

@Techdox 2 месяца назад

@@-someone-. when I checked there was no ARM option which would be needed for the Pi’s

@rhb.digital 2 месяца назад

thnx for guide.. please tell me why we should just trust this company out of the box and installing clients/agents on our servers ? Does this company have any reputation in the world wide security map ?

@Techdox 2 месяца назад

Great question. I’ll make sure to include this in videos from now on. For me, I followed their social pages, verified their company and customers. wazuh.com/our-customers/ After six years of running, I’m sure if they were not legit they would have been called out by now. Gartner is also a good place to check out tooling www.gartner.com/reviews/market/security-information-event-management/vendor/wazuh/product/wazuh-the-open-source-security-platform

@karsh001 2 месяца назад

Security conscious vid and the first thing he does is to grab a random url and running it.... Always, check all scripts from the web before you run them. Else great vid, thanks!

@Techdox 2 месяца назад

Not exactly a random link, in this case I have an active server running from this same script and verified it's legit. This is something I mention a lot on this channel, making sure you actually know what is going on. I mentioned in this video this script installs the 3 components of Wazuh and showcase you can actually install the components individually as well. Valid point still

@karsh001 2 месяца назад

@@Techdox Thanks for the reply, you made a great point. I got a couple of suggestions for follow ups: 1. Like anyone installing automated tools you practically drown in warnings and errors. How do you deal with it in the best way? 2. A simple walk-through of an install script, what it does and what to look out for. Maybe framed for the Linux community as a whole. I am of course referring to the debacle that led up to CVE-2024-3094.

@BonBaisers 2 месяца назад

Looks like it uses ElasticSearch / Kibana under the hood

@zgjbeta 2 месяца назад

The font and layout gave it away for me as well.

@gerardocaceres7997 2 месяца назад

It uses Opensearch for the Indexer and Dashboard.

@thertsr9999 Месяц назад

It does it's based on elastic

@TheMcSebi Месяц назад

Great idea trusting yet another company with full root access to my servers. They won't ever be hacked I'm sure.

@Techdox Месяц назад

Absolutely, it's a valid point to be cautious about who has root access to your servers. But if you think about it, that's a concern with pretty much any third-party service or application we use, not just Wazuh. It really comes down to trust and verifying the security practices of any company you're considering. Plus, with open-source solutions like Wazuh, there's a community keeping an eye on things, which can sometimes offer an additional layer of scrutiny and security. It's all about finding the right balance that works for you!

@dbdevkc 18 часов назад

Good luck fixing that apparmor vulnerability in Ubuntu. I think that remains unresolved even in 22.04

@infocus-media 6 дней назад

I live on the Northern Beaches in Sydney, I am broke, can you send some Kiwi Love with some of that giveaways?, LOL!

@Techdox 5 дней назад

Isn’t northern beaches one of the richest areas in Sydney haha

@infocus-media 5 дней назад

@@Techdox I take it is a NO then, lol

@Techdox 5 дней назад

@@infocus-media Join the Discord channel if you haven't we do giveaways there :)

@Cozza1313 2 месяца назад

Discord invite is invalid.

@Techdox 2 месяца назад

I just tested it, still works. - discord.com/invite/8mX2KRxDw8

@sagarsriva 19 дней назад

Why does this look like splunk UI?

@Techdox 18 дней назад

I think it’s just that enterprise UI feel haha

@sagarsriva 18 дней назад

@@Techdox i like it anyway

@JeremiahDAlessio Месяц назад

Ubiquiti 😁

@udo80 2 месяца назад

Talking about security and then running an install script downloaded from the web as root without even checking its content is a little bit off, right?

@Techdox 2 месяца назад

Someone asked the same below this was my reply :) “Not exactly a random link, in this case I have an active server running from this same script and verified it's legit. This is something I mention a lot on this channel, making sure you actually know what is going on. I mentioned in this video this script installs the 3 components of Wazuh and showcase you can actually install the components individually as well. Valid point still”

@BesmirZanaj Месяц назад

Try to upgrade it. It will fail miserably

@Techdox Месяц назад

What steps are you using to upgrade?

@Rohambili 4 дня назад

Wazzzzzzzzzzzaaaaaaaaaaaap

@Techdox 3 дня назад

😝🤙🏻

@trollingdirty8910 Месяц назад

Doesn't scale well for enterprise especially in highly ephemeral environments.

@Techdox Месяц назад

Keen to hear more about that use case and how it doesn’t work? :)

@trollingdirty8910 Месяц назад

@@Techdox use case as enterprise that makes heavy use of spot instances that auto-register. Wazuh doesn’t scale in these cases very well. Imagine thousands of instances that instantiate and terminate a day. Primarily for data operations, etl.

@Techdox Месяц назад

@@trollingdirty8910 yeah, in this case they would be container based most likely and in that case the image itself would go through the testing for vulnerabilities etc

@trollingdirty8910 Месяц назад

@@Techdox Negative. Fat EC2 instances heavy compute. The AMI is baked and already scanned, primary concern is FIM.

@spoils8179 2 месяца назад

Apparently the dashboard doesnt have a good dark mode, but the docs do? No thank you.

@Techdox 2 месяца назад

Haha, fair enough. Pretty sure you can get browser extensions to do that if it’s a big issue for you

@66maelstrom 2 месяца назад

Wow. So no dark mode is the killer here? Like what??? I guess network security tools rely on things being dark, before things actually go dark?? What a crazy comment.....