Setting Up a Secure Wazuh Environment by AWS EC2
Tags: aws, cloudcomputing, cloudnative, community
Published: 2024-06-16 21:52:01

**Introduction:**
     
   Wazuh is an open-source security platform that aims to help organizations monitor and manage security incidents, detect threats, and ensure compliance with security regulations. It provides capabilities for intrusion detection, log analysis, vulnerability detection, and threat intelligence, wazuh is trusted and used by thousands of organizations around the world. With its powerful features and flexible capabilities, it has become a preferred choice for those looking for a reliable and flexible open-source security platform. Wazuh is a powerful security platform that combines threat detection and response capabilities and is characterized by the ability to integrate and customize to meet the needs of different organizations.
    

**Features of Wazuh**

**Protect endpoints and cloud workloads:** Wazuh provides continuous protection for on-ground and cloud-based environments, ensuring environments are protected from potential threats.

**Integration and scalability:** Wazuh can integrate with other security tools and expand its capabilities based on an organization's needs.

**Security monitoring and log data analysis:** Wazuh enables effective threat detection and response through log data analysis.

**Security Integration Monitoring and Incident Response:** Wazuh supports regulatory compliance monitoring and cloud security.

**Security Tools, Log Control, and Incident Control:** Wazuh provides tools for security, incident control, and log control.




**Installation Wazuh by AWS**

**Step 1 "Launch Instance"**

When logging into the AWS account, we select the EC2 service through Services or by the search box:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lywxncnc6ujxcxz3kn6h.png)

Click on **Launch instance**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dtla1bl93xk2djvvub1x.png)

Under **Name and tags**

Enter a name to identify your instance, For this tutorial, name the instance (Wazuh)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ijq3vv6mhttoj8xjvksg.png)

Under Application and OS Images:

From **Quick Start**, choose an AMI that meets your web server needs
Here we choose Ubuntu (which is free tier eligible)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2ux3jnkpswkqu3v0crpe.png)

Under **Instance type**:

Choose the type of instance, here we choose **t2.medium**.(**It is recommended that the lowest specifications be 2CPU and 4GiB, which are available in the t2.medium or higher instance**).


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0y05act8f1n9rcjx5aun.png)

Under **Key pair (login)**:

Choose the key pair

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/95ys0kycmd8nyvear88n.png)


or create new key pair:
Give a name to the key pair, then click **Create key pair**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c3ewo70jj1qj0mq8chxf.png)


Under **Network settings**: under **Firewall (security groups)**

Choose to Create security groups
**To Allow SSH traffic** by clicking on the check box
**To Allow HTTPS traffic** from the internet by clicking on the check box


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nb46x4h16wy2qiwlfkb1.png)

Leave all other configurations as they are (default settings)

In the **Summary** panel, review your instance configuration and then choose **Launch instance**.



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mnve6n8fbasfs4fdyi1k.png)

Successfully initiated launch of instance and to see the instance click on the ID:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s7ckehjzh6dcqyl52n14.png)

Your instance will first be Pending, and will then go into the Running state.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e2emsizf2dt2doqrb0wr.png)



**Step 2: "Connect to the instance"**

To connect to your instance, select the instance and choose **Connect**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/70lfweizuhrosg1nz9it.png)

There are many ways to connect to ec2, here we will choose the **SSH client** to connect.
After selecting the **"SSH Client"** section, copy and execute the following commands in the terminal as per the following steps:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9z2mqj4h5fjnmmaejxy2.png)


Open Terminal (here we use Git Bash)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/71ior9mzuloqrqbkzh1s.png)

Change the directory with the cd command (change directory), where you have downloaded your pem file(key pair).

In this article, the pem file is stored in the downloads folder.

Execute the **cd** command to change the path to the location of the encryption key
`cd Download/`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/umwp9n4xyjhh6nn6cetd.png)

Execute the following commands sequentially
1. Chmod 400 [key pair name].pem

2. ssh -i /path/key-pair-name.pem instance-user-name@instance-public-dns-name


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/miqxnqplr8g5qq2tco3y.png)

After the command is executed you will be prompted to type “Yes” to continue with the connection

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dve2oipn2gyfusfj6dxa.png)

And that’s it! Now we’re logged in to our AWS instance.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9he8g5joohem1nscaqjb.png)

Before installing Wazuh on an EC2 instance:

We get root permission by executing the `sudo -i` command

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k2fnf271bs1mat0qm9l1.png)

Executing the command "sudo -i" means booting as root on Linux. The main feature of this command is that it gives you full admin (root user) privileges, allowing you to perform commands and operations that require root user privileges.


Step 3 "Install Wazuh"

Now to install Wazuh, execute the command `curl -sO https://packages.wazuh.com/4.7/wazuh-install.sh&&sudo bash ./wazuh-install.sh -a -i` 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zdm9hfnvxbh8o9qhvgg8.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bzqjrdfvn86nrkowk9cg.png)

After some time has passed, the Wazuh installation is completed and we can log in using the username and password that we obtained with the installation:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pugwlhhuo3pgqawx1lv3.png)


Step 4 "login Wazuh"

- Return to the AWS account and click on the instance
- Then click on the details box
- Then click on the public IPV4 address to open in a browser.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/17r8f74xjqnv8z00vcud.png)


After opening the public IPV4 address in the browser, the following page appears, so we click on **Advanced**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hy9rv9529x7degsewrv3.png)

then click below:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vnp83f25vtc14r7dtavl.png)



The wazuh construction steps have been completed successfully

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m4apkdxerr8tidzys1zx.png)

We now login using the username and password that were obtained during the installation process previously:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/58v1khj6kq8r54an3izt.png)

You have successfully logged into Wazuh

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o6ng5iqsq1pnicayl7sx.png)














**References:**

https://documentation.wazuh.com/current/installation-guide/wazuh-server/index.html

https://dev.to/zahraajawad/our-wordpress-site-installation-by-aws-34jn