How to Install Wazuh Server on Ubuntu 24.04 LTS (Step-by-Step Guide)

Wazuh is a free, open-source security platform that unifies XDR and SIEM capabilities. The fastest way to get a working lab or proof-of-concept up and running is the official installation assistant, which deploys the Wazuh indexer, Wazuh server (manager) and Wazuh dashboard on a single Ubuntu 24.04 LTS host. This guide walks through every step, in order, with the exact commands from the official documentation.

System requirements

For a single-node, all-in-one deployment intended for evaluation or a small environment, the official minimum is:

• 4 vCPU, 8 GB RAM, 50 GB disk (production should be sized higher)
• Ubuntu 24.04 LTS (a fresh server install is recommended)
• Root or sudo access
• Outbound internet access to packages.wazuh.com

1. Prepare the host

Update the package index and install curl, which the assistant needs to fetch artifacts:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl

2. Download the installation assistant

Pull the latest assistant script directly from the Wazuh package repository:

curl -sO https://packages.wazuh.com/4.9/wazuh-install.sh
curl -sO https://packages.wazuh.com/4.9/config.yml

3. Run the all-in-one install

The `-a` flag tells the assistant to install all components (indexer, server and dashboard) on the same machine and generate certificates automatically:

sudo bash wazuh-install.sh -a

The script takes roughly 10 to 15 minutes depending on disk and network speed. When it finishes you will see lines confirming that the indexer, filebeat, manager and dashboard services are up.

4. Retrieve the default admin password

The assistant prints credentials at the end of the install but they are also stored in a tar archive. Extract them with:

sudo tar -axf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt -O

Look for the `admin` user, you will use it for the first dashboard login. Keep this file safe; we will rotate the password in a later hardening guide.

5. Access the Wazuh dashboard

The dashboard listens on HTTPS port 443 by default. Open a browser and visit:

https://<server-ip>

Accept the self-signed certificate warning, then log in with user `admin` and the password you retrieved. You should land on the Wazuh overview page with zero agents reporting, that is expected for a fresh install.

6. Verify services

Confirm every component is active:

sudo systemctl status wazuh-indexer
sudo systemctl status wazuh-manager
sudo systemctl status wazuh-dashboard
sudo systemctl status filebeat

All four should report `active (running)`. If any service fails, check `/var/log/wazuh-*` and the indexer log under `/var/log/wazuh-indexer/`.

Next steps

• Enroll your first agent (see our Wazuh Agent Installation Guide)
• Rotate the default admin password before exposing the host
• Configure log retention and backups for the indexer data directory
• For production, switch to a distributed deployment

If you need a hand sizing, hardening or running this stack in production, our team operates Wazuh deployments end to end, get in touch via the contact page.