Wazuh Post-Installation Hardening Checklist

The Wazuh installer ships with defaults that are fine for a fresh lab but not safe to run for long. Work through this checklist immediately after the installer finishes, before exposing the dashboard or enrolling production agents.

1. Rotate every default password

The installer creates several internal users (admin, kibanaserver, wazuh, wazuh-wui and more). Rotate them with the password tool that ships with the assistant:

sudo bash wazuh-passwords-tool.sh -a -A

The tool prints the new passwords, store them in your secrets manager (AWS Secrets Manager, Vault, 1Password) and remove `wazuh-install-files.tar` from disk afterward.

2. Replace self-signed certificates

The installer generates self-signed certs for the indexer, dashboard and API. For anything internet-facing, replace the dashboard certificate with a real one (Lets Encrypt or an internal PKI) and reload the dashboard:

sudo systemctl restart wazuh-dashboard

3. Restrict network access

Only the ports agents and operators actually need should be reachable. Common policy:

• 443/tcp: operators only (VPN or office CIDR)
• 1514/1515 tcp: agent subnets only
• 55000/tcp (API): operators only
• 9200/tcp (indexer): never exposed off-box

4. Lock down the Wazuh API

Edit `/var/ossec/api/configuration/api.yaml` to bind the API to localhost or an internal interface, enforce HTTPS, and disable the default user once an admin user exists.

5. Configure log retention

Indexer disks fill faster than you expect. Set an ILM policy that matches your compliance requirement, for many SOCs that is 90 days hot, 365 days warm, plus monthly snapshots to S3 or an NFS share.

6. Backups

• Snapshot the indexer (`/var/lib/wazuh-indexer`) daily
• Backup `/var/ossec/etc/` (manager config and decoders)
• Backup `/etc/wazuh-indexer/` and the certificate bundle
• Test restore at least once per quarter

7. Monitor the monitor

Wazuh has to monitor itself. Enroll an agent on the Wazuh server host, enable `vulnerability-detector` and FIM on `/var/ossec/etc/`, and forward critical Wazuh alerts (agent disconnected, indexer red, disk > 80%) to your on-call channel.

8. Plan updates

Pin Wazuh package versions and review the release notes before upgrading. Always upgrade the indexer first, then the server, then the dashboard, matching the version triple.

If you want a documented runbook for hardening, backups and upgrades tailored to your environment, our managed Wazuh service covers all of it, get in touch via the contact page.