How to Install Wazuh on Ubuntu 26.04

---

Wazuh is an open-source security platform used for threat detection, integrity monitoring, incident response, vulnerability detection, log analysis, and security event management.

This guide explains how to install the Wazuh All-in-One Docker Deployment on Ubuntu 26.04.

Update the System

---

Update all installed packages:

apt update -y

apt upgrade -y

Install Required Packages

---

Install dependencies required for Docker installation:

apt install -y curl apt-transport-https ca-certificates software-properties-common gnupg lsb-release

Install Docker

---

Install Docker from Ubuntu repository:

apt install -y docker.io

Enable and start Docker service:

systemctl enable --now docker

Verify Docker installation:

docker --version

Output:

Docker version 29.1.3, build 29.1.3-0ubuntu4.1

Install Docker Compose

---

Ubuntu 26.04 may not include the Docker Compose plugin package by default.

Install standalone Docker Compose manually:

curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" \
-o /usr/local/bin/docker-compose

Make it executable:

chmod +x /usr/local/bin/docker-compose

Verify installation:

docker-compose --version

Example output:

Docker Compose version v5.1.3

Download Wazuh Docker Deployment

---

Create working directory:

mkdir -p /opt/wazuh

cd /opt/wazuh

Clone the official Wazuh Docker repository:

git clone https://github.com/wazuh/wazuh-docker.git -b v4.12.0

Move into the single-node deployment directory:

cd wazuh-docker/single-node

Generate SSL Certificates

---

Generate certificates required for Wazuh services:

docker-compose -f generate-indexer-certs.yml run --rm generator

Output:

Created SSL certificates successfully

Start Wazuh Stack

---

Start all Wazuh containers:

docker-compose up -d

Check running containers:

docker ps

Output:

CONTAINER ID   IMAGE                          COMMAND                  CREATED          STATUS          PORTS                                                                                                                                                                 NAMES
e093279f4e87   wazuh/wazuh-dashboard:4.12.0   "/entrypoint.sh"         11 seconds ago   Up 10 seconds   443/tcp, 0.0.0.0:443->5601/tcp, [::]:443->5601/tcp                                                                                                                    single-node-wazuh.dashboard-1
d8764845ec9d   wazuh/wazuh-manager:4.12.0     "/init"                  12 seconds ago   Up 10 seconds   0.0.0.0:1514-1515->1514-1515/tcp, [::]:1514-1515->1514-1515/tcp, 0.0.0.0:514->514/udp, [::]:514->514/udp, 0.0.0.0:55000->55000/tcp, [::]:55000->55000/tcp, 1516/tcp   single-node-wazuh.manager-1
cfc5392eed9b   wazuh/wazuh-indexer:4.12.0     "/entrypoint.sh open…"   12 seconds ago   Up 10 seconds   0.0.0.0:9200->9200/tcp, [::]:9200->9200/tcp                                                                                                                           single-node-wazuh.indexer-1

Configure Firewall

---

Allow required ports:

ufw allow 443/tcp

ufw allow 1514/tcp

ufw allow 1515/tcp

Enable firewall:

ufw enable

Reload firewall:

ufw reload

Check firewall status:

ufw status

Access Wazuh Dashboard

---

Open your browser and visit:

https://your_server_ip

Replace your_server_ip with your actual server IP or domain name.

You may see a browser security warning because Wazuh uses a self-signed SSL certificate by default.

Proceed to continue to the dashboard.

Default Login Credentials

---

Default credentials are usually:

  Username: admin
  Password: SecretPassword

Get the generated admin password:

docker-compose exec wazuh.dashboard bash

Inside the container run:

cat /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml

Or retrieve credentials using:

docker-compose logs | grep admin

Wazuh Login Screen

---

Wazuh Dashboard

---

Verify Wazuh Services

---

Check container status:

docker ps

Check logs:

docker-compose logs -f

Restart services if needed:

docker-compose restart

Stop services:

docker-compose down

Install Wazuh Agent (Optional)

---

To monitor another Linux server, install the Wazuh agent:

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh

bash ./wazuh-install.sh -a

Follow the prompts to connect the agent to your Wazuh manager.

🎉 Wazuh is now successfully installed on Ubuntu 26.04 and ready for security monitoring and threat detection.