Theseus

Appearance

Install on two servers ​

Wazuh on a core server; the consoles and services on an application server. The two servers share one set of secrets and one certificate authority, which the control plane carries from the core to the application server.

Single-server and two-server topologiesOne server (role all)Every serviceWazuh manager, indexer, dashboardconsole, sign-in, enrolment, patchingPallas, scanner, connectors, reportingin: 443, 80 analysts and agentsin: 1514 Wazuh agentsout: 443 control plane, registry8 GB RAM minimumTwo servers (roles core and app)Application server (app)web gateway, console, Keycloak,enrolment, patch service, Pallas,reporting, opsin: 443, 80 analysts and agents4 GB RAM minimumCore server (core)Wazuh manager, indexer,dashboard, vuln-verify,scanner, connectorsin: 1514 Wazuh agents6 GB RAM minimumprivate9200 550005601 9001
In a two-server install the core publishes 9200, 55000, 5601 and 9001 on its private address, for the application server only.

Before you start ​

  • Two servers that meet the requirements: core at least 6 GB, app at least 4 GB.
  • A private network between them. Note the core's private IP address, for example 10.0.1.10.
  • Tell us the core's private address. We enter it for your core server ("Private address") before you install. The application server reaches the core at that address.
  • Decide how endpoints reach the core on TCP 1514: a public IP or DNS name of the core, or its private address if all endpoints are on that network. Tell us this address as well; it becomes AGENT_HOST. If it is not set, endpoints are given the core's private address.
  • Two install commands from us, one per server. Each works once, within 24 hours.

Firewall between the servers ​

On the core server, allow from the application server's private address only:

PortService
9200/tcpWazuh indexer
55000/tcpWazuh manager API
5601/tcpWazuh dashboard
9001/tcpScanner API

These ports are bound to the core's private address. Do not expose them to the internet.

Example with ufw on the core, where the application server is 10.0.1.20:

bash
sudo ufw allow from 10.0.1.20 to any port 9200,55000,5601,9001 proto tcp
sudo ufw allow 1514/tcp

Example with firewalld on a RHEL-family core:

bash
sudo firewall-cmd --permanent --new-zone=theseus-app
sudo firewall-cmd --permanent --zone=theseus-app --add-source=10.0.1.20
sudo firewall-cmd --permanent --zone=theseus-app --add-port={9200,55000,5601,9001}/tcp
sudo firewall-cmd --permanent --add-port=1514/tcp
sudo firewall-cmd --reload

From the outside: 443 and 80 to the application server, 1514 to the core. See Network and firewall.

1. Install the core first ​

Run the core's install command on the core server. It asks no questions (the console address is asked on the application server), checks the host and installs the Wazuh services.

text
== Checking the host (role core, stack /opt/theseus)
    ok    memory: 15.6 GB (role core needs 6 GB)
    ok    vm.max_map_count: set to 262144 (persisted in /etc/sysctl.d/99-theseus.conf)
    ok    port 1514 free
    ok    port 1515 free

When the core finishes it hands its generated secrets and certificate authority to the control plane, sealed, for the application server.

2. Install the application server ​

Run the application server's install command. It asks for the console's domain and certificate, as on a single server. Its install waits until the core has finished, then checks it can reach the core on the four ports above before it starts the console.

The summary at the end is printed on the application server, with the first administrator's sign-in.

3. DNS, firewall, first sign-in ​

  1. Point the console name to the application server.
  2. If endpoints reach the core by a name, create that record too (core's public address).
  3. Open the ports listed above.
  4. Sign in and change the password, as in Install on one server.

Check the split ​

On the application server:

bash
cd /opt/theseus && sudo ./theseus status

The health probes include the indexer, manager API and dashboard on the core; all should be up.

On the core server, ./theseus status lists only the core's containers and checks the indexer, manager API and dashboard itself.

If the application server reports the core as down, see Two servers: the application server cannot reach the core.

Known limit ​

In a two-server install the patch service (app) and vuln-verify (core) do not share the queue for an immediate re-check after a patch. A patch is still verified, by vuln-verify's regular cycle, which runs every 30 minutes, so verification can take longer than on one server.

Theseus documentation