Agentless in Wazuh Docker

[Eduardo-FCS]

I'm new to configuring Wazuh in Docker, and I need to add an agentless monitor to a switch. However, the Wazuh documentation mentions using a command with sudo, but the container of Wazuh manager doesn't have a built-in sudo command. Could you please provide step-by-step instructions on how to configure the agentless monitor?

The Wazuh documentation I'm referring to is here: https://documentation.wazuh.com/current/user-manual/capabilities/agentless-monitoring/connection.html

[naxvog]

Assuming that you are missing the ssh-keygen part:

Use your host system to generate the keys using ssh-keygen (assuming single node docker-compose.yml being used)

1. Use docker compose exec wazuh.manager id wazu to get the uid and gid of the wazu user (I am assuming 999 in both cases)
2. Generate the keys using ssh-keygen on your host system and make sure to put them in a new directory, we are going to mount that directory to the container in a later step
3. Change to user and group to the container's wazuh user using chown 999:999 id_ed25519*
4. Mount the generated directory to the manager container by modifying docker-compose.yml: create a new element in services > wazuh.manager > volumes and mount you local directory to /var/ossec/.ssh (example: - ./.ssh:/var/ossec/.ssh:ro).
5. Restart the container