CR-2026-06-25: Wazuh Agent Enrollment — modestus-p16g

Change Summary

Field	Value
CR ID	CR-2026-06-25-wazuh-agent-enrollment
Author	Evan Rosado
Status	Complete (with follow-ups)
Priority	P0 (security visibility gap — 0/10 agents enrolled)
Risk Level	Medium (root-level agent on hardened system)
Approval	Self-approval
Target Date	2026-06-25
Systems Affected	modestus-p16g (ThinkPad P16 Gen 2, Arch Linux)
Rollback Window	Immediate — stop service, remove package
Related Incidents	INC-2026-06-25-002 (monitor freeze — no logs captured because no agent)

Field

Value

CR ID

CR-2026-06-25-wazuh-agent-enrollment

Author

Evan Rosado

Status

Complete (with follow-ups)

Priority

P0 (security visibility gap — 0/10 agents enrolled)

Risk Level

Medium (root-level agent on hardened system)

Approval

Self-approval

Target Date

2026-06-25

Systems Affected

modestus-p16g (ThinkPad P16 Gen 2, Arch Linux)

Rollback Window

Immediate — stop service, remove package

Related Incidents

INC-2026-06-25-002 (monitor freeze — no logs captured because no agent)

Install and enroll the Wazuh 4.x agent on modestus-p16g as the first endpoint in the Domus Digitalis SIEM cluster. Configure log collection for systemd journal, AppArmor, nftables, pacman, sshd, and auditd. Integrate with the existing hardening stack without introducing regressions.

Why

Two days of intensive security hardening — AppArmor enforce, nftables egress filtering, LUKS, USBGuard, auditd, fail2ban — have produced a defense-in-depth posture with zero telemetry. The Wazuh SIEM cluster is running on k3s, but no agents are enrolled. Every security event on the workstation disappears into local logs that nobody monitors. INC-2026-06-25-002 (monitor freeze) demonstrated the gap: no agent meant no alert, no timeline reconstruction, no correlation.

This is the first agent enrollment. It establishes the template for the remaining 9 endpoints.

Prerequisites Verified

Check	Target	Result
Registration port	wazuh.inside.domusdigitalis.dev:1515	OK
Event port	wazuh-workers.inside.domusdigitalis.dev:1514	OK
API port	wazuh.inside.domusdigitalis.dev:55000	OK
API authentication	wazuh-wui / gopass	OK
Dashboard redirect	wazuh.inside.domusdigitalis.dev:443	302 (expected)

Check

Target

Result

Registration port

wazuh.inside.domusdigitalis.dev:1515

Event port

wazuh-workers.inside.domusdigitalis.dev:1514

API port

wazuh.inside.domusdigitalis.dev:55000

API authentication

wazuh-wui / gopass

Dashboard redirect

wazuh.inside.domusdigitalis.dev:443

302 (expected)

Risk Assessment

Risk	Mitigation
AppArmor conflict	Deploy ossec profile in complain mode first; enforce after 48h observation
nftables egress block	Pre-configure explicit allow rules before starting agent
auditd contention	Wazuh reads audit logs via file — no socket conflict with auditd
Root-level process	ossec-agentd runs as root by design; AppArmor profile constrains filesystem access
Agent instability	systemd service can be stopped/disabled instantly; no kernel modules involved

Risk

Mitigation

AppArmor conflict

Deploy ossec profile in complain mode first; enforce after 48h observation

nftables egress block

Pre-configure explicit allow rules before starting agent

auditd contention

Wazuh reads audit logs via file — no socket conflict with auditd

Root-level process

ossec-agentd runs as root by design; AppArmor profile constrains filesystem access

Agent instability

systemd service can be stopped/disabled instantly; no kernel modules involved

Scope

In scope: modestus-p16g agent install, AppArmor profile, nftables egress rules, log collection config
Out of scope: Other 9 endpoints, Wazuh manager/indexer configuration, custom rules/decoders
Template value: This CR becomes the reference implementation for all subsequent agent enrollments

Deviations from Plan

The following deviations occurred during implementation. All are documented in the implementation partial with the actual commands used.

Deviation Detail

Deviation	Detail
CDN access denied	The `4.x` path on Wazuh’s CDN returned `AccessDenied` from S3. The `4.14` path served the install script, but the `.asc` GPG signature was unavailable.
No Arch support in install script	`wazuh-install.sh` supports only `apt`/`yum`/`dnf`/`zypper`. No `pacman`/Arch Linux path exists.
RPM extraction method	Agent installed by downloading the official RPM and extracting with `bsdtar` instead of using the install script. Required manual service user creation and systemd unit placement.
wazuh group, not ossec	Wazuh 4.14.x expects group `wazuh`, not the legacy `ossec` group. Ownership had to be corrected after initial extraction.
agent-auth manual registration	Auto-enrollment via `systemctl start` created duplicate agents (race condition). Used `agent-auth` with `-P password` for one-shot manual registration. The `-P` flag takes a password string, not a file path — the `authd.pass` file approach failed.
Workers address, not manager	Agent connected to `wazuh-workers.inside.domusdigitalis.dev:1514/tcp` for event delivery, not the manager address directly. This is correct Wazuh architecture — workers handle event ingestion.
Rootcheck definition files missing	RPM extraction does not include `rootcheck_files` or `rootcheck_trojans` definition files. Non-critical warnings logged. Files can be downloaded from the Wazuh GitHub repo.
nftables Phase 4 skipped	No egress filtering active on the workstation — all outbound allowed via `iptables-nft` (Docker/libvirt). Adding `inet` rules would conflict.

CDN access denied

The 4.x path on Wazuh’s CDN returned AccessDenied from S3. The 4.14 path served the install script, but the .asc GPG signature was unavailable.

No Arch support in install script

wazuh-install.sh supports only apt/yum/dnf/zypper. No pacman/Arch Linux path exists.

RPM extraction method

Agent installed by downloading the official RPM and extracting with bsdtar instead of using the install script. Required manual service user creation and systemd unit placement.

wazuh group, not ossec

Wazuh 4.14.x expects group wazuh, not the legacy ossec group. Ownership had to be corrected after initial extraction.

agent-auth manual registration

Auto-enrollment via systemctl start created duplicate agents (race condition). Used agent-auth with -P password for one-shot manual registration. The -P flag takes a password string, not a file path — the authd.pass file approach failed.

Workers address, not manager

Agent connected to wazuh-workers.inside.domusdigitalis.dev:1514/tcp for event delivery, not the manager address directly. This is correct Wazuh architecture — workers handle event ingestion.

Rootcheck definition files missing

RPM extraction does not include rootcheck_files or rootcheck_trojans definition files. Non-critical warnings logged. Files can be downloaded from the Wazuh GitHub repo.

nftables Phase 4 skipped

No egress filtering active on the workstation — all outbound allowed via iptables-nft (Docker/libvirt). Adding inet rules would conflict.