CR-2026-06-25: Rollback

Rollback Plan

If the Wazuh agent causes service degradation, AppArmor conflicts, or fortress-verification regressions, execute this rollback in order.

Step 1: Stop and Disable the Agent Service

Before — confirm service state

systemctl status wazuh-agent 2>&1 | head -5

Change — stop and disable

sudo systemctl stop wazuh-agent
sudo systemctl disable wazuh-agent

After — verify stopped

systemctl status wazuh-agent 2>&1 | head -5

Step 2: Remove AppArmor Profile

Before — confirm profile loaded

sudo aa-status 2>&1 | grep -i ossec

Change — remove profile

sudo apparmor_parser -R /etc/apparmor.d/usr.local.wazuh-agent 2>/dev/null
sudo rm -f /etc/apparmor.d/usr.local.wazuh-agent

After — confirm profile removed

sudo aa-status 2>&1 | grep -i ossec

Expected: No output (profile no longer loaded).

Step 3: Remove nftables Egress Rules

Before — list current Wazuh rules

sudo nft list ruleset | grep -i wazuh

Change — restore pre-change nftables config

BACKUP_DIR="/tmp/pre-wazuh-backup-$(date +%Y%m%d)"
sudo cp "${BACKUP_DIR}/nftables.conf" /etc/nftables.conf
sudo nft flush ruleset
sudo nft -f /etc/nftables.conf

If the backup directory is from a previous day, adjust the date in BACKUP_DIR to match the actual backup timestamp.

After — verify Wazuh rules removed

sudo nft list ruleset | grep -i wazuh

Expected: No output.

Step 4: Uninstall the Wazuh Agent Package

Before — confirm package installed

ls -la /var/ossec/bin/ossec-agentd

Change — remove the agent

sudo /var/ossec/bin/ossec-control stop 2>/dev/null
sudo rm -rf /var/ossec
sudo rm -f /etc/systemd/system/wazuh-agent.service
sudo systemctl daemon-reload

After — verify removal

ls -la /var/ossec 2>&1
systemctl list-unit-files | grep wazuh

Expected: No such file or directory for /var/ossec, no wazuh unit files.

Step 5: Deregister Agent from Manager

Remove the stale agent entry from the Wazuh manager so it does not appear as disconnected.

DOMAIN="inside.domusdigitalis.dev"
TOKEN=$(curl -sk -u "wazuh-wui:$(gopass show -o v3/domains/d000/k3s/wazuh/api)" \
  -X POST "https://wazuh.${DOMAIN}:55000/security/user/authenticate" \
  | jq -r '.data.token')
AGENT_ID=$(curl -sk -H "Authorization: Bearer ${TOKEN}" \
  "https://wazuh.${DOMAIN}:55000/agents?name=modestus-p16g" \
  | jq -r '.data.affected_items[0].id')
curl -sk -H "Authorization: Bearer ${TOKEN}" \
  -X DELETE "https://wazuh.${DOMAIN}:55000/agents?agents_list=${AGENT_ID}&status=all&older_than=0s" \
  | jq '.' | tee /tmp/wazuh-agent-delete.json

Step 6: Verify Clean State

After — fortress verification with no regressions

fortress-verification is not a standalone command. Copy the script block from the fortress-verification/fortress-script.adoc sub-partial to /tmp/fortress-verify.sh and execute:

bash /tmp/fortress-verify.sh | tee /tmp/fortress-post-rollback.txt

Compare against the pre-change baseline. The system should return to its exact pre-enrollment posture.