wazuh manager without remote and authd

[Kathy L]

I am trying to run a simple configuration - just wazuh manager without  remoted and authd.  (we send data back through custom rsyslog).  As soon as I comment out the <remoted> and <authd> sections in ossec.conf and restart using systemctl restart wazuh-manager, I get errors.  Can I run the manager without remoted and authd?  The error logging from journalctl and systemd status don't give me much to go on.  I'm running the latest version, install via repo.   Thanks for your help.

[Federico Pacher]

Hi there,

It is not able to disable 'remoted' since wazuh-remoted program is the server-side daemon that communicates with the agents. If you check the documentation here, you can see that the remote does not have a disable/enable tag. On the other hand, it is possible to disable/enable authd since the wazuh-authd program can automatically add a Wazuh agent to a Wazuh manager and provide the key to the agent. Here you have the documentation link that shows you how to enable/disable authd. Remember to restart wazuh service after making any configuration change.

I hope this information can help you,

Regards