Wazuh 4.14.5 All-in-One Installation Fails at "Updating the internal users" on Ubuntu 22.04

[Madushanka Nayanajith]

Hi everyone,

I'm trying to install Wazuh 4.14.5 All-in-One on Ubuntu Server 22.04 in VMware.

Environment

• Ubuntu Server 22.04

• VMware Workstation

• 2 vCPU

• 6 GB RAM

• 50 GB disk (48 GB available to root filesystem after LVM expansion)

• Fresh OS installation

• No previous Wazuh packages installed

Installation Commandcurl -sO https://packages.wazuh.com/4.14/wazuh-install.sh chmod +x wazuh-install.sh sudo ./wazuh-install.sh -a Installation Progress

The installation completes all major components successfully:

• Wazuh Indexer installed and started

• Wazuh Manager installed and started

• Filebeat installed and started

• Wazuh Dashboard installed and started

The failure occurs at:

INFO: Updating the internal users. ERROR: The backup could not be created INFO: --- Removing existing Wazuh installation --- Additional Information

Dashboard service:

sudo systemctl status wazuh-dashboard

shows:

Active: active (running)

Port 443 is listening:

sudo ss -tulpn | grep 443

Output:

0.0.0.0:443 LISTEN

Indexer port is listening:

sudo ss -tulpn | grep 9200

Output:

127.0.0.1:9200 LISTEN

TLS handshake works:

openssl s_client -connect localhost:9200

returns the Wazuh Indexer certificate successfully.

However:

curl -k -u admin:'<generated_password>' https://localhost:9200/_cluster/health?pretty

returns:

Unauthorized

Dashboard login using the generated admin credentials also fails with:

Invalid username or password Previous Attempts

• Expanded LVM from 24 GB to 48 GB.

• Fully removed all Wazuh packages and directories.

• Reinstalled from a clean state.

• Same failure occurs every time at "Updating the internal users".

Question

Has anyone seen Wazuh 4.14.5 fail during the "Updating the internal users" step while all services appear to start correctly?

Is there a known issue with the internal users initialization, securityadmin.sh execution, or OpenSearch security configuration in 4.14.5?

Any guidance would be appreciated.

[Nikhil Gurjar]

Hi  Madushanka, 

Thank you for the detailed information.

To investigate further, could you please share the contents of /var/log/wazuh-install.log, particularly the section around the "Updating the internal users" message? using the command below: grep -A100 -B100 "Updating the internal users" /var/log/wazuh-install.log . This should provide additional details regarding the backup creation failure and help identify the underlying cause.

Additionally, please provide:

• journalctl -u wazuh-indexer -n 200 --no-pager
• journalctl -u wazuh-dashboard -n 100 --no-pager

In parallel, we will attempt to reproduce the behaviour in a similar Ubuntu Server 22.04 environment running Wazuh 4.14.5 to determine whether the issue is reproducible or specific to your environment.

Looking forward to your update. 

Best regards,
Nikhil

[Nikhil Gurjar]

Hi  Madushanka, 

Thank you for your patience. I tested the scenario and attempted to reproduce the issue in a similar environment; however, I was unable to replicate the problem. The Wazuh installation completed successfully using the Quick Start installation command as expected.

Please refer to the attached screenshot for reference. Additionally, ensure that the installation command is executed with administrator (root) privileges, as insufficient permissions may cause the installation to fail.

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a

To investigate further, could you please share the contents of /var/log/wazuh-install.log, particularly the section around the "Updating the internal users" message? using the command below: grep -A100 -B100 "Updating the internal users" /var/log/wazuh-install.log . 

Additionally, please provide the logs by using:

• journalctl -u wazuh-indexer -n 200 --no-pager
• journalctl -u wazuh-dashboard -n 100 --no-pager
  

Looking forward to your update.

Best regards,
Nikhil