Can wazuh worker node registered wazuh agent

[Naveed Ahmed]

Hi there,

 I have deployed 2 wazuh nodes and became part of cluster, first one is deployed on cloud and other one deployed on local network. I could not expose my local network on the internet then i will have to enroll local agents to local wazuh with this script.

--

Regards,

Naveed Ahmed

DevOps Engineer

[Naveed Ahmed]

Hi there,

I have deployed 2 wazuh nodes and became part of the cluster which are master and worker, first one is deployed on cloud and other one deployed on local network. I could not expose my local network on the internet then I will have to enroll local agents to local wazuh with local script.
I used to install script and it does not create a registration auth key, because the worker node is unable to generate auth key . Is there any possibility that wazuh worker node generate auth keys for local servers?

Thanks. 

[Gabriel Fernando Lojano Mayaguari]

Hi, naveed.ahmed! 

Hope you're having a good day so far.

First, you should check if the wazuh master node and the worker node must have a connection, that can be either by an internet connection or by a local network connection. 

After that, please check the status of the cluster by running the command:  /var/ossec/bin/cluster_control -l 

If there is a proper connection and the cluster status seems to be right, you can proceed to register the agent. As for answering your question, a worker node is not able to generate auth keys for the registration process, however, the registration process can be executed in a worker node with minor issues because the node will receive the registration petition and send it to the master node. The master node will generate the registration key and send it back to the worker and complete the registration process.

If you need more help with the registration process, please share the script that you are using and the ossec.log file from the wazuh agent that you are trying to register.

Hope this answer can help you

Regards,

Fernando Lojano Mayaguari

[Franco Giovanolli]

Hello Naveed!

Yes, a worker can be used to register agents. But in a use case like yours, I recommend that you deploy all the components of your Wazuh cluster on the same site, and use NGINX as a reverse proxy to centralize communication between Wazuh agents and managers.

This is a high-level diagram, which I hope can help you:

Additionally, in these links you can find more information on how to carry out this implementation:

https://wazuh.com/blog/nginx-load-balancer-in-a-wazuh-cluster/

https://documentation.wazuh.com/current/user-manual/configuring-cluster/advanced-settings.html

Please, let me know if this helps.

Franco.