Problem install wazuh agent

[Jymmy Hands]

I have problems installing wazuh agents on red hat 8.9.
I am as root but I get the following message during installation:

warning: wazuh-agent-4.7.2-1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 29111145: NOKEY
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:wazuh-agent-4.7.2-1              ################################# [100%]
/var/tmp/rpm-tmp.St5nZw: line 2: /var/ossec/bin/wazuh-control: Permission denied
/var/tmp/rpm-tmp.St5nZw: line 24: /var/ossec/packages_files/agent_installation_scripts/gen_ossec.sh: Permission denied
/var/tmp/rpm-tmp.St5nZw: line 28: /var/ossec/packages_files/agent_installation_scripts/add_localfiles.sh: Permission denied
/var/tmp/rpm-tmp.St5nZw: line 32: /var/ossec/packages_files/agent_installation_scripts/src/init/register_configure_agent.sh: Permission denied

[Awwal Ishiaku]

Hi Jymmy,

Can you share more information about your installation? What is the architecture of the endpoint?

Also, share the installation steps or documentation you're following.
Ensure that you perform the installation with root privileges.

Regards.

[Jymmy Hands]

Hi Awwal.

hello awwal
Despite installing the agent as root these messages appear.

I'm installing the agent on a clean server

[root@srv1dimld1 giabn]# sudo WAZUH_MANAGER='10.7.25.187' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='ISIMDesarrollo1' rpm -ihv wazuh-agent-4.7.2-1.x86_64.rpm

warning: wazuh-agent-4.7.2-1.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 29111145: NOKEY
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:wazuh-agent-4.7.2-1              ################################# [100%]

/var/tmp/rpm-tmp.WqP6Je: line 2: /var/ossec/bin/wazuh-control: Permission denied
/var/tmp/rpm-tmp.WqP6Je: line 24: /var/ossec/packages_files/agent_installation_scripts/gen_ossec.sh: Permission denied
/var/tmp/rpm-tmp.WqP6Je: line 28: /var/ossec/packages_files/agent_installation_scripts/add_localfiles.sh: Permission denied
/var/tmp/rpm-tmp.WqP6Je: line 32: /var/ossec/packages_files/agent_installation_scripts/src/init/register_configure_agent.sh: Permission denied
[root@srv1dimld1 giabn]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.9 (Ootpa)

[Awwal Ishiaku]

Please take a look at the last comment in this thread.
Maybe you have "noexec" configured on the endpoint?

[Jymmy Hands]

Dear.
Due to policy, the noexec restriction in /var cannot be removed.
Is there another alternative?

 /etc/fstab

# Created by anaconda on Tue Apr  9 20:08:29 2024
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/rhel-LogVol_root /                       xfs     defaults        0 0
UUID=c8aae620-3c13-410e-9eed-ac12c8d87ac8 /boot                   xfs     defaults        0 0
UUID=02F0-1819          /boot/efi               vfat    umask=0077,shortname=winnt 0 2
/dev/mapper/rhel-LogVol_home /home                   xfs     defaults,grpquota,nodev,nosuid,usrquota 0 0
/dev/mapper/rhel-LogVol_tmp /tmp                    xfs     defaults,nodev,noexec,nosuid 0 0
/dev/mapper/rhel-LogVol_var /var                    xfs     defaults,nodev,noexec,nosuid 0 0
/dev/mapper/rhel-LogVol_varlog /var/log                xfs     defaults,nodev,noexec,nosuid 0 0
/dev/mapper/rhel-LogVol_varlogaudit /var/log/audit          xfs     defaults,nodev,noexec,nosuid 0 0
/dev/mapper/rhel-LogVol_vartmp /var/tmp                xfs     defaults,nodev,noexec,nosuid 0 0
/dev/mapper/rhel-LogVol_swap none                    swap    defaults        0 0
/dev/mapper/opt-LogVol_opt      /opt            xfs     defaults        0 0
tmpfs /dev/shm tmpfs defaults,relatime,nodev,noexec,nosuid 0 0

[Awwal Ishiaku]

You can build and install the agent from sources.

You'll be prompted to enter a custom installation path of your choice when using this installation method.