Skip to content

Lab10.1WazuhWindows

Jump to bottom
Beth edited this page Apr 21, 2025 · 14 revisions

Domain Services

Start by installing active directory services on MGMT02 (Make sure to take a snapshot beforehand)

Open Server Manager, Manage > Add Roles and Features

  • Active Directory Domain Services

The server then needed to be promoted to a domain server, so I did so, adding a new forest and naming the domain elizabeth.local

Then I hit install to promote MGMT02 to a domain controller, and waited

WKS01 Domain Connection

https://learn.microsoft.com/en-us/answers/questions/901610/tcp-and-ud-ports-required-for-communication-betwee

Based on this research, it seems that the ports I need to allow for communication are as follows:

These ports were allowed on fwmgmt on the LAN-to-MGMT firewall

UDP

  • 88
  • 135
  • 389
  • 445
  • 464
  • 53
  • 1025 - 5000
  • 49152 - 65535

TCP

  • 88
  • 389
  • 135
  • 445
  • 464
  • 3268 and 3269
  • 53
  • 1025 - 5000
  • 49152 - 65535

image

image

Vyos Aside

During this I learned that you can edit a firewall such as edit firewall name LAN-to-MGMT to only edit rule within there, this reduces the amount of typing you have to do.

I also learned that you can copy rules, such as copy rule 30 to rule 31 to also reduce the amount of typing you have to do

Make sure to point the wks at mgmt02 for dns, and connect it to the domain!

In order to find the few ports I was missing from my research, I ran wireshark and allowed any ports I saw wks trying to use to connect to mgmt02

Wazuh

Connect wks01 to wazuh by following the instructions in the "deploy a new agent" tool and running the command it generates. Make sure to create a new windows group beforehand.

  • Make sure to run it in a privileged powershell prompt

You can start the wazuh service with NET START WazuhSvc

For MGMT02, you can follow the same procedure, however I ended up opening my firewalls temporarily to allow mgmt02 to download the wazuh manager package. This meant a rule 999 on both edge and fwmgmt to allow all traffic coming from 172.16.200.11 (mgmt02-elizabeth) and a quick invoke-webrequest champlain.edu to test connectivity. Once the package was downloaded and installed, both rules were promptly deleted

You also may be able to download the package on mgmt01 and scp it to mgmt02, but I had no luck with this. You at least would need to add a rule to allow port 22 on mgmt02, which I tried with this command: netsh advfirewall firewall add rule name="Open SSH Port 22" dir=in action=allow protocol=TCP localport=22 remoteip=any

image

Clone this wiki locally