Wazuh Agent's ossec.conf is not overwritten from shared agent.conf

[mcastrillo003]

Hi everyone!
I am trying to change remotely agent's configuration from the manager. I want to change the manager's IP where the agent has to connect. For that I wrote this on manager's /var/ossec/etc/shared/default/agent.conf :

<agent_config>
<!-- Shared agent configuration here -->
<client>
<server>
<address>192.168.77.130</address>
</server>
</client>
</agent_config>

The agent does receive it well because in \shared agent.conf appears the same and merged.mg does reflect the changes too:

#default
!78 ar.conf
restart-ossec0 - restart-ossec.sh - 0
restart-ossec0 - restart-ossec.cmd - 0
!168 agent.conf
<agent_config>
<!-- Shared agent configuration here -->
<client>
<server>
<address>192.168.77.130</address>
</server>
</client>
</agent_config>
!28416 cis_apache2224_rcl.txt

.
.
.

But the agent's ossec.conf does not change that IP address and still shows the IP address I configured at the beggining:

<client>
<server>
<address>192.168.77.128</address>
<port>1514</port>
<protocol>tcp</protocol>
</server>
<crypto_method>aes</crypto_method>
<notify_time>10</notify_time>
<time-reconnect>60</time-reconnect>
<auto_restart>yes</auto_restart>
</client>

How do I overwrite ossec.conf automatically without handwriting the new IP?

Thanks!

[antoniomanuelfr]

Hi @mcastrillo003.

The centralized configuration can only be used with some capabilities (here is a link to the documentation page in case you have any doubts) but changing the manager IP of all the agents from the manager is a feature that is not supported.

Maybe, if you can execute commands remotely, you can change the configuration (using commands like sed: sed -i "s:<address>IP</addresst>:<address>NEW_IP</address>:g" /var/ossec/etc/ossec.conf)

Sorry for the inconvenience.
Kindly regards.
Antonio.

[mcastrillo003]

OK, thank you @antoniomanuelfr !!
And if I had to change the manager's IP address in hundreds of agents in different locations, how would you do it instead of changing it agent by agent?

[antoniomanuelfr]

Hi @mcastrillo003

I fear that the only way to change all the IPs is by changing them agent by agent.
I understand that is really inconvenient to change them by hand, but this feature won't be developed because it is dangerous to change the manager's IP of all the agents from the manager.

The workaround that I think maybe solve your problem will be a combination of ssh and the sed command that I posted previously.
It will be something like ssh -t user@server 'sed -i "s:<address>IP</addresst>:<address>NEW_IP</address>:g" /var/ossec/etc/ossec.conf'.

I executed this command from a host to a VM and I was able to change the configuration file from the host.

Again, sorry for the inconvenience that this may cause.
Kindly regards.

[antoniomanuelfr]

I'm closing this issue due to inactivity. Feel free to re-open it again if it's necesary.