Step-by-Step Guide to Installing Wazuh on Ubuntu Server 24.04

The fastest reliable way to install Wazuh on Ubuntu Server 24.04 is the official installation assistant in all-in-one mode: curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a. In about 10 to 15 minutes it installs the Wazuh indexer, server and dashboard on one machine, creates the TLS certificates and prints the admin password. You then open https://<server-ip>, log in as admin and start adding agents.

I rewrote this guide in October 2026 for Wazuh 4.14.9, the current stable release, and checked every option and message below against the 4.14.9 installer script. The first version of this post installed each package by hand, which skips the certificate and security initialisation steps the assistant now does for you; a missed step there is the usual reason a manual install ends with a dashboard that never loads.

Quick answer: Wazuh on Ubuntu 24.04 in 6 steps

1. Create an Ubuntu 24.04 server with at least 4 vCPU, 8 GB RAM and 50 GB disk and a static IP.
2. Update it: sudo apt update && sudo apt upgrade -y.
3. Run the assistant: curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a.
4. Copy the admin password from the summary at the end.
5. Open ports 443, 1514, 1515 and 55000 to the networks that need them.
6. Browse to https://<server-ip>, log in as admin, then deploy agents with WAZUH_MANAGER="<server-ip>".

What gets installed

All-in-one is right for a homelab, a lab or a small business up to roughly 100 endpoints. Beyond that, Wazuh recommends a distributed deployment with the indexer on its own nodes.

Requirements

The assistant checks the hardware and stops with this error if the box is too small:

Your system does not meet the recommended minimum hardware requirements of 4Gb of RAM and 2 CPU cores. If you want to proceed with the installation use the -i option to ignore these requirements.

That is the floor for a test. Wazuh's sizing table for a single host is:

Ubuntu 24.04 (amd64 or arm64) is on the supported list. Give the server a fixed address before you install, because the certificates are created for it; see how to set a static IP on Ubuntu 24.04.

Step 1: Prepare Ubuntu Server 24.04

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl lsof
sudo hostnamectl set-hostname wazuh

lsof lets the assistant check that ports 443, 1514, 1515, 9200 and 55000 are free. If Nginx or Apache already uses 443, the assistant stops with Port 443 is being used by another process. Remove that service, or install the dashboard on another port with -p 8443.

Step 2: Run the Wazuh installation assistant

curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh
sudo bash ./wazuh-install.sh -a

The assistant adds the Wazuh repository, installs each component, generates certificates, initialises the indexer cluster and starts the services. When it finishes you see a summary like this (timestamps removed):

--- Summary ---
You can access the web interface https://<wazuh-dashboard-ip>:443
    User: admin
    Password: <ADMIN_PASSWORD>
Installation finished.

Save that password. All generated passwords are also stored in wazuh-install-files.tar in the same folder:

sudo tar -O -xvf wazuh-install-files.tar wazuh-install-files/wazuh-passwords.txt

Useful assistant options:

Step 3: Verify the services

sudo systemctl status wazuh-indexer wazuh-manager filebeat wazuh-dashboard --no-pager

All four should be active (running). Check that Filebeat can reach the indexer:

sudo filebeat test output

Every line should end in OK, finishing with talk to server... OK.

Step 4: Open the firewall ports

Wazuh's required ports:

Ubuntu leaves UFW disabled by default. If you use it:

sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw allow 1514/tcp
sudo ufw allow 1515/tcp
sudo ufw allow 55000/tcp
sudo ufw enable

Do not expose 9200 or 55000 to the internet. A good pattern is to put the Wazuh server on a server VLAN behind a firewall such as pfSense and allow 1514 and 1515 only from the networks where your agents live.

Step 5: Log in to the Wazuh dashboard

Open https://<server-ip> and log in as admin with the password from Step 2. Your browser warns about the self-signed certificate; that is expected. Accept it, or install a trusted certificate later.

Change the admin password to one you will remember. It must be 8 to 64 characters with upper and lower case, a number and one of .*+?-:

sudo bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh -u admin -p 'MyN3w.Passw0rd'

On an all-in-one host the tool updates the dashboard and Filebeat for you.

Step 6: Stop accidental upgrades

Wazuh recommends disabling its repository after install, so a routine apt upgrade cannot move the indexer, server and dashboard to mismatched versions:

sudo sed -i "s/^deb /#deb /" /etc/apt/sources.list.d/wazuh.list
sudo apt update

Re-enable it only when you deliberately upgrade all components together.

Step 7: Add agents

The easiest way is Agents management > Summary > Deploy new agent in the dashboard, which builds the command for you. The commands below are the same ones it produces.

Ubuntu or Debian agent

curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt update
sudo WAZUH_MANAGER="10.0.0.2" apt install -y wazuh-agent
sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-agent

Replace 10.0.0.2 with your Wazuh server's IP or host name. Then hold the agent so it never gets ahead of the manager:

echo "wazuh-agent hold" | sudo dpkg --set-selections

Windows agent

Download wazuh-agent-4.14.9-1.msi from the Wazuh Windows agent page, then in an administrator PowerShell in the download folder:

msiexec.exe /i .\wazuh-agent-4.14.9-1.msi /q WAZUH_MANAGER="10.0.0.2"
Start-Service wazuhsvc

Confirm the agent is connected

On the Wazuh server:

sudo /var/ossec/bin/agent_control -l

The new agent should be listed as Active. It also appears in the dashboard within a minute. Keep agent versions equal to or lower than the manager version.

Troubleshooting common Wazuh install errors

"Wazuh dashboard server is not ready yet": normal for a minute or two after a start. If it stays, the dashboard cannot reach the indexer. Check sudo systemctl status wazuh-indexer, then the logs:

sudo journalctl -u wazuh-dashboard | grep -i -E "error|warn"
sudo grep -i -E "error|warn" /var/log/wazuh-indexer/wazuh-cluster.log

On small VMs a frequent cause is the indexer running short of memory and failing to start, so give the VM 8 GB if you can.

"Wazuh server API seems to be down": the manager is stopped. Run sudo systemctl restart wazuh-manager and check /var/ossec/logs/ossec.log.

No alerts in the dashboard: run sudo filebeat test output. If it fails, Filebeat cannot talk to the indexer on 9200.

"Wazuh indexer is already installed in this node or some of its files have not been removed": a failed earlier run left files behind. Re-run with overwrite, or uninstall and start clean:

sudo bash ./wazuh-install.sh -a -o
# or
sudo bash ./wazuh-install.sh -u

"Another process is using APT": unattended upgrades are running. The assistant waits and retries; let it finish rather than killing the lock.

Agent shows "Never connected" or "Disconnected": the agent cannot reach 1514/1515 on the server. Test from the agent with nc -zv <server-ip> 1514, check firewalls in between, and confirm the address in /var/ossec/etc/ossec.conf under <client><server><address>.

Wazuh 5.0 status

Wazuh 5.0.0 is at release candidate stage (rc1, October 2026) on GitHub. For production stay on 4.14.x. When 5.0 ships I will update this guide with the upgrade path.

Resumen en español

Para instalar Wazuh en Ubuntu Server 24.04: ejecute curl -sO https://packages.wazuh.com/4.14/wazuh-install.sh && sudo bash ./wazuh-install.sh -a, guarde la contraseña de admin que aparece al final, abra los puertos 443, 1514, 1515 y 55000 y entre en https://<ip-del-servidor>. Necesita al menos 4 vCPU y 8 GB de RAM.

Related guides

• pfSense vs OPNsense for the firewall in front of your Wazuh server.
• Best free NGFW firewalls to pair with Wazuh for network visibility.
• Proxmox VE guide if you want to run Wazuh as a VM like I do.