Arch Linux User Repository

Hi, I tested the Wazuh central components on Arch Linux ARM aarch64 / Raspberry Pi 4B.

I prepared local patches for wazuh-manager, wazuh-indexer, wazuh-dashboard and wazuh-filebeat. The changes keep the existing x86_64 packaging approach and add official aarch64 RPM sources/checksums. I am pasting the wazuh-manager patch below as an example.

If you are open to it, I can share the remaining patches too, or help maintain aarch64 support as a co-maintainer.

Tested: - wazuh-indexer 4.14.5 starts on Raspberry Pi 4B aarch64 - wazuh-manager starts after generating missing /var/ossec/etc/ossec.conf - filebeat publishes alerts to the local indexer - wazuh-dashboard listens on 443 and the Wazuh UI loads - aarch64 package repackaging works on x86_64 with CARCH=aarch64

diff --git a/PKGBUILD b/PKGBUILD
index eec6f00..76c5bcd 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Jesus Martin Ortega Martinez (madara125) <martin.ortega.arashi@gmail.com><jortega@condorbs.net>
 # Contributor: Kevin Muñoz (MrHacker) <kmunoz@condorbs.net><david.munozm@proton.me>
 pkgname=wazuh-manager
-pkgver=4.14.3
+pkgver=4.14.5
 pkgrel=1
 _remRevision=1
 _prodver=${pkgver}-${_remRevision}
 pkgdesc="Wazuh Manager for Arch Linux"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://wazuh.com/"
 license=('gpl2')
 groups=("wazuh-siem")
@@ -21,11 +21,18 @@ optdepends=(
 validpgpkeys=(
 )

-source=(
+options=('!strip' '!debug')
+
+source_x86_64=(
   "https://packages.wazuh.com/4.x/yum/${pkgname}-${_prodver}.x86_64.rpm"
 )

-sha512sums=('987acc2e344586dba932a23f09d6ba2c98a5a860925436a65da9fdf1032e4f70c71b1b2fd499e3939c2f2ae9557e8e411ad94b7549a721cdf4e6d34f7efb80fd')
+source_aarch64=(
+  "https://packages.wazuh.com/4.x/yum/${pkgname}-${_prodver}.aarch64.rpm"
+)
+
+sha512sums_x86_64=('0ef03d73e1cc3dfcfce03ee3b6b5b7c2e3e2f38d6017ade7dc632f8466e5a1baab298b9dbc88572eea19d76ba503dfc431e36832ac337bfa87a33a5da7854882')
+sha512sums_aarch64=('47b5e9a32361b6684db89380394f5fc7200ccee37d032ae18ffd0557943582814c2a1d36a893fa10fd9424b54b1389fd3ef5b4f17b8ee40ced9203c97413a72f')

 install=$pkgname.install

diff --git a/wazuh-manager.install b/wazuh-manager.install
index f46b92c..a7faf4c 100644
--- a/wazuh-manager.install
+++ b/wazuh-manager.install
@@ -47,6 +47,9 @@ post_install()
   echo "Setting permissions..."
   chown -R wazuh:wazuh /var/ossec

+  # Generate ossec.conf if the RPM post-install script did not run
+  _generate_ossec_conf
+
   # Generate SSL certificates for wazuh-authd (agent enrollment)
   echo "Generating certificates for wazuh-authd..."
   /var/ossec/bin/wazuh-authd -C 365 -B 2048 -K /var/ossec/etc/sslmanager.key -X /var/ossec/etc/sslmanager.cert -S "/C=US/ST=California/CN=wazuh/" 2>/dev/null || true
@@ -85,3 +88,28 @@ post_install()
   echo ""
   echo "Documentation: https://documentation.wazuh.com/current/installation-guide/wazuh-server/step-by-step.html"
 }
+
+_generate_ossec_conf()
+{
+  if [ -s /var/ossec/etc/ossec.conf ]; then
+    return
+  fi
+
+  scripts_dir=/var/ossec/packages_files/manager_installation_scripts
+
+  if [ ! -x "$scripts_dir/gen_ossec.sh" ]; then
+    echo "WARNING: $scripts_dir/gen_ossec.sh not found; /var/ossec/etc/ossec.conf was not generated"
+    return
+  fi
+
+  echo "Generating /var/ossec/etc/ossec.conf..."
+  tmpfile=$(mktemp)
+
+  if (cd "$scripts_dir" && ./gen_ossec.sh conf manager arch 0 > "$tmpfile") && grep -q '<ossec_config>' "$tmpfile"; then
+    install -Dm660 -o root -g wazuh "$tmpfile" /var/ossec/etc/ossec.conf
+  else
+    echo "WARNING: failed to generate /var/ossec/etc/ossec.conf"
+  fi
+
+  rm -f "$tmpfile"
+}

Hi, maybe i miss something but it doesn't create me the file /var/ossec/etc/ossec.conf

Fails for me to install as it seems to need a wazuh user and group.

Had to manually add on my end. Otherwise,no other issues so far.