name: Install and configure Wazuh agents

hosts: wazuh_agents
become: yes

tasks:

name: Copy Wazuh RPM to agent

ansible.builtin.copy:
src: "{{ wazuh_rpm_src }}"
dest: "{{ wazuh_rpm_dst }}"
mode: '0644'

name: Install Wazuh agent RPM

ansible.builtin.yum:
name: "{{ wazuh_rpm_dst }}"
state: present

name: Ensure wazuh-agent service is stopped before config

ansible.builtin.service:
name: wazuh-agent
state: stopped
ignore_errors: yes

name: Deploy Wazuh agent ossec.conf

ansible.builtin.template:
src: ossec.conf.j2
dest: /var/ossec/etc/ossec.conf
owner: root
group: ossec
mode: '0640'

name: Reload systemd units

ansible.builtin.systemd:
daemon_reload: yes

name: Enable and start wazuh-agent

ansible.builtin.service:
name: wazuh-agent # systemd unit name
enabled: yes
state: started

name: Ensure firewalld package is present

ansible.builtin.yum:
name: firewalld
state: present

name: Ensure firewalld is running

ansible.builtin.service:
name: firewalld
state: started
enabled: yes

name: Allow outbound Wazuh traffic to managers (1514,1515)

ansible.posix.firewalld:
port: "{{ item }}/tcp"
state: enabled
permanent: yes
immediate: yes
loop:

1514
1515

==============================

<ossec_config>
<client>
{% for m in wazuh_managers %}
<server>
<address>{{ m.address }}</address>
<port>{{ m.port }}</port>
<protocol>{{ m.protocol }}</protocol>
</server>
{% endfor %}

<config-profile>{{ inventory_hostname }}</config-profile>
</client>

</ossec_config>
==========================

group_vars/all.yml

wazuh_rpm_src: "file/wazuh.rpm"
wazuh_rpm_dst: "/tmp/wazuh.rpm"

wazuh_managers:

address: 10.0.0.10

port: 1514
protocol: tcp

address: 10.0.0.11

port: 1514
protocol: tcp

какие порты надо открыть на менеджерах

wazuh_manager_ports:

1514 # agent connection
1515 # enrollment
55000 # API enrollment

========================

[file-name 000321_2026-01-12_19-43-33.txt]

# wazuh-agents.yml

group_vars/all.yml

какие порты надо открыть на менеджерах