Wazuh dashboard installation freezes terminal

[asteriscos]

Description

During the installation process of Wazuh dashboard 4.9.0-2 the terminal asks the user to confirm an action and then it seems to freeze until the user presses "enter".

We need to analyze if there's an issue in the package.

Configuration file '/etc/wazuh-dashboard/opensearch_dashboards.yml'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** opensearch_dashboards.yml (Y/I/N/O/D/Z) [default=N] ?

Related to:

• Test 4.9.0-2 packages #299

[asteriscos]

I made some tests upgrading Wazuh from v4.8.2 to v4.9.0-2 and in this case the terminal didn't freeze and continued to finish the installation process:

root@ubuntu-jammy:/home/vagrant# apt-get install wazuh-dashboard
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be upgraded:
  wazuh-dashboard
1 upgraded, 0 newly installed, 0 to remove and 113 not upgraded.
Need to get 166 MB of archives.
After this operation, 72.7 kB disk space will be freed.
Get:1 https://packages.wazuh.com/4.x/apt stable/main amd64 wazuh-dashboard amd64 4.9.0-2 [166 MB]
Fetched 166 MB in 15s (11.3 MB/s)                                                                                                                                                                           
(Reading database ... 184316 files and directories currently installed.)
Preparing to unpack .../wazuh-dashboard_4.9.0-2_amd64.deb ...
Unpacking wazuh-dashboard (4.9.0-2) over (4.9.0-1) ...
Setting up wazuh-dashboard (4.9.0-2) ...
Installing new version of config file /etc/default/wazuh-dashboard ...
Installing new version of config file /etc/systemd/system/wazuh-dashboard.service ...

Configuration file '/etc/wazuh-dashboard/opensearch_dashboards.yml'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** opensearch_dashboards.yml (Y/I/N/O/D/Z) [default=N] ? y
Installing new version of config file /etc/wazuh-dashboard/opensearch_dashboards.yml ...
Scanning processes...                                                                                                                                                                                        
Scanning linux images...                                                                                                                                                                                     

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.

This test was performed in a "ubuntu/jammy64" virtual machine.

Vagrant file:

Vagrant.configure("2") do |config|
  config.vm.box = "ubuntu/jammy64"
  # config.vm.box = "codeup/Ubuntu-20.04-GUI"

  config.vm.network "private_network", ip: "192.168.56.18"
  config.ssh.insert_key = false
  config.vm.provider "virtualbox" do |vb|
        # Display the VirtualBox GUI when booting the machine
        # vb.gui = true
      
        # Customize the amount of memory on the VM:
        vb.memory = "6096"
        vb.cpus = 2
        vb.name = "ubuntu-4.x"

  config.vm.provision "shell", inline: <<-SHELL
      # Disable firewall
      # systemctl stop firewalld
      # systemctl disable firewalld

      curl -sO https://packages.wazuh.com/4.8/wazuh-install.sh && sudo bash ./wazuh-install.sh -a
  SHELL
end

end

[Tostti]

Tested with the following Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.
  # For a complete reference, please see the online documentation at
  # https://docs.vagrantup.com/.

  # Every Vagrant development environment requires a box. You can search for
  # boxes at https://vagrantcloud.com/search.
  config.vm.box = "bento/ubuntu-22.04"

  # Disable automatic box update checking. If you disable this, then
  # boxes will only be checked for updates when the user runs
  # `vagrant box outdated`. This is not recommended.
  # config.vm.box_check_update = false

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine. In the example below,
  # accessing "localhost:8080" will access port 80 on the guest machine.
  # NOTE: This will enable public access to the opened port
  # config.vm.network "forwarded_port", guest: 80, host: 8080

  # Create a forwarded port mapping which allows access to a specific port
  # within the machine from a port on the host machine and only allow access
  # via 127.0.0.1 to disable public access
  # config.vm.network "forwarded_port", guest: 80, host: 8080, host_ip: "127.0.0.1"

  # Create a private network, which allows host-only access to the machine
  # using a specific IP.
  # config.vm.network "private_network", ip: "192.168.33.10"

  # Create a public network, which generally matched to bridged network.
  # Bridged networks make the machine appear as another physical device on
  # your network.
   config.vm.network "public_network"

  # Share an additional folder to the guest VM. The first argument is
  # the path on the host to the actual folder. The second argument is
  # the path on the guest to mount the folder. And the optional third
  # argument is a set of non-required options.
  # config.vm.synced_folder "../data", "/vagrant_data"

  # Disable the default share of the current code directory. Doing this
  # provides improved isolation between the vagrant box and your host
  # by making sure your Vagrantfile isn't accessible to the vagrant box.
  # If you use this you may want to enable additional shared subfolders as
  # shown above.
  # config.vm.synced_folder ".", "/vagrant", disabled: true

  # Provider-specific configuration so you can fine-tune various
  # backing providers for Vagrant. These expose provider-specific options.
  # Example for VirtualBox:
  #
   config.vm.provider "virtualbox" do |vb|
  #   # Display the VirtualBox GUI when booting the machine
  #   vb.gui = 
     vb.cpus = "8"
  #   # Customize the amount of memory on the VM:
     vb.memory = "8192"
   end
  #
  # View the documentation for the provider you are using for more
  # information on available options.

  # Enable provisioning with a shell script. Additional provisioners such as
  # Ansible, Chef, Docker, Puppet and Salt are also available. Please see the
  # documentation for more information about their specific syntax and use.
  # config.vm.provision "shell", inline: <<-SHELL
  #   apt-get update
  #   apt-get install -y apache2
  # SHELL
end

and was able to reproduce the problem.

Tested in a server with Ubuntu 22.04 installed (physical, not virtual) and the problem didn't occur.

Also tested with OpenSearch Dashboards instead of Wazuh and, although the prompt existed, it didn't freeze the terminal.

More research is required

[Ashkaan]

I'm having this problem and I have no idea how to get our wazuh instance back online. I can't find anything in any logs (unless I'm missing something obvious).

I'm running Ubuntu 24.04 LTS that's mostly default and only running wazuh (on top of dependencies and standard apps).