PKG error

stephenw10

What command are you trying to run?

What is the full error you're seeing?

There are no build tools in pfSense so you cannot build from source on pfSense.

Steve

Vinatra

We followed a Tutorial to install a Wazuh Agent from here: https://benheater.com/integrating-pfsense-with-wazuh/

The errors are either related to pkg or pgk-static
ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg"
impossible to get the value from Last-Modified HTTP header, if using pkg-static

Being able to send the logs from pfSense to a SIEM would be a big plus.

stephenw10

Ok but what is the actual command you're running? And what's the actual error you're seeing?

You should not enable the FreeBSD repos like that. It's much better to fetch and install the individual pkgs you need. Enabling the repo will almost inevitably pull in other pkgs replacing the pfSense defaults potentially causing all sorts of issues as shown in the link on that site.

stephenw10

Like:

[2.7.0-RELEASE][admin@t70.stevew.lan]/root: fetch https://pkg.freebsd.org/FreeBSD:14:amd64/latest/All/wazuh-agent-4.5.0.pkg
wazuh-agent-4.5.0.pkg                                 4370 kB 7337 kBps    00s
[2.7.0-RELEASE][admin@t70.stevew.lan]/root: pkg add wazuh-agent-4.5.0.pkg 
Installing wazuh-agent-4.5.0...
Newer FreeBSD version for package wazuh-agent:
To ignore this error set IGNORE_OSVERSION=yes
- package: 1400097
- running kernel: 1400085
Ignore the mismatch and continue? [y/N]: y
===> Creating groups.
Creating group 'wazuh' with gid '309'.
===> Creating users
Creating user 'wazuh' with uid '309'.
===> Creating homedir(s)
Extracting wazuh-agent-4.5.0: 100%
=====
Message from wazuh-agent-4.5.0:

--
Wazuh Agent was installed

1) Copy /etc/locatime to /var/ossec/etc directory

   # cp /etc/localtime /var/ossec/etc

2) You must edit /var/ossec/etc/ossec.conf.sample for your setup and rename/copy
   it to ossec.conf

   Take a look wazuh configuration at the following url:

   https://documentation.wazuh.com/current/user-manual/index.html

3) You can find additional useful files installed at

  # /var/ossec/packages_files/agent_installation_scripts

4) Add Wazuh agent to /etc/rc.conf

  # sysrc wazuh_agent_enable="YES"

  or

  # service wazuh-agent enable

5) Start Wazuh agent

  # service wazuh-agent start

6) Enjoy it ;)
[2.7.0-RELEASE][admin@t70.stevew.lan]/root: rehash

I have no way of testing it but the fact it installed without complaining about dependencies looks good.

Remember to use the start method as detailed in the tutorial and not the pkg output because pfSense does not use the regular FreeBSD rc system.

Steve

Vinatra

@stephenw10

So thank you for that. I could not run it on the machine that is now giving errors
But I had a second pfsense - and I ran the commands there

Everything looked fine - still i got to the last command
service wazuh-agent start

That seems to run forever until finally it said: out of swap space

I forced a power reboot and and it reboots
Then its says No Core dumps found and be stuck like this for a long time

After which it will say go back to a loop saying
swap_pager: out of wap space
swp_pager_getswapspace(5): failed
and loops an error about pid nnnn(sh), ... failed to reclaim memory

P.S. I backed up the virtual machine, so I should be able to restore completely

Vinatra

@Vinatra BTW there was nothing to copy here cp /etc/localtime
Apart from that .. everything was followed faithfully

stephenw10

@Vinatra said in PKG error:

https://benheater.com/integrating-pfsense-with-wazuh/

You used the commands shown there^ like I said and not from the pkg install output?

How much RAM do you have? What did you configure the agent to do?

Hard to say what that could be without a lot more debug logs. I have no idea if that can work really since Ive never used it myself. That tutorial was written for pfSense 2.6 so there's a good chance it simply doesn't work in 2.7.

Vinatra

@stephenw10
So yes used your exact steps
We used the pkg command as follows: pkg add wazuh-agent-4.5.0.pkg
was part of your steps

these are the specs

VCPU: 2
RAM: 4 GB
DISK LOCAL: 40 GB

stephenw10

Well as I said it may just be broken in FreeBSD 14. Does it run as expected if you test a FreeBSD 14 beta image?
https://download.freebsd.org/releases/ISO-IMAGES/14.0/

Vinatra

@Vinatra configuration wise - we simply edited the config file and put in the IP of the Wazuh server
That was the full extent of any configuration