Bottom line: Prepare the authorized removal workflow before enabling validation. Keep a manager-approved package uninstall separate from a broad claim that every form of agent tampering is prevented.
\nThe Anti-tampering guide limits the feature to Linux endpoints and requires manager validation before the protected agent package is uninstalled.
\nIt supports either centralized group configuration or local agent configuration for enabling package-uninstallation validation.
\nFor authorized removal, the guide recommends a temporary authentication token instead of storing server API credentials on the monitored endpoint.
\nThis article concerns the documented Linux package-removal control. It does not establish protection against every local administrator action, stopping a service, deleting files outside the package workflow or use on another operating system.
\nThe following steps are DSE recommendations based on the cited source.
\nDSE recommends a rehearsed authorized-removal procedure and controlled temporary-token handling before enabling the package validation requirement.
\nProposed verification: on the disposable agent, observe the intended setting and the authorized package-removal path using a temporary token obtained through the reviewed process. Preserve redacted validation and package-operation results. Exercise a rejected authorization case only in the approved test arrangement and keep it separate from the successful removal record.
\nConfirm that retained evidence contains no reusable token or API password and that the temporary test identity is handled through its normal lifecycle. Record unresolved manager-connectivity or authorization problems with their owner. No agent was removed or tamper attempt performed for this article; acceptance would concern only the tested Linux package workflow, not universal endpoint resistance.
\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.
\n", "content_text": "Bottom line: Prepare the authorized removal workflow before enabling validation. Keep a manager-approved package uninstall separate from a broad claim that every form of agent tampering is prevented.\nSource fact: documented behavior\nThe Anti-tampering guide limits the feature to Linux endpoints and requires manager validation before the protected agent package is uninstalled.\nIt supports either centralized group configuration or local agent configuration for enabling package-uninstallation validation.\nFor authorized removal, the guide recommends a temporary authentication token instead of storing server API credentials on the monitored endpoint.\nWhat the source does not establish\nThis article concerns the documented Linux package-removal control. It does not establish protection against every local administrator action, stopping a service, deleting files outside the package workflow or use on another operating system.\nApplicability questions\n\nWhich Linux endpoints and configuration authority are in scope?\nWho can authorize removal through the manager?\nHow will a temporary token reach the authorized operator?\nWhat recovery process applies when removal validation fails?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a rehearsed authorized-removal procedure and controlled temporary-token handling before enabling the package validation requirement.\n\nIdentify the endpoint population and choose whether the setting is managed centrally or locally. Keep that choice with its responsible owner so removal staff know which configuration to review. Prepare an approved disposable Linux agent for the first exercise, and preserve a management path for recovering from a mistaken configuration before extending the setting to other endpoints.\nDesign the authorized removal handoff using the documented temporary-token method and the organization’s current transport-verification policy. Keep tokens and API secrets out of ordinary tickets, screenshots and shared test fixtures. Name the administrator who obtains the token and the operator who uses it. Do not copy the source’s example connection settings as an unexplained production trust policy.\nWrite the expected handling for a missing validation configuration and an authorization failure. Review the source’s applicable removal workflow with the endpoint owner instead of inventing a bypass. If manager validation is unavailable, stop and use the established recovery authority. Do not describe manually erasing agent files as a successful test of the package-uninstallation feature.\n\nVerification and evidence\nProposed verification: on the disposable agent, observe the intended setting and the authorized package-removal path using a temporary token obtained through the reviewed process. Preserve redacted validation and package-operation results. Exercise a rejected authorization case only in the approved test arrangement and keep it separate from the successful removal record.\nConfirm that retained evidence contains no reusable token or API password and that the temporary test identity is handled through its normal lifecycle. Record unresolved manager-connectivity or authorization problems with their owner. No agent was removed or tamper attempt performed for this article; acceptance would concern only the tested Linux package workflow, not universal endpoint resistance.\nOfficial references\n\nAnti-tampering — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Prepare the authorized removal workflow before enabling validation. Keep a manager-approved package uninstall separate from a broad claim that every form of agent tampering is prevented.\n\n## Source fact: documented behavior\n\nThe [Anti-tampering](https://documentation.wazuh.com/current/user-manual/agent/agent-management/anti-tampering.html) guide limits the feature to Linux endpoints and requires manager validation before the protected agent package is uninstalled.\n\nIt supports either centralized group configuration or local agent configuration for enabling package-uninstallation validation.\n\nFor authorized removal, the guide recommends a temporary authentication token instead of storing server API credentials on the monitored endpoint.\n\n## What the source does not establish\n\nThis article concerns the documented Linux package-removal control. It does not establish protection against every local administrator action, stopping a service, deleting files outside the package workflow or use on another operating system.\n\n## Applicability questions\n\n- Which Linux endpoints and configuration authority are in scope?\n\n- Who can authorize removal through the manager?\n\n- How will a temporary token reach the authorized operator?\n\n- What recovery process applies when removal validation fails?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends a rehearsed authorized-removal procedure and controlled temporary-token handling before enabling the package validation requirement.\n\n- Identify the endpoint population and choose whether the setting is managed centrally or locally. Keep that choice with its responsible owner so removal staff know which configuration to review. Prepare an approved disposable Linux agent for the first exercise, and preserve a management path for recovering from a mistaken configuration before extending the setting to other endpoints.\n\n- Design the authorized removal handoff using the documented temporary-token method and the organization’s current transport-verification policy. Keep tokens and API secrets out of ordinary tickets, screenshots and shared test fixtures. Name the administrator who obtains the token and the operator who uses it. Do not copy the source’s example connection settings as an unexplained production trust policy.\n\n- Write the expected handling for a missing validation configuration and an authorization failure. Review the source’s applicable removal workflow with the endpoint owner instead of inventing a bypass. If manager validation is unavailable, stop and use the established recovery authority. Do not describe manually erasing agent files as a successful test of the package-uninstallation feature.\n\n## Verification and evidence\n\nProposed verification: on the disposable agent, observe the intended setting and the authorized package-removal path using a temporary token obtained through the reviewed process. Preserve redacted validation and package-operation results. Exercise a rejected authorization case only in the approved test arrangement and keep it separate from the successful removal record.\n\nConfirm that retained evidence contains no reusable token or API password and that the temporary test identity is handled through its normal lifecycle. Record unresolved manager-connectivity or authorization problems with their owner. No agent was removed or tamper attempt performed for this article; acceptance would concern only the tested Linux package workflow, not universal endpoint resistance.\n\n## Official references\n\n- [Anti-tampering](https://documentation.wazuh.com/current/user-manual/agent/agent-management/anti-tampering.html) — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/", "url": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Prepare authorized Linux agent removal before enabling Wazuh validation", "item": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/#article", "identifier": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/", "url": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/", "headline": "Prepare authorized Linux agent removal before enabling Wazuh validation", "description": "Preserve Wazuh anti-tampering's Linux-only package-removal scope. Plan authorized removal and the documented temporary-token alternative before enabling…", "abstract": "Preserve Wazuh anti-tampering's Linux-only package-removal scope. Plan authorized removal and the documented temporary-token alternative before enabling manager validation on endpoints.", "articleBody": "Bottom line: Prepare the authorized removal workflow before enabling validation. Keep a manager-approved package uninstall separate from a broad claim that every form of agent tampering is prevented.\nSource fact: documented behavior\nThe Anti-tampering guide limits the feature to Linux endpoints and requires manager validation before the protected agent package is uninstalled.\nIt supports either centralized group configuration or local agent configuration for enabling package-uninstallation validation.\nFor authorized removal, the guide recommends a temporary authentication token instead of storing server API credentials on the monitored endpoint.\nWhat the source does not establish\nThis article concerns the documented Linux package-removal control. It does not establish protection against every local administrator action, stopping a service, deleting files outside the package workflow or use on another operating system.\nApplicability questions\n\nWhich Linux endpoints and configuration authority are in scope?\nWho can authorize removal through the manager?\nHow will a temporary token reach the authorized operator?\nWhat recovery process applies when removal validation fails?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a rehearsed authorized-removal procedure and controlled temporary-token handling before enabling the package validation requirement.\n\nIdentify the endpoint population and choose whether the setting is managed centrally or locally. Keep that choice with its responsible owner so removal staff know which configuration to review. Prepare an approved disposable Linux agent for the first exercise, and preserve a management path for recovering from a mistaken configuration before extending the setting to other endpoints.\nDesign the authorized removal handoff using the documented temporary-token method and the organization’s current transport-verification policy. Keep tokens and API secrets out of ordinary tickets, screenshots and shared test fixtures. Name the administrator who obtains the token and the operator who uses it. Do not copy the source’s example connection settings as an unexplained production trust policy.\nWrite the expected handling for a missing validation configuration and an authorization failure. Review the source’s applicable removal workflow with the endpoint owner instead of inventing a bypass. If manager validation is unavailable, stop and use the established recovery authority. Do not describe manually erasing agent files as a successful test of the package-uninstallation feature.\n\nVerification and evidence\nProposed verification: on the disposable agent, observe the intended setting and the authorized package-removal path using a temporary token obtained through the reviewed process. Preserve redacted validation and package-operation results. Exercise a rejected authorization case only in the approved test arrangement and keep it separate from the successful removal record.\nConfirm that retained evidence contains no reusable token or API password and that the temporary test identity is handled through its normal lifecycle. Record unresolved manager-connectivity or authorization problems with their owner. No agent was removed or tamper attempt performed for this article; acceptance would concern only the tested Linux package workflow, not universal endpoint resistance.\nOfficial references\n\nAnti-tampering — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:47:16+00:00", "dateModified": "2026-10-30T06:47:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/prepare-authorized-linux-agent-removal-before-enabling-wazuh-validation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Prepare authorized Linux agent removal before enabling Wazuh validation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 492, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Wazuh — Anti-tampering", "url": "https://documentation.wazuh.com/current/user-manual/agent/agent-management/anti-tampering.html" } } ] } }