Enaraque
commented
3 weeks ago PR Update
We have found a way to use the indexer admin user in the wazuh manager so there is no need to add another user in the API user section.
It has also been added in the dashboard that in order to change the password of wazuh-wui, the option --api should be set so that it does not try to change the password of kibanaserver also if there is an indexer installed on the same system.
Password file
The password file is the same as before, no new users are added
Passwords file
``` # Admin user for the web user interface and Wazuh indexer. Use this user to log in to Wazuh dashboard indexer_username: 'admin' indexer_password: 'VpSUav82Y8x05AT*+*sqU406mAKIq8.g' # Wazuh dashboard user for establishing the connection with Wazuh indexer indexer_username: 'kibanaserver' indexer_password: 'EKf49pm3QtqszKgWiz.HRfEc5adN7QFY' # Regular Dashboard user, only has read permissions to all indices and all permissions on the .kibana index indexer_username: 'kibanaro' indexer_password: 'AO6TqgWcSLi?C5JL*3hL8Lklrmbr9+XT' # Filebeat user for CRUD operations on Wazuh indices indexer_username: 'logstash' indexer_password: 'Pp21DOyGGgCpVUqy9*FabHC41udZqPOO' # User with READ access to all indices indexer_username: 'readall' indexer_password: 'Zr42iiK1?5H3Zta7IlEuly224?NqPtwm' # User with permissions to perform snapshot and restore operations indexer_username: 'snapshotrestore' indexer_password: '.cLInM3Pxb4KsOGGuP.4rvOZiiuJ7*ws' # Password for wazuh API user api_username: 'wazuh' api_password: '9qdiBXzBX?hpXACy3W1r2h8Jjq5keEMn' # Password for wazuh-wui API user api_username: 'wazuh-wui' api_password: 'r7jH.SQ4SMqbzVXcbJrkiyrwvWd+G*w8' ```Wazuh manager
In order to change the Filebeat password, we indicate it with the user admin instead of Filebeat.
Tests
Option with username and password
``` [root@localhost passwords_good]# bash wazuh-passwords-tool.sh -u admin -p PF?whFMYzTyHFI8PqVXjjS5NqsE7xEDx 07/06/2024 12:10:23 INFO: The new password for Filebeat is PF?whFMYzTyHFI8PqVXjjS5NqsE7xEDx [root@localhost passwords_good]# filebeat test output elasticsearch: https://192.168.56.13:9200... parse url... OK connection... parse host... OK dns lookup... OK addresses: 192.168.56.13 dial up... OK TLS... security: server's certificate chain verification is enabled handshake... OK TLS version: TLSv1.3 dial up... OK talk to server... OK version: 7.10.2 ``` For the Filebeat password it is not necessary to add the credentials of the API admin user.--change-all option
``` [root@localhost passwords_good]# bash wazuh-passwords-tool.sh --change-all -au wazuh -ap e0xS4CHkYinyaqtzN9JQ+X7b8F+KKaah -f wazuh-passwords_070624.txt 07/06/2024 12:31:11 INFO: The new password for Filebeat is PF?whFMYzTyHFI8PqVXjjS5NqsE7xEDx 07/06/2024 12:32:06 INFO: The password for Wazuh API user wazuh is e0xS4CHkYinyaqtzN9JQ+X7b8F+KKaah 07/06/2024 12:32:09 INFO: The password for Wazuh API user wazuh-wui is *Kiq7c+MWpj+CCb*jyyx4MMmaAgvd.Ok ```Wazuh dashboard
The change of passwords in the dashboard has been improved. To change API user passwords, the --api option is used so that if the dashboard is installed on the same machine as the indexer it does not try to change kibanaserver passwords as well.
Tests
Change password for wazuh-wui with --api option
``` root@debian9:/home/vagrant/passwords_good# bash wazuh-passwords-tool.sh -u wazuh-wui -p *Kiq7c+MWpj+CCb*jyyx4MMmaAgvd.Ok --api 07/06/2024 12:42:20 INFO: Updated wazuh-wui user password in wazuh dashboard to '*Kiq7c+MWpj+CCb*jyyx4MMmaAgvd.Ok'. ```AIO deployment
Now when changing passwords in AIO, the message also appears when changing the Filebeat password.
Description
When changing the passwords for the different services, neither the Filebeat password in the manager nor the wazuh-wui password in the dashboard were updated. Also in the indexer there was a message indicating that there were no API users, which was a bit confusing. The steps to solve this problem have been:
Password file
In order to be able to change the filebeat password in the wazuh-manager, a new user
adminhas been created in the API users section. This user will have the same password as theadminuser in the indexer section. This provides a way to manage the Filebeat password from the manager.Tests
When generating the passwords we can see how a new API user
adminis generated with the same password as indexeradminuser.Wazuh indexer
In the indexer section we had the problem that a message appeared regarding the change of API user passwords:
INFO: Wazuh API admin credentials not provided, Wazuh API passwords not changed.Which was a bit confusing if the manager was not installed on the machine. Now every time we try to change the indexer passwords without having the manager installed, we won't get the message again.Tests
Wazuh manager
Regarding the manager, the problem was that when we changed the passwords with the
--changealloption, the Filebeat password was not changed. Now, a new user has been added to the users section of the API calledFilebeat. With these changes, if we put this user with his password in the password file, it will be changed correctly in the manager. Also, being a manager user, we can change the Filebeat password with the--userand--passwordoption as well.Tests
When executing the
filebeat test outputcommand we see that the filebeat password is wrong and therefore we get the errorERROR 401 Unauthorized: Unauthorized.--changealloption:If we check the connection again, it reconnects:
--userand--password.Wazuh dashboard
With the dashboard we had the problem that we couldn't change the password for
kibanaserverandwazuh-wui. Like the server, we can now change the passwords of these with the--changealloption and also with--userand--password.Tests
--changeall.--userand--password.root@debian9:/home/vagrant/passwords_good# bash wazuh-passwords-tool.sh --user wazuh-wui --password r7jH.SQ4SMqbzVXcbJrkiyrwvWd+Gw8 28/05/2024 12:22:52 INFO: Updated wazuh-wui user password in wazuh dashboard to 'r7jH.SQ4SMqbzVXcbJrkiyrwvWd+Gw8'.
Change of all passwords where API passwords are changed as well. If we check the output of filebeat, we can see that it works correctly.
When the dashboard is installed in a distributed deployment, we can change the password of the user that communicates with the server without giving the admin credentials. In this case, as the manager is installed, we would have to specify them. If we try this, we get the following output:
If we do it with the right credentials, we can see that it does change:
Everything works correctly with the changes: