yahoo_1999/fk-wazuh
1
0
Fork 0
forked from wazuh/wazuh-docker
Code Pull Requests Activity

Merge pull request #2289 from wazuh/change/2288-delete-API-references

Browse Source 
Delete all API user and password references and Wazuh agent references
This commit is contained in:
Carlos Bordon
2026-04-08 09:34:37 -03:00
committed by GitHub
parent 70d0a55f46 9d19f070de
commit cf8bfea424
10 changed files with 8 additions and 164 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/5_pr_check.yml
+4 -4
View File
@@ -95,9 +95,9 @@ jobs:
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin
API_USERNAME: wazuh-wui
API_PASSWORD: MyS3cr37P450r.*-
MANAGER_NODES: "manager"
API_USERNAME: wazuh-wui
API_PASSWORD: wazuh-wui
steps:
- name: Check out code
@@ -368,9 +368,9 @@ jobs:
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin
API_USERNAME: wazuh-wui
API_PASSWORD: MyS3cr37P450r.*-
MANAGER_NODES: "master,worker01"
API_USERNAME: wazuh-wui
API_PASSWORD: wazuh-wui
steps:
- name: Check out code
CHANGELOG.md
+1
View File
@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
### Changed
- Delete all API user and password references and Wazuh agent references ([#2289](https://github.com/wazuh/wazuh-docker/pull/2289))
- Create certificate directory with default user and group ([#2287](https://github.com/wazuh/wazuh-docker/pull/2287))
- Standarize Artifact URL keys ([#2286](https://github.com/wazuh/wazuh-docker/pull/2286))
- Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285))
build-docker-images/wazuh-agent/Dockerfile
-2
View File
@@ -6,9 +6,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
ARG WAZUH_VERSION
ARG S6_VERSION="v2.2.0.3"
ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
ARG TARGETARCH
ARG wazuh_agent_x86_64_rpm
build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
-9
View File
@@ -4,10 +4,7 @@
WAZUH_INSTALL_PATH=/var/ossec
WAZUH_CONFIG_MOUNT=/wazuh-config-mount
WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER
WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"}
WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER}
WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"}
WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD
WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"}
##############################################################################
@@ -63,14 +60,8 @@ mount_files() {
set_manager_conn() {
echo "ossec.conf configuration"
sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#<port>CHANGE_MANAGER_PORT</port>#<port>$WAZUH_MANAGER_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#<port>CHANGE_ENROLL_PORT</port>#<port>$WAZUH_REGISTRATION_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#<agent_name>CHANGE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
[ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \
echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass
}
##############################################################################
build-docker-images/wazuh-manager/Dockerfile
-1
View File
@@ -30,7 +30,6 @@ RUN RPM_ARCH="x86_64" && \
rm -f /var/wazuh-manager/etc/sslmanager.cert
COPY config/etc/ /etc/
COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py
# Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547
build-docker-images/wazuh-manager/config/create_user.py
-102
View File
@@ -1,102 +0,0 @@
import logging
import sys
import json
import random
import string
import os
# Set framework path
sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json"
SPECIAL_CHARS = "@$!%*?&-_"
try:
from wazuh.rbac.orm import check_database_integrity
from wazuh.security import (
create_user,
get_users,
get_roles,
set_user_role,
update_user,
)
except ModuleNotFoundError as e:
logging.error("No module 'wazuh' found.")
sys.exit(1)
def read_user_file(path=USER_FILE_PATH):
with open(path) as user_file:
data = json.load(user_file)
return data["username"], data["password"]
def db_users():
users_result = get_users()
return {user["username"]: user["id"] for user in users_result.affected_items}
def db_roles():
roles_result = get_roles()
return {role["name"]: role["id"] for role in roles_result.affected_items}
def disable_user(uid):
random_pass = "".join(
random.choices(
string.ascii_uppercase
+ string.ascii_lowercase
+ string.digits
+ SPECIAL_CHARS,
k=8,
)
)
# assure there must be at least one character from each group
random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
random_pass = ''.join(random.sample(random_pass,len(random_pass)))
update_user(
user_id=[
str(uid),
],
password=random_pass,
)
if __name__ == "__main__":
if not os.path.exists(USER_FILE_PATH):
# abort if no user file detected
sys.exit(0)
username, password = read_user_file()
# create RBAC database
check_database_integrity()
initial_users = db_users()
if username not in initial_users:
# create a new user
create_user(username=username, password=password)
users = db_users()
uid = users[username]
roles = db_roles()
rid = roles["administrator"]
set_user_role(
user_id=[
str(uid),
],
role_ids=[
str(rid),
],
)
else:
# modify an existing user ("wazuh" or "wazuh-wui")
uid = initial_users[username]
update_user(
user_id=[
str(uid),
],
password=password,
)
# disable unused default users
for def_user in ['wazuh', 'wazuh-wui']:
if def_user != username:
disable_user(initial_users[def_user])
build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
-25
View File
@@ -73,28 +73,6 @@ function_wazuh_migration(){
fi
}
function_create_custom_user() {
if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
cat << EOF > /var/wazuh-manager/api/configuration/admin.json
{
"username": "$API_USERNAME",
"password": "$API_PASSWORD"
}
EOF
# create or customize API user
if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then
# remove json if exit code is 0
rm /var/wazuh-manager/api/configuration/admin.json
else
echored "There was an error configuring the API user"
# terminate container to avoid unpredictable behavior
exec s6-svscanctl -t /var/run/s6/services
exit 1
fi
fi
}
function_entrypoint_scripts() {
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
if [ -d "/entrypoint-scripts/" ]
@@ -116,9 +94,6 @@ fi
# Migrate data from /wazuh-migration volume
function_wazuh_migration
# create API custom user
function_create_custom_user
# configure Vulnerabilty detection
function_configure_vulnerability_detection
docs/ref/configuration/environment-variables.md
+1 -9
View File
@@ -26,8 +26,6 @@ environment:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
```
**Variable Descriptions:**
@@ -35,7 +33,6 @@ environment:
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions.
- `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication.
- `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer.
- `API_USERNAME` / `API_PASSWORD`: Credentials for the Wazuh API user, utilized by the Dashboard for API interactions.
---
@@ -65,8 +62,6 @@ environment:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
```
**Variable Descriptions:**
@@ -87,14 +82,11 @@ The Wazuh Agent container uses the following environment variables to dynamicall
```yaml
environment:
- WAZUH_MANAGER_SERVER=wazuh.manager
- WAZUH_MANAGER_PORT=1514
- WAZUH_REGISTRATION_SERVER=wazuh.manager
- WAZUH_REGISTRATION_PORT=1515
- WAZUH_AGENT_NAME=my-agent
- WAZUH_REGISTRATION_PASSWORD=StrongPassword
```
These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf` and set the enrollment password.
These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf`.
---
multi-node/docker-compose.yml
+1 -7
View File
@@ -9,7 +9,7 @@ services:
wazuh1.indexer:
condition: service_healthy
healthcheck:
test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
interval: 15s
timeout: 5s
retries: 5
@@ -32,8 +32,6 @@ services:
- WAZUH_CLUSTER_NODES=wazuh.master
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
volumes:
- master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- master-wazuh-etc:/var/wazuh-manager/etc
@@ -73,8 +71,6 @@ services:
- WAZUH_CLUSTER_NODES=wazuh.master
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
volumes:
- worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- worker-wazuh-etc:/var/wazuh-manager/etc
@@ -221,8 +217,6 @@ services:
- WAZUH_API_URL=https://wazuh.master
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
- SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
single-node/docker-compose.yml
+1 -5
View File
@@ -9,7 +9,7 @@ services:
wazuh.indexer:
condition: service_healthy
healthcheck:
test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
interval: 15s
timeout: 5s
retries: 5
@@ -32,8 +32,6 @@ services:
- WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
volumes:
- wazuh_api_configuration:/var/wazuh-manager/api/configuration
- wazuh_etc:/var/wazuh-manager/etc
@@ -103,8 +101,6 @@ services:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- API_USERNAME=wazuh-wui
- API_PASSWORD=MyS3cr37P450r.*-
- SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem