diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 287c46e4..4e51ca06 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -95,9 +95,9 @@ jobs: WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} INDEXER_USERNAME: admin INDEXER_PASSWORD: admin - API_USERNAME: wazuh-wui - API_PASSWORD: MyS3cr37P450r.*- MANAGER_NODES: "manager" + API_USERNAME: wazuh-wui + API_PASSWORD: wazuh-wui steps: - name: Check out code @@ -368,9 +368,9 @@ jobs: WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }} INDEXER_USERNAME: admin INDEXER_PASSWORD: admin - API_USERNAME: wazuh-wui - API_PASSWORD: MyS3cr37P450r.*- MANAGER_NODES: "master,worker01" + API_USERNAME: wazuh-wui + API_PASSWORD: wazuh-wui steps: - name: Check out code diff --git a/CHANGELOG.md b/CHANGELOG.md index c2f1a23d..889b3e7a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Delete all API user and password references and Wazuh agent references ([#2289](https://github.com/wazuh/wazuh-docker/pull/2289)) - Create certificate directory with default user and group ([#2287](https://github.com/wazuh/wazuh-docker/pull/2287)) - Standarize Artifact URL keys ([#2286](https://github.com/wazuh/wazuh-docker/pull/2286)) - Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285)) diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile index 1963540c..302c8125 100644 --- a/build-docker-images/wazuh-agent/Dockerfile +++ b/build-docker-images/wazuh-agent/Dockerfile @@ -6,9 +6,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh ARG WAZUH_VERSION ARG S6_VERSION="v2.2.0.3" ARG WAZUH_MANAGER='CHANGE_MANAGER_IP' -ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT' ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP' -ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT' ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME' ARG TARGETARCH ARG wazuh_agent_x86_64_rpm diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init index fa5578a1..27dfbf88 100644 --- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init +++ b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init @@ -4,10 +4,7 @@ WAZUH_INSTALL_PATH=/var/ossec WAZUH_CONFIG_MOUNT=/wazuh-config-mount WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER -WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"} WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER} -WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"} -WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"} ############################################################################## @@ -63,14 +60,8 @@ mount_files() { set_manager_conn() { echo "ossec.conf configuration" sed -i "s#
CHANGE_MANAGER_IP
#
$WAZUH_MANAGER_SERVER
#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_MANAGER_PORT#$WAZUH_MANAGER_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf sed -i "s#CHANGE_ENROLL_IP#$WAZUH_REGISTRATION_SERVER#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - sed -i "s#CHANGE_ENROLL_PORT#$WAZUH_REGISTRATION_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf sed -i "s#CHANGE_AGENT_NAME#$WAZUH_AGENT_NAME#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf - [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \ - echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \ - chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass } ############################################################################## diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile index 507049ea..553eb368 100644 --- a/build-docker-images/wazuh-manager/Dockerfile +++ b/build-docker-images/wazuh-manager/Dockerfile @@ -30,7 +30,6 @@ RUN RPM_ARCH="x86_64" && \ rm -f /var/wazuh-manager/etc/sslmanager.cert COPY config/etc/ /etc/ -COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 diff --git a/build-docker-images/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py deleted file mode 100644 index f1417298..00000000 --- a/build-docker-images/wazuh-manager/config/create_user.py +++ /dev/null @@ -1,102 +0,0 @@ -import logging -import sys -import json -import random -import string -import os - -# Set framework path -sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") - -USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json" -SPECIAL_CHARS = "@$!%*?&-_" - - -try: - from wazuh.rbac.orm import check_database_integrity - from wazuh.security import ( - create_user, - get_users, - get_roles, - set_user_role, - update_user, - ) -except ModuleNotFoundError as e: - logging.error("No module 'wazuh' found.") - sys.exit(1) - - -def read_user_file(path=USER_FILE_PATH): - with open(path) as user_file: - data = json.load(user_file) - return data["username"], data["password"] - - -def db_users(): - users_result = get_users() - return {user["username"]: user["id"] for user in users_result.affected_items} - - -def db_roles(): - roles_result = get_roles() - return {role["name"]: role["id"] for role in roles_result.affected_items} - -def disable_user(uid): - random_pass = "".join( - random.choices( - string.ascii_uppercase - + string.ascii_lowercase - + string.digits - + SPECIAL_CHARS, - k=8, - ) - ) - # assure there must be at least one character from each group - random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]]) - random_pass = ''.join(random.sample(random_pass,len(random_pass))) - update_user( - user_id=[ - str(uid), - ], - password=random_pass, - ) - - -if __name__ == "__main__": - if not os.path.exists(USER_FILE_PATH): - # abort if no user file detected - sys.exit(0) - username, password = read_user_file() - - # create RBAC database - check_database_integrity() - - initial_users = db_users() - if username not in initial_users: - # create a new user - create_user(username=username, password=password) - users = db_users() - uid = users[username] - roles = db_roles() - rid = roles["administrator"] - set_user_role( - user_id=[ - str(uid), - ], - role_ids=[ - str(rid), - ], - ) - else: - # modify an existing user ("wazuh" or "wazuh-wui") - uid = initial_users[username] - update_user( - user_id=[ - str(uid), - ], - password=password, - ) - # disable unused default users - for def_user in ['wazuh', 'wazuh-wui']: - if def_user != username: - disable_user(initial_users[def_user]) diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager index 448832b9..2dbf13b2 100644 --- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager +++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager @@ -73,28 +73,6 @@ function_wazuh_migration(){ fi } -function_create_custom_user() { - if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then - cat << EOF > /var/wazuh-manager/api/configuration/admin.json -{ - "username": "$API_USERNAME", - "password": "$API_PASSWORD" -} -EOF - - # create or customize API user - if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then - # remove json if exit code is 0 - rm /var/wazuh-manager/api/configuration/admin.json - else - echored "There was an error configuring the API user" - # terminate container to avoid unpredictable behavior - exec s6-svscanctl -t /var/run/s6/services - exit 1 - fi - fi -} - function_entrypoint_scripts() { # It will run every .sh script located in entrypoint-scripts folder in lexicographical order if [ -d "/entrypoint-scripts/" ] @@ -116,9 +94,6 @@ fi # Migrate data from /wazuh-migration volume function_wazuh_migration -# create API custom user -function_create_custom_user - # configure Vulnerabilty detection function_configure_vulnerability_detection diff --git a/docs/ref/configuration/environment-variables.md b/docs/ref/configuration/environment-variables.md index 09ab6e53..4c124fdf 100644 --- a/docs/ref/configuration/environment-variables.md +++ b/docs/ref/configuration/environment-variables.md @@ -26,8 +26,6 @@ environment: - WAZUH_API_URL=https://wazuh.manager - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- ``` **Variable Descriptions:** @@ -35,7 +33,6 @@ environment: - `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions. - `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication. - `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer. -- `API_USERNAME` / `API_PASSWORD`: Credentials for the Wazuh API user, utilized by the Dashboard for API interactions. --- @@ -65,8 +62,6 @@ environment: - WAZUH_API_URL=https://wazuh.manager - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- ``` **Variable Descriptions:** @@ -87,14 +82,11 @@ The Wazuh Agent container uses the following environment variables to dynamicall ```yaml environment: - WAZUH_MANAGER_SERVER=wazuh.manager - - WAZUH_MANAGER_PORT=1514 - WAZUH_REGISTRATION_SERVER=wazuh.manager - - WAZUH_REGISTRATION_PORT=1515 - WAZUH_AGENT_NAME=my-agent - - WAZUH_REGISTRATION_PASSWORD=StrongPassword ``` -These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf` and set the enrollment password. +These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf`. --- diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml index b3e76e5a..3076d6b0 100644 --- a/multi-node/docker-compose.yml +++ b/multi-node/docker-compose.yml @@ -9,7 +9,7 @@ services: wazuh1.indexer: condition: service_healthy healthcheck: - test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ] + test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ] interval: 15s timeout: 5s retries: 5 @@ -32,8 +32,6 @@ services: - WAZUH_CLUSTER_NODES=wazuh.master - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- volumes: - master-wazuh-api-configuration:/var/wazuh-manager/api/configuration - master-wazuh-etc:/var/wazuh-manager/etc @@ -73,8 +71,6 @@ services: - WAZUH_CLUSTER_NODES=wazuh.master - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- volumes: - worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration - worker-wazuh-etc:/var/wazuh-manager/etc @@ -221,8 +217,6 @@ services: - WAZUH_API_URL=https://wazuh.master - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml index bf8ca96f..8365ed62 100644 --- a/single-node/docker-compose.yml +++ b/single-node/docker-compose.yml @@ -9,7 +9,7 @@ services: wazuh.indexer: condition: service_healthy healthcheck: - test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ] + test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ] interval: 15s timeout: 5s retries: 5 @@ -32,8 +32,6 @@ services: - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager - INDEXER_USERNAME=admin - INDEXER_PASSWORD=admin - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- volumes: - wazuh_api_configuration:/var/wazuh-manager/api/configuration - wazuh_etc:/var/wazuh-manager/etc @@ -103,8 +101,6 @@ services: - WAZUH_API_URL=https://wazuh.manager - DASHBOARD_USERNAME=kibanaserver - DASHBOARD_PASSWORD=kibanaserver - - API_USERNAME=wazuh-wui - - API_PASSWORD=MyS3cr37P450r.*- - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem