diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml
index 287c46e4..4e51ca06 100644
--- a/.github/workflows/5_pr_check.yml
+++ b/.github/workflows/5_pr_check.yml
@@ -95,9 +95,9 @@ jobs:
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin
- API_USERNAME: wazuh-wui
- API_PASSWORD: MyS3cr37P450r.*-
MANAGER_NODES: "manager"
+ API_USERNAME: wazuh-wui
+ API_PASSWORD: wazuh-wui
steps:
- name: Check out code
@@ -368,9 +368,9 @@ jobs:
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
INDEXER_USERNAME: admin
INDEXER_PASSWORD: admin
- API_USERNAME: wazuh-wui
- API_PASSWORD: MyS3cr37P450r.*-
MANAGER_NODES: "master,worker01"
+ API_USERNAME: wazuh-wui
+ API_PASSWORD: wazuh-wui
steps:
- name: Check out code
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2f1a23d..889b3e7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
### Changed
+- Delete all API user and password references and Wazuh agent references ([#2289](https://github.com/wazuh/wazuh-docker/pull/2289))
- Create certificate directory with default user and group ([#2287](https://github.com/wazuh/wazuh-docker/pull/2287))
- Standarize Artifact URL keys ([#2286](https://github.com/wazuh/wazuh-docker/pull/2286))
- Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285))
diff --git a/build-docker-images/wazuh-agent/Dockerfile b/build-docker-images/wazuh-agent/Dockerfile
index 1963540c..302c8125 100644
--- a/build-docker-images/wazuh-agent/Dockerfile
+++ b/build-docker-images/wazuh-agent/Dockerfile
@@ -6,9 +6,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
ARG WAZUH_VERSION
ARG S6_VERSION="v2.2.0.3"
ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
-ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
-ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
ARG TARGETARCH
ARG wazuh_agent_x86_64_rpm
diff --git a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
index fa5578a1..27dfbf88 100644
--- a/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
+++ b/build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init
@@ -4,10 +4,7 @@
WAZUH_INSTALL_PATH=/var/ossec
WAZUH_CONFIG_MOUNT=/wazuh-config-mount
WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER
-WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"}
WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER}
-WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"}
-WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD
WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"}
##############################################################################
@@ -63,14 +60,8 @@ mount_files() {
set_manager_conn() {
echo "ossec.conf configuration"
sed -i "s#
CHANGE_MANAGER_IP#$WAZUH_MANAGER_SERVER#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
- sed -i "s#CHANGE_MANAGER_PORT#$WAZUH_MANAGER_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#CHANGE_ENROLL_IP#$WAZUH_REGISTRATION_SERVER#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
- sed -i "s#CHANGE_ENROLL_PORT#$WAZUH_REGISTRATION_PORT#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
sed -i "s#CHANGE_AGENT_NAME#$WAZUH_AGENT_NAME#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
- [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \
- echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
- chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
- chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass
}
##############################################################################
diff --git a/build-docker-images/wazuh-manager/Dockerfile b/build-docker-images/wazuh-manager/Dockerfile
index 507049ea..553eb368 100644
--- a/build-docker-images/wazuh-manager/Dockerfile
+++ b/build-docker-images/wazuh-manager/Dockerfile
@@ -30,7 +30,6 @@ RUN RPM_ARCH="x86_64" && \
rm -f /var/wazuh-manager/etc/sslmanager.cert
COPY config/etc/ /etc/
-COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py
# Prepare permanent data
# Sync calls are due to https://github.com/docker/docker/issues/9547
diff --git a/build-docker-images/wazuh-manager/config/create_user.py b/build-docker-images/wazuh-manager/config/create_user.py
deleted file mode 100644
index f1417298..00000000
--- a/build-docker-images/wazuh-manager/config/create_user.py
+++ /dev/null
@@ -1,102 +0,0 @@
-import logging
-import sys
-import json
-import random
-import string
-import os
-
-# Set framework path
-sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
-
-USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json"
-SPECIAL_CHARS = "@$!%*?&-_"
-
-
-try:
- from wazuh.rbac.orm import check_database_integrity
- from wazuh.security import (
- create_user,
- get_users,
- get_roles,
- set_user_role,
- update_user,
- )
-except ModuleNotFoundError as e:
- logging.error("No module 'wazuh' found.")
- sys.exit(1)
-
-
-def read_user_file(path=USER_FILE_PATH):
- with open(path) as user_file:
- data = json.load(user_file)
- return data["username"], data["password"]
-
-
-def db_users():
- users_result = get_users()
- return {user["username"]: user["id"] for user in users_result.affected_items}
-
-
-def db_roles():
- roles_result = get_roles()
- return {role["name"]: role["id"] for role in roles_result.affected_items}
-
-def disable_user(uid):
- random_pass = "".join(
- random.choices(
- string.ascii_uppercase
- + string.ascii_lowercase
- + string.digits
- + SPECIAL_CHARS,
- k=8,
- )
- )
- # assure there must be at least one character from each group
- random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
- random_pass = ''.join(random.sample(random_pass,len(random_pass)))
- update_user(
- user_id=[
- str(uid),
- ],
- password=random_pass,
- )
-
-
-if __name__ == "__main__":
- if not os.path.exists(USER_FILE_PATH):
- # abort if no user file detected
- sys.exit(0)
- username, password = read_user_file()
-
- # create RBAC database
- check_database_integrity()
-
- initial_users = db_users()
- if username not in initial_users:
- # create a new user
- create_user(username=username, password=password)
- users = db_users()
- uid = users[username]
- roles = db_roles()
- rid = roles["administrator"]
- set_user_role(
- user_id=[
- str(uid),
- ],
- role_ids=[
- str(rid),
- ],
- )
- else:
- # modify an existing user ("wazuh" or "wazuh-wui")
- uid = initial_users[username]
- update_user(
- user_id=[
- str(uid),
- ],
- password=password,
- )
- # disable unused default users
- for def_user in ['wazuh', 'wazuh-wui']:
- if def_user != username:
- disable_user(initial_users[def_user])
diff --git a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
index 448832b9..2dbf13b2 100644
--- a/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
+++ b/build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager
@@ -73,28 +73,6 @@ function_wazuh_migration(){
fi
}
-function_create_custom_user() {
- if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
- cat << EOF > /var/wazuh-manager/api/configuration/admin.json
-{
- "username": "$API_USERNAME",
- "password": "$API_PASSWORD"
-}
-EOF
-
- # create or customize API user
- if /var/wazuh-manager/framework/python/bin/python3 /var/wazuh-manager/framework/scripts/create_user.py; then
- # remove json if exit code is 0
- rm /var/wazuh-manager/api/configuration/admin.json
- else
- echored "There was an error configuring the API user"
- # terminate container to avoid unpredictable behavior
- exec s6-svscanctl -t /var/run/s6/services
- exit 1
- fi
- fi
-}
-
function_entrypoint_scripts() {
# It will run every .sh script located in entrypoint-scripts folder in lexicographical order
if [ -d "/entrypoint-scripts/" ]
@@ -116,9 +94,6 @@ fi
# Migrate data from /wazuh-migration volume
function_wazuh_migration
-# create API custom user
-function_create_custom_user
-
# configure Vulnerabilty detection
function_configure_vulnerability_detection
diff --git a/docs/ref/configuration/environment-variables.md b/docs/ref/configuration/environment-variables.md
index 09ab6e53..4c124fdf 100644
--- a/docs/ref/configuration/environment-variables.md
+++ b/docs/ref/configuration/environment-variables.md
@@ -26,8 +26,6 @@ environment:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
```
**Variable Descriptions:**
@@ -35,7 +33,6 @@ environment:
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions.
- `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication.
- `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer.
-- `API_USERNAME` / `API_PASSWORD`: Credentials for the Wazuh API user, utilized by the Dashboard for API interactions.
---
@@ -65,8 +62,6 @@ environment:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
```
**Variable Descriptions:**
@@ -87,14 +82,11 @@ The Wazuh Agent container uses the following environment variables to dynamicall
```yaml
environment:
- WAZUH_MANAGER_SERVER=wazuh.manager
- - WAZUH_MANAGER_PORT=1514
- WAZUH_REGISTRATION_SERVER=wazuh.manager
- - WAZUH_REGISTRATION_PORT=1515
- WAZUH_AGENT_NAME=my-agent
- - WAZUH_REGISTRATION_PASSWORD=StrongPassword
```
-These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf` and set the enrollment password.
+These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf`.
---
diff --git a/multi-node/docker-compose.yml b/multi-node/docker-compose.yml
index b3e76e5a..3076d6b0 100644
--- a/multi-node/docker-compose.yml
+++ b/multi-node/docker-compose.yml
@@ -9,7 +9,7 @@ services:
wazuh1.indexer:
condition: service_healthy
healthcheck:
- test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
+ test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
interval: 15s
timeout: 5s
retries: 5
@@ -32,8 +32,6 @@ services:
- WAZUH_CLUSTER_NODES=wazuh.master
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
volumes:
- master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- master-wazuh-etc:/var/wazuh-manager/etc
@@ -73,8 +71,6 @@ services:
- WAZUH_CLUSTER_NODES=wazuh.master
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
volumes:
- worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
- worker-wazuh-etc:/var/wazuh-manager/etc
@@ -221,8 +217,6 @@ services:
- WAZUH_API_URL=https://wazuh.master
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
- SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem
diff --git a/single-node/docker-compose.yml b/single-node/docker-compose.yml
index bf8ca96f..8365ed62 100644
--- a/single-node/docker-compose.yml
+++ b/single-node/docker-compose.yml
@@ -9,7 +9,7 @@ services:
wazuh.indexer:
condition: service_healthy
healthcheck:
- test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
+ test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
interval: 15s
timeout: 5s
retries: 5
@@ -32,8 +32,6 @@ services:
- WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
- INDEXER_USERNAME=admin
- INDEXER_PASSWORD=admin
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
volumes:
- wazuh_api_configuration:/var/wazuh-manager/api/configuration
- wazuh_etc:/var/wazuh-manager/etc
@@ -103,8 +101,6 @@ services:
- WAZUH_API_URL=https://wazuh.manager
- DASHBOARD_USERNAME=kibanaserver
- DASHBOARD_PASSWORD=kibanaserver
- - API_USERNAME=wazuh-wui
- - API_PASSWORD=MyS3cr37P450r.*-
- SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem
- SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
- OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem