Merge pull request #2289 from wazuh/change/2288-delete-API-references

Delete all API user and password references and Wazuh agent references

.github/workflows/5_pr_check.yml

@@ -95,9 +95,9 @@ jobs:
       WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
       INDEXER_USERNAME: admin
       INDEXER_PASSWORD: admin
-      API_USERNAME: wazuh-wui
-      API_PASSWORD: MyS3cr37P450r.*-
       MANAGER_NODES: "manager"
+      API_USERNAME: wazuh-wui
+      API_PASSWORD: wazuh-wui
     steps:
 
     - name: Check out code
@@ -368,9 +368,9 @@ jobs:
       WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
       INDEXER_USERNAME: admin
       INDEXER_PASSWORD: admin
-      API_USERNAME: wazuh-wui
-      API_PASSWORD: MyS3cr37P450r.*-
       MANAGER_NODES: "master,worker01"
+      API_USERNAME: wazuh-wui
+      API_PASSWORD: wazuh-wui
     steps:
 
     - name: Check out code

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- Delete all API user and password references and Wazuh agent references ([#2289](https://github.com/wazuh/wazuh-docker/pull/2289))
 - Create certificate directory with default user and group ([#2287](https://github.com/wazuh/wazuh-docker/pull/2287))
 - Standarize Artifact URL keys ([#2286](https://github.com/wazuh/wazuh-docker/pull/2286))
 - Certificates configuration script. ([#2285](https://github.com/wazuh/wazuh-docker/pull/2285))

build-docker-images/wazuh-agent/Dockerfile

@@ -6,9 +6,7 @@ RUN rm /bin/sh && ln -s /bin/bash /bin/sh
 ARG WAZUH_VERSION
 ARG S6_VERSION="v2.2.0.3"
 ARG WAZUH_MANAGER='CHANGE_MANAGER_IP'
-ARG WAZUH_MANAGER_PORT='CHANGE_MANAGER_PORT'
 ARG WAZUH_REGISTRATION_SERVER='CHANGE_ENROLL_IP'
-ARG WAZUH_REGISTRATION_PORT='CHANGE_ENROLL_PORT'
 ARG WAZUH_AGENT_NAME='CHANGE_AGENT_NAME'
 ARG TARGETARCH
 ARG wazuh_agent_x86_64_rpm

build-docker-images/wazuh-agent/config/etc/cont-init.d/0-wazuh-init

@@ -4,10 +4,7 @@
 WAZUH_INSTALL_PATH=/var/ossec
 WAZUH_CONFIG_MOUNT=/wazuh-config-mount
 WAZUH_MANAGER_SERVER=$WAZUH_MANAGER_SERVER
-WAZUH_MANAGER_PORT=${WAZUH_MANAGER_PORT:-"1514"}
 WAZUH_REGISTRATION_SERVER=${WAZUH_REGISTRATION_SERVER:-$WAZUH_MANAGER_SERVER}
-WAZUH_REGISTRATION_PORT=${WAZUH_REGISTRATION_PORT:-"1515"}
-WAZUH_REGISTRATION_PASSWORD=$WAZUH_REGISTRATION_PASSWORD
 WAZUH_AGENT_NAME=${WAZUH_AGENT_NAME:-"wazuh-agent-$HOSTNAME"}
 
 ##############################################################################
@@ -63,14 +60,8 @@ mount_files() {
 set_manager_conn() {
   echo "ossec.conf configuration"
   sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  sed -i "s#<port>CHANGE_MANAGER_PORT</port>#<port>$WAZUH_MANAGER_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  sed -i "s#<port>CHANGE_ENROLL_PORT</port>#<port>$WAZUH_REGISTRATION_PORT</port>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
   sed -i "s#<agent_name>CHANGE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
-  [ -n "$WAZUH_REGISTRATION_PASSWORD" ] && \
-  echo "$WAZUH_REGISTRATION_PASSWORD" > ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
-  chown root:wazuh ${WAZUH_INSTALL_PATH}/etc/authd.pass && \
-  chmod 640 ${WAZUH_INSTALL_PATH}/etc/authd.pass
 }
 
 ##############################################################################

build-docker-images/wazuh-manager/Dockerfile

@@ -30,7 +30,6 @@ RUN RPM_ARCH="x86_64" && \
     rm -f /var/wazuh-manager/etc/sslmanager.cert
 
 COPY config/etc/ /etc/
-COPY --chown=root:wazuh-manager config/create_user.py /var/wazuh-manager/framework/scripts/create_user.py
 # Prepare permanent data
 # Sync calls are due to https://github.com/docker/docker/issues/9547
 

build-docker-images/wazuh-manager/config/create_user.py

@@ -1,102 +0,0 @@
-import logging
-import sys
-import json
-import random
-import string
-import os
-
-# Set framework path
-sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
-
-USER_FILE_PATH = "/var/wazuh-manager/api/configuration/admin.json"
-SPECIAL_CHARS = "@$!%*?&-_"
-
-
-try:
-    from wazuh.rbac.orm import check_database_integrity
-    from wazuh.security import (
-        create_user,
-        get_users,
-        get_roles,
-        set_user_role,
-        update_user,
-    )
-except ModuleNotFoundError as e:
-    logging.error("No module 'wazuh' found.")
-    sys.exit(1)
-
-
-def read_user_file(path=USER_FILE_PATH):
-    with open(path) as user_file:
-        data = json.load(user_file)
-        return data["username"], data["password"]
-
-
-def db_users():
-    users_result = get_users()
-    return {user["username"]: user["id"] for user in users_result.affected_items}
-
-
-def db_roles():
-    roles_result = get_roles()
-    return {role["name"]: role["id"] for role in roles_result.affected_items}
-
-def disable_user(uid):
-    random_pass = "".join(
-                random.choices(
-                    string.ascii_uppercase
-                    + string.ascii_lowercase
-                    + string.digits
-                    + SPECIAL_CHARS,
-                    k=8,
-                )
-            )
-    # assure there must be at least one character from each group
-    random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
-    random_pass = ''.join(random.sample(random_pass,len(random_pass)))
-    update_user(
-        user_id=[
-            str(uid),
-        ],
-        password=random_pass,
-    )
-
-
-if __name__ == "__main__":
-    if not os.path.exists(USER_FILE_PATH):
-        # abort if no user file detected
-        sys.exit(0)
-    username, password = read_user_file()
-
-    # create RBAC database
-    check_database_integrity()
-
-    initial_users = db_users()
-    if username not in initial_users:
-        # create a new user
-        create_user(username=username, password=password)
-        users = db_users()
-        uid = users[username]
-        roles = db_roles()
-        rid = roles["administrator"]
-        set_user_role(
-            user_id=[
-                str(uid),
-            ],
-            role_ids=[
-                str(rid),
-            ],
-        )
-    else:
-        # modify an existing user ("wazuh" or "wazuh-wui")
-        uid = initial_users[username]
-        update_user(
-            user_id=[
-                str(uid),
-            ],
-            password=password,
-        )
-    # disable unused default users
-    for def_user in ['wazuh', 'wazuh-wui']:
-        if def_user != username:
-            disable_user(initial_users[def_user])

build-docker-images/wazuh-manager/config/etc/cont-init.d/1-manager

@@ -73,28 +73,6 @@ function_wazuh_migration(){
   fi
 }
 
-function_create_custom_user() {
-  if [[ ! -z $API_USERNAME ]] && [[ ! -z $API_PASSWORD ]]; then
-  cat << EOF > /var/wazuh-manager/api/configuration/admin.json
-{
-  "username": "$API_USERNAME",
-  "password": "$API_PASSWORD"
-}
-EOF
-
-    # create or customize API user
-    if /var/wazuh-manager/framework/python/bin/python3  /var/wazuh-manager/framework/scripts/create_user.py; then
-      # remove json if exit code is 0
-      rm /var/wazuh-manager/api/configuration/admin.json
-    else
-      echored "There was an error configuring the API user"
-      # terminate container to avoid unpredictable behavior
-      exec s6-svscanctl -t /var/run/s6/services
-      exit 1
-    fi
-  fi
-}
-
 function_entrypoint_scripts() {
   # It will run every .sh script located in entrypoint-scripts folder in lexicographical order
   if [ -d "/entrypoint-scripts/" ]
@@ -116,9 +94,6 @@ fi
 # Migrate data from /wazuh-migration volume
 function_wazuh_migration
 
-# create API custom user
-function_create_custom_user
-
 # configure Vulnerabilty detection
 function_configure_vulnerability_detection
 

docs/ref/configuration/environment-variables.md

@@ -26,8 +26,6 @@ environment:
   - WAZUH_API_URL=https://wazuh.manager
   - DASHBOARD_USERNAME=kibanaserver
   - DASHBOARD_PASSWORD=kibanaserver
-  - API_USERNAME=wazuh-wui
-  - API_PASSWORD=MyS3cr37P450r.*-
 ```
 
 **Variable Descriptions:**
@@ -35,7 +33,6 @@ environment:
 - `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions.
 - `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication.
 - `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer.
-- `API_USERNAME` / `API_PASSWORD`: Credentials for the Wazuh API user, utilized by the Dashboard for API interactions.
 
 ---
 
@@ -65,8 +62,6 @@ environment:
   - WAZUH_API_URL=https://wazuh.manager
   - DASHBOARD_USERNAME=kibanaserver
   - DASHBOARD_PASSWORD=kibanaserver
-  - API_USERNAME=wazuh-wui
-  - API_PASSWORD=MyS3cr37P450r.*-
 ```
 
 **Variable Descriptions:**
@@ -87,14 +82,11 @@ The Wazuh Agent container uses the following environment variables to dynamicall
 ```yaml
 environment:
   - WAZUH_MANAGER_SERVER=wazuh.manager
-  - WAZUH_MANAGER_PORT=1514
   - WAZUH_REGISTRATION_SERVER=wazuh.manager
-  - WAZUH_REGISTRATION_PORT=1515
   - WAZUH_AGENT_NAME=my-agent
-  - WAZUH_REGISTRATION_PASSWORD=StrongPassword
 ```
 
-These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf` and set the enrollment password.
+These variables are used by the `set_manager_conn()` function in the entrypoint script to replace placeholder values in `ossec.conf`.
 
 ---
 

multi-node/docker-compose.yml

@@ -9,7 +9,7 @@ services:
       wazuh1.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
+      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
       interval: 15s
       timeout: 5s
       retries: 5
@@ -32,8 +32,6 @@ services:
       - WAZUH_CLUSTER_NODES=wazuh.master
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
-      - API_USERNAME=wazuh-wui
-      - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
       - master-wazuh-etc:/var/wazuh-manager/etc
@@ -73,8 +71,6 @@ services:
       - WAZUH_CLUSTER_NODES=wazuh.master
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
-      - API_USERNAME=wazuh-wui
-      - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
       - worker-wazuh-etc:/var/wazuh-manager/etc
@@ -221,8 +217,6 @@ services:
       - WAZUH_API_URL=https://wazuh.master
       - DASHBOARD_USERNAME=kibanaserver
       - DASHBOARD_PASSWORD=kibanaserver
-      - API_USERNAME=wazuh-wui
-      - API_PASSWORD=MyS3cr37P450r.*-
       - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard.pem
       - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/wazuh-dashboard-key.pem
       - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem

single-node/docker-compose.yml

@@ -9,7 +9,7 @@ services:
       wazuh.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -u $$API_USERNAME:$$API_PASSWORD -k -s -f -X POST https://localhost:55000/security/user/authenticate?raw=true -o /dev/null || exit 1" ]
+      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
       interval: 15s
       timeout: 5s
       retries: 5
@@ -32,8 +32,6 @@ services:
       - WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=admin
-      - API_USERNAME=wazuh-wui
-      - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
       - wazuh_api_configuration:/var/wazuh-manager/api/configuration
       - wazuh_etc:/var/wazuh-manager/etc
@@ -103,8 +101,6 @@ services:
       - WAZUH_API_URL=https://wazuh.manager
       - DASHBOARD_USERNAME=kibanaserver
       - DASHBOARD_PASSWORD=kibanaserver
-      - API_USERNAME=wazuh-wui
-      - API_PASSWORD=MyS3cr37P450r.*-
       - SERVER_SSL_CERTIFICATE=/usr/share/wazuh-dashboard/config/certs/dashboard.pem
       - SERVER_SSL_KEY=/usr/share/wazuh-dashboard/config/certs/dashboard-key.pem
       - OPENSEARCH_SSL_CERTIFICATE_AUTHORITIES=/usr/share/wazuh-dashboard/config/certs/root-ca.pem