Merge pull request #403 from wazuh/fix-random-passwords

Fix password change and refactor disable user into function

README.md

@@ -150,7 +150,7 @@ ADMIN_PRIVILEGES=true               # App privileges
 
 * `4.0` branch on correspond to the latest Wazuh-Docker stable version.
 * `master` branch contains the latest code, be aware of possible bugs on this branch.
-* `Wazuh.Version_ElasticStack.Version` (for example 3.10.2_7.5.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
+* `Wazuh.Version_ElasticStack.Version` (for example 3.13.1_7.8.0) branch. This branch contains the current release referenced in Docker Hub. The container images are installed under the current version of this branch.
 
 
 ## Compatibility Matrix

kibana-odfe/config/wazuh_app_config.sh

@@ -3,8 +3,8 @@
 
 wazuh_url="${WAZUH_API_URL:-https://wazuh}"
 wazuh_port="${API_PORT:-55000}"
-api_username="${API_USERNAME:-wazuh}"
-api_password="${API_PASSWORD:-wazuh}"
+api_username="${API_USERNAME:-wazuh-wui}"
+api_password="${API_PASSWORD:-wazuh-wui}"
 
 kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml"
 

wazuh-odfe/config/create_user.py

@@ -9,6 +9,7 @@ import os
 sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
 
 USER_FILE_PATH = "/var/ossec/api/configuration/admin.json"
+SPECIAL_CHARS = "@$!%*?&-_"
 
 
 try:
@@ -39,6 +40,26 @@ def db_roles():
     roles_result = get_roles()
     return {role["name"]: role["id"] for role in roles_result.affected_items}
 
+def disable_user(uid):
+    random_pass = "".join(
+                random.choices(
+                    string.ascii_uppercase
+                    + string.ascii_lowercase
+                    + string.digits
+                    + SPECIAL_CHARS,
+                    k=8,
+                )
+            )
+    # assure there must be at least one character from each group
+    random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
+    random_pass = ''.join(random.sample(random_pass,len(random_pass)))
+    update_user(
+        user_id=[
+            str(uid),
+        ],
+        password=random_pass,
+    )
+
 
 if __name__ == "__main__":
     if not os.path.exists(USER_FILE_PATH):
@@ -70,21 +91,7 @@ if __name__ == "__main__":
             ],
             password=password,
         )
-    # set a random password for all other users
-    for name, id in initial_users.items():
-        if name != username:
-            random_pass = "".join(
-                random.choices(
-                    string.ascii_uppercase
-                    + string.ascii_lowercase
-                    + string.digits
-                    + "@$!%*?&-_",
-                    k=16,
-                )
-            )
-            update_user(
-                user_id=[
-                    str(id),
-                ],
-                password=random_pass,
-            )
+    # disable unused default users
+    for def_user in ['wazuh', 'wazuh-wui']:
+        if def_user != username:
+            disable_user(initial_users[def_user])