# Security

This section summarizes security recommendations for Wazuh Docker deployments (single-node and multi-node). Apply the controls that match your environment and risk profile.

## Credentials and secrets

- Do not use default credentials. The Compose examples include placeholder values for the Wazuh API, Dashboard, and Indexer access.
- Prefer injecting secrets at runtime (for example, via your CI/CD secret store or an external secrets manager) instead of hardcoding them in `docker-compose.yml`.
- Rotate credentials regularly and after any suspected exposure.
- The Wazuh dashboard keeps its secrets in `opensearch_dashboards.keystore`, persisted in the `wazuh-dashboard-config` volume. It stores the Indexer credentials and the `wazuh_ai_assistant.encryptionKey`, generated at random on the first start and unique per deployment. Restrict access to that volume and to `docker compose exec` on the dashboard container, and do not copy the keystore between deployments.

## Certificates and TLS

- Protect the generated `wazuh-certificates/` directory. Limit filesystem permissions and do not publish it.
- Regenerate certificates if private keys are leaked or if nodes are re-provisioned.
- Use certificates and TLS settings appropriate for production (trusted CA, correct DNS names, and key protection).

## Network exposure

- Restrict access to exposed service ports at the host firewall and security group level.
- Do not expose internal-only endpoints to untrusted networks. In particular, limit access to the Indexer API port (`9200`) and the Wazuh API port (`55000`) to administrative networks.

## Host and runtime hardening

- Run Docker on a hardened host (patched OS, minimal installed packages, restricted SSH access).
- Limit access to the Docker daemon. Docker socket access grants administrative control over the host.
- Ensure persistent volumes and bind-mounted configuration files are backed by secure storage and appropriate permissions.