fk-wazuh/docs/ref/security.md

Security

This section summarizes security recommendations for Wazuh Docker deployments (single-node and multi-node). Apply the controls that match your environment and risk profile.

Credentials and secrets

• Do not use default credentials. The Compose examples include placeholder values for the Wazuh API, Dashboard, and Indexer access.
• Prefer injecting secrets at runtime (for example, via your CI/CD secret store or an external secrets manager) instead of hardcoding them in docker-compose.yml.
• Rotate credentials regularly and after any suspected exposure.
• The Wazuh dashboard keeps its secrets in opensearch_dashboards.keystore, persisted in the wazuh-dashboard-config volume. It stores the Indexer credentials and the wazuh_ai_assistant.encryptionKey, generated at random on the first start and unique per deployment. Restrict access to that volume and to docker compose exec on the dashboard container, and do not copy the keystore between deployments.

Certificates and TLS

• Protect the generated wazuh-certificates/ directory. Limit filesystem permissions and do not publish it.
• Regenerate certificates if private keys are leaked or if nodes are re-provisioned.
• Use certificates and TLS settings appropriate for production (trusted CA, correct DNS names, and key protection).

Network exposure

• Restrict access to exposed service ports at the host firewall and security group level.
• Do not expose internal-only endpoints to untrusted networks. In particular, limit access to the Indexer API port (9200) and the Wazuh API port (55000) to administrative networks.

Host and runtime hardening

• Run Docker on a hardened host (patched OS, minimal installed packages, restricted SSH access).
• Limit access to the Docker daemon. Docker socket access grants administrative control over the host.
• Ensure persistent volumes and bind-mounted configuration files are backed by secure storage and appropriate permissions.