Persistence configuration

When customizing your Wazuh Docker deployment, certain files and directories must be persisted to retain your changes across container restarts and recreations. This is critical for maintaining custom configurations, user credentials, and security settings.

Wazuh Indexer

Internal Users

The internal_users.yml file contains the initial users and passwords for the Wazuh Indexer. This file is not included by default in the repository and must be created manually if you wish to customize internal users or update passwords.

Creating the Configuration File

Create the directory:
```
mkdir -p ./config/wazuh_indexer/
```

Create the file: Create ./config/wazuh_indexer/internal_users.yml with your user definitions. Here is a basic example:

---
# This is the internal user database
# The hash value is a bcrypt hash and can be generated with /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh

_meta:
  type: "internalusers"
  config_version: 2

# Default users

admin:
  hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
  reserved: true
  backend_roles:
  - "admin"
  description: "Admin user"

kibanaserver:
  hash: "$2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H."
  reserved: true
  description: "Kibana server user"

Important

: This example includes the default admin and kibanaserver users with their default passwords (hashed). These users are required for the standard docker-compose.yml configuration (e.g., INDEXER_USERNAME=admin and DASHBOARD_USERNAME=kibanaserver) to function correctly. If you change these passwords, you must also update the corresponding environment variables in your docker-compose.yml.

Docker Compose Configuration

To persist the internal_users.yml file, add a volume mount to your docker-compose.yml for the wazuh.indexer service:

services:
  wazuh.indexer:
    volumes:
      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/opensearch-security/securityconfig/internal_users.yml

Note

: Ensure the file exists on your host before starting the containers to prevent Docker from creating it as a directory.

Applying Changes

After modifying internal_users.yml, restart the stack to apply the changes:

docker-compose down

docker-compose up -d

Other Components

For other components like the Wazuh Manager and Wazuh Dashboard, persistence is typically handled by mounting their respective configuration directories or using Docker volumes for data storage.

Wazuh Manager: Persist /var/ossec/data and /var/ossec/etc (or specific files like ossec.conf) to retain rules, decoders, and logs.
Wazuh Dashboard: Persist /usr/share/wazuh-dashboard/data to retain tenants, dashboards, and visualizations.

Refer to the Configuration Files section for more details on mapping specific configuration files.

3.0 KiB Raw Blame History