fk-wazuh/docs/ref/configuration/change-passwords.md

Change passwords

This section describes how to rotate the credentials used by the provided Docker Compose deployments.

Scope

The Compose files include the following password-controlled integrations:

• Wazuh Indexer access (Manager and Dashboard clients): INDEXER_USERNAME, INDEXER_PASSWORD
• Wazuh Dashboard login: DASHBOARD_USERNAME, DASHBOARD_PASSWORD
• Wazuh API access (Dashboard client): API_USERNAME, API_PASSWORD

For variable descriptions, see Environment variables.

Rotate credentials

1. Navigate to your deployment directory:

   • single-node/ (single-node stack)
   • multi-node/ (multi-node stack)

2. Edit the deployment docker-compose.yml and update the required values under environment:

   • Single-node: update wazuh.manager and wazuh.dashboard.
   • Multi-node: update wazuh.master, wazuh.worker, and wazuh.dashboard.

   Ensure INDEXER_USERNAME and INDEXER_PASSWORD are consistent anywhere they are defined.

3. Recreate the containers to apply the new values:

   docker compose down
   docker compose up -d
   

4. Validate access:

   • Log in to the Dashboard with the updated credentials.
   • Confirm the Dashboard can query data (indirectly validating the Indexer and API credentials).

Notes

• The Manager applies API_USERNAME / API_PASSWORD at startup by creating or updating the API user.
• The Dashboard regenerates its OpenSearch Dashboards keystore on startup; changes take effect after the container is recreated.
• Rotating Indexer credentials requires updating both the Indexer user configuration and the Compose client variables (INDEXER_*).