Wazuh API Issues

[kl3ss]

Hey All,

I'm currently having some issues using the Wazuh API and require some assistance troubleshooting. When trying to run an Invoke-WebRequest or curl I get a 401 Unauthorized error. I am using the default username and password to try authenticate with the API.

curl command im running is curl -k -u username:password "https://localhost:55000?pretty"

Cheers

kl3ss

[kl3ss]

Have looked through the Wazuh API logs and all I am seeing is Authentication failed. Am using the same creds specified in the Security Onion 2.0 Documentation.

[wildlyunder]

I've tried connecting via the API using foo:bar and hit the same issue. Did you ever find a solution?

[weslambert]

We may have disabled/removed the default user. It's been a bit since I've looked at it.

You can (and should) add a new user, like:

so-wazuh-user-add testuser

(you will be prompted to provide a password)

Next, restart Wazuh:

so-wazuh-restart

Then, try connecting to the API:

curl -k -u testuser:testpassword https://localhost:55000

[dougburks]

Documented here:
https://docs.securityonion.net/en/2.3/wazuh.html#api

[kl3ss]

@dougburks @weslambert Thank you both for that, have tried this and can now connect to the API. :-)