Skip to content

Commit 1cecd3b

Browse files
javimedjavimed
authored
Merge pull request #8839 from wazuh/enhancement/301-docker-rework
Enhancement/301 docker rework
2 parents f64291f + 8f53e86 commit 1cecd3b

File tree

11 files changed

+765
-580
lines changed

11 files changed

+765
-580
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ All notable changes to this project will be documented in this file.
5151
- **Post-release**: Changed the warning note on using the `$` and `&` characters when changing passwords in Docker deployments. ([#8694](https://github.com/wazuh/wazuh-documentation/pull/8694))
5252
- **Post-release**: Changed Windows commands in the backup guide to PowerShell. ([#8761](https://github.com/wazuh/wazuh-documentation/pull/8761))
5353
- **Post-release**: Updated 4.12.0 command output examples. ([#8779](https://github.com/wazuh/wazuh-documentation/pull/8779)) ([#8780](https://github.com/wazuh/wazuh-documentation/pull/8780))
54-
- **Post-release**: Updated the *Deployment on Docker* documentation. ([#8793](https://github.com/wazuh/wazuh-documentation/pull/8793))
54+
- **Post-release**: Updated the *Deployment on Docker* documentation. ([#8793](https://github.com/wazuh/wazuh-documentation/pull/8793)) ([#8839](https://github.com/wazuh/wazuh-documentation/pull/8839))
5555
- **Post-release**: Updated the Windows logo in the documentation. ([#8804](https://github.com/wazuh/wazuh-documentation/pull/8804))
5656
- **Post-release**: Updated the offline installation guide. ([#8803](https://github.com/wazuh/wazuh-documentation/pull/8803))
5757
- **Post-release**: Updated the instruction and images in Wazuh server API getting started documentation to reflect the new navigation path (**Server management** > **Dev Tools**). ([#8811](https://github.com/wazuh/wazuh-documentation/pull/8811))

‎source/_static/js/redirects.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,9 @@ newUrls['4.12'] = [
7575
'/development/packaging/generate-server-package.html',
7676
'/development/packaging/generate-agent-package.html',
7777
'/cloud-service/ai-analyst.html',
78-
'/deployment-options/docker/prerequisites.html',
7978
'/deployment-options/docker/build-docker-images-locally.html',
79+
'/deployment-options/docker/changing-default-password.html',
80+
'/deployment-options/docker/uninstalling-wazuh-docker.html',
8081
]
8182

8283
/* Redirections from 4.9 to 4.10 */

‎source/deployment-options/docker/build-docker-images-locally.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
.. meta::
44
:description: You can modify and build Docker images for the Wazuh central components. Learn more in this section of the documentation.
55

6-
Build Docker images locally
7-
===========================
6+
Building Docker images locally
7+
==============================
88

99
You can modify and build Docker images for the Wazuh central components (manager, indexer, and dashboard).
1010

@@ -20,4 +20,4 @@ You can modify and build Docker images for the Wazuh central components (manager
2020
2121
# build-docker-images/build-images.sh
2222
23-
This generates updated Docker images for all Wazuh components on your local system.
23+
This builds Docker images for all Wazuh components on your local system.

‎source/deployment-options/docker/changing-default-password.rst‎

Lines changed: 303 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,303 @@
1+
.. Copyright (C) 2015, Wazuh, Inc.
2+
3+
.. meta::
4+
:description: Learn how to change the default password of Wazuh users in Docker environments in this section of the documentation.
5+
6+
Changing the default password of Wazuh users
7+
============================================
8+
9+
We recommend changing the default Wazuh user's password to improve security.
10+
11+
There are two types of users on Wazuh Docker environments:
12+
13+
- :ref:`Wazuh indexer users <wazuh-indexer-user>`
14+
- `Wazuh server API users`_
15+
16+
Follow the steps below to change the password of these Wazuh users.
17+
18+
.. note::
19+
20+
Depending on your Wazuh Docker stack, you must run the commands from the ``wazuh-docker/single-node`` or ``wazuh-docker/multi-node`` directory.
21+
22+
.. _wazuh-indexer-user:
23+
24+
Wazuh indexer user
25+
------------------
26+
27+
The Wazuh indexer has the ``admin`` and ``kibanaserver`` users by default. You can access the Wazuh dashboard using either the ``admin`` or ``kibanaserver`` user credentials.
28+
29+
To change these credentials, you must:
30+
31+
- :ref:`Log out of your Wazuh dashboard <log-out-of-your-wazuh-dashboard>`
32+
- :ref:`Set a new password in the Docker Compose file <set-a-new-password-in-the-docker-compose-file>`
33+
- :ref:`Create and set the hash of your new password <create-and-set-the-hash-of-your-new-password>`
34+
- :ref:`Apply the changes <apply-the-changes>`
35+
36+
.. warning::
37+
38+
- You can only change one user's password at a time.
39+
- If you have custom users, add them to the ``config/wazuh_indexer/internal_users.yml`` file in the deployment model directory. Otherwise, executing this procedure deletes them.
40+
41+
.. _log-out-of-your-wazuh-dashboard:
42+
43+
Logging out of your Wazuh dashboard
44+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
45+
46+
You must log out of your Wazuh dashboard before starting the password change process. If you don't, persistent session cookies will cause errors when accessing Wazuh after changing user passwords.
47+
48+
.. _set-a-new-password-in-the-docker-compose-file:
49+
50+
Setting the new password in the Docker Compose file
51+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
52+
53+
.. note::
54+
55+
If your password contains the ``$`` character, you must escape it by doubling it. For example, to set the password ``Secret$Password`` in the ``docker-compose.yml`` file, write it as ``Secret$$Password``.
56+
57+
#. Open the ``docker-compose.yml`` file. Change all occurrences of the old password with the new one. For example, for a single-node stack:
58+
59+
.. tabs::
60+
61+
.. group-tab:: admin user
62+
63+
.. code-block:: yaml
64+
:emphasize-lines: 8, 25
65+
66+
...
67+
services:
68+
wazuh.manager:
69+
...
70+
environment:
71+
- INDEXER_URL=https://wazuh.indexer:9200
72+
- INDEXER_USERNAME=admin
73+
- INDEXER_PASSWORD=SecretPassword
74+
- FILEBEAT_SSL_VERIFICATION_MODE=full
75+
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
76+
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
77+
- SSL_KEY=/etc/ssl/filebeat.key
78+
- API_USERNAME=wazuh-wui
79+
- API_PASSWORD=MyS3cr37P450r.*-
80+
...
81+
wazuh.indexer:
82+
...
83+
environment:
84+
- "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m"
85+
...
86+
wazuh.dashboard:
87+
...
88+
environment:
89+
- INDEXER_USERNAME=admin
90+
- INDEXER_PASSWORD=SecretPassword
91+
- WAZUH_API_URL=https://wazuh.manager
92+
- DASHBOARD_USERNAME=kibanaserver
93+
- DASHBOARD_PASSWORD=kibanaserver
94+
- API_USERNAME=wazuh-wui
95+
- API_PASSWORD=MyS3cr37P450r.*-
96+
...
97+
98+
.. group-tab:: kibanaserver user
99+
100+
.. code-block:: yaml
101+
:emphasize-lines: 11
102+
103+
...
104+
105+
services:
106+
wazuh.dashboard:
107+
...
108+
environment:
109+
- INDEXER_USERNAME=admin
110+
- INDEXER_PASSWORD=SecretPassword
111+
- WAZUH_API_URL=https://wazuh.manager
112+
- DASHBOARD_USERNAME=kibanaserver
113+
- DASHBOARD_PASSWORD=kibanaserver
114+
- API_USERNAME=wazuh-wui
115+
- API_PASSWORD=MyS3cr37P450r.*-
116+
...
117+
118+
.. _create-and-set-the-hash-of-your-new-password:
119+
120+
Setting a new hash
121+
^^^^^^^^^^^^^^^^^^
122+
123+
Follow the steps below to generate and set a new password hash for your Wazuh users.
124+
125+
#. Stop the stack if it's running:
126+
127+
.. code-block:: console
128+
129+
# docker compose down
130+
131+
#. Run this command to generate the hash for your new password:
132+
133+
.. code-block:: console
134+
135+
# docker run --rm -ti wazuh/wazuh-indexer:|WAZUH_CURRENT_DOCKER| bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh
136+
137+
Once the container launches, input the new password and press **Enter**.
138+
139+
#. Copy the generated hash.
140+
141+
#. Open the ``config/wazuh_indexer/internal_users.yml`` file. Locate the block for the user whose password you want to change.
142+
143+
#. Replace ``<NEW_HASH>`` with your hash values.
144+
145+
.. tabs::
146+
147+
.. group-tab:: admin user
148+
149+
.. code-block:: yaml
150+
:emphasize-lines: 4
151+
152+
...
153+
154+
admin:
155+
hash: "<NEW_HASH>"
156+
reserved: true
157+
backend_roles:
158+
- "admin"
159+
description: "Demo admin user"
160+
161+
...
162+
163+
.. group-tab:: kibanaserver user
164+
165+
.. code-block:: yaml
166+
:emphasize-lines: 4
167+
168+
...
169+
170+
kibanaserver:
171+
hash: "<NEW_HASH>"
172+
reserved: true
173+
description: "Demo kibanaserver user"
174+
175+
...
176+
177+
Save the changes.
178+
179+
.. _apply-the-changes:
180+
181+
Applying the changes
182+
^^^^^^^^^^^^^^^^^^^^
183+
184+
After updating ``docker-compose.yml`` file, restart the Wazuh Docker stack and reapply settings using the ``securityadmin.sh`` tool.
185+
186+
#. Start the deployment stack.
187+
188+
.. code-block:: console
189+
190+
# docker compose up -d
191+
192+
#. Run ``docker ps`` and note the name of the first Wazuh indexer container. For example, ``single-node-wazuh.indexer-1``, or ``multi-node-wazuh1.indexer-1``.
193+
194+
#. Run ``docker exec -it <WAZUH_INDEXER_CONTAINER_NAME> bash`` to access the container. Replace ``<WAZUH_INDEXER_CONTAINER_NAME>`` with the Wazuh indexer container name. For example, use ``single-node-wazuh.indexer-1`` for the single-node stack and ``multi-node-wazuh1.indexer-1`` for the multi-node stack:
195+
196+
.. code-block:: console
197+
198+
# docker exec -it single-node-wazuh.indexer-1 bash
199+
200+
#. Set the following variables:
201+
202+
.. code-block:: bash
203+
204+
export INSTALLATION_DIR=/usr/share/wazuh-indexer
205+
CACERT=$INSTALLATION_DIR/certs/root-ca.pem
206+
KEY=$INSTALLATION_DIR/certs/admin-key.pem
207+
CERT=$INSTALLATION_DIR/certs/admin.pem
208+
export JAVA_HOME=/usr/share/wazuh-indexer/jdk
209+
210+
#. Wait for the Wazuh indexer to initialize properly. The waiting time can vary from one to five minutes. It depends on the size of the cluster, the assigned resources, and the network speed. Then, run the ``securityadmin.sh`` script to apply all changes.
211+
212+
.. tabs::
213+
214+
.. group-tab:: Single-node stack
215+
216+
.. code-block:: console
217+
218+
$ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl
219+
220+
.. group-tab:: Multi-node stack
221+
222+
.. code-block:: console
223+
224+
$ HOST=$(grep node.name $INSTALLATION_DIR/opensearch.yml | awk '{printf $2}')
225+
$ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert $CACERT -cert $CERT -key $KEY -p 9200 -icl -h $HOST
226+
227+
.. note::
228+
229+
When working on Docker Desktop with a multi-node stack, use the ``multi-node-wazuh1.indexer-1`` IP address instead of the ``$HOST`` variable.
230+
231+
#. Exit the Wazuh indexer container. Refresh the Wazuh dashboard and log in with the new credentials.
232+
233+
.. _wazuh-server-api-users:
234+
235+
Wazuh server API users
236+
----------------------
237+
238+
The ``wazuh-wui`` user is the default user for connecting to the Wazuh server API. Follow these steps to change the password.
239+
240+
.. warning::
241+
242+
The password for Wazuh server API users must be between 8 and 64 characters long and contain at least one uppercase and lowercase letter, number, and symbol. The Wazuh manager service will fail to start if these requirements are unmet.
243+
244+
#. Open the ``config/wazuh_dashboard/wazuh.yml`` file and modify the value of the ``password`` parameter.
245+
246+
.. code-block:: yaml
247+
:emphasize-lines: 8
248+
249+
...
250+
hosts:
251+
- 1513629884013:
252+
url: "https://wazuh.manager"
253+
port: 55000
254+
username: wazuh-wui
255+
256+
password: "MyS3cr37P450r.*-"
257+
258+
run_as: false
259+
...
260+
261+
#. Open the ``docker-compose.yml`` file. Change all occurrences of the old password with the new one.
262+
263+
.. code-block:: yaml
264+
:emphasize-lines: 14, 27
265+
266+
...
267+
services:
268+
wazuh.manager:
269+
...
270+
environment:
271+
- INDEXER_URL=https://wazuh.indexer:9200
272+
- INDEXER_USERNAME=admin
273+
- INDEXER_PASSWORD=SecretPassword
274+
- FILEBEAT_SSL_VERIFICATION_MODE=full
275+
- SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
276+
- SSL_CERTIFICATE=/etc/ssl/filebeat.pem
277+
- SSL_KEY=/etc/ssl/filebeat.key
278+
- API_USERNAME=wazuh-wui
279+
- API_PASSWORD=MyS3cr37P450r.*-
280+
281+
...
282+
wazuh.dashboard:
283+
...
284+
environment:
285+
- INDEXER_USERNAME=admin
286+
- INDEXER_PASSWORD=SecretPassword
287+
- WAZUH_API_URL=https://wazuh.manager
288+
- DASHBOARD_USERNAME=kibanaserver
289+
- DASHBOARD_PASSWORD=kibanaserver
290+
- API_USERNAME=wazuh-wui
291+
292+
- API_PASSWORD=MyS3cr37P450r.*-
293+
294+
...
295+
296+
#. Recreate the Wazuh containers:
297+
298+
.. code-block:: console
299+
300+
# docker compose down
301+
# docker compose up -d
302+
303+
Refer to :ref:`logging in to the Wazuh server API via the command line <api_log_in>` to learn more.

0 commit comments

Comments
 (0)