Wazuh Docker deployment

Logging out of your Wazuh dashboard

You need to log out of your Wazuh dashboard before starting the password change process. If you don't log out, persistent session cookies will cause errors when accessing Wazuh after changing user passwords.

Setting a new hash

1. Stop the stack if it’s running:

   # docker-compose down
   

2. Run this command to generate the hash of your new password:

   # docker run --rm -ti wazuh/wazuh-indexer:4.12.0 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh
   

   Once the container launches, input the new password and press Enter.

3. Copy the generated hash.

4. Open the config/wazuh_indexer/internal_users.yml file. Locate the block for the user whose password you want to change.

5. Replace <NEW_HASH> with your hash values.

   • admin user

     ...
     
     admin:
       hash: "<NEW_HASH>"
       reserved: true
       backend_roles:
       - "admin"
       description: "Demo admin user"
     
     ...
     

   • kibanaserver user

     ...
     
     kibanaserver:
       hash: "<NEW_HASH>"
       reserved: true
       description: "Demo kibanaserver user"
     
     ...
     

Setting the new password

1. Open the docker-compose.yml file. Change all occurrences of the old password with the new one. For example, for a single-node stack:

   • admin user

     ...
     services:
       wazuh.manager:
         ...
         environment:
           - INDEXER_URL=https://wazuh.indexer:9200
           - INDEXER_USERNAME=admin
          - INDEXER_PASSWORD=SecretPassword
          - FILEBEAT_SSL_VERIFICATION_MODE=full
           - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
           - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
           - SSL_KEY=/etc/ssl/filebeat.key
           - API_USERNAME=wazuh-wui
           - API_PASSWORD=MyS3cr37P450r.*-
       ...
       wazuh.indexer:
         ...
         environment:
           - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m"
       ...
       wazuh.dashboard:
         ...
         environment:
           - INDEXER_USERNAME=admin
          - INDEXER_PASSWORD=SecretPassword
          - WAZUH_API_URL=https://wazuh.manager
           - DASHBOARD_USERNAME=kibanaserver
           - DASHBOARD_PASSWORD=kibanaserver
           - API_USERNAME=wazuh-wui
           - API_PASSWORD=MyS3cr37P450r.*-
       ...
     

   • kibanaserver user

     ...
     
     services:
       wazuh.dashboard:
         ...
         environment:
           - INDEXER_USERNAME=admin
           - INDEXER_PASSWORD=SecretPassword
           - WAZUH_API_URL=https://wazuh.manager
           - DASHBOARD_USERNAME=kibanaserver
     
          - DASHBOARD_PASSWORD=kibanaserver
     
          - API_USERNAME=wazuh-wui
           - API_PASSWORD=MyS3cr37P450r.*-
     
     ...
     

Applying the changes

After updating docker-compose.yml file, restart the Wazuh Docker stack and reapply settings using the securityadmin.sh tool.

1. Start the deployment stack.

   # docker-compose up -d
   

2. Run docker ps and note the name of the first Wazuh indexer container. For example, single-node-wazuh.indexer-1, or multi-node-wazuh1.indexer-1.

3. Run docker exec -it <WAZUH_INDEXER_CONTAINER_NAME> bash to enter the container, where <WAZUH_INDEXER_CONTAINER_NAME> is the name of the Wazuh indexer container. Use single-node-wazuh.indexer-1 for the single-node stack and multi-node-wazuh1.indexer-1 for the multi-node stack:

   # docker exec -it single-node-wazuh.indexer-1 bash
   

4. Set the following variables:

   export INSTALLATION_DIR=/usr/share/wazuh-indexer
   CACERT=$INSTALLATION_DIR/certs/root-ca.pem
   KEY=$INSTALLATION_DIR/certs/admin-key.pem
   CERT=$INSTALLATION_DIR/certs/admin.pem
   export JAVA_HOME=/usr/share/wazuh-indexer/jdk
   

5. Wait for the Wazuh indexer to initialize properly. The waiting time can vary from one to five minutes. It depends on the size of the cluster, the assigned resources, and the network speed. Then, run the securityadmin.sh script to apply all changes.

   • Single-node stack

     $ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9200 -icl
     

   • Multi-node stack

     $ HOST=$(grep node.name $INSTALLATION_DIR/opensearch.yml | awk '{printf $2}')
     $ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9200 -icl -h $HOST
     

     Note

     When working on Docker Desktop with a multi-node stack, use the multi-node-wazuh1.indexer-1 IP address instead of the $HOST variable.

6. Exit the Wazuh indexer container. Refresh the Wazuh dashboard and log in with the new credentials.