Password management

The Wazuh passwords tool changes the passwords for Wazuh indexer users, also known as internal users, and the Wazuh manager API users.

The following Wazuh indexer users are relevant to password management:

admin: The default administrator user of the Wazuh indexer. This user logs in to the Wazuh dashboard and handles communication between the Wazuh manager and the Wazuh indexer.
kibanaserver: Handles communications between the Wazuh dashboard and the Wazuh indexer.

The Wazuh manager API has two default users:

wazuh: The default administrator user for the Wazuh manager API.
wazuh-wui: Administrator user that handles communications between the Wazuh dashboard and the Wazuh manager API.

The Wazuh passwords tool is located at /usr/share/wazuh-indexer/plugins/opensearch-security/tools/wazuh-passwords-tool.sh. You can also download it by running the following command:

# curl -so wazuh-passwords-tool.sh https://packages-staging.xdrsiem.wazuh.info/pre-release/5.x/installation-assistant/wazuh-passwords-tool-5.0.0-beta3.sh

In an all-in-one deployment, the tool automatically updates the passwords in the required components. In a distributed deployment, you must update the password in other components depending on the user whose password you change. See Change the passwords in a distributed environment for more details.

The wazuh-passwords-tool.sh script provides the following options for managing Wazuh internal user passwords:

Option	Description
`-A`, `--api`	Changes the Wazuh manager API password for the specified user. Requires `-u\|--user <USER>`, `-p\|--password <PASSWORD>`, `-au\|--admin-user <API_ADMIN_USERNAME>`, and `-ap\|--admin-password <API_ADMIN_PASSWORD>`.
`-au`, `--admin-user <ADMIN_USER>`	Specifies the Wazuh manager API administrator user. Required when changing the Wazuh manager API passwords. Requires `-A`, `--api`.
`-ap`, `--admin-password <ADMIN_PASSWORD>`	Specifies the password for the Wazuh manager API administrator user. Required when changing the Wazuh manager API passwords. Requires `-A`, `--api`.
`-u`, `--user <user>`	Specifies the user whose password is changed. If you don't provide a password, the tool generates a random one.
`-p`, `--password <PASSWORD>`	Specifies the new password. Must be used with option `-u`, `--user <user>`.
`-v`, `--verbose`	Displays the full script execution output.
`-h`, `--help`	Displays the help message.

Change the password for a Wazuh indexer user

Wazuh indexer users are defined in /etc/wazuh-indexer/opensearch-security/internal_users.yml. To change the password for a Wazuh indexer user, run the script with the -u option and specify the new password with the -p option. The password must contain 8 to 64 characters, including at least one uppercase letter, one lowercase letter, one number, and one of the following special characters: .*+?-.

# bash wazuh-passwords-tool.sh -u <USER> [-p <PASSWORD>]

Where:

<USER> is the name of the user whose password you want to change.
<PASSWORD> is the new password. If <PASSWORD> is not specified, the tool generates a random password.

Note

Run this command on any Wazuh indexer node for distributed deployments.

For example, run the following command to change the password of the admin user to Secr3tP4ssw*rd:

# bash wazuh-passwords-tool.sh -u admin -p Secr3tP4ssw*rd

INFO: Updating the internal users.
INFO: A backup of the internal users has been saved in the /etc/wazuh-indexer/internalusers-backup folder.
INFO: Generating password hash
WARNING: Password changed. Remember to update the password in the Wazuh dashboard and the Wazuh manager nodes if necessary, and restart the services.

Change the password for a Wazuh manager API user

To change the password for a Wazuh manager API user, use the -A option and specify the Wazuh manager API administrator credentials:

# bash wazuh-passwords-tool.sh -A -au <API_ADMIN_USERNAME> -ap <API_ADMIN_PASSWORD> -u <USER> [-p <PASSWORD>]

Where:

<API_ADMIN_USERNAME> is the Wazuh manager API administrator user.
<API_ADMIN_PASSWORD> is the Wazuh manager API administrator password.
<USER> is the name of the API user whose password you want to change.
<PASSWORD> is the new password. If <PASSWORD> is not specified, the tool generates a random password.

Note

Run this command on the Wazuh manager master node for distributed deployments.

For example, run the following command to change the password of the wazuh user to Hello*123:

# bash wazuh-passwords-tool.sh -A -au wazuh -ap wazuh -u wazuh -p Hello*123

INFO: The password for Wazuh API user wazuh is Hello*123

Change the passwords in a distributed environment

Run the wazuh-passwords-tool.sh script on the node that corresponds to the user whose password you want to change in a distributed deployment:

To change the password of a Wazuh indexer user, run the tool on any Wazuh indexer node.
To change the password of a Wazuh manager API user, run the tool on the Wazuh manager master node.

Update the Wazuh dashboard configuration

Perform these steps on the Wazuh dashboard node after you change the kibanaserver or wazuh-wui password in a distributed deployment. This ensures the Wazuh dashboard can authenticate with the Wazuh indexer and Wazuh manager API using the updated credentials.

Update the kibanaserver password

When you change the kibanaserver password, update the opensearch.password value in the Wazuh dashboard keystore. Replace <KIBANASERVER_PASSWORD> with the new password:

# echo <KIBANASERVER_PASSWORD> | /usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore --allow-root add -f --stdin opensearch.password

Update the wazuh-wui password

When you change the wazuh-wui password, update the /etc/wazuh-dashboard/opensearch_dashboards.yml configuration file with the new password generated. Replace <WAZUH_WUI_PASSWORD> with the new password:

wazuh_core.hosts:
  default:
    url: https://127.0.0.1
    port: 55000
    username: wazuh-wui
    password: <WAZUH_WUI_PASSWORD>
    run_as: true

Restart the Wazuh dashboard to apply the changes.

# systemctl restart wazuh-dashboard

# service wazuh-dashboard restart