Changing the default password of Wazuh users

Logging out of your Wazuh dashboard

You must log out of your Wazuh dashboard before starting the password change process. If you don't, persistent session cookies will cause errors when accessing Wazuh after changing user passwords.

Setting the new password in the Docker Compose file

1. Open the docker-compose.yml file. Change all occurrences of the old password with the new one. For example, for a single-node stack:

   admin userkibanaserver user

   ...
   services:
       wazuh.manager:
       ...
       environment:
           - INDEXER_URL=https://wazuh.indexer:9200
           - INDEXER_USERNAME=admin
           - INDEXER_PASSWORD=SecretPassword
           - FILEBEAT_SSL_VERIFICATION_MODE=full
           - SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
           - SSL_CERTIFICATE=/etc/ssl/filebeat.pem
           - SSL_KEY=/etc/ssl/filebeat.key
           - API_USERNAME=wazuh-wui
           - API_PASSWORD=MyS3cr37P450r.*-
       ...
       wazuh.indexer:
       ...
       environment:
           - "OPENSEARCH_JAVA_OPTS=-Xms1024m -Xmx1024m"
       ...
       wazuh.dashboard:
       ...
       environment:
           - INDEXER_USERNAME=admin
           - INDEXER_PASSWORD=SecretPassword
           - WAZUH_API_URL=https://wazuh.manager
           - DASHBOARD_USERNAME=kibanaserver
           - DASHBOARD_PASSWORD=kibanaserver
           - API_USERNAME=wazuh-wui
           - API_PASSWORD=MyS3cr37P450r.*-
       ...
   

Setting a new hash

Follow the steps below to generate and set a new password hash for your Wazuh users.

1. Stop the stack if it's running:

   # docker compose down
   

2. Run this command to generate the hash for your new password:

   # docker run --rm -ti wazuh/wazuh-indexer:4.13.1 bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/hash.sh
   

   Once the container launches, input the new password and press Enter.

3. Copy the generated hash.

4. Open the config/wazuh_indexer/internal_users.yml file. Locate the block for the user whose password you want to change.

5. Replace <NEW_HASH> with your hash values.

   admin userkibanaserver user

   ...
   
   admin:
     hash: "<NEW_HASH>"
     reserved: true
     backend_roles:
     - "admin"
     description: "Demo admin user"
   
   ...
   

   Save the changes.

Applying the changes

After updating docker-compose.yml file, restart the Wazuh Docker stack and reapply settings using the securityadmin.sh tool.

1. Start the deployment stack.

   # docker compose up -d
   

2. Run docker ps and note the name of the first Wazuh indexer container. For example, single-node-wazuh.indexer-1, or multi-node-wazuh1.indexer-1.

3. Run docker exec -it <WAZUH_INDEXER_CONTAINER_NAME> bash to access the container. Replace <WAZUH_INDEXER_CONTAINER_NAME> with the Wazuh indexer container name. For example, use single-node-wazuh.indexer-1 for the single-node stack and multi-node-wazuh1.indexer-1 for the multi-node stack:

   # docker exec -it single-node-wazuh.indexer-1 bash
   

4. Set the following variables:

   export INSTALLATION_DIR=/usr/share/wazuh-indexer
   CACERT=$INSTALLATION_DIR/certs/root-ca.pem
   KEY=$INSTALLATION_DIR/certs/admin-key.pem
   CERT=$INSTALLATION_DIR/certs/admin.pem
   export JAVA_HOME=/usr/share/wazuh-indexer/jdk
   

5. Wait for the Wazuh indexer to initialize properly. The waiting time can vary from one to five minutes. It depends on the size of the cluster, the assigned resources, and the network speed. Then, run the securityadmin.sh script to apply all changes.

   Single-node stackMulti-node stack

   $ bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/wazuh-indexer/opensearch-security/ -nhnv -cacert  $CACERT -cert $CERT -key $KEY -p 9200 -icl
   

6. Exit the Wazuh indexer container. Refresh the Wazuh dashboard and log in with the new credentials.