Configuration

Wazuh server API configuration file

The Wazuh server API configuration is located in the /var/ossec/api/configuration/api.yaml file on the Wazuh server. By default, all settings are commented out. To apply a different configuration, uncomment and edit the desired line.

Here are all the available settings for the /var/ossec/api/configuration/api.yaml configuration file. For more information on each of the settings, check the configuration options:

host: 0.0.0.0
port: 55000

drop_privileges: yes
experimental_features: no
max_upload_size: 10485760

intervals:
   request_timeout: 10

https:
   enabled: yes
   key: "server.key"
   cert: "server.crt"
   use_ca: False
   ca: "ca.crt"
   ssl_protocol: "auto"
   ssl_ciphers: ""

logs:
   level: "info"
   format: "plain"
   max_size:
    enabled: false

cors:
   enabled: no
   source_route: "*"
   expose_headers: "*"
   allow_headers: "*"
   allow_credentials: no

access:
   max_login_attempts: 50
   block_time: 300
   max_request_per_minute: 300

upload_configuration:
   remote_commands:
      localfile:
         allow: yes
         exceptions: []
      wodle_command:
         allow: yes
         exceptions: []
   limits:
      eps:
         allow: yes
    agents:
      allow_higher_versions:
         allow: yes
    indexer:
      allow: yes
    integrations:
      virustotal:
         public_key:
            allow: yes
            minimum_quota: 240

Make sure to restart the Wazuh server API using the Wazuh manager service after editing the configuration file:

SystemdSysV init

# systemctl restart wazuh-manager

API configuration options

Wazuh server API security configuration

You can query and modify the security configuration, including auth_token_exp_timeout and rbac_mode settings, exclusively through the Wazuh server API endpoints: GET /security/config, PUT /security/config, and DELETE /security/config. The auth_token_exp_timeout defines the duration in seconds before an authentication token expires and requires renewal. The rbac_mode determines the overall behavior of the Role-Based Access Control system, which can be configured to either broadly permit or restrict access to resources and endpoints based on user roles and permissions. Refer to the Role-Based Access Control documentation for more details. The configuration is applied to every Wazuh server API in a cluster if applicable.

For more information on each of the settings, please check the security configuration options.

auth_token_exp_timeout: 900
rbac_mode: white

Configuration endpoints

The Wazuh server API has several endpoints that allow querying its current configuration. To modify the general API configuration, edit the /var/ossec/api/configuration/api.yaml file as detailed in the Wazuh server API configuration file section.

SSL certificate

The SSL certificate ensures secure communication between the Wazuh server API and its clients. The certificate files are stored within the /var/ossec/api/configuration/ssl/ directory.

Take the following steps to generate new certificates for the Wazuh server API:

1. Generate the key and certificate request (the openssl package is required):

   # cd /var/ossec/api/configuration/ssl
   # openssl req -newkey rsa:2048 -new -nodes -x509 -days 365 -keyout server.key -out server.crt
   

   By default, the key's password must be entered every time the server is run. If the key was generated by the Wazuh server API or the command above, it would not have a password.

2. (Optional) Secure the key with a password:

   # ssh-keygen -p -f server.key
   

   You will be prompted to enter and confirm the new password.