You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description: Deploying Wazuh using the self-hosted Docker Compose setup with default credentials is so easy but with custom credentials (for Indexer, Kibana, OpenSearch, API, etc.) is notably challenging. Changing default passwords and credentials often leads to errors, making it difficult to secure the deployment against open ports and links.
Issues Encountered:
Difficulty Changing Credentials: Attempting to customize passwords (specifically Kibana and API) results in errors, potentially due to hard-coded dependencies on the default values in multiple components.
Security Risks: Because changing passwords is so complex, default credentials might be left in place, increasing security risks.
Undocumented Dependencies: Changing credentials seems to break dependencies between containers. Detailed information about how each component (Indexer, OpenSearch, Logstash, Kibana, etc.) interacts would be very helpful.
Suggested Improvements:
if you add all username and password dependencies schema to docs i can rewrite compose with parameter expansion dependencies and also with bcrypt command to get hashed credentials and write that to other files, or if it possible write better compose with passwords as a parameter expansion of environment variables like that, there is absolutely 0 reasons to running commands outside of docker-compose if you can do all with only docker-compose like that:
environment:
- INDEXER_PASSWORD=${INDEXER_PASSWORD:-indexerpasswordhere}
- KIBANA_PASSWORD=${KIBANA_PASSWORD:-kibanapasswordhere}
- API_PASSWORD=${API_PASSWORD:-Apipasswordhere-1}
Opensearch password?
Logstack password?
Other services which also have hardcoded bcrypt passwords?
command: Making bcrypt passwords, change on files and run cert creation
Documentation of Dependencies Between Components: Provide a dependency schema for authentication between services (e.g., which services rely on the API_PASSWORD or KIBANA_PASSWORD). This would enable us to update credentials with minimal disruption.
Automated Hashing for Passwords: Include optional commands (e.g., using openssl) to hash passwords, with clear instructions on how and where to apply these hashed values in the configuration. There is ton of complications about passwords on Issues page and majority of that uses with default credentials what makes extremely unsecure of usage.
Impact of Changes:
Improving these areas would make the remote deployment process of the self-hosted Wazuh much more user-friendly, secure, and adaptable to custom setups.
The text was updated successfully, but these errors were encountered:
che0one
changed the title
Improvement Request: Password customization makes error, Simplify Password Customization over Wazuh Docker Compose
Improvement Request: Simplify Password Customization over Wazuh Docker Compose
Nov 6, 2024
Description: Deploying Wazuh using the self-hosted Docker Compose setup with default credentials is so easy but with custom credentials (for Indexer, Kibana, OpenSearch, API, etc.) is notably challenging. Changing default passwords and credentials often leads to errors, making it difficult to secure the deployment against open ports and links.
Issues Encountered:
Difficulty Changing Credentials: Attempting to customize passwords (specifically Kibana and API) results in errors, potentially due to hard-coded dependencies on the default values in multiple components.
Security Risks: Because changing passwords is so complex, default credentials might be left in place, increasing security risks.
Undocumented Dependencies: Changing credentials seems to break dependencies between containers. Detailed information about how each component (Indexer, OpenSearch, Logstash, Kibana, etc.) interacts would be very helpful.
Suggested Improvements:
if you add all username and password dependencies schema to docs i can rewrite compose with parameter expansion dependencies and also with bcrypt command to get hashed credentials and write that to other files, or if it possible write better compose with passwords as a parameter expansion of environment variables like that, there is absolutely 0 reasons to running commands outside of docker-compose if you can do all with only docker-compose like that:
Documentation of Dependencies Between Components: Provide a dependency schema for authentication between services (e.g., which services rely on the API_PASSWORD or KIBANA_PASSWORD). This would enable us to update credentials with minimal disruption.
Automated Hashing for Passwords: Include optional commands (e.g., using openssl) to hash passwords, with clear instructions on how and where to apply these hashed values in the configuration. There is ton of complications about passwords on Issues page and majority of that uses with default credentials what makes extremely unsecure of usage.
Impact of Changes:
Improving these areas would make the remote deployment process of the self-hosted Wazuh much more user-friendly, secure, and adaptable to custom setups.
The text was updated successfully, but these errors were encountered: