Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add custom Filebeat user information and delete obsolete information about ossec.conf file on Wazuh server. #7382

Merged
merged 3 commits into from
Jun 13, 2024
Merged

Add custom Filebeat user information and delete obsolete information about ossec.conf file on Wazuh server. #7382

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6181ecd
add custom user info and delete obsolete instructions
CarlosALgit Jun 11, 2024
af2b5b0
changed whole third step to a note
CarlosALgit Jun 13, 2024
e2be2dc
Add changes from review
javimed Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 5 additions & 8 deletions source/user-manual/user-administration/password-management.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,19 +213,16 @@ Follow the instructions below to change the passwords for all the Wazuh indexer
INFO: The password for Wazuh API user wazuh is ivLOfmj7.jL6*7Ev?UJoFjrkGy9t6Je.
INFO: The password for Wazuh API user wazuh-wui is fL+f?sFRPEv5pYRE559rqy9b6G4Z5pVi

#. On `all your Wazuh server nodes`, run the following command to update the `admin` password in the Filebeat keystore and in the ``ossec.conf`` file for the Wazuh server. Replace ``<ADMIN_PASSWORD>`` with the random password generated in the first step.
#. If you've set up a user other than ``admin`` for Filebeat, manually add the username and password using the following commands. Replace ``<CUSTOM_USERNAME>`` and ``<CUSTOM_PASSWORD>`` with your custom username and password.

.. code-block:: console

# echo <ADMIN_PASSWORD> | filebeat keystore add password --stdin --force
# sed -i 's/<password>.*<\/password>/<password><ADMIN_PASSWORD><\/password>/g' /var/ossec/etc/ossec.conf

#. Restart Filebeat and the Wazuh server to apply the change.
# echo <CUSTOM_USERNAME> | filebeat keystore add username --stdin --force
# echo <CUSTOM_PASSWORD> | filebeat keystore add password --stdin --force
Restart Filebeat to apply the changes.

.. include:: /_templates/common/restart_filebeat.rst
.. include:: /_templates/common/restart_manager.rst

.. note:: Repeat steps 3 and 4 on `every Wazuh server node`.

#. On your `Wazuh dashboard node`, run the following command to update the `kibanaserver` password in the Wazuh dashboard keystore. Replace ``<KIBANASERVER_PASSWORD>`` with the random password generated in the first step.

Expand Down
Loading