diff --git a/CHANGELOG.md b/CHANGELOG.md index e64cd534..20be0027 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,6 +27,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Remove custom user configuration and related scripts ([#1967](https://github.com/wazuh/wazuh-ansible/pull/1967)) - Fix mismatched tags in .j2 template files ([#1930](https://github.com/wazuh/wazuh-ansible/pull/1930)) - Address Misconfiguration of indexer_cluster_nodes Parameter ([#1929](https://github.com/wazuh/wazuh-ansible/pull/1929)) - Remove meta yamls that prevent indexer and agent role installation from PR #1806 ([#1921](https://github.com/wazuh/wazuh-ansible/pull/1921)) diff --git a/README.md b/README.md index 27fcfb42..b2c58168 100644 --- a/README.md +++ b/README.md @@ -186,9 +186,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -236,8 +233,8 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod - id: default url: https://{{ hostvars.manager.private_ip }} port: 55000 - username: custom-user - password: SecretPassword1! + username: "wazuh-wui" + password: "wazuh-wui" ansible_shell_allow_world_readable_temp: true ``` @@ -375,9 +372,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a Wazu nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-manager-oss-cluster.yml b/playbooks/wazuh-manager-oss-cluster.yml index 57109581..93fffa3d 100644 --- a/playbooks/wazuh-manager-oss-cluster.yml +++ b/playbooks/wazuh-manager-oss-cluster.yml @@ -22,9 +22,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-production-ready.yml b/playbooks/wazuh-production-ready.yml index da866cfa..5f1e979a 100644 --- a/playbooks/wazuh-production-ready.yml +++ b/playbooks/wazuh-production-ready.yml @@ -117,9 +117,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -171,6 +168,6 @@ - id: default url: https://{{ hostvars.manager.private_ip }} port: 55000 - username: custom-user - password: SecretPassword1! + username: "wazuh-wui" + password: "wazuh-wui" ansible_shell_allow_world_readable_temp: true diff --git a/roles/elastic-stack/ansible-kibana/defaults/main.yml b/roles/elastic-stack/ansible-kibana/defaults/main.yml deleted file mode 100644 index a2b2a66e..00000000 --- a/roles/elastic-stack/ansible-kibana/defaults/main.yml +++ /dev/null @@ -1,49 +0,0 @@ ---- -kibana_node_name: node-1 - -elasticsearch_http_port: "9200" -elasticsearch_network_host: "127.0.0.1" -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_conf_path: /etc/kibana -elastic_stack_version: 7.10.2 -wazuh_version: 4.14.5 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -elasticrepo: - apt: 'https://artifacts.elastic.co/packages/7.x/apt' - yum: 'https://artifacts.elastic.co/packages/7.x/yum' - gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' - key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# Xpack Security -kibana_xpack_security: false -kibana_ssl_verification_mode: "full" - -elasticsearch_xpack_security_user: elastic -elasticsearch_xpack_security_password: elastic_pass - -node_certs_destination: /etc/kibana/certs - -# CA Generation -master_certs_path: "{{ playbook_dir }}/es_certs" -generate_CA: true -ca_cert_name: "" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 diff --git a/roles/opendistro/opendistro-kibana/defaults/main.yml b/roles/opendistro/opendistro-kibana/defaults/main.yml deleted file mode 100644 index 1099b158..00000000 --- a/roles/opendistro/opendistro-kibana/defaults/main.yml +++ /dev/null @@ -1,57 +0,0 @@ ---- - -# Kibana configuration -elasticsearch_http_port: 9200 -elastic_api_protocol: https -kibana_conf_path: /etc/kibana -kibana_node_name: node-1 -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_server_name: "kibana" -kibana_max_payload_bytes: 1048576 -elastic_stack_version: 7.10.2 -wazuh_version: 4.4.1 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -# The OpenDistro package repository -kibana_opendistro_version: 1.13.2-1 # Version includes the - for RedHat family compatibility, replace with = for Debian hosts - -package_repos: - yum: - opendistro: - baseurl: 'https://packages.wazuh.com/4.x/yum/' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - apt: - opendistro: - baseurl: 'deb https://packages.wazuh.com/4.x/apt/ stable main' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# opendistro Security -kibana_opendistro_security: true -kibana_newsfeed_enabled: "false" -kibana_telemetry_optin: "false" -kibana_telemetry_enabled: "false" - -opendistro_admin_password: changeme -opendistro_kibana_user: kibanaserver -opendistro_kibana_password: changeme -local_certs_path: "{{ playbook_dir }}/opendistro/certificates" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index c6b1c45b..c37dd041 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -363,9 +363,6 @@ wazuh_manager_api: remote_commands_localfile_exceptions: [] remote_commands_wodle: yes remote_commands_wodle_exceptions: [] -# wazuh_api_users: -# - username: custom-user -# password: .S3cur3Pa55w0rd*- # Must comply with requirements (8+ length, uppercase, lowercase, specials chars) # NOTE: As wazuh_manager_config is built dynamically per playbooks and ansible.cfg provided in the repo, # we should also cover the case for partial settings in inventory variables overlayed on top of role's diff --git a/roles/wazuh/ansible-wazuh-manager/files/create_user.py b/roles/wazuh/ansible-wazuh-manager/files/create_user.py deleted file mode 100644 index 0216d58d..00000000 --- a/roles/wazuh/ansible-wazuh-manager/files/create_user.py +++ /dev/null @@ -1,102 +0,0 @@ -import logging -import sys -import json -import random -import string -import os - -# Set framework path -sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") - -USER_FILE_PATH = "/var/ossec/api/configuration/admin.json" -SPECIAL_CHARS = "@$!%*?&-_" - - -try: - from wazuh.rbac.orm import check_database_integrity - from wazuh.security import ( - create_user, - get_users, - get_roles, - set_user_role, - update_user, - ) -except Exception as e: - logging.error("No module 'wazuh' found.") - sys.exit(1) - - -def read_user_file(path=USER_FILE_PATH): - with open(path) as user_file: - data = json.load(user_file) - return data["username"], data["password"] - - -def db_users(): - users_result = get_users() - return {user["username"]: user["id"] for user in users_result.affected_items} - - -def db_roles(): - roles_result = get_roles() - return {role["name"]: role["id"] for role in roles_result.affected_items} - -def disable_user(uid): - random_pass = "".join( - random.choices( - string.ascii_uppercase - + string.ascii_lowercase - + string.digits - + SPECIAL_CHARS, - k=8, - ) - ) - # assure there must be at least one character from each group - random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]]) - random_pass = ''.join(random.sample(random_pass,len(random_pass))) - update_user( - user_id=[ - str(uid), - ], - password=random_pass, - ) - - -if __name__ == "__main__": - if not os.path.exists(USER_FILE_PATH): - # abort if no user file detected - sys.exit(0) - username, password = read_user_file() - - # create RBAC database - check_database_integrity() - - initial_users = db_users() - if username not in initial_users: - # create a new user - create_user(username=username, password=password) - users = db_users() - uid = users[username] - roles = db_roles() - rid = roles["administrator"] - set_user_role( - user_id=[ - str(uid), - ], - role_ids=[ - str(rid), - ], - ) - else: - # modify an existing user ("wazuh" or "wazuh-wui") - uid = initial_users[username] - update_user( - user_id=[ - str(uid), - ], - password=password, - ) - # disable unused default users - #for def_user in ['wazuh', 'wazuh-wui']: - # if def_user != username: - # disable_user(initial_users[def_user]) \ No newline at end of file diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml index cab4a7c2..add28a6b 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml @@ -313,44 +313,6 @@ tags: - config -- name: Create custom API user - block: - - name: Copy create_user script - copy: - src: create_user.py - dest: "{{ wazuh_dir }}/framework/scripts/create_user.py" - owner: root - group: wazuh - mode: 0644 - - - name: Create admin.json - template: - src: templates/admin.json.j2 - dest: "{{ wazuh_dir }}/api/configuration/admin.json" - owner: wazuh - group: wazuh - mode: 0644 - no_log: true - - - name: Execute create_user script - script: - chdir: "{{ wazuh_dir }}/framework/scripts/" - cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}" - executable: "{{ wazuh_dir }}/framework/python/bin/python3" - with_items: - - "{{ wazuh_api_users }}" - - - name: Delete create_user script - file: - path: "{{ wazuh_dir }}/framework/scripts/create_user.py" - state: absent - - tags: - - config_api_users - when: - - wazuh_api_users is defined - - wazuh_manager_config.cluster.node_type == "master" - - name: Agentless Hosts & Passwd template: src: agentless.j2 diff --git a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 b/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 deleted file mode 100644 index 6522f530..00000000 --- a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 +++ /dev/null @@ -1,4 +0,0 @@ - -{% for api in wazuh_api_users %} -{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"} -{% endfor %} \ No newline at end of file