From 94b84a72091449603083a8be34a54ae49a6b30c3 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Thu, 12 Mar 2026 10:07:47 -0500 Subject: [PATCH 1/5] Remove custom user configuration and related scripts --- README.md | 12 --- playbooks/wazuh-manager-oss-cluster.yml | 3 - playbooks/wazuh-production-ready.yml | 9 -- .../ansible-wazuh-manager/defaults/main.yml | 3 - .../files/create_user.py | 102 ------------------ .../ansible-wazuh-manager/tasks/main.yml | 38 ------- .../templates/admin.json.j2 | 4 - 7 files changed, 171 deletions(-) delete mode 100644 roles/wazuh/ansible-wazuh-manager/files/create_user.py delete mode 100644 roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 diff --git a/README.md b/README.md index 27fcfb42..27c7e751 100644 --- a/README.md +++ b/README.md @@ -186,9 +186,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -232,12 +229,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod vars: indexer_network_host: "{{ hostvars.wi1.private_ip }}" dashboard_node_name: node-6 - wazuh_api_credentials: - - id: default - url: https://{{ hostvars.manager.private_ip }} - port: 55000 - username: custom-user - password: SecretPassword1! ansible_shell_allow_world_readable_temp: true ``` @@ -375,9 +366,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a Wazu nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-manager-oss-cluster.yml b/playbooks/wazuh-manager-oss-cluster.yml index 57109581..93fffa3d 100644 --- a/playbooks/wazuh-manager-oss-cluster.yml +++ b/playbooks/wazuh-manager-oss-cluster.yml @@ -22,9 +22,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! - hosts: worker01 roles: diff --git a/playbooks/wazuh-production-ready.yml b/playbooks/wazuh-production-ready.yml index da866cfa..5d939c29 100644 --- a/playbooks/wazuh-production-ready.yml +++ b/playbooks/wazuh-production-ready.yml @@ -117,9 +117,6 @@ nodes: - "{{ hostvars.manager.private_ip }}" hidden: 'no' - wazuh_api_users: - - username: custom-user - password: SecretPassword1! filebeat_output_indexer_hosts: - "{{ hostvars.wi1.private_ip }}" - "{{ hostvars.wi2.private_ip }}" @@ -167,10 +164,4 @@ - "{{ hostvars.wi2.private_ip }}" - "{{ hostvars.wi3.private_ip }}" dashboard_node_name: node-6 - wazuh_api_credentials: - - id: default - url: https://{{ hostvars.manager.private_ip }} - port: 55000 - username: custom-user - password: SecretPassword1! ansible_shell_allow_world_readable_temp: true diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 06d1a67b..c66a3894 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -363,9 +363,6 @@ wazuh_manager_api: remote_commands_localfile_exceptions: [] remote_commands_wodle: yes remote_commands_wodle_exceptions: [] -# wazuh_api_users: -# - username: custom-user -# password: .S3cur3Pa55w0rd*- # Must comply with requirements (8+ length, uppercase, lowercase, specials chars) # NOTE: As wazuh_manager_config is built dynamically per playbooks and ansible.cfg provided in the repo, # we should also cover the case for partial settings in inventory variables overlayed on top of role's diff --git a/roles/wazuh/ansible-wazuh-manager/files/create_user.py b/roles/wazuh/ansible-wazuh-manager/files/create_user.py deleted file mode 100644 index 0216d58d..00000000 --- a/roles/wazuh/ansible-wazuh-manager/files/create_user.py +++ /dev/null @@ -1,102 +0,0 @@ -import logging -import sys -import json -import random -import string -import os - -# Set framework path -sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework") - -USER_FILE_PATH = "/var/ossec/api/configuration/admin.json" -SPECIAL_CHARS = "@$!%*?&-_" - - -try: - from wazuh.rbac.orm import check_database_integrity - from wazuh.security import ( - create_user, - get_users, - get_roles, - set_user_role, - update_user, - ) -except Exception as e: - logging.error("No module 'wazuh' found.") - sys.exit(1) - - -def read_user_file(path=USER_FILE_PATH): - with open(path) as user_file: - data = json.load(user_file) - return data["username"], data["password"] - - -def db_users(): - users_result = get_users() - return {user["username"]: user["id"] for user in users_result.affected_items} - - -def db_roles(): - roles_result = get_roles() - return {role["name"]: role["id"] for role in roles_result.affected_items} - -def disable_user(uid): - random_pass = "".join( - random.choices( - string.ascii_uppercase - + string.ascii_lowercase - + string.digits - + SPECIAL_CHARS, - k=8, - ) - ) - # assure there must be at least one character from each group - random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]]) - random_pass = ''.join(random.sample(random_pass,len(random_pass))) - update_user( - user_id=[ - str(uid), - ], - password=random_pass, - ) - - -if __name__ == "__main__": - if not os.path.exists(USER_FILE_PATH): - # abort if no user file detected - sys.exit(0) - username, password = read_user_file() - - # create RBAC database - check_database_integrity() - - initial_users = db_users() - if username not in initial_users: - # create a new user - create_user(username=username, password=password) - users = db_users() - uid = users[username] - roles = db_roles() - rid = roles["administrator"] - set_user_role( - user_id=[ - str(uid), - ], - role_ids=[ - str(rid), - ], - ) - else: - # modify an existing user ("wazuh" or "wazuh-wui") - uid = initial_users[username] - update_user( - user_id=[ - str(uid), - ], - password=password, - ) - # disable unused default users - #for def_user in ['wazuh', 'wazuh-wui']: - # if def_user != username: - # disable_user(initial_users[def_user]) \ No newline at end of file diff --git a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml index 6bbd5b33..4a533e13 100644 --- a/roles/wazuh/ansible-wazuh-manager/tasks/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/tasks/main.yml @@ -304,44 +304,6 @@ tags: - config -- name: Create custom API user - block: - - name: Copy create_user script - copy: - src: create_user.py - dest: "{{ wazuh_dir }}/framework/scripts/create_user.py" - owner: root - group: wazuh - mode: 0644 - - - name: Create admin.json - template: - src: templates/admin.json.j2 - dest: "{{ wazuh_dir }}/api/configuration/admin.json" - owner: wazuh - group: wazuh - mode: 0644 - no_log: true - - - name: Execute create_user script - script: - chdir: "{{ wazuh_dir }}/framework/scripts/" - cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}" - executable: "{{ wazuh_dir }}/framework/python/bin/python3" - with_items: - - "{{ wazuh_api_users }}" - - - name: Delete create_user script - file: - path: "{{ wazuh_dir }}/framework/scripts/create_user.py" - state: absent - - tags: - - config_api_users - when: - - wazuh_api_users is defined - - wazuh_manager_config.cluster.node_type == "master" - - name: Agentless Hosts & Passwd template: src: agentless.j2 diff --git a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 b/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 deleted file mode 100644 index 6522f530..00000000 --- a/roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2 +++ /dev/null @@ -1,4 +0,0 @@ - -{% for api in wazuh_api_users %} -{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"} -{% endfor %} \ No newline at end of file From a70d072578041ad9ac4ff31ff9567cfc47dadf17 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Thu, 12 Mar 2026 11:45:32 -0500 Subject: [PATCH 2/5] Update changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 412a513b..c2c6ed4b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Remove custom user configuration and related scripts ([#1967](https://github.com/wazuh/wazuh-ansible/pull/1967)) - Fix mismatched tags in .j2 template files ([#1930](https://github.com/wazuh/wazuh-ansible/pull/1930)) - Address Misconfiguration of indexer_cluster_nodes Parameter ([#1929](https://github.com/wazuh/wazuh-ansible/pull/1929)) - Remove meta yamls that prevent indexer and agent role installation from PR #1806 ([#1921](https://github.com/wazuh/wazuh-ansible/pull/1921)) From 82b5771ff6439956ae8e7b1be38161c5904d96e4 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Thu, 12 Mar 2026 11:57:00 -0500 Subject: [PATCH 3/5] Override default Wazuh API credentials in the production-ready playbook to target manager ip --- README.md | 6 ++++++ playbooks/wazuh-production-ready.yml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/README.md b/README.md index 27c7e751..b2c58168 100644 --- a/README.md +++ b/README.md @@ -229,6 +229,12 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod vars: indexer_network_host: "{{ hostvars.wi1.private_ip }}" dashboard_node_name: node-6 + wazuh_api_credentials: + - id: default + url: https://{{ hostvars.manager.private_ip }} + port: 55000 + username: "wazuh-wui" + password: "wazuh-wui" ansible_shell_allow_world_readable_temp: true ``` diff --git a/playbooks/wazuh-production-ready.yml b/playbooks/wazuh-production-ready.yml index 5d939c29..5f1e979a 100644 --- a/playbooks/wazuh-production-ready.yml +++ b/playbooks/wazuh-production-ready.yml @@ -164,4 +164,10 @@ - "{{ hostvars.wi2.private_ip }}" - "{{ hostvars.wi3.private_ip }}" dashboard_node_name: node-6 + wazuh_api_credentials: + - id: default + url: https://{{ hostvars.manager.private_ip }} + port: 55000 + username: "wazuh-wui" + password: "wazuh-wui" ansible_shell_allow_world_readable_temp: true From 4b38bfe3e25672268ec0fd01915808e447a97354 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gonzalo=20Acu=C3=B1a?= Date: Thu, 12 Mar 2026 14:47:52 -0300 Subject: [PATCH 4/5] Deprecated role files removed --- .../ansible-kibana/defaults/main.yml | 49 ---------------- .../opendistro-kibana/defaults/main.yml | 57 ------------------- 2 files changed, 106 deletions(-) delete mode 100644 roles/elastic-stack/ansible-kibana/defaults/main.yml delete mode 100644 roles/opendistro/opendistro-kibana/defaults/main.yml diff --git a/roles/elastic-stack/ansible-kibana/defaults/main.yml b/roles/elastic-stack/ansible-kibana/defaults/main.yml deleted file mode 100644 index ead0f6ba..00000000 --- a/roles/elastic-stack/ansible-kibana/defaults/main.yml +++ /dev/null @@ -1,49 +0,0 @@ ---- -kibana_node_name: node-1 - -elasticsearch_http_port: "9200" -elasticsearch_network_host: "127.0.0.1" -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_conf_path: /etc/kibana -elastic_stack_version: 7.10.2 -wazuh_version: 4.14.4 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -elasticrepo: - apt: 'https://artifacts.elastic.co/packages/7.x/apt' - yum: 'https://artifacts.elastic.co/packages/7.x/yum' - gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' - key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# Xpack Security -kibana_xpack_security: false -kibana_ssl_verification_mode: "full" - -elasticsearch_xpack_security_user: elastic -elasticsearch_xpack_security_password: elastic_pass - -node_certs_destination: /etc/kibana/certs - -# CA Generation -master_certs_path: "{{ playbook_dir }}/es_certs" -generate_CA: true -ca_cert_name: "" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 diff --git a/roles/opendistro/opendistro-kibana/defaults/main.yml b/roles/opendistro/opendistro-kibana/defaults/main.yml deleted file mode 100644 index 1099b158..00000000 --- a/roles/opendistro/opendistro-kibana/defaults/main.yml +++ /dev/null @@ -1,57 +0,0 @@ ---- - -# Kibana configuration -elasticsearch_http_port: 9200 -elastic_api_protocol: https -kibana_conf_path: /etc/kibana -kibana_node_name: node-1 -kibana_server_host: "0.0.0.0" -kibana_server_port: "5601" -kibana_server_name: "kibana" -kibana_max_payload_bytes: 1048576 -elastic_stack_version: 7.10.2 -wazuh_version: 4.4.1 -wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana - -# The OpenDistro package repository -kibana_opendistro_version: 1.13.2-1 # Version includes the - for RedHat family compatibility, replace with = for Debian hosts - -package_repos: - yum: - opendistro: - baseurl: 'https://packages.wazuh.com/4.x/yum/' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - apt: - opendistro: - baseurl: 'deb https://packages.wazuh.com/4.x/apt/ stable main' - gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH' - -# API credentials -wazuh_api_credentials: - - id: "default" - url: "https://localhost" - port: 55000 - username: "wazuh" - password: "wazuh" - -# opendistro Security -kibana_opendistro_security: true -kibana_newsfeed_enabled: "false" -kibana_telemetry_optin: "false" -kibana_telemetry_enabled: "false" - -opendistro_admin_password: changeme -opendistro_kibana_user: kibanaserver -opendistro_kibana_password: changeme -local_certs_path: "{{ playbook_dir }}/opendistro/certificates" - -# Nodejs -nodejs: - repo_dict: - debian: "deb" - redhat: "rpm" - repo_url_ext: "nodesource.com/setup_10.x" - - -#Nodejs NODE_OPTIONS -node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536 From 4262fe8be7cd9f04de4e19a1482f82604eee2628 Mon Sep 17 00:00:00 2001 From: wazuhci <22834044+wazuhci@users.noreply.github.com> Date: Fri, 13 Mar 2026 08:32:11 +0000 Subject: [PATCH 5/5] feat: bump 4.14.4 --- VERSION.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION.json b/VERSION.json index 04478604..31c92e74 100644 --- a/VERSION.json +++ b/VERSION.json @@ -1,4 +1,4 @@ { "version": "4.14.4", - "stage": "rc1" + "stage": "rc2" }