Merge branch '4.14.4' into 4.14.5

CHANGELOG.md

@@ -27,6 +27,7 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- Remove custom user configuration and related scripts ([#1967](https://github.com/wazuh/wazuh-ansible/pull/1967))
 - Fix mismatched tags in .j2 template files ([#1930](https://github.com/wazuh/wazuh-ansible/pull/1930))
 - Address Misconfiguration of indexer_cluster_nodes Parameter ([#1929](https://github.com/wazuh/wazuh-ansible/pull/1929))
 - Remove meta yamls that prevent indexer and agent role installation from PR #1806 ([#1921](https://github.com/wazuh/wazuh-ansible/pull/1921))

README.md

@@ -186,9 +186,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod
               nodes:
                   - "{{ hostvars.manager.private_ip }}"
               hidden: 'no'
-        wazuh_api_users:
-          - username: custom-user
-            password: SecretPassword1!
         filebeat_output_indexer_hosts:
                 - "{{ hostvars.wi1.private_ip }}"
                 - "{{ hostvars.wi2.private_ip }}"
@@ -236,8 +233,8 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a prod
           - id: default
             url: https://{{ hostvars.manager.private_ip }}
             port: 55000
-            username: custom-user
+            username: "wazuh-wui"
-            password: SecretPassword1!
+            password: "wazuh-wui"
         ansible_shell_allow_world_readable_temp: true
 ```
 
@@ -375,9 +372,6 @@ The hereunder example playbook uses the `wazuh-ansible` role to provision a Wazu
               nodes:
                   - "{{ hostvars.manager.private_ip }}"
               hidden: 'no'
-        wazuh_api_users:
-          - username: custom-user
-            password: SecretPassword1!
 
     - hosts: worker01
       roles:

playbooks/wazuh-manager-oss-cluster.yml

@@ -22,9 +22,6 @@
               nodes:
                   - "{{ hostvars.manager.private_ip }}"
               hidden: 'no'
-        wazuh_api_users:
-          - username: custom-user
-            password: SecretPassword1!
 
     - hosts: worker01
       roles:

playbooks/wazuh-production-ready.yml

@@ -117,9 +117,6 @@
               nodes:
                   - "{{ hostvars.manager.private_ip }}"
               hidden: 'no'
-        wazuh_api_users:
-          - username: custom-user
-            password: SecretPassword1!
         filebeat_output_indexer_hosts:
                 - "{{ hostvars.wi1.private_ip }}"
                 - "{{ hostvars.wi2.private_ip }}"
@@ -171,6 +168,6 @@
           - id: default
             url: https://{{ hostvars.manager.private_ip }}
             port: 55000
-            username: custom-user
+            username: "wazuh-wui"
-            password: SecretPassword1!
+            password: "wazuh-wui"
         ansible_shell_allow_world_readable_temp: true

roles/elastic-stack/ansible-kibana/defaults/main.yml

@@ -1,49 +0,0 @@
----
-kibana_node_name: node-1
-
-elasticsearch_http_port: "9200"
-elasticsearch_network_host: "127.0.0.1"
-kibana_server_host: "0.0.0.0"
-kibana_server_port: "5601"
-kibana_conf_path: /etc/kibana
-elastic_stack_version: 7.10.2
-wazuh_version: 4.14.5
-wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana
-
-elasticrepo:
-  apt: 'https://artifacts.elastic.co/packages/7.x/apt'
-  yum: 'https://artifacts.elastic.co/packages/7.x/yum'
-  gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'
-  key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
-
-# API credentials
-wazuh_api_credentials:
-  - id: "default"
-    url: "https://localhost"
-    port: 55000
-    username: "wazuh"
-    password: "wazuh"
-
-# Xpack Security
-kibana_xpack_security: false
-kibana_ssl_verification_mode: "full"
-
-elasticsearch_xpack_security_user: elastic
-elasticsearch_xpack_security_password: elastic_pass
-
-node_certs_destination: /etc/kibana/certs
-
-# CA Generation
-master_certs_path: "{{ playbook_dir }}/es_certs"
-generate_CA: true
-ca_cert_name: ""
-
-# Nodejs
-nodejs:
-  repo_dict:
-      debian: "deb"
-      redhat: "rpm"
-  repo_url_ext: "nodesource.com/setup_10.x"
-
-#Nodejs NODE_OPTIONS
-node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536

roles/opendistro/opendistro-kibana/defaults/main.yml

@@ -1,57 +0,0 @@
----
-
-# Kibana configuration
-elasticsearch_http_port: 9200
-elastic_api_protocol: https
-kibana_conf_path: /etc/kibana
-kibana_node_name: node-1
-kibana_server_host: "0.0.0.0"
-kibana_server_port: "5601"
-kibana_server_name: "kibana"
-kibana_max_payload_bytes: 1048576
-elastic_stack_version: 7.10.2
-wazuh_version: 4.4.1
-wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana
-
-# The OpenDistro package repository
-kibana_opendistro_version: 1.13.2-1 # Version includes the - for RedHat family compatibility, replace with = for Debian hosts
-
-package_repos:
-  yum:
-    opendistro:
-      baseurl: 'https://packages.wazuh.com/4.x/yum/'
-      gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH'
-  apt:
-    opendistro:
-      baseurl: 'deb https://packages.wazuh.com/4.x/apt/ stable main'
-      gpg: 'https://packages.wazuh.com/key/GPG-KEY-WAZUH'
-
-# API credentials
-wazuh_api_credentials:
-  - id: "default"
-    url: "https://localhost"
-    port: 55000
-    username: "wazuh"
-    password: "wazuh"
-
-# opendistro Security
-kibana_opendistro_security: true
-kibana_newsfeed_enabled: "false"
-kibana_telemetry_optin: "false"
-kibana_telemetry_enabled: "false"
-
-opendistro_admin_password: changeme
-opendistro_kibana_user: kibanaserver
-opendistro_kibana_password: changeme
-local_certs_path: "{{ playbook_dir }}/opendistro/certificates"
-
-# Nodejs
-nodejs:
-  repo_dict:
-      debian: "deb"
-      redhat: "rpm"
-  repo_url_ext: "nodesource.com/setup_10.x"
-
-
-#Nodejs NODE_OPTIONS
-node_options: --no-warnings --max-old-space-size=2048 --max-http-header-size=65536

roles/wazuh/ansible-wazuh-manager/defaults/main.yml

@@ -363,9 +363,6 @@ wazuh_manager_api:
   remote_commands_localfile_exceptions: []
   remote_commands_wodle: yes
   remote_commands_wodle_exceptions: []
-# wazuh_api_users:
-#   - username: custom-user
-#     password: .S3cur3Pa55w0rd*- # Must comply with requirements (8+ length, uppercase, lowercase, specials chars)
 
 # NOTE: As wazuh_manager_config is built dynamically per playbooks and ansible.cfg provided in the repo,
 # we should also cover the case for partial settings in inventory variables overlayed on top of role's

roles/wazuh/ansible-wazuh-manager/files/create_user.py

@@ -1,102 +0,0 @@
-import logging
-import sys
-import json
-import random
-import string
-import os
-
-# Set framework path
-sys.path.append(os.path.dirname(sys.argv[0]) + "/../framework")
-
-USER_FILE_PATH = "/var/ossec/api/configuration/admin.json"
-SPECIAL_CHARS = "@$!%*?&-_"
-
-
-try:
-    from wazuh.rbac.orm import check_database_integrity
-    from wazuh.security import (
-        create_user,
-        get_users,
-        get_roles,
-        set_user_role,
-        update_user,
-    )
-except Exception as e:
-    logging.error("No module 'wazuh' found.")
-    sys.exit(1)
-
-
-def read_user_file(path=USER_FILE_PATH):
-    with open(path) as user_file:
-        data = json.load(user_file)
-        return data["username"], data["password"]
-
-
-def db_users():
-    users_result = get_users()
-    return {user["username"]: user["id"] for user in users_result.affected_items}
-
-
-def db_roles():
-    roles_result = get_roles()
-    return {role["name"]: role["id"] for role in roles_result.affected_items}
-
-def disable_user(uid):
-    random_pass = "".join(
-                random.choices(
-                    string.ascii_uppercase
-                    + string.ascii_lowercase
-                    + string.digits
-                    + SPECIAL_CHARS,
-                    k=8,
-                )
-            )
-    # assure there must be at least one character from each group
-    random_pass = random_pass + ''.join([random.choice(chars) for chars in [string.ascii_lowercase, string.digits, string.ascii_uppercase, SPECIAL_CHARS]])
-    random_pass = ''.join(random.sample(random_pass,len(random_pass)))
-    update_user(
-        user_id=[
-            str(uid),
-        ],
-        password=random_pass,
-    )
-
-
-if __name__ == "__main__":
-    if not os.path.exists(USER_FILE_PATH):
-        # abort if no user file detected
-        sys.exit(0)
-    username, password = read_user_file()
-
-    # create RBAC database
-    check_database_integrity()
-
-    initial_users = db_users()
-    if username not in initial_users:
-        # create a new user
-        create_user(username=username, password=password)
-        users = db_users()
-        uid = users[username]
-        roles = db_roles()
-        rid = roles["administrator"]
-        set_user_role(
-            user_id=[
-                str(uid),
-            ],
-            role_ids=[
-                str(rid),
-            ],
-        )
-    else:
-        # modify an existing user ("wazuh" or "wazuh-wui")
-        uid = initial_users[username]
-        update_user(
-            user_id=[
-                str(uid),
-            ],
-            password=password,
-        )
-    # disable unused default users
-    #for def_user in ['wazuh', 'wazuh-wui']:
-    #    if def_user != username:
-    #        disable_user(initial_users[def_user])

roles/wazuh/ansible-wazuh-manager/tasks/main.yml

@@ -313,44 +313,6 @@
   tags:
     - config
 
-- name: Create custom API user
-  block:
-    - name: Copy create_user script
-      copy:
-        src: create_user.py
-        dest: "{{ wazuh_dir }}/framework/scripts/create_user.py"
-        owner: root
-        group: wazuh
-        mode: 0644
-
-    - name: Create admin.json
-      template:
-        src: templates/admin.json.j2
-        dest: "{{ wazuh_dir }}/api/configuration/admin.json"
-        owner: wazuh
-        group: wazuh
-        mode: 0644
-      no_log: true
-
-    - name: Execute create_user script
-      script:
-        chdir: "{{ wazuh_dir }}/framework/scripts/"
-        cmd: create_user.py --username "{{ item.username }}" --password "{{ item.password }}"
-        executable: "{{ wazuh_dir }}/framework/python/bin/python3"
-      with_items:
-        - "{{ wazuh_api_users }}"
-
-    - name: Delete create_user script
-      file:
-        path: "{{ wazuh_dir }}/framework/scripts/create_user.py"
-        state: absent
-
-  tags:
-    - config_api_users
-  when:
-    - wazuh_api_users is defined
-    - wazuh_manager_config.cluster.node_type == "master"
-
 - name: Agentless Hosts & Passwd
   template:
     src: agentless.j2

roles/wazuh/ansible-wazuh-manager/templates/admin.json.j2

@@ -1,4 +0,0 @@
-
-{% for api in wazuh_api_users %}
-{"username":"{{ api['username'] }}", "password": "{{ api['password'] }}"}
-{% endfor %}